@open-mercato/gateway-stripe 0.6.8-develop.7066.1.6bfa9ff69f → 0.6.8-develop.7067.1.82e9867ea1

package/dist/modules/gateway_stripe/workers/webhook-processor.js

@@ -1,3 +1,4 @@
+import { isTrustedWebhookDispatch } from "@open-mercato/shared/lib/queue/dispatchOrigin";
 import { claimWebhookProcessing, releaseWebhookClaim } from "@open-mercato/core/modules/payment_gateways/lib/webhook-utils";
 import { mapWebhookEventToStatus, mapStripeStatus } from "../lib/status-map.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
@@ -15,6 +16,13 @@ function readSessionIdFromEvent(event) {
   return null;
 }
 async function handle(job, ctx) {
+  if (!isTrustedWebhookDispatch(job.payload)) {
+    logger.error("Dropping webhook job with missing or untrusted dispatch origin", {
+      eventType: job.payload?.event?.eventType,
+      transactionId: job.payload?.transactionId ?? null
+    });
+    return;
+  }
   const em = ctx.resolve("em");
   const paymentGatewayService = ctx.resolve("paymentGatewayService");
   const integrationLogService = ctx.resolve("integrationLogService");

package/dist/modules/gateway_stripe/workers/webhook-processor.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/gateway_stripe/workers/webhook-processor.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { JobContext, QueuedJob, WorkerMeta } from '@open-mercato/queue'\nimport type { WebhookEvent } from '@open-mercato/shared/modules/payment_gateways/types'\nimport type { IntegrationLogService } from '@open-mercato/core/modules/integrations/lib/log-service'\nimport type { PaymentGatewayService } from '@open-mercato/core/modules/payment_gateways/lib/gateway-service'\nimport { claimWebhookProcessing, releaseWebhookClaim } from '@open-mercato/core/modules/payment_gateways/lib/webhook-utils'\nimport { mapWebhookEventToStatus, mapStripeStatus } from '../lib/status-map'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('gateway_stripe').child({ component: 'webhook-processor' })\n\ntype WebhookJobPayload = {\n  providerKey: string\n  event: WebhookEvent\n  transactionId?: string | null\n  scope?: {\n    organizationId: string\n    tenantId: string\n  } | null\n}\n\ntype HandlerContext = JobContext & {\n  resolve: <T = unknown>(name: string) => T\n}\n\nexport const metadata: WorkerMeta = {\n  queue: 'stripe-webhook',\n  id: 'gateway-stripe:webhook-processor',\n  concurrency: 5,\n}\n\nfunction readSessionIdFromEvent(event: WebhookEvent): string | null {\n  const id = event.data.id\n  if (typeof id === 'string' && id.trim().length > 0) return id.trim()\n  const paymentIntent = event.data.payment_intent\n  if (typeof paymentIntent === 'string' && paymentIntent.trim().length > 0) return paymentIntent.trim()\n  return null\n}\n\nexport default async function handle(job: QueuedJob<WebhookJobPayload>, ctx: HandlerContext): Promise<void> {\n  const em = ctx.resolve<EntityManager>('em')\n  const paymentGatewayService = ctx.resolve<PaymentGatewayService>('paymentGatewayService')\n  const integrationLogService = ctx.resolve<IntegrationLogService>('integrationLogService')\n  const event = job.payload.event\n  // Scope MUST come from the trusted enqueuer (a signature-verified transaction), never from\n  // attacker-controlled `event.data.metadata` \u2014 that fallback was the cross-tenant-write vector.