fix: OpenNode callback accepts unauthenticated requests by Anshumancanrock · Pull Request #454 · cameri/nostream

Anshumancanrock · 2026-04-11T00:15:08Z

Description

Two bugs in the OpenNode callback handler

No signature verification. The controller accepted any request unconditionally. An attacker could POST to /callbacks/opennode and flip an invoice's status to COMPLETED in the database.
Body was never parsed. OpenNode sends application/x-www-form-urlencoded payloads, but the route only registered json() middleware. So request.body was always {} , the handler was running on empty input every time.

This PR fixes both.

Closes #453

Testing

Added unit tests covering:

wrong processor will throw 403
missing/malformed body fields will thow 400
invalid signature will thow 403
valid signed request = invoice processed

And a route-level test confirming the form-encoded body is actually parsed before hitting the controller.

Types of changes

Bug fix (non-breaking change which fixes an issue)

Checklist

My code follows the code style of this project.
I have added tests to cover my code changes.
All new and existing tests passed.

Copilot

Pull request overview

Fixes the OpenNode webhook callback so it correctly parses OpenNode’s form-encoded payloads and rejects unauthenticated/forged requests.

Changes:

Adds urlencoded() middleware to /callbacks/opennode so application/x-www-form-urlencoded bodies are parsed.
Implements OpenNode webhook authentication by verifying hashed_order against an HMAC of the invoice/charge id.
Adds unit tests for OpenNode callback controller authorization/validation, plus a parsing-focused route test.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
test/unit/routes/callbacks.spec.ts	Adds a test intended to verify form-urlencoded bodies are parsed.
test/unit/controllers/callbacks/opennode-callback-controller.spec.ts	Adds unit coverage for OpenNode callback validation and processing.
src/routes/callbacks/index.ts	Updates the OpenNode callback route to include `urlencoded()` parsing.
src/controllers/callbacks/opennode-callback-controller.ts	Adds payment-processor gating and HMAC signature verification for OpenNode callbacks.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Anshumancanrock · 2026-04-11T16:48:04Z

hi @cameri , could you please review this PR? Thank you !

cameri · 2026-04-18T04:48:38Z

@copilot resolve the merge conflicts in this pull request

…ennode-webhook-validation # Conflicts: # src/controllers/callbacks/opennode-callback-controller.ts

Anshumancanrock · 2026-04-18T13:13:10Z

hii @cameri , I’ve resolved the merge conflicts. Please take another look when you get a chance.

cameri · 2026-04-18T16:55:05Z

@Anshumancanrock some conflicts maybe with the other PR

coveralls · 2026-04-18T16:55:52Z

Coverage is 65.929% — Anshumancanrock:fix/opennode-webhook-validation into cameri:main. No base build found for cameri:main.

…ennode-webhook-validation # Conflicts: # test/unit/controllers/callbacks/opennode-callback-controller.spec.ts

fix: parse form-encoded body on OpenNode callback route

341ddea

Anshumancanrock force-pushed the fix/opennode-webhook-validation branch from f1cf70a to f92d818 Compare April 11, 2026 06:44

cameri requested a review from Copilot April 11, 2026 09:27

Copilot started reviewing on behalf of cameri April 11, 2026 09:27 View session

Copilot AI reviewed Apr 11, 2026

View reviewed changes

Comment thread src/controllers/callbacks/opennode-callback-controller.ts Outdated

Comment thread src/controllers/callbacks/opennode-callback-controller.ts

Comment thread test/unit/routes/callbacks.spec.ts Outdated

Anshumancanrock force-pushed the fix/opennode-webhook-validation branch from f92d818 to 3dc52d8 Compare April 11, 2026 10:04

Anshumancanrock requested a review from Copilot April 11, 2026 10:08

Copilot started reviewing on behalf of Anshumancanrock April 11, 2026 10:09 View session

Copilot AI reviewed Apr 11, 2026

View reviewed changes

Comment thread src/controllers/callbacks/opennode-callback-controller.ts Outdated

Comment thread src/controllers/callbacks/opennode-callback-controller.ts Outdated

Anshumancanrock force-pushed the fix/opennode-webhook-validation branch from 3dc52d8 to 4dafd0e Compare April 11, 2026 10:33

Anshumancanrock requested a review from Copilot April 11, 2026 10:38

Copilot started reviewing on behalf of Anshumancanrock April 11, 2026 10:38 View session

