feat: complete outbound event delivery, billing webhooks, and Stripe setup

[khaliqgant]

• Implement outbound event subscription delivery engine with HMAC-SHA256
  signing, channel/mentions filtering, and retry with exponential backoff
• Wire publishEvent() and deliverEvent() into all mutation route handlers:
  message.created, thread.reply, reaction.added/removed, channel.created/
  archived, dm.received, group_dm.received, file.uploaded, message.read
• Complete billing webhook stubs: handleInvoicePaid resets usage counters,
  handlePaymentFailed downgrades workspace to free plan
• Add Stripe product/price setup script (scripts/stripe-setup.ts) for
  creating Free/Pro/Enterprise pricing tiers idempotently
• Add 29 new tests across 3 test files (eventDelivery, eventPublishing,
  webhooks) bringing total from 378 to 407 passing tests

https://claude.ai/code/session_01NoF17Dac9CpDzg9qScB39o

---

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

Devin Review found 1 new potential issue.

View 10 additional findings in Devin Review.

[devin-ai-integration]

Devin Review found 1 new potential issue.

View 13 additional findings in Devin Review.

[devin-ai-integration]

Devin Review found 2 new potential issues.

View 14 additional findings in Devin Review.

[devin-ai-integration]

Devin Review found 2 new potential issues.

View 13 additional findings in Devin Review.

[devin-ai-integration]

🟡 Raw body buffer stored on every request, not just webhook requests

The verify callback in express.json() stores the raw body buffer on every incoming JSON request, not just the Stripe webhook endpoint that needs it. This doubles memory usage for every API call across the entire application.

Performance Impact Details

At packages/server/src/app.ts:29-34, the verify callback unconditionally stores rawBody on every request:

app.use(express.json({
  verify: (req, _res, buf) => {
    (req as Request & { rawBody?: Buffer }).rawBody = buf;
  },
}));

This means every single API call (messages, channels, agents, DMs, etc.) will have its raw body buffered in memory alongside the parsed JSON body. For a messaging platform handling high throughput, this effectively doubles the memory cost of every request body.

The rawBody is only needed by the Stripe webhook endpoint at packages/server/src/routes/webhooks.ts:41 for signature verification. A better approach would be to use a separate express.raw() middleware only on the webhook route, or conditionally store the raw body based on the request path.

Impact: Increased memory usage and GC pressure proportional to total API traffic, not just webhook traffic.

Prompt for agents

Instead of storing rawBody on every request, only store it for the webhook route. One approach is to use a path check inside the verify callback:

app.use(express.json({
  verify: (req, _res, buf) => {
    // Only preserve raw body for Stripe webhook signature verification
    if ((req as any).url === '/billing/webhooks' || (req as any).originalUrl?.endsWith('/billing/webhooks')) {
      (req as Request & { rawBody?: Buffer }).rawBody = buf;
    }
  },
}));

Alternatively, you could use a separate express.raw() middleware mounted only on the webhook route before the JSON parser, or use a dedicated body parser for that specific route.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🟡 Webhook processing errors expose internal error messages to external callers

When processWebhook throws an error, the error message is directly included in the 500 response body, potentially leaking internal implementation details (database errors, stack traces, etc.) to external Stripe webhook callers.

Security Concern Details

At packages/server/src/routes/webhooks.ts:58:

res.status(500).json({ ok: false, error: { code: 'webhook_processing_error', message: (err as Error).message } });

The processWebhook function at packages/server/src/engine/webhooks.ts calls database operations (getDb(), db.update(), db.select(), resetUsageCounters()). If any of these fail, the raw error message (which could contain database connection strings, SQL errors, or internal state) is sent directly to the external caller.

Since the /v1/billing/webhooks endpoint is unauthenticated (it doesn't require auth — it's called by Stripe), this could leak internal information to anyone who sends a POST to this endpoint.

Impact: Information disclosure of internal error details to unauthenticated external callers.

Suggested change

	res.status(500).json({ ok: false, error: { code: 'webhook_processing_error', message: (err as Error).message } });
	res.status(500).json({ ok: false, error: { code: 'webhook_processing_error', message: 'Internal webhook processing error' } });

---

Was this helpful? React with 👍 or 👎 to provide feedback.