\n  const scope = job.payload.scope ?? null\n\n  try {\n    let transaction = job.payload.transactionId && scope\n      ? await paymentGatewayService.findTransaction(job.payload.transactionId, scope)\n      : null\n    if (!transaction) {\n      const sessionId = readSessionIdFromEvent(event)\n      if (!sessionId || !scope) return\n      transaction = await paymentGatewayService.findTransactionBySessionId(sessionId, scope, 'stripe')\n    }\n    if (!transaction) return\n\n    const transactionScope = { organizationId: transaction.organizationId, tenantId: transaction.tenantId }\n    const log = integrationLogService.scoped('gateway_stripe', transactionScope)\n    const claimed = await claimWebhookProcessing(em, event.idempotencyKey, 'stripe', transactionScope, event.eventType)\n    if (!claimed) {\n      await log.info('Duplicate Stripe webhook skipped', {\n        eventType: event.eventType,\n        idempotencyKey: event.idempotencyKey,\n        transactionId: transaction.id,\n      })\n      return\n    }\n\n    const eventStatus = mapWebhookEventToStatus(event.eventType)\n    const providerStatus = typeof event.data.status === 'string' ? event.data.status : ''\n    const unifiedStatus = eventStatus ?? mapStripeStatus(providerStatus)\n\n    if (unifiedStatus !== 'unknown') {\n      await paymentGatewayService.syncTransactionStatus(transaction.id, {\n        unifiedStatus,\n        providerStatus: event.eventType,\n        providerData: event.data,\n      }, transactionScope)\n    }\n\n    await log.info('Stripe webhook processed', {\n      eventType: event.eventType,\n      transactionId: transaction.id,\n      unifiedStatus,\n    })\n  } catch (error: unknown) {\n    const message = error instanceof Error ? error.message : 'Stripe webhook processing failed'\n    if (scope) {\n      await releaseWebhookClaim(em, event.idempotencyKey, 'stripe', scope)\n      await integrationLogService.write({\n        integrationId: 'gateway_stripe',\n        level: 'error',\n        message: 'Stripe webhook processing failed',\n        code: 'stripe_webhook_processing_failed',\n        payload: {\n          error: message,\n          eventType: event.eventType,\n          transactionId: job.payload.transactionId ?? null,\n        },\n      }, scope)\n    } else {\n      logger.error('Stripe webhook processing failed', {\n        eventType: event.eventType,\n        transactionId: job.payload.transactionId ?? null,\n        err: error,\n      })\n    }\n    throw error\n  }\n}\n"],
-  "mappings": "AAKA,SAAS,wBAAwB,2BAA2B;AAC5D,SAAS,yBAAyB,uBAAuB;AACzD,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,gBAAgB,EAAE,MAAM,EAAE,WAAW,oBAAoB,CAAC;AAgB/E,MAAM,WAAuB;AAAA,EAClC,OAAO;AAAA,EACP,IAAI;AAAA,EACJ,aAAa;AACf;AAEA,SAAS,uBAAuB,OAAoC;AAClE,QAAM,KAAK,MAAM,KAAK;AACtB,MAAI,OAAO,OAAO,YAAY,GAAG,KAAK,EAAE,SAAS,EAAG,QAAO,GAAG,KAAK;AACnE,QAAM,gBAAgB,MAAM,KAAK;AACjC,MAAI,OAAO,kBAAkB,YAAY,cAAc,KAAK,EAAE,SAAS,EAAG,QAAO,cAAc,KAAK;AACpG,SAAO;AACT;AAEA,eAAO,OAA8B,KAAmC,KAAoC;AAC1G,QAAM,KAAK,IAAI,QAAuB,IAAI;AAC1C,QAAM,wBAAwB,IAAI,QAA+B,uBAAuB;AACxF,QAAM,wBAAwB,IAAI,QAA+B,uBAAuB;AACxF,QAAM,QAAQ,IAAI,QAAQ;AAG1B,QAAM,QAAQ,IAAI,QAAQ,SAAS;AAEnC,MAAI;AACF,QAAI,cAAc,IAAI,QAAQ,iBAAiB,QAC3C,MAAM,sBAAsB,gBAAgB,IAAI,QAAQ,eAAe,KAAK,IAC5E;AACJ,QAAI,CAAC,aAAa;AAChB,YAAM,YAAY,uBAAuB,KAAK;AAC9C,UAAI,CAAC,aAAa,CAAC,MAAO;AAC1B,oBAAc,MAAM,sBAAsB,2BAA2B,WAAW,OAAO,QAAQ;AAAA,IACjG;AACA,QAAI,CAAC,YAAa;AAElB,UAAM,mBAAmB,