From 6422c52c0e910bb3629f16c8d9019aed8c790f1f Mon Sep 17 00:00:00 2001
From: JOY <5027251+JOY@users.noreply.github.com>
Date: Wed, 26 Aug 2026 19:43:38 +0700
Subject: [PATCH] fix(webhooks): use rawBody for HMAC verification and make
 sync DTO payload flexible

Use rawBody buffer in DosOrgSyncWebhookController for exact signature matching, and update DosOrgSyncDto to support flexible ecosystem and ping event payloads.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .../src/api/routes/dos-org-sync.controller.ts       |  4 +++-
 .../src/dtos/webhooks/dos-org-sync.dto.ts           | 13 +++++++++----
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/apps/backend/src/api/routes/dos-org-sync.controller.ts b/apps/backend/src/api/routes/dos-org-sync.controller.ts
index 7e08d3a294..3b1e4647bb 100644
--- a/apps/backend/src/api/routes/dos-org-sync.controller.ts
+++ b/apps/backend/src/api/routes/dos-org-sync.controller.ts
@@ -62,7 +62,9 @@ export class DosOrgSyncWebhookController {
     @Body() payload: DosOrgSyncDto,
     @Headers('x-dos-signature') signature?: string
   ) {
-    const rawBody = typeof req.body === 'string' ? req.body : JSON.stringify(payload);
+    const rawBody =
+      (req as any).rawBody ||
+      (typeof req.body === 'string' ? req.body : JSON.stringify(payload));
     if (!this.verifySignature(rawBody, signature)) {
       throw new HttpException('Invalid webhook signature', HttpStatus.UNAUTHORIZED);
     }
diff --git a/libraries/nestjs-libraries/src/dtos/webhooks/dos-org-sync.dto.ts b/libraries/nestjs-libraries/src/dtos/webhooks/dos-org-sync.dto.ts
index 399cc6f2c6..77b5dc0428 100644
--- a/libraries/nestjs-libraries/src/dtos/webhooks/dos-org-sync.dto.ts
+++ b/libraries/nestjs-libraries/src/dtos/webhooks/dos-org-sync.dto.ts
@@ -27,8 +27,8 @@ export enum DosSyncEvent {
 
 export class DosOrgSyncDataDto {
   @IsString()
-  @IsNotEmpty()
-  org_id: string;
+  @IsOptional()
+  org_id?: string;
 
   @IsString()
   @IsOptional()
@@ -52,16 +52,21 @@ export class DosOrgSyncDataDto {
 }
 
 export class DosOrgSyncDto {
+  @IsString()
+  @IsOptional()
+  id?: string;
+
   @IsString()
   @IsNotEmpty()
-  event: DosSyncEvent;
+  event: string;
 
   @IsString()
   @IsOptional()
   timestamp?: string;
 
   @IsObject()
+  @IsOptional()
   @ValidateNested()
   @Type(() => DosOrgSyncDataDto)
-  data: DosOrgSyncDataDto;
+  data?: DosOrgSyncDataDto;
 }