fix(security): audit fixes — Stripe webhook scope, fail-fast secrets, prisma singleton, worker auth, Zod validation, WA number env var

.env.example

@@ -0,0 +1,38 @@
+# Environment Variables — EdTech
+
+# Copy this file to .env and fill in the values.
+# NEVER commit the real .env file to git.
+
+# ─── API Auth ──────────────────────────────────────────────────────────────────
+ADMIN_API_KEY=              # Strong random secret, e.g. openssl rand -hex 32
+
+# ─── WhatsApp / Meta ───────────────────────────────────────────────────────────
+WHATSAPP_VERIFY_TOKEN=      # Token you set in the Meta App dashboard
+WHATSAPP_APP_SECRET=        # App Secret from Meta App Settings > Basic
+WHATSAPP_ACCESS_TOKEN=      # Permanent System User token from Meta Business
+
+# ─── Database ──────────────────────────────────────────────────────────────────
+DATABASE_URL=postgresql://user:password@localhost:5432/edtech?schema=public
+
+# ─── Redis ─────────────────────────────────────────────────────────────────────
+REDIS_URL=                  # e.g. redis://default:password@host:6379
+# Or individual connection params (if REDIS_URL is not set):
+# REDIS_HOST=localhost
+# REDIS_PORT=6379
+# REDIS_USERNAME=default
+# REDIS_PASSWORD=
+# REDIS_TLS=false
+
+# ─── Stripe ────────────────────────────────────────────────────────────────────
+STRIPE_SECRET_KEY=          # sk_live_... (or sk_test_... for dev)
+STRIPE_WEBHOOK_SECRET=      # whsec_... from Stripe dashboard > Webhooks
+
+# ─── OpenAI / AI ───────────────────────────────────────────────────────────────
+OPENAI_API_KEY=             # sk-...
+
+# ─── Frontend ──────────────────────────────────────────────────────────────────
+VITE_CLIENT_URL=https://your-frontend.netlify.app
+VITE_WHATSAPP_NUMBER=221771234567  # Without + prefix, for wa.me links
+
+# ─── Internal (Worker → API) ───────────────────────────────────────────────────
+API_URL=http://localhost:3001   # In prod: full URL of the Fastify API

apps/api/src/index.ts

@@ -3,7 +3,16 @@ import cors from '@fastify/cors';
 import { whatsappRoutes } from './routes/whatsapp';
 import { adminRoutes } from './routes/admin';
 import { aiRoutes } from './routes/ai';
-import { paymentRoutes } from './routes/payments';
+import { paymentRoutes, stripeWebhookRoute } from './routes/payments';
+
+// ── Fail-fast: vérifier les secrets critiques au démarrage ─────────────────────
+const REQUIRED_ENV = ['ADMIN_API_KEY', 'WHATSAPP_APP_SECRET', 'WHATSAPP_VERIFY_TOKEN'];
+for (const key of REQUIRED_ENV) {
+    if (!process.env[key]) {
+        console.error(`[STARTUP] ❌ Missing required environment variable: ${key}`);
+        process.exit(1);
+    }
+}
 
 const server = Fastify({
     logger: true,
@@ -31,8 +40,10 @@ async function setupRateLimit() {
 // ── Public Routes (no auth) ────────────────────────────────────────────────────
 server.register(whatsappRoutes, { prefix: '/v1/whatsapp' });
 
+// ── Stripe Webhook (public — Stripe can't send API Key, verified by signature) ─
+server.register(stripeWebhookRoute, { prefix: '/v1/payments' });
+
 // ── Private Routes (require ADMIN_API_KEY) ─────────────────────────────────────
-// Inline addHook on guardedRoutes scope — properly encapsulated in Fastify v4
 server.register(async function guardedRoutes(scope) {
     scope.addHook('onRequest', async (request, reply) => {
         const apiKey = process.env.ADMIN_API_KEY;

apps/api/src/routes/admin.ts

@@ -1,7 +1,6 @@
 import { FastifyInstance } from 'fastify';
-import { PrismaClient } from '@prisma/client';
+import { prisma } from '../services/prisma';
 
