@open-mercato/gateway-stripe 0.9.1-develop.7519.1.38f51f8dbb → 0.9.1-develop.7532.1.8eac7e198f

package/dist/modules/gateway_stripe/di.js

@@ -1,4 +1,5 @@
 import { asValue } from "awilix";
+import { DEFAULT_WEBHOOK_BODY_LIMIT_BYTES, resolveWebhookBodyLimitBytes } from "@open-mercato/shared/lib/webhooks";
 import {
   registerGatewayAdapter,
   registerPaymentGatewayDescriptor,
@@ -15,7 +16,8 @@ function register(container) {
   registerGatewayAdapter(stripeAdapterV20231016, { version: "2023-10-16" });
   registerWebhookHandler("stripe", verifyStripeWebhook, {
     queue: "stripe-webhook",
-    readSessionIdHint: readStripeSessionIdHint
+    readSessionIdHint: readStripeSessionIdHint,
+    maxBodyBytes: Math.min(resolveWebhookBodyLimitBytes(), DEFAULT_WEBHOOK_BODY_LIMIT_BYTES)
   });
   registerPaymentGatewayDescriptor({
     providerKey: "stripe",

package/dist/modules/gateway_stripe/di.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/gateway_stripe/di.ts"],
-  "sourcesContent": ["import { asValue } from 'awilix'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport {\n  registerGatewayAdapter,\n  registerPaymentGatewayDescriptor,\n  registerWebhookHandler,\n} from '@open-mercato/shared/modules/payment_gateways/types'\nimport { stripeHealthCheck } from './lib/health'\nimport { stripeAdapterV20250224Acacia } from './lib/adapters/v2025-02-24.acacia'\nimport { stripeAdapterV20241218 } from './lib/adapters/v2024-12-18'\nimport { stripeAdapterV20231016 } from './lib/adapters/v2023-10-16'\nimport { readStripeSessionIdHint, verifyStripeWebhook } from './lib/webhook-handler'\n\nexport function register(container: AppContainer) {\n  registerGatewayAdapter(stripeAdapterV20250224Acacia, { version: '2025-02-24.acacia' })\n  registerGatewayAdapter(stripeAdapterV20241218, { version: '2024-12-18' })\n  registerGatewayAdapter(stripeAdapterV20231016, { version: '2023-10-16' })\n  registerWebhookHandler('stripe', verifyStripeWebhook, {\n    queue: 'stripe-webhook',\n    readSessionIdHint: readStripeSessionIdHint,\n  })\n  registerPaymentGatewayDescriptor({\n    providerKey: 'stripe',\n    label: 'Stripe',\n    sessionConfig: {\n      fields: [\n        {\n          key: 'captureMethod',\n          label: 'Capture method',\n          type: 'select',\n          required: false,\n          options: [\n            { value: 'automatic', label: 'Automatic capture' },\n            { value: 'manual', label: 'Manual capture' },\n          ],\n        },\n        {\n          key: 'paymentTypes',\n          label: 'Payment methods',\n          type: 'multiselect',\n          required: false,\n          options: [\n            { value: 'card', label: 'Credit card' },\n            { value: 'apple_pay', label: 'Apple Pay' },\n            { value: 'google_pay', label: 'Google Pay' },\n            { value: 'link', label: 'Link' },\n          ],\n        },\n      ],\n      supportedCurrencies: '*',\n      supportedPaymentTypes: [\n        { value: 'card', label: 'Card' },\n        { value: 'apple_pay', label: 'Apple Pay' },\n        { value: 'google_pay', label: 'Google Pay' },\n        { value: 'link', label: 