fix: bind outgoing webhook signatures to a timestamp

registerWebhook's response has always documented HMAC-SHA256(timestamp +
"." + body) with an x-webhook-timestamp header as the signature contract
- middleware/webhookSecurity.ts already verifies inbound webhooks this
way - but outbound delivery never sent the header or included the
timestamp in what it signed. Any receiver following NEPA's own
documented instructions would fail every signature check.

- Add X-Webhook-Timestamp header; sign `${timestamp}.${body}` instead
  of the body alone, across real delivery, retry, and testWebhook
- Compute the signature fresh inside attemptWebhookDelivery per attempt
  rather than once at event-creation time - retries can now happen up
  to an hour later (Phase 3's delay cap), so a signature computed at
  attempt 0 would sign an already-stale timestamp by the time a retry
  actually fires
- Add round-trip tests: capture the real axios.post call and verify it
  via WebhookSecurityService.validateSignature (the real verification
  path), plus a negative check that an un-timestamped signature is
  correctly rejected

71/71 tests passing; tsc error count unchanged (760, all pre-existing)

Author: Alanwiz00

backend/services/WebhookService.ts

@@ -242,10 +242,6 @@ export class WebhookService {
    */
   private async deliverWebhookEvent(webhook: Webhook, payload: WebhookPayload): Promise<void> {
     try {
-      // Create event record
-      const payloadString = JSON.stringify(payload);
-      const signature = WebhookService.generateSignature(payloadString, webhook.secret);
-
       const event = await prisma.webhookEvent.create({
         data: {
           webhookId: webhook.id,
@@ -257,7 +253,7 @@ export class WebhookService {
       });
 
       // Attempt delivery
-      await this.attemptWebhookDelivery(webhook, event, payload, signature, 0);
+      await this.attemptWebhookDelivery(webhook, event, payload, 0);
     } catch (error) {
       logger.error(`Failed to deliver webhook event for webhook ${webhook.id}: ${error}`);
     }
@@ -270,14 +266,26 @@ export class WebhookService {
     webhook: Webhook,
     event: WebhookEvent,
     payload: WebhookPayload,
-    signature: string,
     attemptNumber: number
   ): Promise<void> {
     try {
       const payloadString = JSON.stringify(payload);
+
+      // Bind the timestamp into the signed string (matching the contract
+      // documented in registerWebhook's response and the convention
+      // middleware/webhookSecurity.ts already uses to verify *inbound*
+      // signatures) so a receiver can enforce a replay window. Computed
+      // fresh per attempt, not once at event-creation time — retries can
+      // now happen up to an hour later (see calculateRetryDelay's cap), so
+      // a signature computed at attempt 0 would otherwise sign a
+      // timestamp that's long since expired by the time a retry fires.
+      const timestamp = Math.floor(Date.now() / 1000);
+      const signature = WebhookService.generateSignature(`${timestamp}.${payloadString}`, webhook.secret);
+
       const headers: { [key: string]: string } = {
         'Content-Type': 'application/json',
         'X-Webhook-Signature': signature,
+        'X-Webhook-Timestamp': String(timestamp),
         'X-Webhook-ID': webhook.id,
         'X-Event-Type': payload.eventType,
         'X-Delivery-ID': event.id,
@@ -454,9 +462,8 @@ export class WebhookService {
         }
 
         const payload: WebhookPayload = JSON.parse(JSON.stringify(event.payload));
-        const signature = WebhookService.generateSignature(JSON.stringify(payload), webhook.secret);
 
-        await this.attemptWebhookDelivery(webhook, event, payload, signature, event.attempts);
+        await this.attemptWebhookDelivery(webhook, event, payload, event.attempts);
       }
     } catch (error) {
       logger.error(`Failed to process pending webhook retries: ${error}`);
@@ -590,11 +597,13 @@ export class WebhookService {
       };
 
       const payloadString = JSON.stringify(testPayload);
-      const signature = WebhookService.generateSignature(payloadString, webhook.secret);
+      const timestamp = Math.floor(Date.now() / 1000);
+      const signature = WebhookService.generateSignature(`${timestamp}.${payloadString}`, webhook.secret);
 
       const headers = {
         'Content-Type': 'application/json',
         'X-Webhook-Signature': signature,
+        'X-Webhook-Timestamp': String(timestamp),
         'X-Webhook-ID': webhook.id,
         'X-Event-Type': 'webhook.test',
         'X-Test-Delivery': 'true',
@@ -694,7 +703,6 @@ export class WebhookService {
       }
 
       const payload: WebhookPayload = JSON.parse(JSON.stringify(event.payload));
-      const signature = WebhookService.generateSignature(JSON.stringify(payload), webhook.secret);
 