-const prisma = new PrismaClient();
 
 export async function adminRoutes(fastify: FastifyInstance) {
     // 1. Get Dashboard Stats

apps/api/src/routes/payments.ts

@@ -1,20 +1,26 @@
 import { FastifyInstance } from 'fastify';
 import { stripeService } from '../services/stripe';
+import { prisma } from '../services/prisma';
+import { z } from 'zod';
 
-// Use the local PrismaClient to avoid the module resolution issue. We'll instantiate it here.
-import { PrismaClient } from '@prisma/client';
-const prisma = new PrismaClient();
+// ─── Shared Zod schemas ────────────────────────────────────────────────────────
+const checkoutSchema = z.object({
+    userId: z.string().uuid(),
+    trackId: z.string().uuid(),
+});
 
+// ─── Private routes (require ADMIN_API_KEY) ───────────────────────────────────
 export async function paymentRoutes(fastify: FastifyInstance) {
 
     // Create a Checkout Session
     fastify.post('/checkout', async (request, reply) => {
-        const { userId, trackId } = request.body as { userId: string, trackId: string };
-
-        if (!userId || !trackId) {
-            return reply.status(400).send({ error: 'Missing userId or trackId' });
+        const parseResult = checkoutSchema.safeParse(request.body);
+        if (!parseResult.success) {
+            return reply.status(400).send({ error: 'Invalid request body', details: parseResult.error.flatten() });
         }
 
+        const { userId, trackId } = parseResult.data;
+
         try {
             // Validate the track exists and is premium
             const track = await prisma.track.findUnique({ where: { id: trackId } });
@@ -42,10 +48,21 @@ export async function paymentRoutes(fastify: FastifyInstance) {
             return reply.status(500).send({ error: 'Failed to create checkout session' });
         }
     });
+}
+
+// ─── Public Stripe webhook (no API key auth — secured by Stripe signature) ────
+export async function stripeWebhookRoute(fastify: FastifyInstance) {
+    // Capture raw body buffer for Stripe signature verification
+    fastify.addContentTypeParser('application/json', { parseAs: 'buffer' }, (req, body, done) => {
+        (req as any).rawBody = body;
+        try {
+            done(null, JSON.parse(body.toString('utf8')));
+        } catch (err: any) {
+            done(err as Error, undefined as unknown as Buffer);
+        }
+    });
 
-    // Handle Stripe Webhook
-    // Note: We need the raw body to verify the signature. Fastify requires specific config for this.
-    fastify.post('/webhook', { config: { rawBody: true } }, async (request, reply) => {
+    fastify.post('/webhook', async (request, reply) => {
         const sig = request.headers['stripe-signature'];
 
         if (!sig || typeof sig !== 'string') {
@@ -55,9 +72,10 @@ export async function paymentRoutes(fastify: FastifyInstance) {
         let event;
 
         try {
-            // @ts-ignore - Assuming rawBody plugin is configured on the Fastify instance
-            event = stripeService.verifyWebhookSignature(request.rawBody || request.body, sig);
+            const rawBody = (request as any).rawBody as Buffer;
+            event = stripeService.verifyWebhookSignature(rawBody, sig);
         } catch (err: any) {
+            fastify.log.warn(`[Stripe Webhook] Signature verification failed: ${err.message}`);
             return reply.status(400).send(`Webhook Error: ${err.message}`);
         }
 
@@ -71,7 +89,6 @@ export async function paymentRoutes(fastify: FastifyInstance) {
 
             if (userId && trackId) {
                 try {
-                    // Start a transaction: Record payment and Create Enrollment
                     await prisma.$transaction(async (tx: any) => {
                         // 1. Record the payment
                         await tx.payment.create({
@@ -85,8 +102,7 @@ export async function paymentRoutes(fastify: FastifyInstance) {
                             }
                         });
 