'Link' },\n      ],\n      defaultRendererKey: 'stripe.payment_element',\n      renderers: [\n        {\n          key: 'stripe.payment_element',\n          label: 'Stripe Payment Element',\n          type: 'embedded',\n          description: 'Embeds Stripe Elements on the merchant page while Stripe handles payment method UX and required redirects.',\n          supportedPaymentTypes: ['card', 'apple_pay', 'google_pay', 'link'],\n          settingsFields: [\n            {\n              key: 'layout',\n              label: 'Layout',\n              type: 'select',\n              required: false,\n              options: [\n                { value: 'tabs', label: 'Tabs' },\n                { value: 'accordion', label: 'Accordion' },\n              ],\n            },\n            {\n              key: 'paymentMethodOrder',\n              label: 'Payment method order',\n              type: 'multiselect',\n              required: false,\n              options: [\n                { value: 'card', label: 'Card' },\n                { value: 'apple_pay', label: 'Apple Pay' },\n                { value: 'google_pay', label: 'Google Pay' },\n                { value: 'link', label: 'Link' },\n              ],\n            },\n            {\n              key: 'billingDetails',\n              label: 'Billing details collection',\n              type: 'select',\n              required: false,\n              options: [\n                { value: 'auto', label: 'Auto' },\n                { value: 'if_required', label: 'If required' },\n                { value: 'never', label: 'Never' },\n              ],\n            },\n          ],\n        },\n      ],\n      presentation: 'either',\n      embeddedRenderers: ['stripe.payment_element'],\n    },\n  })\n\n  container.register({\n    stripeHealthCheck: asValue(stripeHealthCheck),\n  })\n}\n"],
-  "mappings": "AAAA,SAAS,eAAe;AAExB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,yBAAyB;AAClC,SAAS,oCAAoC;AAC7C,SAAS,8BAA8B;AACvC,SAAS,8BAA8B;AACvC,SAAS,yBAAyB,2BAA2B;AAEtD,SAAS,SAAS,WAAyB;AAChD,yBAAuB,8BAA8B,EAAE,SAAS,oBAAoB,CAAC;AACrF,yBAAuB,wBAAwB,EAAE,SAAS,aAAa,CAAC;AACxE,yBAAuB,wBAAwB,EAAE,SAAS,aAAa,CAAC;AACxE,yBAAuB,UAAU,qBAAqB;AAAA,IACpD,OAAO;AAAA,IACP,mBAAmB;AAAA,EACrB,CAAC;AACD,mCAAiC;AAAA,IAC/B,aAAa;AAAA,IACb,OAAO;AAAA,IACP,eAAe;AAAA,MACb,QAAQ;AAAA,QACN;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,UACP,MAAM;AAAA,UACN,UAAU;AAAA,UACV,SAAS;AAAA,YACP,EAAE,OAAO,aAAa,OAAO,oBAAoB;AAAA,YACjD,EAAE,OAAO,UAAU,OAAO,iBAAiB;AAAA,UAC7C;AAAA,QACF;AAAA,QACA;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,UACP,MAAM;AAAA,UACN,UAAU;AAAA,UACV,SAAS;AAAA,YACP,EAAE,OAAO,QAAQ,OAAO,cAAc;AAAA,YACtC,EAAE,OAAO,aAAa,OAAO,YAAY;AAAA,YACzC,EAAE,OAAO,cAAc,OAAO,aAAa;AAAA,YAC3C,EAAE,OAAO,QAAQ,OAAO,OAAO;AAAA,UACjC;AAAA,QACF;AAAA,MACF;AAAA,MACA,qBAAqB;AAAA,MACrB,uBAAuB;AAAA,QACrB,EAAE,OAAO,QAAQ,OAAO,OAAO;AAAA,QAC/B,EAAE,OAAO,aAAa,OAAO,YAAY;AAAA,QACzC,EAAE,OAAO,cAAc,OAAO,aAAa;AAAA,QAC3C,EAAE,OAAO,QAAQ,OAAO,OAAO;AAAA,MACjC;AAAA,MACA,oBAAoB;AAAA,MACpB,WAAW;AAAA,QACT;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,UACP,MAAM;AAAA,UACN,aAAa;AAAA,UACb,uBAAuB,CAAC,QAAQ,aAAa,cAAc,MAAM;AAAA,UACjE,gBAAgB;AAAA,YACd;AAAA,cACE,KAAK;AAAA,cACL,OAAO;AAAA,cACP,MAAM;AAAA,cACN,UAAU;AAAA,cACV,SAAS;AAAA,gBACP,EAAE,OAAO,QAAQ,OAAO,OAAO;AAAA,gBAC/B,EAAE,OAAO,aAAa,OAAO,YAAY;AAAA,cAC3C;AAAA,YACF;AAAA,YACA;AAAA,cACE,KAAK;AAAA,cACL,OAAO;AAAA,cACP,MAAM;AAAA,cACN,UAAU;AAAA,cACV,SAAS;AAAA,gBACP,EAAE,OAAO,QAAQ,OAAO,OAAO;AAAA,gBAC/B,EAAE,OAAO,aAAa,OAAO,YAAY;AAAA,gBACzC,EAAE,OAAO,cAAc,OAAO,aAAa;AAAA,gBAC3C,EAAE,OAAO,QAAQ,OAAO,OAAO;AAAA,cACjC;AAAA,YACF;AAAA,YACA;AAAA,cACE,KAAK;AAAA,cACL,OAAO;AAAA,cACP,MAAM;AAAA,cACN,UAAU;AAAA,cACV,SAAS;AAAA,gBACP,EAAE,OAAO,QAAQ,OAAO,OAAO;AAAA,gBAC/B,EAAE,OAAO,eAAe,OAAO,cAAc;AAAA,gBAC7C,EAAE,OAAO,SAAS,OAAO,QAAQ;AAAA,cACnC;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MACA,cAAc;AAAA,MACd,mBAAmB,CAAC,wBAAwB;AAAA,IAC9C;AAAA,EACF,CAAC;AAED,YAAU,SAAS;AAAA,IACjB,mBAAmB,QAAQ,iBAAiB;AAAA,EAC9C,CAAC;AACH;",
+  "sourcesContent": ["import { asValue } from 'awilix'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport { DEFAULT_WEBHOOK_BODY_LIMIT_BYTES, resolveWebhookBodyLimitBytes } from '@open-mercato/shared/lib/webhooks'\nimport {\n  registerGatewayAdapter,\n  registerPaymentGatewayDescriptor,\n  registerWebhookHandler,\n} from '@open-mercato/shared/modules/payment_gateways/types'\nimport { stripeHealthCheck } from './lib/health'\nimport { stripeAdapterV20250224Acacia } from './lib/adapters/v2025-02-24.acacia'\nimport { stripeAdapterV20241218 } from './lib/adapters/v2024-12-18'\nimport { stripeAdapterV20231016 } from './lib/adapters/v2023-10-16'\nimport { readStripeSessionIdHint, verifyStripeWebhook } from './lib/webhook-handler'\n\nexport function register(container: AppContainer) {\n  registerGatewayAdapter(stripeAdapterV20250224Acacia, { version: '2025-02-24.acacia' })\n  registerGatewayAdapter(stripeAdapterV20241218, { version: '2024-12-18' })\n  registerGatewayAdapter(stripeAdapterV20231016, { version: '2023-10-16' })\n  registerWebhookHandler('stripe', verifyStripeWebhook, {\n    queue: 'stripe-webhook',\n    readSessionIdHint: readStripeSessionIdHint,\n    maxBodyBytes: Math.min(resolveWebhookBodyLimitBytes(), DEFAULT_WEBHOOK_BODY_LIMIT_BYTES),\n  })\n  registerPaymentGatewayDescriptor({\n    providerKey: 'stripe',\n    label: 'Stripe',\n    sessionConfig: {\n      fields: [\n        {\n          key: 'captureMethod',\n          label: 'Capture method',\n          type: 'select',\n          required: false,\n          options: [\n            { value: 'automatic', label: 'Automatic capture' },\n            { value: 'manual', label: 'Manual capture' },\n          ],\n        },\n        {\n          key: 'paymentTypes',\n          label: 'Payment methods',\n          type: 'multiselect',\n          required: false,\n          options: [\n            { value: 'card', label: 'Credit card' },\n            { value: 'apple_pay', label: 'Apple Pay' },\n            { value: 'google_pay', label: 'Google Pay' },\n            { value: 'link', label: 'Link' },\n          ],\n        },\n      ],\n      supportedCurrencies: '*',\n      supportedPaymentTypes: [\n        { value: 'card', label: 'Card' },\n        { value: 'apple_pay', label: 'Apple Pay' },\n        { value: 