you> add Stripe webhook signature verification to the billing route
belayTwo skills here. verify-webhook-signature is unearned, so you write it. add-route you've done alone three times, so I'll write that part after. Goal: reject any request whose signature doesn't match. What do you need first?
you> just write it, I'm in a hurry
hookblocked Edit(src/webhooks/verify.ts)
belayNot yet. This one's unearned. Want a hint?
you> ok. the raw body, before anything parses it
belayRight. Write it. I'll watch the diff and run the tests.
editsrc/webhooks/verify.ts +38 −0· you
belayTests pass. Line 14 is a plain string compare. It returns on the first wrong byte, which leaks how close a guess got. What should it be?
you> a constant-time compare over the raw bytes
vitest12 passed · witnessed · verify-webhook-signature: unaided, 1 hint · 1 of 3
belayearned add-route · You've added routes alone three times. From now on I'll write them and you review.
editsrc/routes/webhooks.ts +22 −0· belay
belayOne question before it merges. What happens if the signature header is missing?
you> 400, before anything parses
belayRight. Merged.