Verify Stripe Webhook Signatures in a NestJS Guard Before the Handler

import {
  BadRequestException,
  CanActivate,
  ExecutionContext,
  Injectable,
} from '@nestjs/common';
import { ConfigService } from '@nestjs/config';
import { Request } from 'express';
import Stripe from 'stripe';

@Injectable()
export class StripeWebhookGuard implements CanActivate {
  private readonly stripe: Stripe;
  private readonly endpointSecret: string;

  constructor(private readonly config: ConfigService) {
    this.stripe = new Stripe(this.config.getOrThrow('STRIPE_SECRET_KEY'));
    this.endpointSecret = this.config.getOrThrow('STRIPE_WEBHOOK_SECRET');
  }

  canActivate(context: ExecutionContext): boolean {
    const req = context.switchToHttp().getRequest<Request & { rawBody?: Buffer }>();
    const signature = req.headers['stripe-signature'];

    if (!signature || !req.rawBody) {
      throw new BadRequestException('Missing signature or raw body');
    }

    try {
      // Recomputes HMAC over rawBody and enforces the timestamp tolerance
      const event = this.stripe.webhooks.constructEvent(
        req.rawBody,
        signature,
        this.endpointSecret,
      );
      (req as any).stripeEvent = event;
      return true;
    } catch (err) {
      throw new BadRequestException(`Invalid webhook signature: ${(err as Error).message}`);
    }
  }
}

import { createParamDecorator, ExecutionContext } from '@nestjs/common';
import Stripe from 'stripe';

export const StripeEvent = createParamDecorator(
  (_data: unknown, ctx: ExecutionContext): Stripe.Event => {
    const req = ctx.switchToHttp().getRequest();
    return req.stripeEvent as Stripe.Event;
  },
);

import { Controller, HttpCode, Logger, Post, UseGuards } from '@nestjs/common';
import Stripe from 'stripe';
import { StripeWebhookGuard } from './stripe-webhook.guard';
import { StripeEvent } from './stripe-event.decorator';
import { BillingService } from './billing.service';

@Controller('webhooks/stripe')
export class StripeWebhookController {
  private readonly logger = new Logger(StripeWebhookController.name);

  constructor(private readonly billing: BillingService) {}

  @Post()
  @HttpCode(200)
  @UseGuards(StripeWebhookGuard)
  async handle(@StripeEvent() event: Stripe.Event): Promise<{ received: true }> {
    switch (event.type) {
      case 'invoice.paid':
        await this.billing.markInvoicePaid(event.data.object as Stripe.Invoice);
        break;
      case 'customer.subscription.deleted':
        await this.billing.cancelSubscription(event.data.object as Stripe.Subscription);
        break;
      default:
        this.logger.debug(`Unhandled event type: ${event.type}`);
    }

    // Acknowledge fast so Stripe does not retry
    return { received: true };
  }
}