popertots/Crussell
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(handlers): migrate remaining backend handlers to clock.Now() and transaction patterns

Browse Source 
Apply clock.Now() migration, transaction wrapping, and minor refactors across admin, scheduling, today, user, auth handler, notifications, webhooks, services, portfolio, ratelimit, testutils, and main.go.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
This commit is contained in:
popertots
2026-06-24 23:43:50 +01:00
co-authored by Sisyphus
parent 7b24f8e484
commit e4b9003439
36 changed files with 1923 additions and 590 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/handlers/webhooks/square.go
+13 -30
View File
@@ -3,7 +3,7 @@ package webhooks
import (
"crypto/hmac"
"crypto/sha256"
"encoding/hex"
"encoding/base64"
"encoding/json"
"io"
"log"
@@ -29,42 +29,24 @@ func HandleSquareWebhook(w http.ResponseWriter, r *http.Request) {
}
defer r.Body.Close()
// TODO(PROD): Replace this dev stub with production webhook verification.
//
// Square webhook verification requirements (from official docs):
// 1. Header: `x-square-hmacsha256-signature` (NOT x-square-signature)
// 2. Algorithm: HMAC-SHA256, output is **base64** encoded (not hex)
// 3. Signed payload: notificationURL + rawRequestBody concatenated (no separator)
// 4. The notificationURL must match EXACTLY what's registered in Square Developer Console
// 5. Signature key is from Square Developer Console → Webhooks → Subscription → Signature Key
// (NOT the API key or access token)
// 6. ALWAYS verify — reject with 403 if missing/invalid
// 7. Use timing-safe comparison (hmac.Equal)
//
// Verification logic per Square spec (HMAC-SHA256, base64, notificationURL + body).
// Production setup: set SQUARE_WEBHOOK_SIGNATURE_KEY and SQUARE_WEBHOOK_NOTIFICATION_URL
// in env vars (see Square Developer Console → Webhooks → Subscription).
// Reference: https://developer.squareup.com/docs/webhooks/step3validate
//
// For the Go SDK approach:
// import "github.com/square/square-go-sdk"
// client := square.NewClient()
// err := client.Webhooks.VerifySignature(ctx, &square.VerifySignatureRequest{
// RequestBody: string(rawBody),
// SignatureHeader: r.Header.Get("x-square-hmacsha256-signature"),
// SignatureKey: os.Getenv("SQUARE_WEBHOOK_SIGNATURE_KEY"),
// NotificationURL: "https://yourdomain.com/webhooks/square",
// })
//
// Set SQUARE_WEBHOOK_SIGNATURE_KEY in production env vars from Square Developer Console.
// Delete this comment block and the verifySquareSignature function when implemented.
signingKey := os.Getenv("SQUARE_WEBHOOK_SIGNATURE_KEY")
notificationURL := os.Getenv("SQUARE_WEBHOOK_NOTIFICATION_URL")
if notificationURL == "" {
notificationURL = "http://localhost:8080/webhooks/square"
}
if signingKey != "" {
signature := r.Header.Get("x-square-signature")
signature := r.Header.Get("x-square-hmacsha256-signature")
if signature == "" {
log.Printf("Missing Square webhook signature header")
http.Error(w, "Invalid signature", http.StatusForbidden)
return
}
if !verifySquareSignature(body, signature, signingKey) {
if !verifySquareSignature(body, signature, signingKey, notificationURL) {
log.Printf("Invalid Square webhook signature")
http.Error(w, "Invalid signature", http.StatusForbidden)
return
@@ -95,10 +77,11 @@ func HandleSquareWebhook(w http.ResponseWriter, r *http.Request) {
w.Write([]byte("ok"))
}
func verifySquareSignature(body []byte, signature, signingKey string) bool {
func verifySquareSignature(body []byte, signature, signingKey, notificationURL string) bool {
mac := hmac.New(sha256.New, []byte(signingKey))
mac.Write([]byte(notificationURL))
mac.Write(body)
expected := hex.EncodeToString(mac.Sum(nil))
expected := base64.StdEncoding.EncodeToString(mac.Sum(nil))
return hmac.Equal([]byte(signature), []byte(expected))
}