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AACtG,UAAM,MAAM,sBAAsB,OAAO,kBAAkB,gBAAgB;AAC3E,UAAM,UAAU,MAAM,uBAAuB,IAAI,MAAM,gBAAgB,UAAU,kBAAkB,MAAM,SAAS;AAClH,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,KAAK,oCAAoC;AAAA,QACjD,WAAW,MAAM;AAAA,QACjB,gBAAgB,MAAM;AAAA,QACtB,eAAe,YAAY;AAAA,MAC7B,CAAC;AACD;AAAA,IACF;AAEA,UAAM,cAAc,wBAAwB,MAAM,SAAS;AAC3D,UAAM,iBAAiB,OAAO,MAAM,KAAK,WAAW,WAAW,MAAM,KAAK,SAAS;AACnF,UAAM,gBAAgB,eAAe,gBAAgB,cAAc;AAEnE,QAAI,kBAAkB,WAAW;AAC/B,YAAM,sBAAsB,sBAAsB,YAAY,IAAI;AAAA,QAChE;AAAA,QACA,gBAAgB,MAAM;AAAA,QACtB,cAAc,MAAM;AAAA,MACtB,GAAG,gBAAgB;AAAA,IACrB;AAEA,UAAM,IAAI,KAAK,4BAA4B;AAAA,MACzC,WAAW,MAAM;AAAA,MACjB,eAAe,YAAY;AAAA,MAC3B;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAgB;AACvB,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,QAAI,OAAO;AACT,YAAM,oBAAoB,IAAI,MAAM,gBAAgB,UAAU,KAAK;AACnE,YAAM,sBAAsB,MAAM;AAAA,QAChC,eAAe;AAAA,QACf,OAAO;AAAA,QACP,SAAS;AAAA,QACT,MAAM;AAAA,QACN,SAAS;AAAA,UACP,OAAO;AAAA,UACP,WAAW,MAAM;AAAA,UACjB,eAAe,IAAI,QAAQ,iBAAiB;AAAA,QAC9C;AAAA,MACF,GAAG,KAAK;AAAA,IACV,OAAO;AACL,aAAO,MAAM,oCAAoC;AAAA,QAC/C,WAAW,MAAM;AAAA,QACjB,eAAe,IAAI,QAAQ,iBAAiB;AAAA,QAC5C,KAAK;AAAA,MACP,CAAC;AAAA,IACH;AACA,UAAM;AAAA,EACR;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { JobContext, QueuedJob, WorkerMeta } from '@open-mercato/queue'\nimport type { WebhookEvent } from '@open-mercato/shared/modules/payment_gateways/types'\nimport { isTrustedWebhookDispatch } from '@open-mercato/shared/lib/queue/dispatchOrigin'\nimport type { IntegrationLogService } from '@open-mercato/core/modules/integrations/lib/log-service'\nimport type { PaymentGatewayService } from '@open-mercato/core/modules/payment_gateways/lib/gateway-service'\nimport { claimWebhookProcessing, releaseWebhookClaim } from '@open-mercato/core/modules/payment_gateways/lib/webhook-utils'\nimport { mapWebhookEventToStatus, mapStripeStatus } from '../lib/status-map'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('gateway_stripe').child({ component: 'webhook-processor' })\n\ntype WebhookJobPayload = {\n  providerKey: string\n  event: WebhookEvent\n  transactionId?: string | null\n  scope?: {\n    organizationId: string\n    tenantId: string\n  } | null\n}\n\ntype HandlerContext = JobContext & {\n  resolve: <T = unknown>(name: string) => T\n}\n\nexport const metadata: WorkerMeta = {\n  queue: 'stripe-webhook',\n  id: 'gateway-stripe:webhook-processor',\n  concurrency: 5,\n}\n\nfunction readSessionIdFromEvent(event: WebhookEvent): string | null {\n  const id = event.data.id\n  if (typeof id === 'string' && id.trim().length > 0) return id.trim()\n  const paymentIntent = event.data.payment_intent\n  if (typeof paymentIntent === 'string' && paymentIntent.trim().length > 0) return paymentIntent.trim()\n  return null\n}\n\nexport default async function handle(job: QueuedJob<WebhookJobPayload>, ctx: HandlerContext): Promise<void> {\n  // Fail closed on untrusted dispatch origins (#5213): only jobs enqueued by the\n  // inbound webhook route (signature verified against per-tenant credentials) may\n  // drive Stripe payment state. Scheduler-dispatched or unmarked jobs are dropped.