Webhook Payload

async function processWebhook(payload) {
  const { referenceNumber } = payload;

  // Look up order in database
  const order = await db.orders.findOne({ referenceNumber });

  if (!order) {
    console.warn(`Unknown reference number: ${referenceNumber}`);
    // Log suspicious webhook for investigation
    await logSuspiciousWebhook(payload);
    return; // Don't process
  }

  // Proceed with processing
  await updateOrderStatus(order, payload);
}

async function processWebhook(payload) {
  const order = await db.orders.findOne({ referenceNumber: payload.referenceNumber });

  if (order.amount !== payload.amount) {
    console.error('Amount mismatch', {
      expected: order.amount,
      received: payload.amount,
      referenceNumber: payload.referenceNumber
    });

    // Alert fraud team
    await alertFraudTeam('Amount mismatch detected', { order, payload });

    // Don't fulfill order
    return;
  }

  // Amount matches, proceed
  await fulfillOrder(order);
}

async function processWebhook(payload) {
  const transactionDate = new Date(payload.transactionDate);
  const now = new Date();
  const ageMinutes = (now - transactionDate) / 1000 / 60;

  if (ageMinutes > 60) {
    console.warn('Old webhook received', {
      referenceNumber: payload.referenceNumber,
      ageMinutes: ageMinutes
    });

    // Still process but log for investigation
    await logDelayedWebhook(payload, ageMinutes);
  }

  await processTransaction(payload);
}

function validateStatusConsistency(payload) {
  const { action, status } = payload;

  const validCombinations = {
    'QRPH_SUCCESS': ['SUCCESS'],
    'QRPH_DECLINED': ['FAILED']
  };

  const validStatuses = validCombinations[action];

  if (!validStatuses || !validStatuses.includes(status)) {
    throw new Error(`Inconsistent action (${action}) and status (${status})`);
  }

  return true;
}

// Trim whitespace from secret key
const SECRET_KEY = process.env.MODULUS_SECRET_KEY.trim();

// Verify key format
console.log('Key length:', SECRET_KEY.length);
console.log('Key starts with:', SECRET_KEY.substring(0, 3));

const result = await jose.JWE.createDecrypt(keystore).decrypt(encryptedData);

// Log raw plaintext before parsing
console.log('Raw plaintext:', result.plaintext.toString());

// Safely parse JSON
try {
  const payload = JSON.parse(result.plaintext.toString());
  return payload;
} catch (error) {
  console.error('JSON parse error:', error);
  console.error('Raw plaintext:', result.plaintext.toString());
  throw error;
}

# Update to latest version
npm install node-jose@latest

# Or use alternative library
npm install jose

// Using 'jose' library instead
const jose = require('jose');

async function decrypt(encryptedData, secretKey) {
  const secret = new TextEncoder().encode(secretKey);
  const { plaintext } = await jose.compactDecrypt(encryptedData, secret);
  return JSON.parse(new TextDecoder().decode(plaintext));
}

// Express: Use raw body parser for webhook endpoint
app.use('/webhooks/modulus', express.json({
  verify: (req, res, buf) => {
    req.rawBody = buf.toString('utf8');
  }
}));

app.post('/webhooks/modulus', (req, res) => {
  console.log('Raw body:', req.rawBody);
  console.log('Parsed body:', req.body);

  // Use parsed body
  const { data } = req.body;
});

// Good: Load once
const SECRET_KEY = process.env.MODULUS_SECRET_KEY;

app.post('/webhooks/modulus', async (req, res) => {
  const payload = await decrypt(req.body.data, SECRET_KEY);
});

// Bad: Load repeatedly
app.post('/webhooks/modulus', async (req, res) => {
  const key = process.env.MODULUS_SECRET_KEY; // Don't do this
  const payload = await decrypt(req.body.data, key);
});

app.post('/webhooks/modulus', async (req, res) => {
  try {
    const payload = await decrypt(req.body.data, SECRET_KEY);

    // Validate first
    validatePayload(payload);

    // Then process
    await processWebhook(payload);

    res.status(200).json({ received: true });
  } catch (error) {
    console.error('Webhook error:', error);
    res.status(200).json({ received: true }); // Still acknowledge
  }
});

await db.webhookLogs.insert({
  referenceNumber: payload.referenceNumber,
  encryptedData: req.body.data, // Store encrypted version
  decryptedPayload: payload,     // Store decrypted version
  receivedAt: new Date(),
  processed: true
});

const {
  customerName = 'Unknown',
  bankName = 'Unknown',
  declineReason = 'No reason provided'
} = payload;

// Use defaults when fields are missing
console.log(`Payment from ${customerName} via ${bankName}`);