Add webhook signature verification middleware and automated retry scheduler

[Cjay-Cyber-2]

Description — what to implement and the why/impact.

Astroid API dispatches webhooks to external agent endpoints for transaction status changes and risk alerts. To ensure secure and reliable event delivery, external receivers need cryptographic verification signatures (HMAC-SHA256), and the platform needs a reliable delivery retry mechanism with exponential backoff.

Context & Requirements — background, constraints, design references, edge cases;

• Located in src/modules/webhooks.
• Generate HMAC signature headers (X-Astroid-Signature) for outgoing webhooks using a shared secret.
• Implement a BullMQ worker processor for webhook delivery with configurable backoff strategies (e.g., 5s, 30s, 5m, 1h).
• Handle endpoint timeout and non-2xx responses gracefully.

Acceptance Criteria — a checklist ("- [ ] ...") of specific, testable conditions that define "done".

• Implement cryptographic signature generator utility for outgoing HTTP requests.
• Create a BullMQ webhook worker supporting exponential backoff retries.
• Record delivery attempts, response status codes, and failure reasons in the database.
• Add unit tests for signature generation and worker retry logic.

Implementation Guidance — likely files/modules to touch and a suggested approach

• Likely touch files under src/modules/webhooks/ (controllers, services, workers).
• Use Node.js built-in crypto module for HMAC generation.

Testing & Validation — how the contributor should prove it works

• Run npm test and ensure all tests pass successfully.
• Add unit tests verifying signature headers match expected cryptographic outputs.

Submission Guidelines — must open a PR that includes "Closes #"; assignment is required before starting; follow the repo's existing style and conventions.

---

Wave complexity: Medium

[Duyicoda]

@Duyicoda has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

please assign, i will like to work on this

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Duyicoda to this issue.

[Chideraakude]

@Chideraakude has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello,
I would love to help resolve this issue. Please assign to me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Chideraakude to this issue.

[Damilorlar]

@Damilorlar has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I would love to work on this project

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Damilorlar to this issue.

[Johnsource-hub]

@Johnsource-hub has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I’d like to work on this issue. I understand the problem described and I’m confident I can investigate it, implement the necessary changes, and test the solution properly.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Johnsource-hub to this issue.

[drips-wave]

Congratulations, @Damilorlar! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @Damilorlar: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