\n  if (!isTrustedWebhookDispatch(job.payload)) {\n    logger.error('Dropping webhook job with missing or untrusted dispatch origin', {\n      eventType: job.payload?.event?.eventType,\n      transactionId: job.payload?.transactionId ?? null,\n    })\n    return\n  }\n\n  const em = ctx.resolve<EntityManager>('em')\n  const paymentGatewayService = ctx.resolve<PaymentGatewayService>('paymentGatewayService')\n  const integrationLogService = ctx.resolve<IntegrationLogService>('integrationLogService')\n  const event = job.payload.event\n  // Scope MUST come from the trusted enqueuer (a signature-verified transaction), never from\n  // attacker-controlled `event.data.metadata` \u2014 that fallback was the cross-tenant-write vector.\n  const scope = job.payload.scope ?? null\n\n  try {\n    let transaction = job.payload.transactionId && scope\n      ? await paymentGatewayService.findTransaction(job.payload.transactionId, scope)\n      : null\n    if (!transaction) {\n      const sessionId = readSessionIdFromEvent(event)\n      if (!sessionId || !scope) return\n      transaction = await paymentGatewayService.findTransactionBySessionId(sessionId, scope, 'stripe')\n    }\n    if (!transaction) return\n\n    const transactionScope = { organizationId: transaction.organizationId, tenantId: transaction.tenantId }\n    const log = integrationLogService.scoped('gateway_stripe', transactionScope)\n    const claimed = await claimWebhookProcessing(em, event.idempotencyKey, 'stripe', transactionScope, event.eventType)\n    if (!claimed) {\n      await log.info('Duplicate Stripe webhook skipped', {\n        eventType: event.eventType,\n        idempotencyKey: event.idempotencyKey,\n        transactionId: transaction.id,\n      })\n      return\n    }\n\n    const eventStatus = mapWebhookEventToStatus(event.eventType)\n    const providerStatus = typeof event.data.status === 'string' ? event.data.status : ''\n    const unifiedStatus = eventStatus ?? mapStripeStatus(providerStatus)\n\n    if (unifiedStatus !== 'unknown') {\n      await paymentGatewayService.syncTransactionStatus(transaction.id, {\n        unifiedStatus,\n        providerStatus: event.eventType,\n        providerData: event.data,\n      }, transactionScope)\n    }\n\n    await log.info('Stripe webhook processed', {\n      eventType: event.eventType,\n      transactionId: transaction.id,\n      unifiedStatus,\n    })\n  } catch (error: unknown) {\n    const message = error instanceof Error ? error.message : 'Stripe webhook processing failed'\n    if (scope) {\n      await releaseWebhookClaim(em, event.idempotencyKey, 'stripe', scope)\n      await integrationLogService.write({\n        integrationId: 'gateway_stripe',\n        level: 'error',\n        message: 'Stripe webhook processing failed',\n        code: 'stripe_webhook_processing_failed',\n        payload: {\n          error: message,\n          eventType: event.eventType,\n          transactionId: job.payload.transactionId ?? null,\n        },\n      }, scope)\n    } else {\n      logger.error('Stripe webhook processing failed', {\n        eventType: event.eventType,\n        transactionId: job.payload.transactionId ?? null,\n        err: error,\n      })\n    }\n    throw error\n  }\n}\n"],
