fix: OpenNode callback accepts unauthenticated requests by Anshumancanrock · Pull Request #454 · cameri/nostream

Anshumancanrock · 2026-04-11T00:15:08Z

Description

Two bugs in the OpenNode callback handler

No signature verification. The controller accepted any request unconditionally. An attacker could POST to /callbacks/opennode and flip an invoice's status to COMPLETED in the database.
Body was never parsed. OpenNode sends application/x-www-form-urlencoded payloads, but the route only registered json() middleware. So request.body was always {} , the handler was running on empty input every time.

This PR fixes both.

Closes#453

Testing

Added unit tests covering:

wrong processor will throw 403
missing/malformed body fields will thow 400
invalid signature will thow 403
valid signed request = invoice processed

And a route-level test confirming the form-encoded body is actually parsed before hitting the controller.

Types of changes

Bug fix (non-breaking change which fixes an issue)

Checklist

My code follows the code style of this project.
I have added tests to cover my code changes.
All new and existing tests passed.

Copilot

Pull request overview

Fixes the OpenNode webhook callback so it correctly parses OpenNode’s form-encoded payloads and rejects unauthenticated/forged requests.

Changes:

Adds urlencoded() middleware to /callbacks/opennode so application/x-www-form-urlencoded bodies are parsed.
Implements OpenNode webhook authentication by verifying hashed_order against an HMAC of the invoice/charge id.
Adds unit tests for OpenNode callback controller authorization/validation, plus a parsing-focused route test.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
test/unit/routes/callbacks.spec.ts	Adds a test intended to verify form-urlencoded bodies are parsed.
test/unit/controllers/callbacks/opennode-callback-controller.spec.ts	Adds unit coverage for OpenNode callback validation and processing.
src/routes/callbacks/index.ts	Updates the OpenNode callback route to include `urlencoded()` parsing.
src/controllers/callbacks/opennode-callback-controller.ts	Adds payment-processor gating and HMAC signature verification for OpenNode callbacks.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Anshumancanrock · 2026-04-11T16:48:04Z

hi @cameri , could you please review this PR? Thank you !

cameri · 2026-04-18T04:48:38Z

@copilot resolve the merge conflicts in this pull request

…ennode-webhook-validation # Conflicts: # src/controllers/callbacks/opennode-callback-controller.ts

Anshumancanrock · 2026-04-18T13:13:10Z

hii @cameri , I’ve resolved the merge conflicts. Please take another look when you get a chance.

cameri · 2026-04-18T16:55:05Z

@Anshumancanrock some conflicts maybe with the other PR

coveralls · 2026-04-18T16:55:52Z

Coverage is 65.929% — Anshumancanrock:fix/opennode-webhook-validation into cameri:main. No base build found for cameri:main.

…ennode-webhook-validation # Conflicts: # test/unit/controllers/callbacks/opennode-callback-controller.spec.ts

fix: parse form-encoded body on OpenNode callback route
341ddea

Anshumancanrock force-pushed the fix/opennode-webhook-validation branch from f1cf70a to f92d818Compare April 11, 2026 06:44

cameri requested a review from Copilot April 11, 2026 09:27

Copilotstarted reviewing on behalf of cameri April 11, 2026 09:27 View session

CopilotAI reviewed Apr 11, 2026
View reviewed changes

Comment threadsrc/controllers/callbacks/opennode-callback-controller.ts Outdated
Comment threadsrc/controllers/callbacks/opennode-callback-controller.ts
Comment threadtest/unit/routes/callbacks.spec.ts Outdated

Anshumancanrock force-pushed the fix/opennode-webhook-validation branch from f92d818 to 3dc52d8Compare April 11, 2026 10:04

Anshumancanrock requested a review from Copilot April 11, 2026 10:08

Copilotstarted reviewing on behalf of Anshumancanrock April 11, 2026 10:09 View session

CopilotAI reviewed Apr 11, 2026
View reviewed changes

Comment threadsrc/controllers/callbacks/opennode-callback-controller.ts Outdated
Comment threadsrc/controllers/callbacks/opennode-callback-controller.ts Outdated

Anshumancanrock force-pushed the fix/opennode-webhook-validation branch from 3dc52d8 to 4dafd0eCompare April 11, 2026 10:33

Anshumancanrock requested a review from Copilot April 11, 2026 10:38

Copilotstarted reviewing on behalf of Anshumancanrock April 11, 2026 10:38 View session