Copilot AI reviewed Apr 11, 2026

View reviewed changes

Comment thread src/controllers/callbacks/opennode-callback-controller.ts

Comment thread test/unit/controllers/callbacks/opennode-callback-controller.spec.ts Outdated

Anshumancanrock added 2 commits April 11, 2026 16:18

fix: validate OpenNode webhook signature before processing

6473ae5

test: add unit tests for OpenNode callback controller and route

5cc207c

Anshumancanrock force-pushed the fix/opennode-webhook-validation branch from 4dafd0e to 5cc207c Compare April 11, 2026 10:49

Anshumancanrock requested a review from Copilot April 11, 2026 10:59

Copilot started reviewing on behalf of Anshumancanrock April 11, 2026 11:00 View session

Copilot AI reviewed Apr 11, 2026

View reviewed changes

Comment thread src/controllers/callbacks/opennode-callback-controller.ts Outdated

Comment thread src/controllers/callbacks/opennode-callback-controller.ts

Comment thread src/controllers/callbacks/opennode-callback-controller.ts Outdated

Anshumancanrock requested a review from Copilot April 11, 2026 11:05

Copilot started reviewing on behalf of Anshumancanrock April 11, 2026 11:05 View session

Copilot AI reviewed Apr 11, 2026

View reviewed changes

Comment thread src/controllers/callbacks/opennode-callback-controller.ts Outdated

Comment thread src/controllers/callbacks/opennode-callback-controller.ts

Anshumancanrock added 2 commits April 11, 2026 17:01

fix: align amountPaid and test missing OPENNODE_API_KEY

42ae225

fix: reject malformed OpenNode hashed_order

e99c055

Anshumancanrock requested a review from Copilot April 11, 2026 11:58

Copilot started reviewing on behalf of Anshumancanrock April 11, 2026 11:59 View session

Copilot AI reviewed Apr 11, 2026

View reviewed changes

Comment thread src/controllers/callbacks/opennode-callback-controller.ts Outdated

fix: avoid logging sensitive OpenNode callback fields

949b78a

Anshumancanrock requested a review from Copilot April 11, 2026 12:41

Copilot started reviewing on behalf of Anshumancanrock April 11, 2026 12:42 View session

Copilot AI reviewed Apr 11, 2026

View reviewed changes

Anshumancanrock requested a review from Copilot April 11, 2026 15:37

Copilot started reviewing on behalf of Anshumancanrock April 11, 2026 15:37 View session

Copilot AI reviewed Apr 11, 2026

View reviewed changes

Merge branch 'main' into fix/opennode-webhook-validation

a8d26a6

Anshumancanrock and others added 2 commits April 18, 2026 18:31

Merge branch 'main' of https://github.com/cameri/nostream into fix/op…

c62c442

…ennode-webhook-validation # Conflicts: # src/controllers/callbacks/opennode-callback-controller.ts

Merge branch 'main' into fix/opennode-webhook-validation

f1daf3e

cameri self-assigned this Apr 18, 2026

cameri reviewed Apr 18, 2026

View reviewed changes

Comment thread src/controllers/callbacks/opennode-callback-controller.ts Outdated

Comment thread src/controllers/callbacks/opennode-callback-controller.ts Outdated

fix: validate opennode callback body with zod

695c9c7

Anshumancanrock added 4 commits April 18, 2026 22:34

Merge branch 'main' of https://github.com/cameri/nostream into fix/op…

e9f148c

…ennode-webhook-validation # Conflicts: # test/unit/controllers/callbacks/opennode-callback-controller.spec.ts

test: add opennode callback integration scenarios

c337d7a

test: verify paid opennode callback completes invoice

cda190a

Merge upstream main into fix/opennode-webhook-validation

c23ca3a

cameri merged commit c9c1fda into cameri:main Apr 18, 2026
12 checks passed

Conversation

Anshumancanrock commented Apr 11, 2026

Description

Testing

Types of changes

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Anshumancanrock commented Apr 11, 2026

Uh oh!

cameri commented Apr 18, 2026

Uh oh!

Anshumancanrock commented Apr 18, 2026

Uh oh!

Uh oh!

Uh oh!

cameri commented Apr 18, 2026

Uh oh!

coveralls commented Apr 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

coveralls commented Apr 18, 2026 •

edited

Loading