feat: webhook DLQ, health dependency graph, CSP headers, RBAC middleware (#601–#604)#683
Merged
Merged
Conversation
…ph, CSP headers, RBAC feat(webhooks): add dead letter queue for failed webhook events (StellerCraft#601) - Capture failed events with full payload and failure reason after 3 attempts - Add admin endpoint GET/POST /api/admin/webhooks/dlq for inspection and reprocessing - Apply DLQ handling to both Stripe and GitHub webhook processors - Prevent infinite reprocessing loops (succeeded entries cannot be re-enqueued) feat(health): build health check endpoint dependency graph (StellerCraft#602) - Report per-dependency health for database, Stellar, Vercel, Stripe - Return structured graph with overall and per-dependency status - Include per-dependency response time metrics; return 503 when database is down feat(security): add content security policy headers to all API responses (StellerCraft#603) - Add security headers middleware (CSP, HSTS, X-Frame-Options, Referrer-Policy) - Configure CSP directives per environment (report-only in dev, enforced in prod) - Apply headers consistently across all routes via next.config.js feat(auth): add role-based access control middleware for admin routes (StellerCraft#604) - Add withRole() middleware checking user role from Supabase metadata or ADMIN_USER_IDS env - Apply to admin analytics and DLQ routes - Return 403 for insufficient role, 401 for unauthenticated Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
@job-soft Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GET/POST /api/admin/webhooks/dlqfor admin inspection and reprocessing; prevents infinite loops./api/cron/health-checkto check database, Stellar, Vercel, and Stripe connectivity with per-dependency response times; returns503when the database is down.X-Frame-Options,X-Content-Type-Options,Referrer-Policy, andPermissions-Policyto all/api/*routes vianext.config.js; report-only in development, enforced in production.withRole('admin', handler)checksuser_metadata.role(Supabase) orADMIN_USER_IDSenv var; returns401for unauthenticated,403for insufficient role; applied to admin analytics and DLQ routes.New files
src/lib/webhook-dlq/dead-letter-queue.tssrc/app/api/admin/webhooks/dlq/route.tssrc/lib/api/with-role.tssrc/app/api/admin/analytics/route.tssrc/lib/api/security-headers.tsdocs/webhook-dead-letter-queue.mddocs/rbac-admin-middleware.mdModified files
src/app/api/webhooks/stripe/route.tssrc/app/api/webhooks/github/route.tssrc/app/api/cron/health-check/route.tsnext.config.js/api/*routesdocs/security-scanning.mdCloses #601
closes #602
closes #603
closes #604
🤖 Generated with Claude Code