-                        // 2. Create the Enrollment
-                        // Check if an enrollment already exists to avoid duplicates
+                        // 2. Create the Enrollment (dedup)
                         const existingEnrollment = await tx.enrollment.findFirst({
                             where: { userId, trackId }
                         });
@@ -100,18 +116,16 @@ export async function paymentRoutes(fastify: FastifyInstance) {
                                     currentDay: 1
                                 }
                             });
-                            fastify.log.info(`[PaymentRoute] Enrollment created for User ${userId}, Track ${trackId}`);
+                            fastify.log.info(`[Stripe Webhook] Enrollment created for User ${userId}, Track ${trackId}`);
                         }
                     });
                 } catch (dbError) {
-                    fastify.log.error(dbError, '[PaymentRoute] Database error during webhook processing');
-                    // Standard practice is to still return a 200 to Stripe so it doesn't retry infinitely,
-                    // but you'd want robust alerting here.
+                    fastify.log.error(dbError, '[Stripe Webhook] Database error during webhook processing');
+                    // Still return 200 so Stripe doesn't retry endlessly — but alert monitoring.
                 }
             }
         }
 
-        // Return a 200 response to acknowledge receipt of the event
         reply.send({ received: true });
     });
 }

apps/api/src/services/stripe.ts

@@ -6,9 +6,13 @@ export class StripeService {
     private clientUrl: string;
 
     constructor() {
-        // Initialize Stripe. Defaults to a dummy key if env var is missing during dev.
-        const secretKey = process.env.STRIPE_SECRET_KEY || 'sk_test_dummy';
-        this.webhookSecret = process.env.STRIPE_WEBHOOK_SECRET || 'whsec_dummy';
+        const secretKey = process.env.STRIPE_SECRET_KEY;
+        if (!secretKey) throw new Error('[StripeService] STRIPE_SECRET_KEY is required');
+
+        const webhookSecret = process.env.STRIPE_WEBHOOK_SECRET;
+        if (!webhookSecret) throw new Error('[StripeService] STRIPE_WEBHOOK_SECRET is required');
+
+        this.webhookSecret = webhookSecret;
         this.clientUrl = process.env.VITE_CLIENT_URL || 'http://localhost:5174';
 
         this.stripe = new Stripe(secretKey, {

apps/web/src/App.tsx

@@ -1,6 +1,8 @@
 import { BrowserRouter as Router, Routes, Route, Link, useNavigate } from 'react-router-dom';
 import { BookOpen, FileText, Smartphone, ArrowRight, Phone } from 'lucide-react';
 
+const WA_NUMBER = import.meta.env.VITE_WHATSAPP_NUMBER || '221771234567';
+
 function Navbar() {
     return (
         <nav className="sticky top-0 z-50 bg-white/80 backdrop-blur-md border-b border-gray-100">
@@ -17,7 +19,7 @@ function Navbar() {
                             Student Login
                         </Link>
                         <a
-                            href="https://wa.me/1234567890?text=Hello! I want to enroll." // Placeholder for actual bot link
+                            href={`https://wa.me/${WA_NUMBER}?text=Hello! I want to enroll.`}
                             target="_blank"
                             rel="noreferrer"
                             className="bg-primary text-white px-5 py-2.5 rounded-full font-medium hover:bg-emerald-700 hover:shadow-lg hover:shadow-primary/30 transition-all active:scale-95 hidden sm:inline-flex items-center"
@@ -60,7 +62,7 @@ function Hero() {
 
                 <div className="flex flex-col sm:flex-row justify-center items-center gap-4">
                     <a
-                        href="https://wa.me/1234567890?text=Start"
+                        href={`https://wa.me/${WA_NUMBER}?text=Start`}
                         target="_blank"
                         rel="noreferrer"
                         className="w-full sm:w-auto bg-primary text-white text-lg px-8 py-4 rounded-full font-bold shadow-xl shadow-primary/30 hover:bg-emerald-700 hover:scale-105 transition-all flex items-center justify-center group"

apps/web/src/vite-env.d.ts

@@ -0,0 +1,11 @@
+/// <reference types="vite/client" />
+
+interface ImportMetaEnv {
+    readonly VITE_API_URL: string;
+    readonly VITE_CLIENT_URL: string;
+    readonly VITE_WHATSAPP_NUMBER: string;
+}
+
+interface ImportMeta {
+    readonly env: ImportMetaEnv;
+}