+  "mappings": "AAGA,SAAS,gCAAgC;AAGzC,SAAS,wBAAwB,2BAA2B;AAC5D,SAAS,yBAAyB,uBAAuB;AACzD,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,gBAAgB,EAAE,MAAM,EAAE,WAAW,oBAAoB,CAAC;AAgB/E,MAAM,WAAuB;AAAA,EAClC,OAAO;AAAA,EACP,IAAI;AAAA,EACJ,aAAa;AACf;AAEA,SAAS,uBAAuB,OAAoC;AAClE,QAAM,KAAK,MAAM,KAAK;AACtB,MAAI,OAAO,OAAO,YAAY,GAAG,KAAK,EAAE,SAAS,EAAG,QAAO,GAAG,KAAK;AACnE,QAAM,gBAAgB,MAAM,KAAK;AACjC,MAAI,OAAO,kBAAkB,YAAY,cAAc,KAAK,EAAE,SAAS,EAAG,QAAO,cAAc,KAAK;AACpG,SAAO;AACT;AAEA,eAAO,OAA8B,KAAmC,KAAoC;AAI1G,MAAI,CAAC,yBAAyB,IAAI,OAAO,GAAG;AAC1C,WAAO,MAAM,kEAAkE;AAAA,MAC7E,WAAW,IAAI,SAAS,OAAO;AAAA,MAC/B,eAAe,IAAI,SAAS,iBAAiB;AAAA,IAC/C,CAAC;AACD;AAAA,EACF;AAEA,QAAM,KAAK,IAAI,QAAuB,IAAI;AAC1C,QAAM,wBAAwB,IAAI,QAA+B,uBAAuB;AACxF,QAAM,wBAAwB,IAAI,QAA+B,uBAAuB;AACxF,QAAM,QAAQ,IAAI,QAAQ;AAG1B,QAAM,QAAQ,IAAI,QAAQ,SAAS;AAEnC,MAAI;AACF,QAAI,cAAc,IAAI,QAAQ,iBAAiB,QAC3C,MAAM,sBAAsB,gBAAgB,IAAI,QAAQ,eAAe,KAAK,IAC5E;AACJ,QAAI,CAAC,aAAa;AAChB,YAAM,YAAY,uBAAuB,KAAK;AAC9C,UAAI,CAAC,aAAa,CAAC,MAAO;AAC1B,oBAAc,MAAM,sBAAsB,2BAA2B,WAAW,OAAO,QAAQ;AAAA,IACjG;AACA,QAAI,CAAC,YAAa;AAElB,UAAM,mBAAmB,EAAE,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AACtG,UAAM,MAAM,sBAAsB,OAAO,kBAAkB,gBAAgB;AAC3E,UAAM,UAAU,MAAM,uBAAuB,IAAI,MAAM,gBAAgB,UAAU,kBAAkB,MAAM,SAAS;AAClH,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,KAAK,oCAAoC;AAAA,QACjD,WAAW,MAAM;AAAA,QACjB,gBAAgB,MAAM;AAAA,QACtB,eAAe,YAAY;AAAA,MAC7B,CAAC;AACD;AAAA,IACF;AAEA,UAAM,cAAc,wBAAwB,MAAM,SAAS;AAC3D,UAAM,iBAAiB,OAAO,MAAM,KAAK,WAAW,WAAW,MAAM,KAAK,SAAS;AACnF,UAAM,gBAAgB,eAAe,gBAAgB,cAAc;AAEnE,QAAI,kBAAkB,WAAW;AAC/B,YAAM,sBAAsB,sBAAsB,YAAY,IAAI;AAAA,QAChE;AAAA,QACA,gBAAgB,MAAM;AAAA,QACtB,cAAc,MAAM;AAAA,MACtB,GAAG,gBAAgB;AAAA,IACrB;AAEA,UAAM,IAAI,KAAK,4BAA4B;AAAA,MACzC,WAAW,MAAM;AAAA,MACjB,eAAe,YAAY;AAAA,MAC3B;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAgB;AACvB,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,QAAI,OAAO;AACT,YAAM,oBAAoB,IAAI,MAAM,gBAAgB,UAAU,KAAK;AACnE,YAAM,sBAAsB,MAAM;AAAA,QAChC,eAAe;AAAA,QACf,OAAO;AAAA,QACP,SAAS;AAAA,QACT,MAAM;AAAA,QACN,SAAS;AAAA,UACP,OAAO;AAAA,UACP,WAAW,MAAM;AAAA,UACjB,eAAe,IAAI,QAAQ,iBAAiB;AAAA,QAC9C;AAAA,MACF,GAAG,KAAK;AAAA,IACV,OAAO;AACL,aAAO,MAAM,oCAAoC;AAAA,QAC/C,WAAW,MAAM;AAAA,QACjB,eAAe,IAAI,QAAQ,iBAAiB;AAAA,QAC5C,KAAK;AAAA,MACP,CAAC;AAAA,IACH;AACA,UAAM;AAAA,EACR;AACF;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/gateway-stripe",
-  "version": "0.6.8-develop.7066.1.6bfa9ff69f",
+  "version": "0.6.8-develop.7067.1.82e9867ea1",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -62,21 +62,21 @@
     }
   },
   "dependencies": {
-    "@open-mercato/core": "0.6.8-develop.7066.1.6bfa9ff69f",
-    "@open-mercato/queue": "0.6.8-develop.7066.1.6bfa9ff69f",
-    "@open-mercato/ui": "0.6.8-develop.7066.1.6bfa9ff69f",
+    "@open-mercato/core": "0.6.8-develop.7067.1.82e9867ea1",
+    "@open-mercato/queue": "0.6.8-develop.7067.1.82e9867ea1",
+    "@open-mercato/ui": "0.6.8-develop.7067.1.82e9867ea1",
     "@stripe/react-stripe-js": "^6.7.0",
     "@stripe/stripe-js": "^9.12.1",
     "stripe": "^22.3.1"
   },
   "peerDependencies": {
     "@mikro-orm/postgresql": "^7.0.14",
-    "@open-mercato/shared": "0.6.8-develop.7066.1.6bfa9ff69f",
+    "@open-mercato/shared": "0.6.8-develop.7067.1.82e9867ea1",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.6.8-develop.7066.1.6bfa9ff69f",
+    "@open-mercato/shared": "0.6.8-develop.7067.1.82e9867ea1",
     "@types/jest": "^30.0.0",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",

package/src/modules/gateway_stripe/__tests__/webhook-processor-origin.test.ts

@@ -0,0 +1,57 @@
+import { describe, it, expect, jest, beforeEach } from '@jest/globals'
+import handler from '../workers/webhook-processor'
+
+const makeCtx = () => ({
+  resolve: jest.fn(),
+  jobId: 'job-1',
