What
Protect the webhook routes in backend/src/routes/webhook.routes.ts. All four endpoints currently mount with no auth or tenant middleware:
POST /subscribeGET /subscriptionsDELETE /subscriptions/:idPOST /test-trigger (triggers a mock event)
Why
Every other data route in the app stacks authenticateJWT, syncTenantFromUser, and tenant-isolation middleware (see balanceRoutes.ts). The webhook routes have none, so any unauthenticated caller can register webhook subscriptions (a data-exfiltration / SSRF vector — the server will POST event data to an attacker URL), enumerate or delete other tenants' subscriptions by ID, and fire mock events in production.
Scope
In scope:
- Apply
authenticateJWT + syncTenantFromUser + tenant-isolation middleware to the subscription routes.
- Scope list/delete to the caller's organization so IDs from other tenants are not accessible.
- Restrict or remove
POST /test-trigger outside non-production (guard by NODE_ENV/admin).
- Consider validating/allowlisting subscription target URLs to reduce SSRF risk.
Out of scope:
- Redesigning the webhook delivery pipeline.
Acceptance criteria
- Unauthenticated requests to subscription routes are rejected (401).
- A tenant cannot read or delete another tenant's subscription by ID.
test-trigger is not reachable by ordinary users in production.- Tests cover auth-required and cross-tenant-denied cases.
Technical context
- Routes:
backend/src/routes/webhook.routes.ts; controller: backend/src/controllers/webhook.controller.ts.
- Middleware pattern to copy:
backend/src/routes/balanceRoutes.ts (lines using authenticateJWT, syncTenantFromUser, strictTenantBoundary, logTenantAccess).
What
Protect the webhook routes in
backend/src/routes/webhook.routes.ts. All four endpoints currently mount with no auth or tenant middleware:POST /subscribeGET /subscriptionsDELETE /subscriptions/:idPOST /test-trigger(triggers a mock event)Why
Every other data route in the app stacks
authenticateJWT,syncTenantFromUser, and tenant-isolation middleware (seebalanceRoutes.ts). The webhook routes have none, so any unauthenticated caller can register webhook subscriptions (a data-exfiltration / SSRF vector — the server will POST event data to an attacker URL), enumerate or delete other tenants' subscriptions by ID, and fire mock events in production.Scope
In scope:
authenticateJWT+syncTenantFromUser+ tenant-isolation middleware to the subscription routes.POST /test-triggeroutside non-production (guard byNODE_ENV/admin).Out of scope:
Acceptance criteria
test-triggeris not reachable by ordinary users in production.Technical context
backend/src/routes/webhook.routes.ts; controller:backend/src/controllers/webhook.controller.ts.backend/src/routes/balanceRoutes.ts(lines usingauthenticateJWT,syncTenantFromUser,strictTenantBoundary,logTenantAccess).