feat(middleware): verify webhook signature middleware and clean up te…

[Tekprecious]

…sts (#464)

Description

Implements HMAC-SHA256 webhook signature verification middleware to validate incoming webhook payloads and prevent spoofed events from third-party providers.

Key capabilities:

• Captures and preserves the unparsed request body as a Buffer on req.rawBody for downstream routing and validation.
• Computes HMAC-SHA256 signatures over the raw payload and performs timing-safe comparison (crypto.timingSafeEqual) against the signature header.
• Rejects requests missing signature headers or carrying invalid signatures with HTTP 401.
• Supports configurable signature header names per webhook provider (e.g. x-webhook-signature, x-provider-signature).
• Resolves shared secrets from environment variables (or optional explicit config).

Closes #464

Type of Change

• 🐛 Bug fix (non-breaking change which fixes an issue)
• ✨ New feature (non-breaking change which adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)
• 📝 Documentation update
• 🎨 UI/UX improvement
• ♻️ Code refactoring
• ✅ Test addition or update
• 🔧 Configuration change

Checklist

• All GitHub Actions workflows are green on this PR (required for merge)
• Commit messages follow Conventional Commits (feat:, fix:, chore:, etc.) — enforced by CI
• No secrets, API keys, .env, or credentials committed (see CONTRIBUTING.md)
• My code follows the code style of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published

Testing

How to Test

1. Run unit tests for the webhook signature middleware:

   npx jest tests/unit/webhook-signature.middleware.test.ts

[drips-wave]

@Tekprecious Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits