jeffemmett
/
rspace-online
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: handle body read in Transak webhook — clone request for HMAC + JSON 

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Jeff Emmett 2026-03-02 18:08:24 -08:00
parent 34c96b5a45
commit 4bca76cf45
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
modules/rfunds/mod.ts
View File

@ -155,7 +155,8 @@ routes.get("/api/transak/config", (c) => {
}); });
routes.post("/api/transak/webhook", async (c) => { routes.post("/api/transak/webhook", async (c) => {
const rawBody = await c.req.text(); // Clone request so we can read body twice (once for HMAC, once for JSON)
const rawBody = await c.req.raw.clone().text();
// HMAC verification — if TRANSAK_WEBHOOK_SECRET is set, validate signature // HMAC verification — if TRANSAK_WEBHOOK_SECRET is set, validate signature
const webhookSecret = process.env.TRANSAK_WEBHOOK_SECRET; const webhookSecret = process.env.TRANSAK_WEBHOOK_SECRET;
@ -169,7 +170,8 @@ routes.post("/api/transak/webhook", async (c) => {
} }
} }
const body = JSON.parse(rawBody); let body: any;
try { body = rawBody ? JSON.parse(rawBody) : await c.req.json(); } catch { return c.json({ error: "Invalid JSON" }, 400); }
const { webhookData } = body; const { webhookData } = body;
// Ack non-completion events (Transak sends multiple status updates) // Ack non-completion events (Transak sends multiple status updates)