The Sandbox Payment
Vulnerability: Full Breakdown

// ❌ VULNERABLE — body parsed before signature verification
const app = express();

// ❌ This runs BEFORE webhook verification — body already parsed
app.use(express.json());     // transforms raw bytes → JSON object
app.use(express.urlencoded());

// By the time this runs, req.body is already parsed —
// Stripe signature verification will fail or be bypassed
app.post('/webhook/stripe', (req, res) => {
  // req.body has already been transformed — signature mismatch!
  const sig = req.get('Stripe-Signature');
  const event = verifyStripeSignature(rawBody, sig); // rawBody is GONE
});

// Register raw body capture BEFORE express.json()
app.use('/'
, express.raw({ type: 'application/json', limit: '10mb' }), (req, res, next) => {
  req.rawBody = req.body;            // store raw bytes
  req.body = JSON.parse(req.rawBody);  // also expose parsed JSON
  next();
});

// Global JSON parser for all other routes
app.use(express.json());

// Stripe webhook — raw body available for signature verification
app.post('/webhook/stripe', async (req, res) => {
  const sig = req.get('Stripe-Signature');
  const secret = process.env.STRIPE_WEBHOOK_SECRET;

  let event;
  try {
    event = stripe.webhooks.constructEvent(
      req.rawBody,    // ← raw bytes, NOT parsed body
      sig,
      secret
    );
  } catch (err) {
    console.error(`Webhook signature verification failed: ${err.message}`);
    return res.status(400).send(`Webhook Error: ${err.message}`);
  }

  // Only proceed if verification passes — forged events rejected here
  await handleStripeEvent(event);
  res.json({ received: true });
});

async function handleStripeEventWithIdempotency(event) {
  const idempotencyKey = `stripe_${event.id}`;
  const client = await pool.connect();

  try {
    await client.query('BEGIN');

    // Try to claim the idempotency slot — returns 0 rows if already processed
    const claimResult = await client.query(
      `INSERT INTO idempotency_keys (key, event_type, processed_at)
       VALUES ($1, $2, NOW())
       ON CONFLICT (key) DO NOTHING
       RETURNING id`,
      [idempotencyKey, event.type]
    );

    if (claimResult.rowCount === 0) {
      console.log(`Duplicate webhook ignored: ${event.id}`);
      await client.query('COMMIT');
      return;
    }

    // Safe to process — we own the idempotency slot
    await processStripeEvent(event, client);

    await client.query('COMMIT');
  } catch (err) {
    await client.query('ROLLBACK');
    throw err;
  } finally {
    client.release();
  }
}

CREATE TABLE IF NOT EXISTS idempotency_keys (
  id           BIGSERIAL PRIMARY KEY,
  key          VARCHAR(255) UNIQUE NOT NULL,
  event_type   VARCHAR(100) NOT NULL,
  processed_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  metadata     JSONB
);

-- Index for fast duplicate lookups (the hot path)
CREATE UNIQUE INDEX IF NOT EXISTS
  idx_idempotency_keys_key ON idempotency_keys (key);

-- Purge old entries to keep table lean (cron job)
DELETE FROM idempotency_keys
WHERE processed_at < NOW() - INTERVAL '30 days';

// At application startup — crashes if wrong key type in wrong environment
const STRIPE_KEY = process.env.STRIPE_SECRET_KEY;
const NODE_ENV = process.env.NODE_ENV;

if (NODE_ENV === 'production' || NODE_ENV === 'prod') {
  if (!STRIPE_KEY || !STRIPE_KEY.startsWith('sk_live_')) {
    throw new Error(
      'FATAL: STRIPE_SECRET_KEY must be a live key (sk_live_*) in production. ' +
      'Current key starts with: ' + (STRIPE_KEY?.split('_'0) ?? ['MISSING']).join()
    );
  }
}

// Runtime verification — assert at the payment operation level
function assertStripeMode() {
  const key = process.env.STRIPE_SECRET_KEY;
  if (key.startsWith('sk_test_') && process.env.NODE_ENV === 'production') {
    throw new Error('REFUSING to process payment: test key in production mode');
  }
}

// Call before any payment operation
app.post('/api/create-checkout-session', async (req, res) => {
  assertStripeMode();  // crashes if wrong key type
  // ... proceed with payment
});

const app = express();

// ── 1. Webhook route FIRST — needs raw body, before any body parser ──

// Capture raw body ONLY for /webhook/stripe — all other routes unaffected
app.post(
  '/webhook/stripe',
  express.raw({ type: 'application/json' }),   // raw body only for this route
  stripeWebhookHandler
);

// ── 2. Body parsers SECOND — all other routes get parsed JSON/URL encoded ──

app.use(express.json());
app.use(express.urlencoded({ extended: true }));

// ── 3. All other routes AFTER body parsers ──

app.post('/api/create-checkout-session',  requireAuth, createCheckoutSession);
app.get('/api/my-subscriptions',        requireAuth, getMySubscriptions);

// ✅ Webhook gets raw body. All other routes get parsed body.
// ✅ Stripe signature verification works because raw bytes are preserved.