What's pending across every project
5 open · sorted by priority then due-date
Filtered by tag webhook clear
todo
urgent
Rotate Razorpay webhook secret — 'hopewell' is guessable
The RAZORPAY_SECRET_WEBHOOK value in /opt/ocpp/.env on the production VM is literally 'hopewell' — a common English word, effectively no protection. HMAC verification against a guessable secret means anyone who learns the plaintext can forge webhook calls and credit any wallet.
Fix:
1. Razorpay Dashboard → Settings → Webhooks → regenerate a long random secret (32+ char base64).
2. Update /opt/ocpp/.env on the VM (SMTP_PASSWORD-style edit).
3. sudo systemctl restart ocpp.service.
4. Send a test webhook from Razorpay dashboard and confirm it verifies.
This is the single most impactful hardening we can do.
/opt/ocpp/.envinternal/handlers/wallet_handler.go:239-254↗ https://dashboard.razorpay.com/app/webhooks
Vajra Volt Mobile App
· vajra-mobile-app
· by saravanan@scrumclaw.ai
from the conversationclaude: RAZORPAY_SECRET_WEBHOOK=hopewell in .env is weak - anyone who guesses the plaintext can forge webhooks (i.e., forge topups). Regenerate a long random secret in the Razorpay dashboard and update .env, then restart the service. This is the single most impactful hardening you can do.
saravanan: put them in my project tracker - scrumclaw.ai
8d ago
07-31 02:51
07-31 02:51
todo
high
Add POST /webhook/github endpoint to the Go server
Accepts GitHub webhook events (configure on the repo with a shared secret). When a pull_request event with action=closed and merged=true comes in, parse the PR body for `Closes #<item_id>` or `Fixes #<item_id>` patterns and call the existing complete_item path for each. Add: HMAC-SHA256 signature verification using `GITHUB_WEBHOOK_SECRET` env var. Route lives in main.go alongside the other public POST endpoints. Probably one new file github_webhook.go.
api-go/main.goapi-go/handlers_api.go
claude-project-tracker
· claude-project-tracker
· by saravanan@scrumclaw.ai
from the conversationclaude: Webhook handler (medium): Add /webhook/github to the tracker server; parse merged-PR bodies for Closes #<item_id> and call complete_item. Single HTTP handler + webhook secret.
saravanan: [agreed, this is the keystone feature]
58d ago
06-11 11:26
06-11 11:26
todo
high
qr_code.credited webhook handler in existing PaymentWebhook
Per BRD v1 §7.2 FR6–FR9.\n\nExtend existing internal/handlers/wallet_handler.go PaymentWebhook to switch on hook.Event:\n\n switch hook.Event {\n case "payment.captured": // existing app topup path\n case "qr_code.credited": // NEW walk-in path\n h.handleQRCredit(payload)\n }\n\nhandleQRCredit implements:\n1. Lookup gun via notes.charger_id + notes.connector_id (cross-check charger_qr_codes row exists)\n2. Call resolveOrCreateUser(contact, email, vpa)\n3. Insert TOPUP ledger entry (idempotency key: qrpay:<payment_id>)\n4. Check OCPP status of connector — if Available, trigger RemoteStart via existing internal path with 3x5s retry (see #62)\n5. If not Available, credit persists in wallet only\n6. If WALKIN_QR_SMS_ENABLED flag on → dispatch appropriate SMS template (Phase 1.5)\n7. Return 200 to Razorpay\n\nBlocked on TDD (#50), migrations 0028–0029.</body>
Vajra Volt Mobile App
· vajra-mobile-app
· by saravanan@scrumclaw.ai
6d ago
08-02 11:52
08-02 11:52
todo
Rate-limit / IP-allowlist /webhooks/payment endpoint
The webhook endpoint currently accepts any POST from anywhere. HMAC signature check is the only defense — cryptographically sound, but each invalid request still triggers signature compute + JSON parse + DB lookup, so it's a cheap DoS vector.
Two things worth adding (nginx-level is easiest):
1. Restrict source IPs to Razorpay's published webhook IPs (they publish a list): allow only those in the nginx server block for /webhooks/*.
2. Rate-limit /webhooks/* at nginx (limit_req_zone). Even a modest 20 rps burst limit stops volumetric noise.
Doesn't change functionality, just hardens.
internal/routes/routes.go:161-163internal/handlers/wallet_handler.go:239-303/etc/nginx/sites-available/vajraev
Vajra Volt Mobile App
· vajra-mobile-app
· by saravanan@scrumclaw.ai
8d ago
07-31 02:51
07-31 02:51
note
low
Reference: Razorpay VPA + customer data extraction from qr_code.credited
Where to find each customer field in the qr_code.credited webhook payload. Confirmed from Razorpay official docs (docs/webhooks/qr-codes).
**Payload path for VPA:** `payload.payment.entity.vpa`
**Trimmed sample:**
```json
{
"event": "qr_code.credited",
"contains": ["payment", "qr_code"],
"payload": {
"payment": {
"entity": {
"id": "pay_HO2fEpc9JeOQU5",
"amount": 200,
"method": "upi",
"vpa": "gauri.kumar@okhdfcbank",
"email": "gauri.kumari@example.com",
"contact": "+919000090000",
"customer_id": "cust_HKsR5se84c5LTO",
"notes": {},
"acquirer_data": { "rrn": "116812981837" }
}
},
"qr_code": {
"entity": {
"id": "qr_HO2e0813YlchUn",
"notes": { "charger_id": "VAJRA0001", "connector_id": "2" }
}
}
}
}
```
**Two subtle gotchas:**
1. **Two separate `notes` blocks** — `payload.payment.entity.notes` is per-payment (usually empty for QR), and `payload.qr_code.entity.notes` is the QR's notes (where we set charger_id + connector_id at QR creation). Read the second one for gun identification.
2. **VPA presence:** always present for QR-triggered payments (method is always upi). Fallback: null.
**Go struct extraction:** see TDD §4.3 `qrCreditedPayload`.
**Fallback retrieval (webhook lost):**
- `GET /v1/payments/pay_XXX` — fetch single payment; includes vpa
- `GET /v1/payments/qr_codes/qr_XXX/payments` — list all payments for a QR (great for admin ops "show all payments to this gun")
Sources:
- https://razorpay.com/docs/webhooks/qr-codes/
- https://razorpay.com/docs/webhooks/payloads/payments/</body>
docs/TDD-walkin-qr-v0.md↗ https://razorpay.com/docs/webhooks/qr-codes/↗ https://razorpay.com/docs/webhooks/payloads/payments/
Vajra Volt Mobile App
· vajra-mobile-app
· by saravanan@scrumclaw.ai
6d ago
08-02 12:10
08-02 12:10