fix(webhooks): use rawBody for HMAC verification and relax DTO schema

[JOY (JOY)]

What kind of change does this PR introduce?

Bug fix & Webhook verification optimization

Why was this change needed?

1. Uses (req as any).rawBody buffer directly in DosOrgSyncWebhookController to ensure the exact incoming byte stream is verified against x-dos-signature, preventing HMAC mismatch caused by JSON re-serialization differences.
2. Updates DosOrgSyncDto and DosOrgSyncDataDto with optional fields to support health/ping checks and diverse ecosystem event schemas.

Other information:

• Successfully tested with test ping payloads.

Checklist:

• I have read the CONTRIBUTING guide.
• I have signed the Contributor License Agreement (CLA).
• I checked that there were no similar issues or PRs already open for this.
• This PR fixes just ONE issue

---

Note

Medium Risk
Changes webhook HMAC input and weakens request validation on a signed endpoint; correctness depends on rawBody being populated by upstream middleware when present.

Overview
Fixes DOS org-sync webhook signature checks by preferring (req as any).rawBody when computing the HMAC, so verification uses the original request bytes instead of JSON.stringify(payload) (which can diverge from what the sender signed).

Relaxes DosOrgSyncDto / DosOrgSyncDataDto validation: org_id and top-level data are optional, adds optional id, and types event as a plain string instead of DosSyncEvent—so health/ping payloads and varied event shapes pass validation while unhandled events still fall through to the controller’s ignored path.

^{Reviewed by Cursor Bugbot for commit 6422c52. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_989a106e-67a1-4f0d-b4a0-c8af570ba3f0)

[gemini-code-assist]

Code Review

This pull request updates the webhook signature verification in DosOrgSyncWebhookController to prioritize (req as any).rawBody if available, and relaxes several validation constraints in DosOrgSyncDto and DosOrgSyncDataDto (making org_id, id, and data optional, and changing event to a string). Feedback suggests using req.body instead of payload in the fallback stringification to ensure the stringified payload is as close to the original request as possible, avoiding issues with stripped or transformed properties.

[gemini-code-assist]

When falling back to stringifying the parsed body, using req.body is more reliable than payload. payload is the validated and transformed DTO instance, which may have properties stripped (if whitelist: true is enabled in the global ValidationPipe) or transformed by class-transformer. Using req.body ensures that the fallback stringification is as close to the original request payload as possible.

Suggested change

	const rawBody =
	(req as any).rawBody ||
	(typeof req.body === 'string' ? req.body : JSON.stringify(payload));
	const rawBody =
	(req as any).rawBody ||
	(typeof req.body === 'string' ? req.body : JSON.stringify(req.body));