fix: enable gatehub signature check (#1757)

Author: dragosp1011

packages/wallet/backend/src/app.ts

@@ -49,7 +49,7 @@ import { GateHubService } from '@/gatehub/service'
 import { CardController } from './card/controller'
 import { CardService } from './card/service'
 import { isRafikiSignedWebhook } from '@/middleware/isRafikiSignedWebhook'
-// import { isGateHubSignedWebhook } from '@/middleware/isGateHubSignedWebhook'
+import { isGateHubSignedWebhook } from '@/middleware/isGateHubSignedWebhook'
 
 export interface Bindings {
   env: Env
@@ -317,7 +317,7 @@ export class App {
     router.get('/iframe-urls/:type', isAuth, gateHubController.getIframeUrl)
     router.post(
       '/gatehub-webhooks',
-      // isGateHubSignedWebhook,
+      isGateHubSignedWebhook(env, logger),
       gateHubController.webhook
     )
     router.post(

packages/wallet/backend/src/middleware/isGateHubSignedWebhook.ts

@@ -1,45 +1,57 @@
 import type { NextFunction, Request, Response } from 'express'
 import { Unauthorized } from '@shared/backend'
-import { env } from '@/config/env'
 import { createHmac } from 'crypto'
+import { Env } from '@/config/env'
+import { Logger } from 'winston'
 
 const TOLERANCE_MILLISECONDS = 5000
-export const isGateHubSignedWebhook = async (
-  req: Request,
-  res: Response,
-  next: NextFunction
-): Promise<void> => {
-  try {
-    if (!req.body.timestamp) {
-      // Respond with 200 on initial setup call
-      res.status(200).json()
-      return
-    }
-
-    const body = JSON.stringify(req.body)
-    const key = Buffer.from(env.GATEHUB_WEBHOOK_SECRET, 'hex')
-    const messageBuffer = Buffer.from(body, 'utf-8')
-
-    const requestSignature = createHmac('sha256', key)
-      .update(messageBuffer)
-      .digest('hex')
-
-    const timeDiffMilliseconds =
-      new Date().getTime() - parseFloat(req.body.timestamp)
 
-    // Check the difference of the received and current timestamp based on your tolerance
-    const timestampIsValid = timeDiffMilliseconds < TOLERANCE_MILLISECONDS
-    const signatureIsValid =
-      requestSignature === req.headers['x-gh-webhook-signature']
-
-    const isSignatureValid = timestampIsValid && signatureIsValid
-
-    if (!isSignatureValid) {
-      throw new Unauthorized('Invalid signature header')
+export const isGateHubSignedWebhook = (env: Env, logger: Logger) => {
+  const verify = async (
+    req: Request,
+    res: Response,
+    next: NextFunction
+  ): Promise<void> => {
+    try {
+      if (!req.body.timestamp) {
+        // Respond with 200 on initial setup call
+        res.status(200).json()
+        return
+      }
+
+      const body = JSON.stringify(req.body)
+      const key = Buffer.from(env.GATEHUB_WEBHOOK_SECRET, 'hex')
+      const messageBuffer = Buffer.from(body, 'utf-8')
+
+      const requestSignature = createHmac('sha256', key)
+        .update(messageBuffer)
+        .digest('hex')
+
+      const timeDiffMilliseconds =
+        new Date().getTime() - parseFloat(req.body.timestamp)
+      const webhookSignature = req.headers['x-gh-webhook-signature']
+
+      // Check the difference of the received and current timestamp based on your tolerance
+      const timestampIsValid = timeDiffMilliseconds < TOLERANCE_MILLISECONDS
+      const signatureIsValid = requestSignature === webhookSignature
+
+      const isSignatureValid = timestampIsValid && signatureIsValid
+
+      if (!isSignatureValid) {
+        logger.warn('GateHub invalid signature', {
+          timestampIsValid,
+          signatureIsValid,
+          body,
+          webhookSignature
+        })
+        throw new Unauthorized('Invalid signature header')
+      }
+    } catch (e) {
+      next(e)
     }
-  } catch (e) {
-    next(e)
+
+    next()
   }
 
-  next()
+  return verify
 }