Overview
Build Express/Next.js middleware for receiving StellarSplit invoice webhooks. The middleware must verify HMAC-SHA256 signatures, reject replayed requests using a timestamp + nonce window, and provide typed event handlers.
Requirements
createWebhookMiddleware(secret: string, options?: WebhookOptions): RequestHandlerWebhookOptions { toleranceSeconds: number, nonceWindowSize: number }- Verify
X-StellarSplit-Signature header (HMAC-SHA256 of timestamp + body)
- Reject requests where timestamp is outside
toleranceSeconds window
- Reject replayed nonces using an in-memory LRU nonce cache (size =
nonceWindowSize)
- Export
on(event: InvoiceEventType, handler) typed event emitter
- Write tests: valid webhook passes, expired timestamp rejected, replayed nonce rejected, tampered signature rejected
Acceptance Criteria
Definition of Done
All CI checks must pass before the PR is reviewed.
Overview
Build Express/Next.js middleware for receiving StellarSplit invoice webhooks. The middleware must verify HMAC-SHA256 signatures, reject replayed requests using a timestamp + nonce window, and provide typed event handlers.
Requirements
createWebhookMiddleware(secret: string, options?: WebhookOptions): RequestHandlerWebhookOptions { toleranceSeconds: number, nonceWindowSize: number }X-StellarSplit-Signatureheader (HMAC-SHA256 of timestamp + body)toleranceSecondswindownonceWindowSize)on(event: InvoiceEventType, handler)typed event emitterAcceptance Criteria
npm testpasses with zero failuresDefinition of Done
All CI checks must pass before the PR is reviewed.