fix(webhooks): make SNS processing replay-safe

.env.self-host.example

@@ -42,6 +42,9 @@ USE_HTTPS=false
 AWS_SES_REGION=us-east-1
 AWS_SES_ACCESS_KEY_ID=
 AWS_SES_SECRET_ACCESS_KEY=
+# Exact SNS topics allowed to call /webhooks/sns. Include a separate inbound
+# topic too, if used, as a comma-separated ARN.
+SNS_TOPIC_ARNS=arn:aws:sns:us-east-1:123456789012:plunk-ses-events
 
 # Configuration sets for email tracking
 # SES_CONFIGURATION_SET: Default configuration with open/click tracking enabled

.github/workflows/ci.yml

@@ -110,6 +110,7 @@ jobs:
           AWS_SES_REGION=us-east-1
           AWS_SES_ACCESS_KEY_ID=mock
           AWS_SES_SECRET_ACCESS_KEY=mock
+          SNS_TOPIC_ARNS=arn:aws:sns:us-east-1:123456789012:plunk-ses-events
           SES_CONFIGURATION_SET=test
           SES_CONFIGURATION_SET_NO_TRACKING=test-no-tracking
           EOF
@@ -195,6 +196,7 @@ jobs:
           AWS_SES_REGION=us-east-1
           AWS_SES_ACCESS_KEY_ID=mock
           AWS_SES_SECRET_ACCESS_KEY=mock
+          SNS_TOPIC_ARNS=arn:aws:sns:us-east-1:123456789012:plunk-ses-events
           SES_CONFIGURATION_SET=test
           SES_CONFIGURATION_SET_NO_TRACKING=test
           EOF

CLAUDE.md

@@ -140,8 +140,8 @@ Required for builds and deployment (see turbo.json and .env.example):
   optional)
 - S3-compatible Storage (Minio): `S3_ENDPOINT`, `S3_ACCESS_KEY_ID`, `S3_ACCESS_KEY_SECRET`, `S3_BUCKET`,
   `S3_PUBLIC_URL`, `S3_FORCE_PATH_STYLE`
-- AWS SES: `AWS_SES_REGION`, `AWS_SES_ACCESS_KEY_ID`, `AWS_SES_SECRET_ACCESS_KEY`, `SES_CONFIGURATION_SET`,
-  `SES_CONFIGURATION_SET_NO_TRACKING`
+- AWS SES: `AWS_SES_REGION`, `AWS_SES_ACCESS_KEY_ID`, `AWS_SES_SECRET_ACCESS_KEY`, `SNS_TOPIC_ARNS`,
+  `SES_CONFIGURATION_SET`, `SES_CONFIGURATION_SET_NO_TRACKING`
 - OAuth (optional): `GITHUB_OAUTH_CLIENT`, `GITHUB_OAUTH_SECRET`, `GOOGLE_OAUTH_CLIENT`, `GOOGLE_OAUTH_SECRET`
 - Stripe (optional): `STRIPE_SK`, `STRIPE_WEBHOOK_SECRET`, `STRIPE_PRICE_ONBOARDING`, `STRIPE_PRICE_EMAIL_USAGE`,
   `STRIPE_METER_EVENT_NAME`

apps/api/.env.example

@@ -54,6 +54,8 @@ S3_FORCE_PATH_STYLE=true
 AWS_SES_REGION=eu-north-1
 AWS_SES_ACCESS_KEY_ID=
 AWS_SES_SECRET_ACCESS_KEY=
+# Exact SNS topics allowed to call /webhooks/sns (comma-separated when using more than one)
+SNS_TOPIC_ARNS=arn:aws:sns:eu-north-1:123456789012:plunk-ses-events
 
 # Configuration sets for email tracking
 SES_CONFIGURATION_SET=plunk-configuration-set                     # Default: with open/click tracking

apps/api/src/app/constants.ts

@@ -45,6 +45,19 @@ export const AWS_SES_REGION = validateEnv('AWS_SES_REGION');
 export const AWS_SES_ACCESS_KEY_ID = validateEnv('AWS_SES_ACCESS_KEY_ID');
 export const AWS_SES_SECRET_ACCESS_KEY = validateEnv('AWS_SES_SECRET_ACCESS_KEY');
 
+// Exact SNS topic ARNs authorized to deliver SES events to /webhooks/sns.
+// Multiple topics support deployments that separate outbound and inbound SES.
+const snsTopicArns = validateEnv('SNS_TOPIC_ARNS')
+  .split(',')
+  .map(topicArn => topicArn.trim())
+  .filter(Boolean);
+
+if (snsTopicArns.length === 0) {
+  throw new Error('SNS_TOPIC_ARNS must contain at least one topic ARN');
+}
+
+export const SNS_TOPIC_ARNS: ReadonlySet<string> = new Set(snsTopicArns);
+
 // Custom MAIL FROM subdomain used to construct `<subdomain>.<your-domain>`
 // when a domain is added. Defaults to `plunk`. Override when `plunk.<your-domain>`
 // is already used for something else (e.g. a CDN), since the MAIL FROM hostname