security: verify payload integrity before processing notifications

[michaelvic123]

What

Adds HMAC-SHA256 payload integrity verification to the notification pipeline. Tampered payloads are detected and rejected before delivery.

How it works

At schedule time (notification-api.ts → repository.create):

• If PAYLOAD_INTEGRITY_SECRET is set, an HMAC-SHA256 hash of the serialised payload is computed and stored in a new payload_hash column.

At execution time (notification-scheduler.ts → processNotification):

• If the secret is set and a hash is present, the hash is recomputed from the stored payload and compared using crypto.timingSafeEqual.
• Mismatch → the notification is immediately marked as FAILED (retries exhausted so it won't retry a tampered payload) and an error log is emitted.
• No secret configured → processing continues unchanged (backward compatible).

Files changed

File	Change
utils/payload-integrity.ts	New — hashPayload() and verifyPayloadIntegrity()
database/database.ts	Additive ALTER TABLE migration for payload_hash column (idempotent)
types/scheduled-notification.ts	Added payloadHash to ScheduledNotification and ScheduledNotificationRow
services/scheduled-notification-repository.ts	Compute and store hash on create(), map field in rowToModel()
services/notification-scheduler.ts	Verify hash before execution, reject + log on mismatch
tests/payload-integrity.test.ts	13 tests (unit + integration)

Tests

npm test -- --testPathPattern=payload-integrity

13 tests pass:

• hashPayload — determinism, payload sensitivity, secret sensitivity
• verifyPayloadIntegrity — valid pair, tampered payload, wrong hash, empty inputs
• Integration — hash stored, hash matches payload, tamper detected, valid payload verified

Configuration

Set PAYLOAD_INTEGRITY_SECRET in your environment. If unset the feature is inactive and existing behaviour is unchanged.

[drips-wave]

Hey @michaelvic123! 👋 It looks like this PR isn't linked to any issue.

If this PR is for one of the issues assigned to you as part of a Wave, please link it to ensure your contribution is tracked properly. You can do this by adding a keyword to the PR description (e.g., Closes #123), or by clicking a button below:

Issue	Title
#250	[Backend] Implement Webhook Delivery Logs API	Link to this issue
#255	[Testing] Improve Smart Contract Test Coverage	Link to this issue
#256	[Backend] Implement Notification Queue Metrics Service	Link to this issue
#259	[Backend] Add Notification Deduplication Mechanism	Link to this issue

ℹ️ Learn more about linking PRs to issues