Fixes

Author: lourou

package.json

@@ -58,8 +58,7 @@
     "uint8array-extras": "^1.4.0",
     "uuid": "^11.0.5",
     "viem": "^2.23.2",
-    "zod": "^3.24.1",
-    "zod-prisma-types": "^3.2.4"
+    "zod": "^3.24.1"
   },
   "devDependencies": {
     "@bufbuild/buf": "^1.50.0",
@@ -82,7 +81,7 @@
     "prisma": "^6.17.0",
     "rimraf": "^6.0.1",
     "typescript": "^5.7.3",
-    "typescript-eslint": "^8.20.0"
-  },
-  "packageManager": "yarn@4.6.0+sha512.5383cc12567a95f1d668fbe762dfe0075c595b4bfff433be478dbbe24e05251a8e8c3eb992a986667c1d53b6c3a9c85b8398c35a960587fbd9fa3a0915406728"
+    "typescript-eslint": "^8.20.0",
+    "zod-prisma-types": "^3.2.4"
+  }
 }

src/api/shared/notifications/webhook-handler.ts

@@ -8,6 +8,7 @@ import type {
 import { getPushNotificationService } from "@/api/shared/notifications/services/push-notification.service";
 import {
   createNotificationClient,
+  webhookNotificationBodySchema,
   type WebhookNotificationBody,
 } from "@/notifications/client";
 import { getHttpDeliveryNotificationAuthHeader } from "@/notifications/utils";
@@ -32,7 +33,21 @@ export async function handleXmtpNotification(req: Request, res: Response) {
   } | null = null;
 
   try {
-    const notification = req.body as WebhookNotificationBody;
+    // Validate webhook body structure
+    const parseResult = webhookNotificationBodySchema.safeParse(req.body);
+    if (!parseResult.success) {
+      req.log.error(
+        { errors: parseResult.error.errors },
+        "Invalid webhook payload",
+      );
+      res.status(400).json({
+        error: "Invalid webhook payload",
+        details: parseResult.error.errors,
+      });
+      return;
+    }
+
+    const notification = parseResult.data;
 
     // Log the notification for debugging
     req.log.info(

src/api/v2/notifications/handlers/register.ts

@@ -36,6 +36,7 @@ export async function register(
     });
 
     res.status(200).send();
+    return;
   } catch (error) {
     if (error instanceof z.ZodError) {
       res.status(400).json({ error: "Invalid request body" });

src/notifications/client.ts

@@ -2,6 +2,7 @@ import { create } from "@bufbuild/protobuf";
 import { createClient } from "@connectrpc/connect";
 import { createConnectTransport } from "@connectrpc/connect-node";
 import { type HmacKey } from "@xmtp/node-sdk";
+import { z } from "zod";
 import {
   Notifications,
   Subscription_HmacKeySchema,
@@ -25,30 +26,35 @@ export type Topic = {
   hmacKeys: HmacKey[];
 };
 
-export type WebhookNotificationBody = {
-  idempotency_key: string;
-  message: {
-    content_topic: string;
-    timestamp_ns: string;
-    message: string;
-  };
-  message_context: {
-    message_type: string;
-    should_push?: boolean;
-  };
-  installation: {
-    id: string;
-    delivery_mechanism: {
-      kind: string;
-      token: string;
-    };
-  };
-  subscription: {
-    created_at: string;
-    topic: string;
-    is_silent: boolean;
-  };
-};
+// Zod schema for webhook notification validation
+export const webhookNotificationBodySchema = z.object({
+  idempotency_key: z.string(),
+  message: z.object({
+    content_topic: z.string(),
+    timestamp_ns: z.string(),
+    message: z.string(),
+  }),
+  message_context: z.object({
+    message_type: z.string(),
+    should_push: z.boolean().optional(),
+  }),
+  installation: z.object({
+    id: z.string(),
+    delivery_mechanism: z.object({
+      kind: z.string(),
+      token: z.string(),
+    }),
+  }),
+  subscription: z.object({
+    created_at: z.string(),
+    topic: z.string(),
+    is_silent: z.boolean(),
+  }),
+});
+
+export type WebhookNotificationBody = z.infer<
+  typeof webhookNotificationBodySchema
+>;
 
 export async function subscribeToTopics(
   // The installationId we want to apply the subscription to

src/utils/v2/jwt.ts

@@ -21,6 +21,10 @@ export const createV2JwtToken = async (args: {
   metadata?: V2JWTMetadata;
   expirationTime?: string;
 }) => {
+  if (!process.env.JWT_SECRET) {
+    throw new AppError(500, "JWT_SECRET is not configured");
+  }
+
   // Validate metadata size to prevent JWT bloat
   if (args.metadata) {
     const metadataSize = JSON.stringify(args.metadata).length;
@@ -60,6 +64,10 @@ export const createV2JwtToken = async (args: {
 };
 
 export const verifyV2JwtToken = async (args: { token: string }) => {
+  if (!process.env.JWT_SECRET) {
+    throw new AppError(500, "JWT_SECRET is not configured");
+  }
+
   const { data: verified, error: verifyError } = await tryCatch(
     jose.jwtVerify(
       args.token,