       // Reset attempts for retry
       await prisma.webhookEvent.update({
@@ -705,7 +713,7 @@ export class WebhookService {
         },
       });
 
-      await this.attemptWebhookDelivery(webhook, event, payload, signature, 0);
+      await this.attemptWebhookDelivery(webhook, event, payload, 0);
       logger.info(`Webhook event retried: ${eventId}`);
     } catch (error) {
       logger.error(`Failed to retry webhook event: ${error}`);

backend/tests/webhook/WebhookService.test.ts

@@ -385,6 +385,56 @@ describe('WebhookService', () => {
         data: expect.objectContaining({ status: 'FAILED', attempts: 1 }),
       });
     });
+
+    it('should sign deliveries so WebhookSecurityService.validateSignature accepts them', async () => {
+      // registerWebhook's response documents this exact contract to API
+      // consumers (algorithm HMAC-SHA256, header x-webhook-timestamp,
+      // format "timestamp + '.' + body") — this proves the delivery code
+      // actually implements what's documented, using the same verification
+      // path a real receiver would run.
+      const secret = 'test-secret';
+      const eventType = 'payment.success';
+      const mockWebhooks = [
+        {
+          id: 'webhook-1',
+          url: testWebhookUrl,
+          events: [eventType],
+          secret,
+          isActive: true,
+          retryPolicy: 'FIXED',
+          maxRetries: 3,
+          retryDelaySeconds: 60,
+          timeoutSeconds: 30,
+          headers: null,
+        },
+      ];
+      const mockEvent = { id: 'event-1', webhookId: 'webhook-1', eventType, status: 'PENDING' };
+
+      mockPrisma.webhook.findMany.mockResolvedValue(mockWebhooks as any);
+      mockPrisma.webhookEvent.create.mockResolvedValue(mockEvent as any);
+      mockPrisma.webhookAttempt.create.mockResolvedValue({} as any);
+      mockPrisma.webhookEvent.update.mockResolvedValue({} as any);
+      mockPrisma.webhookLog.create.mockResolvedValue({} as any);
+      mockedAxios.post.mockResolvedValue({ status: 200, data: { ok: true } });
+
+      const before = Math.floor(Date.now() / 1000);
+      await webhookService.triggerWebhook(eventType, { amount: 100 });
+      const after = Math.floor(Date.now() / 1000);
+
+      const [, body, config] = mockedAxios.post.mock.calls[0];
+      const sentTimestamp = Number(config.headers['X-Webhook-Timestamp']);
+      const sentSignature = config.headers['X-Webhook-Signature'];
+
+      expect(sentTimestamp).toBeGreaterThanOrEqual(before);
+      expect(sentTimestamp).toBeLessThanOrEqual(after);
+      expect(
+        WebhookSecurityService.validateSignature(`${sentTimestamp}.${body}`, sentSignature, secret)
+      ).toBe(true);
+      // A signature computed without the timestamp binding (the old,
+      // broken behavior) must NOT validate — otherwise this test would
+      // pass even if the timestamp weren't actually part of what's signed.
+      expect(WebhookSecurityService.validateSignature(body, sentSignature, secret)).toBe(false);
+    });
   });
 
   describe('processPendingRetries', () => {
@@ -629,6 +679,32 @@ describe('WebhookService', () => {
 
       await expect(webhookService.testWebhook('non-existent')).rejects.toThrow('Webhook not found');
     });
+
+    it('should sign test deliveries with the same timestamp-bound contract as real deliveries', async () => {
+      const secret = 'test-secret';
+      const mockWebhook = {
+        id: webhookId,
+        url: testWebhookUrl,
+        secret,
+        timeoutSeconds: 30,
+        headers: null,
+      };
+
+      mockPrisma.webhook.findUnique.mockResolvedValue(mockWebhook as any);
+      mockPrisma.webhookLog.create.mockResolvedValue({} as any);
+      mockedAxios.post.mockResolvedValue({ status: 200, data: 'Success' });
+
+      await webhookService.testWebhook(webhookId);
+
+      const [, body, config] = mockedAxios.post.mock.calls[0];
+      const sentTimestamp = config.headers['X-Webhook-Timestamp'];
+      const sentSignature = config.headers['X-Webhook-Signature'];
+
+      expect(sentTimestamp).toEqual(expect.any(String));
+      expect(
+        WebhookSecurityService.validateSignature(`${sentTimestamp}.${body}`, sentSignature, secret)
+      ).toBe(true);
+    });
   });
 
   describe('processWebhookEvent', () => {