Webhook fixes

src/pages/api/external/ping.ts

@@ -6,9 +6,9 @@ export default async function handler(
   req: NextApiRequest,
   res: NextApiResponse
 ) {
-  const success = await validateRequest(req, res);
+  const isValid = await validateRequest(req, res);
 
-  if (success) {
+  if (isValid) {
     await db.query.votes.findFirst();
     res.status(200).json({ result: "Pong!" });
   }

src/pages/api/webhooks/index.ts

@@ -4,7 +4,7 @@ import {
   onUserCreatedHandler,
   onUserDeletedHandler,
 } from "~/server/webhookHelpers";
-import { type WebhookEvent, WebhookEvents } from "~/utils/types";
+import { WebhookEventBodySchema, WebhookEvents } from "~/utils/types";
 
 export default async function handler(
   req: NextApiRequest,
@@ -16,24 +16,8 @@ export default async function handler(
     return;
   }
 
-  const requestBody = req.body as {
+  try {
-    data: {
+    const requestBody = WebhookEventBodySchema.parse(req.body);
-      id: string;
-      email_addresses:
-        | [
-            {
-              email_address: string;
-              id: string;
-              verification: {
-                status: string;
-                strategy: string;
-              };
-            }
-          ]
-        | null;
-    };
-    type: WebhookEvent;
-  };
 
     switch (requestBody.type) {
       case WebhookEvents.USER_CREATED:
@@ -45,7 +29,11 @@ export default async function handler(
         return;
 
       default:
-      res.status(400).json({ error: "INVALID WEBHOOK EVENT" });
+        res.status(400).json({ error: "INVALID WEBHOOK EVENT TYPE" });
+        return;
+    }
+  } catch {
+    res.status(400).json({ error: "INVALID WEBHOOK EVENT BODY" });
     return;
   }
 }

src/utils/types.ts

@@ -1,3 +1,5 @@
+import { z } from "zod";
+
 type BetterEnum<T> = T[keyof T];
 
 export const EventTypes = {
@@ -14,6 +16,27 @@ export const WebhookEvents = {
 } as const;
 export type WebhookEvent = BetterEnum<typeof WebhookEvents>;
 
+export const WebhookEventBodySchema = z.object({
+  data: z.object({
+    id: z.string(),
+    email_addresses: z
+      .array(
+        z.object({
+          email_address: z.string().email(),
+          id: z.string(),
+          verification: z.object({
+            status: z.string(),
+            strategy: z.string(),
+          }),
+        })
+      )
+      .optional(),
+  }),
+  type: z.string(),
+});
+
+export type WebhookEventBody = z.infer<typeof WebhookEventBodySchema>;
+
 export interface PresenceItem {
   name: string;
   image: string;