1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
|
import config from "$config";
import got from "got";
import { l, err } from "$lib/logging";
export const callWebhook = async (invoice, payment) => {
try {
if (!invoice || !payment) return;
const { address, received, text, webhook, secret } = invoice;
if (webhook) {
const { amount, confirmed, hash, memo } = payment;
l("calling webhook", webhook, amount, hash, address, text);
// TLS verification stays ON. This body carries `secret` — the shared
// value the merchant uses to authenticate the notification — so with
// rejectUnauthorized:false any party able to intercept the connection
// could present its own certificate, harvest the secret, and then forge
// "payment received" callbacks to that merchant. A merchant on a
// self-signed cert now fails here instead, which the catch below logs;
// the payment itself is unaffected.
const res = await got.post(webhook, {
json: {
address,
amount,
confirmed,
hash,
memo,
received,
text,
secret,
},
});
return res;
}
} catch (e) {
err("problem calling webhook", e.message);
}
};
|
