From 4bca76cf4524b130bdf3070d7aae3c2a66d4c1cf Mon Sep 17 00:00:00 2001 From: Jeff Emmett Date: Mon, 2 Mar 2026 18:08:24 -0800 Subject: [PATCH] =?UTF-8?q?fix:=20handle=20body=20read=20in=20Transak=20we?= =?UTF-8?q?bhook=20=E2=80=94=20clone=20request=20for=20HMAC=20+=20JSON?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.6 --- modules/rfunds/mod.ts | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/modules/rfunds/mod.ts b/modules/rfunds/mod.ts index aafe5b6..d5c0c4b 100644 --- a/modules/rfunds/mod.ts +++ b/modules/rfunds/mod.ts @@ -155,7 +155,8 @@ routes.get("/api/transak/config", (c) => { }); routes.post("/api/transak/webhook", async (c) => { - const rawBody = await c.req.text(); + // Clone request so we can read body twice (once for HMAC, once for JSON) + const rawBody = await c.req.raw.clone().text(); // HMAC verification — if TRANSAK_WEBHOOK_SECRET is set, validate signature const webhookSecret = process.env.TRANSAK_WEBHOOK_SECRET; @@ -169,7 +170,8 @@ routes.post("/api/transak/webhook", async (c) => { } } - const body = JSON.parse(rawBody); + let body: any; + try { body = rawBody ? JSON.parse(rawBody) : await c.req.json(); } catch { return c.json({ error: "Invalid JSON" }, 400); } const { webhookData } = body; // Ack non-completion events (Transak sends multiple status updates)