ApiAudit

Implemented a zero-trust ingestion controller for the shipping partner webhook. This implementation includes strict schema validation, field stripping, and fail-closed error handling.

Secure Ingestion Controller

const express = require('express');
const { Joi, validate } = require('express-validation');
const logger = require('./logger');

const router = express.Router();

// 1. Boundary Definition: Strict Schema Constraints
const orderUpdateSchema = {
  body: Joi.object({
    tracking_number: Joi.string().alphanum().min(10).max(32).required(),
    status_code: Joi.string().valid('PICKUP', 'IN_TRANSIT', 'DELIVERED', 'RETURNED').required(),
    timestamp: Joi.date().iso().required(),
    location: Joi.object({
      city: Joi.string().max(100).required(),
      country_code: Joi.string().length(2).uppercase().required()
    }).required()
  }).unknown(false) // Strips and rejects unmapped fields
};

/**
 * Zero-trust ingestion layer
 * Rejects on schema mismatch before touching internal message queues.
 */
router.post('/webhooks/shipping/update', 
  validate(orderUpdateSchema, { keyByField: true }, {}),
  async (req, res) => {
    try {
      const sanitizedData = req.body;
      
      // 2. Execution: Process only verified, sanitized data
      await processOrderUpdate(sanitizedData);
      
      return res.status(200).json({ status: 'accepted' });
    } catch (error) {
      logger.error('ApiAudit Security Violation: Internal processing fault', { error });
      return res.status(500).json({ error: 'Internal processing error' });
    }
});

// 3. Fail-Closed Error Handler
router.use((err, req, res, next) => {
  if (err.name === 'ValidationError') {
    logger.error('🚨 ApiAudit Security Violation: Structural schema poisoning attempt blocked', {
      details: err.details,
      ip: req.ip
    });
    return res.status(422).json(err);
  }
  return res.status(500).json(err);
});

module.exports = router;

Next steps

• Deploy this middleware to your staging environment and test with the partner's sandbox payloads.
• Configure centralized logging to alert on 422 status codes, as these indicate potential schema poisoning.
• Update your internal processOrderUpdate function to expect the exact structure defined in the Joi schema.