Function createWorkOSWebhooksRouter

server/src/routes/workos-webhooks.ts:678–950

()

 * Create WorkOS webhooks router
 */
export function createWorkOSWebhooksRouter(): Router {
  const router = Router();

  router.post(
    '/workos',
    // Parse JSON body manually since the global JSON parser is skipped for this route
    (req: Request, res: Response, next) => {
      let rawBody = '';
      req.setEncoding('utf8');
      req.on('data', (chunk: string) => { rawBody += chunk; });
      req.on('end', () => {
        try {
          req.body = JSON.parse(rawBody);
          next();
        } catch {
          logger.warn({ rawBodyLength: rawBody.length }, 'Invalid JSON in WorkOS webhook request');
          res.status(400).json({ error: 'Invalid JSON' });
        }
      });
    },
    async (req: Request, res: Response) => {
      const startTime = Date.now();

      try {
        const rawSigHeader = req.headers['workos-signature'];
        const sigHeader = Array.isArray(rawSigHeader) ? rawSigHeader[0] : rawSigHeader;

        logger.info({
          event: req.body?.event,
          hasSigHeader: !!sigHeader,
        }, 'Received WorkOS webhook');

        if (!WORKOS_WEBHOOK_SECRET) {
          logger.error('WORKOS_WEBHOOK_SECRET not configured — rejecting webhook');
          notifySystemError({ source: 'workos-webhook', errorMessage: 'WORKOS_WEBHOOK_SECRET not configured — all webhooks rejected' });
          return res.status(401).json({ error: 'Webhook verification unavailable' });
        }

        if (!sigHeader) {
          logger.warn('Missing WorkOS-Signature header');
          return res.status(401).json({ error: 'Missing signature' });
        }

        try {
          await getWorkos().webhooks.constructEvent({
            payload: req.body,
            sigHeader,
            secret: WORKOS_WEBHOOK_SECRET,
          });
        } catch (err) {
          logger.warn({ err }, 'WorkOS webhook signature verification failed');
          notifySystemError({ source: 'workos-webhook-sig', errorMessage: `Signature verification failed for ${req.body?.event || 'unknown'} — check WORKOS_WEBHOOK_SECRET` });
          return res.status(401).json({ error: 'Invalid signature' });
        }

        const event = req.body as { id: string; event: string; data: Record<string, unknown>; created_at: string };

        switch (event.event) {