Description — what to implement and the why/impact.
Implement a robust webhook delivery mechanism with exponential backoff retry policies via BullMQ and an incoming signature verification guard/middleware. This ensures external subscriber integrations receive financial events reliably while guaranteeing security through cryptographic HMAC signatures.
Context & Requirements — background, constraints, design references, edge cases;
External applications and AI agents subscribe to wallet, transaction, and policy events emitted by Astroid. If a subscriber endpoint is down, deliveries must be retried with exponential backoff. Every outgoing webhook payload must include an X-Astroid-Signature header computed using HMAC-SHA256 with a secret tied to the subscription.
Acceptance Criteria — a checklist of specific, testable conditions that define "done".
Implementation Guidance — likely files/modules to touch and a suggested approach.
- Likely files:
src/modules/webhooks/, src/queues/, src/workers/.
- Utilize NestJS BullMQ integration
@nestjs/bullmq for queue definition and worker processors.
- Ensure signing secrets are securely fetched and never logged in plain text.
Testing & Validation — how the contributor should prove it works.
- Run vitest suites (
npm test) ensuring webhook processor tests pass.
- Verify retry backoff intervals using mock timers in unit tests.
Submission Guidelines — must open a PR that includes "Closes #"; assignment is required before starting.
Wave complexity: Medium
Description — what to implement and the why/impact.
Implement a robust webhook delivery mechanism with exponential backoff retry policies via BullMQ and an incoming signature verification guard/middleware. This ensures external subscriber integrations receive financial events reliably while guaranteeing security through cryptographic HMAC signatures.
Context & Requirements — background, constraints, design references, edge cases;
External applications and AI agents subscribe to wallet, transaction, and policy events emitted by Astroid. If a subscriber endpoint is down, deliveries must be retried with exponential backoff. Every outgoing webhook payload must include an
X-Astroid-Signatureheader computed using HMAC-SHA256 with a secret tied to the subscription.Acceptance Criteria — a checklist of specific, testable conditions that define "done".
X-Astroid-Signaturefor every outgoing delivery.Implementation Guidance — likely files/modules to touch and a suggested approach.
src/modules/webhooks/,src/queues/,src/workers/.@nestjs/bullmqfor queue definition and worker processors.Testing & Validation — how the contributor should prove it works.
npm test) ensuring webhook processor tests pass.Submission Guidelines — must open a PR that includes "Closes #"; assignment is required before starting.
Wave complexity: Medium