[omoh5]

Closes #109

Summary

Implements reliable webhook delivery using BullMQ exponential backoff retries and HMAC-SHA256 signatures.

The feature improves the reliability and security of financial event notifications sent to external subscribers.

Changes

• Added or updated BullMQ webhook delivery processing.
• Configured exponential backoff for failed deliveries.
• Added configurable maximum retry attempts.
• Added dead-letter handling for exhausted deliveries.
• Added HMAC-SHA256 signing using subscription-specific secrets.
• Added the X-Astroid-Signature header to outgoing webhook requests.
• Added signature verification for applicable incoming webhook requests.
• Added focused unit and integration tests.

Security

• Uses HMAC-SHA256 for webhook authentication.
• Verifies signatures against the original request body.
• Uses constant-time signature comparison.
• Rejects missing, malformed, or invalid signatures.
• Keeps subscription secrets out of logs and payloads.
• Preserves existing endpoint validation and authorization.

Reliability

• Retries transient delivery failures.
• Uses configurable exponential backoff.
• Enforces maximum delivery attempts.
• Handles exhausted deliveries through a dead-letter mechanism.
• Preserves event identifiers for idempotent processing.

Testing

Coverage includes:

• Successful webhook delivery.
• Correct signature generation.
• Valid and invalid signature verification.
• Retry scheduling and exponential backoff.
• Maximum retry exhaustion.
• Dead-letter handling.
• Protection against sensitive data leakage.

Verification

• npm test
• [Insert actual type-check, lint, build, and integration commands run.]

Results: [Insert actual command results.]

Scope

Changes are limited to webhook delivery processing, signing, verification, retry configuration, dead-letter handling, documentation, and associated tests.

No unrelated financial transaction logic is modified.

[Cjay-Cyber-2]

Merge Conflict — Action Needed

This pull request has merge conflicts with the base branch (main).

What to do: update your branch by merging or rebasing against main, resolve any conflicts locally, and push the result.