fix: restrict CORS origins and gate webhook events endpoint

direct-charge-integration-reference/.env.example

@@ -4,3 +4,6 @@ LOMI_API_KEY=your-lomi-secret-key
 LOMI_PUBLISHABLE_KEY=lomi_pk_your_publishable_key
 
 LOMI_WEBHOOK_SECRET=whsec_replace_with_your_webhook_signing_secret
+
+# Optional: protect the /api/webhooks/events debug endpoint with a Bearer token
+# ADMIN_TOKEN=your-random-admin-token

direct-charge-integration-reference/server/index.js

@@ -23,7 +23,7 @@ app.use(
     },
   }),
 );
-app.use(cors());
+app.use(cors({ origin: appBaseUrl }));
 app.use(express.static(path.join(__dirname, "..", "frontend")));
 
 const eventStore = [];
@@ -246,7 +246,11 @@ app.post("/api/webhooks/lomi", (req, res) => {
   return res.status(200).json({ ok: true });
 });
 
-app.get("/api/webhooks/events", (_req, res) => {
+app.get("/api/webhooks/events", (req, res) => {
+  const token = process.env.ADMIN_TOKEN;
+  if (token && req.get("Authorization") !== `Bearer ${token}`) {
+    return res.status(401).json({ error: "Unauthorized" });
+  }
   res.json({ count: eventStore.length, events: eventStore });
 });
 

lomi-edupay-connector/.env.example

@@ -9,3 +9,6 @@ APP_BASE_URL=http://localhost:3010
 
 # Optional: forward PAYMENT_SUCCEEDED to EduPay backend
 # EDUPAY_WEBHOOK_FORWARD_URL=https://api.edupay.example/webhooks/lomi
+
+# Optional: protect the /api/webhooks/events debug endpoint with a Bearer token
+# ADMIN_TOKEN=your-random-admin-token

lomi-edupay-connector/server/index.js

@@ -32,7 +32,7 @@ app.use(
     },
   }),
 );
-app.use(cors());
+app.use(cors({ origin: appBaseUrl }));
 app.use(express.static(path.join(__dirname, "..", "frontend")));
 
 const webhookEvents = [];
@@ -234,7 +234,11 @@ app.post("/api/webhooks/lomi", async (req, res) => {
   return res.status(200).json({ ok: true });
 });
 
-app.get("/api/webhooks/events", (_req, res) => {
+app.get("/api/webhooks/events", (req, res) => {
+  const token = process.env.ADMIN_TOKEN;
+  if (token && req.get("Authorization") !== `Bearer ${token}`) {
+    return res.status(401).json({ error: "Unauthorized" });
+  }
   res.json({ count: webhookEvents.length, events: webhookEvents });
 });
 

payment-integration-reference/.env.example

@@ -1,3 +1,6 @@
 LOMI_BASE_URL=https://api.lomi.africa
 LOMI_API_KEY=your-lomi-api-key
 LOMI_WEBHOOK_SECRET=whsec_replace_with_your_webhook_signing_secret
+
+# Optional: protect the /api/webhooks/events debug endpoint with a Bearer token
+# ADMIN_TOKEN=your-random-admin-token

payment-integration-reference/server/index.js

@@ -22,7 +22,7 @@ app.use(
     },
   }),
 );
-app.use(cors());
+app.use(cors({ origin: appBaseUrl }));
 app.use(express.static(path.join(__dirname, "..", "frontend")));
 
 const eventStore = [];
@@ -258,7 +258,11 @@ app.post("/api/webhooks/lomi", (req, res) => {
   return res.status(200).json({ ok: true });
 });
 
-app.get("/api/webhooks/events", (_req, res) => {
+app.get("/api/webhooks/events", (req, res) => {
+  const token = process.env.ADMIN_TOKEN;
+  if (token && req.get("Authorization") !== `Bearer ${token}`) {
+    return res.status(401).json({ error: "Unauthorized" });
+  }
   res.json({ count: eventStore.length, events: eventStore });
 });
 

payment-integration-sdk-reference/.env.example

@@ -2,3 +2,6 @@ LOMI_BASE_URL=https://api.lomi.africa
 LOMI_API_KEY=your-lomi-api-key
 LOMI_WEBHOOK_SECRET=whsec_your_webhook_signing_secret
 LOMI_PUBLIC_KEY=lomi_pk_your_publishable_key
+
+# Optional: protect the /api/webhooks/events debug endpoint with a Bearer token
+# ADMIN_TOKEN=your-random-admin-token

payment-integration-sdk-reference/server/index.js

@@ -38,7 +38,7 @@ app.use(
     },
   }),
 );
-app.use(cors());
+app.use(cors({ origin: appBaseUrl }));
 app.use(express.static(path.join(__dirname, "..", "frontend")));
 
 app.get("/vendor/lomi-embed.js", (_req, res) => {
@@ -267,7 +267,11 @@ app.post("/api/webhooks/lomi", (req, res) => {
   return res.status(200).json({ ok: true });
 });
 
-app.get("/api/webhooks/events", (_req, res) => {
+app.get("/api/webhooks/events", (req, res) => {
+  const token = process.env.ADMIN_TOKEN;
+  if (token && req.get("Authorization") !== `Bearer ${token}`) {
+    return res.status(401).json({ error: "Unauthorized" });
+  }
   res.json({ count: eventStore.length, events: eventStore });
 });