[SECURITY][WEBHOOK INTAKE] Reject oversized Paystack bodies before HMAC processing

[Obiajulu-gif]

Summary

The Paystack route reads the complete request with request.text() before signature validation. An unauthenticated client can force the serverless worker to allocate and hash an arbitrarily large body even though the request will ultimately fail authentication.

Repository evidence

• app/api/payments/webhook/route.ts:31-45 buffers the entire body, computes HMAC, and parses JSON without an intake size guard.
• Signature verification necessarily occurs only after the unbounded allocation.
• The existing upload limit work is scoped to KYC and vehicle files, not provider webhook bodies.

Scope

• Enforce a documented maximum webhook envelope size before full buffering.
• Reject oversized or indeterminate-length bodies with a stable response and redacted telemetry.
• Keep HMAC verification over the exact accepted raw bytes.

Acceptance criteria

• Oversized requests are terminated before full allocation or JSON parsing.
• Valid Paystack requests under the limit continue to verify byte-for-byte.
• Limit failures cannot enter financial business logic and expose no body contents.

Tests

• Content-Length over limit, chunked body crossing the limit, exact-boundary payload, invalid signature, valid signature, and multibyte UTF-8 tests.

Non-goals

• Replacing the durable webhook inbox or changing event idempotency semantics.

[Owolabenjade]

Hello maintainer, I want to work on this issue.