CopilotAI reviewed Apr 11, 2026
View reviewed changes

Comment threadsrc/controllers/callbacks/opennode-callback-controller.ts
Comment threadtest/unit/controllers/callbacks/opennode-callback-controller.spec.ts Outdated

Anshumancanrock added 2 commits April 11, 2026 16:18

fix: validate OpenNode webhook signature before processing
6473ae5

test: add unit tests for OpenNode callback controller and route
5cc207c

Anshumancanrock force-pushed the fix/opennode-webhook-validation branch from 4dafd0e to 5cc207cCompare April 11, 2026 10:49

Anshumancanrock requested a review from Copilot April 11, 2026 10:59

Copilotstarted reviewing on behalf of Anshumancanrock April 11, 2026 11:00 View session

CopilotAI reviewed Apr 11, 2026
View reviewed changes

Comment threadsrc/controllers/callbacks/opennode-callback-controller.ts Outdated
Comment threadsrc/controllers/callbacks/opennode-callback-controller.ts
Comment threadsrc/controllers/callbacks/opennode-callback-controller.ts Outdated

Anshumancanrock requested a review from Copilot April 11, 2026 11:05

Copilotstarted reviewing on behalf of Anshumancanrock April 11, 2026 11:05 View session

CopilotAI reviewed Apr 11, 2026
View reviewed changes

Comment threadsrc/controllers/callbacks/opennode-callback-controller.ts Outdated
Comment threadsrc/controllers/callbacks/opennode-callback-controller.ts

Anshumancanrock added 2 commits April 11, 2026 17:01

fix: align amountPaid and test missing OPENNODE_API_KEY
42ae225

fix: reject malformed OpenNode hashed_order
e99c055

Anshumancanrock requested a review from Copilot April 11, 2026 11:58

Copilotstarted reviewing on behalf of Anshumancanrock April 11, 2026 11:59 View session

CopilotAI reviewed Apr 11, 2026
View reviewed changes

Comment threadsrc/controllers/callbacks/opennode-callback-controller.ts Outdated

fix: avoid logging sensitive OpenNode callback fields
949b78a

Anshumancanrock requested a review from Copilot April 11, 2026 12:41

Copilotstarted reviewing on behalf of Anshumancanrock April 11, 2026 12:42 View session

CopilotAI reviewed Apr 11, 2026
View reviewed changes

Anshumancanrock requested a review from Copilot April 11, 2026 15:37

Copilotstarted reviewing on behalf of Anshumancanrock April 11, 2026 15:37 View session

CopilotAI reviewed Apr 11, 2026
View reviewed changes

Merge branch 'main' into fix/opennode-webhook-validation
a8d26a6

Anshumancanrockand others added 2 commits April 18, 2026 18:31

Merge branch 'main' ofhttps://github.com/cameri/nostreaminto fix/op…
c62c442
…ennode-webhook-validation # Conflicts: # src/controllers/callbacks/opennode-callback-controller.ts

Merge branch 'main' into fix/opennode-webhook-validation
f1daf3e

cameri self-assigned this Apr 18, 2026

cameri reviewed Apr 18, 2026
View reviewed changes

Comment threadsrc/controllers/callbacks/opennode-callback-controller.ts Outdated
Comment threadsrc/controllers/callbacks/opennode-callback-controller.ts Outdated

fix: validate opennode callback body with zod
695c9c7

Anshumancanrock added 4 commits April 18, 2026 22:34

Merge branch 'main' ofhttps://github.com/cameri/nostreaminto fix/op…
e9f148c
…ennode-webhook-validation # Conflicts: # test/unit/controllers/callbacks/opennode-callback-controller.spec.ts

test: add opennode callback integration scenarios
c337d7a

test: verify paid opennode callback completes invoice
cda190a

Merge upstream main into fix/opennode-webhook-validation
c23ca3a

cameri merged commit c9c1fda into cameri:mainApr 18, 2026
12 checks passed

Conversation

Anshumancanrock commented Apr 11, 2026

Description

Testing

Types of changes

Checklist

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Anshumancanrock commented Apr 11, 2026

Uh oh!

cameri commented Apr 18, 2026

Uh oh!

Anshumancanrock commented Apr 18, 2026

Uh oh!

Uh oh!

Uh oh!

cameri commented Apr 18, 2026

Uh oh!

coveralls commented Apr 18, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

coveralls commented Apr 18, 2026•
edited
Loading