+  attemptNumber: 1,
+})
+
+const baseEvent = {
+  idempotencyKey: 'evt_1',
+  eventType: 'payment_intent.succeeded',
+  data: { id: 'cs_test_1' },
+}
+
+describe('gateway-stripe webhook processor dispatch-origin enforcement (#5213)', () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+  })
+
+  it('drops scheduler-originated jobs before touching any service', async () => {
+    const ctx = makeCtx()
+    const consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation()
+
+    await handler({
+      payload: {
+        providerKey: 'stripe',
+        event: baseEvent,
+        transactionId: 'tx-1',
+        scope: { organizationId: 'o-1', tenantId: 't-1' },
+        _jobOrigin: 'scheduler',
+      },
+    } as never, ctx as never)
+
+    expect(ctx.resolve).not.toHaveBeenCalled()
+
+    consoleErrorSpy.mockRestore()
+  })
+
+  it('drops unmarked jobs (fail closed)', async () => {
+    const ctx = makeCtx()
+    const consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation()
+
+    await handler({
+      payload: {
+        providerKey: 'stripe',
+        event: baseEvent,
+        transactionId: 'tx-1',
+        scope: { organizationId: 'o-1', tenantId: 't-1' },
+      },
+    } as never, ctx as never)
+
+    expect(ctx.resolve).not.toHaveBeenCalled()
+
+    consoleErrorSpy.mockRestore()
+  })
+})

package/src/modules/gateway_stripe/__tests__/webhook-processor.test.ts

@@ -57,7 +57,7 @@ function makeJob(payload: {
   return {
     id: 'job_1',
     createdAt: '2026-01-01T00:00:00.000Z',
-    payload: { providerKey: 'stripe', ...payload },
+    payload: { providerKey: 'stripe', _jobOrigin: 'inbound-webhook', ...payload },
   } as unknown as WorkerJob
 }
 

package/src/modules/gateway_stripe/workers/webhook-processor.ts

@@ -1,6 +1,7 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import type { JobContext, QueuedJob, WorkerMeta } from '@open-mercato/queue'
 import type { WebhookEvent } from '@open-mercato/shared/modules/payment_gateways/types'
+import { isTrustedWebhookDispatch } from '@open-mercato/shared/lib/queue/dispatchOrigin'
 import type { IntegrationLogService } from '@open-mercato/core/modules/integrations/lib/log-service'
 import type { PaymentGatewayService } from '@open-mercato/core/modules/payment_gateways/lib/gateway-service'
 import { claimWebhookProcessing, releaseWebhookClaim } from '@open-mercato/core/modules/payment_gateways/lib/webhook-utils'
@@ -38,6 +39,17 @@ function readSessionIdFromEvent(event: WebhookEvent): string | null {
 }
 
 export default async function handle(job: QueuedJob<WebhookJobPayload>, ctx: HandlerContext): Promise<void> {
+  // Fail closed on untrusted dispatch origins (#5213): only jobs enqueued by the
+  // inbound webhook route (signature verified against per-tenant credentials) may
+  // drive Stripe payment state. Scheduler-dispatched or unmarked jobs are dropped.
+  if (!isTrustedWebhookDispatch(job.payload)) {
+    logger.error('Dropping webhook job with missing or untrusted dispatch origin', {
+      eventType: job.payload?.event?.eventType,
+      transactionId: job.payload?.transactionId ?? null,
+    })
+    return
+  }
+
   const em = ctx.resolve<EntityManager>('em')
   const paymentGatewayService = ctx.resolve<PaymentGatewayService>('paymentGatewayService')
   const integrationLogService = ctx.resolve<IntegrationLogService>('integrationLogService')