apps/whatsapp-worker/src/index.ts

@@ -40,10 +40,14 @@ const worker = new Worker('whatsapp-queue', async (job: Job) => {
             if (track.isPremium) {
                 console.log(`[WORKER] User ${userId} requested Premium Track ${trackId}. Generating Payment Link...`);
                 try {
-                    const API_URL = process.env.VITE_API_URL || 'http://localhost:3001';
+                    const API_URL = process.env.API_URL || 'http://localhost:3001';
+                    const apiKey = process.env.ADMIN_API_KEY || '';
                     const checkoutRes = await fetch(`${API_URL}/v1/payments/checkout`, {
                         method: 'POST',
-                        headers: { 'Content-Type': 'application/json' },
+                        headers: {
+                            'Content-Type': 'application/json',
+                            'Authorization': `Bearer ${apiKey}`
+                        },
                         body: JSON.stringify({ userId, trackId })
                     });
 
@@ -87,10 +91,14 @@ const worker = new Worker('whatsapp-queue', async (job: Job) => {
                 if (user && user.activity) {
                     try {
                         console.log(`[WORKER] Personalizing lesson for User ${userId}'s activity: ${user.activity}`);
-                        const API_URL = process.env.VITE_API_URL || 'http://localhost:3001';
+                        const API_URL = process.env.API_URL || 'http://localhost:3001';
+                        const apiKey = process.env.ADMIN_API_KEY || '';
                         const personalizeRes = await fetch(`${API_URL}/v1/ai/personalize-lesson`, {
                             method: 'POST',
-                            headers: { 'Content-Type': 'application/json' },
+                            headers: {
+                                'Content-Type': 'application/json',
+                                'Authorization': `Bearer ${apiKey}`
+                            },
                             body: JSON.stringify({ lessonText: trackDay.textContent, userActivity: user.activity })
                         });
 
@@ -109,10 +117,14 @@ const worker = new Worker('whatsapp-queue', async (job: Job) => {
                 let audioUrl = null;
                 try {
                     console.log(`[WORKER] Generating TTS Audio for User ${userId}...`);
-                    const API_URL = process.env.VITE_API_URL || 'http://localhost:3001';
+                    const API_URL = process.env.API_URL || 'http://localhost:3001';
+                    const apiKey = process.env.ADMIN_API_KEY || '';
                     const ttsRes = await fetch(`${API_URL}/v1/ai/tts`, {
                         method: 'POST',
-                        headers: { 'Content-Type': 'application/json' },
+                        headers: {
+                            'Content-Type': 'application/json',
+                            'Authorization': `Bearer ${apiKey}`
+                        },
                         body: JSON.stringify({ text: finalContent })
                     });
 
@@ -154,12 +166,17 @@ const worker = new Worker('whatsapp-queue', async (job: Job) => {
                     // Update userContext to explicitly reference the user's sector/activity
                     const userContext = `User ${userId} completed the Business Pitch track. Their business activity/sector is: ${user?.activity || 'Unknown'}. They want to build a business in this sector using the concepts learned in the track.`;
 
-                    const API_URL = process.env.VITE_API_URL || 'http://localhost:3001';
+                    const API_URL = process.env.API_URL || 'http://localhost:3001';
+                    const apiKey = process.env.ADMIN_API_KEY || '';
+                    const authHeaders = {
+                        'Content-Type': 'application/json',
+                        'Authorization': `Bearer ${apiKey}`
+                    };
 
                     // Trigger OnePager (PDF)
                     const pdfRes = await fetch(`${API_URL}/v1/ai/onepager`, {
                         method: 'POST',
-                        headers: { 'Content-Type': 'application/json' },
+                        headers: authHeaders,
                         body: JSON.stringify({ userContext })
                     });
                     const pdfData = await pdfRes.json();
@@ -167,7 +184,7 @@ const worker = new Worker('whatsapp-queue', async (job: Job) => {
                     // Trigger Pitch Deck (PPTX)
                     const pptxRes = await fetch(`${API_URL}/v1/ai/deck`, {
                         method: 'POST',
-                        headers: { 'Content-Type': 'application/json' },
+                        headers: authHeaders,
                         body: JSON.stringify({ userContext })
                     });
                     const pptxData = await pptxRes.json();