'google_pay', label: 'Google Pay' },\n        { value: 'link', label: 'Link' },\n      ],\n      defaultRendererKey: 'stripe.payment_element',\n      renderers: [\n        {\n          key: 'stripe.payment_element',\n          label: 'Stripe Payment Element',\n          type: 'embedded',\n          description: 'Embeds Stripe Elements on the merchant page while Stripe handles payment method UX and required redirects.',\n          supportedPaymentTypes: ['card', 'apple_pay', 'google_pay', 'link'],\n          settingsFields: [\n            {\n              key: 'layout',\n              label: 'Layout',\n              type: 'select',\n              required: false,\n              options: [\n                { value: 'tabs', label: 'Tabs' },\n                { value: 'accordion', label: 'Accordion' },\n              ],\n            },\n            {\n              key: 'paymentMethodOrder',\n              label: 'Payment method order',\n              type: 'multiselect',\n              required: false,\n              options: [\n                { value: 'card', label: 'Card' },\n                { value: 'apple_pay', label: 'Apple Pay' },\n                { value: 'google_pay', label: 'Google Pay' },\n                { value: 'link', label: 'Link' },\n              ],\n            },\n            {\n              key: 'billingDetails',\n              label: 'Billing details collection',\n              type: 'select',\n              required: false,\n              options: [\n                { value: 'auto', label: 'Auto' },\n                { value: 'if_required', label: 'If required' },\n                { value: 'never', label: 'Never' },\n              ],\n            },\n          ],\n        },\n      ],\n      presentation: 'either',\n      embeddedRenderers: ['stripe.payment_element'],\n    },\n  })\n\n  container.register({\n    stripeHealthCheck: asValue(stripeHealthCheck),\n  })\n}\n"],
+  "mappings": "AAAA,SAAS,eAAe;AAExB,SAAS,kCAAkC,oCAAoC;AAC/E;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,yBAAyB;AAClC,SAAS,oCAAoC;AAC7C,SAAS,8BAA8B;AACvC,SAAS,8BAA8B;AACvC,SAAS,yBAAyB,2BAA2B;AAEtD,SAAS,SAAS,WAAyB;AAChD,yBAAuB,8BAA8B,EAAE,SAAS,oBAAoB,CAAC;AACrF,yBAAuB,wBAAwB,EAAE,SAAS,aAAa,CAAC;AACxE,yBAAuB,wBAAwB,EAAE,SAAS,aAAa,CAAC;AACxE,yBAAuB,UAAU,qBAAqB;AAAA,IACpD,OAAO;AAAA,IACP,mBAAmB;AAAA,IACnB,cAAc,KAAK,IAAI,6BAA6B,GAAG,gCAAgC;AAAA,EACzF,CAAC;AACD,mCAAiC;AAAA,IAC/B,aAAa;AAAA,IACb,OAAO;AAAA,IACP,eAAe;AAAA,MACb,QAAQ;AAAA,QACN;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,UACP,MAAM;AAAA,UACN,UAAU;AAAA,UACV,SAAS;AAAA,YACP,EAAE,OAAO,aAAa,OAAO,oBAAoB;AAAA,YACjD,EAAE,OAAO,UAAU,OAAO,iBAAiB;AAAA,UAC7C;AAAA,QACF;AAAA,QACA;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,UACP,MAAM;AAAA,UACN,UAAU;AAAA,UACV,SAAS;AAAA,YACP,EAAE,OAAO,QAAQ,OAAO,cAAc;AAAA,YACtC,EAAE,OAAO,aAAa,OAAO,YAAY;AAAA,YACzC,EAAE,OAAO,cAAc,OAAO,aAAa;AAAA,YAC3C,EAAE,OAAO,QAAQ,OAAO,OAAO;AAAA,UACjC;AAAA,QACF;AAAA,MACF;AAAA,MACA,qBAAqB;AAAA,MACrB,uBAAuB;AAAA,QACrB,EAAE,OAAO,QAAQ,OAAO,OAAO;AAAA,QAC/B,EAAE,OAAO,aAAa,OAAO,YAAY;AAAA,QACzC,EAAE,OAAO,cAAc,OAAO,aAAa;AAAA,QAC3C,EAAE,OAAO,QAAQ,OAAO,OAAO;AAAA,MACjC;AAAA,MACA,oBAAoB;AAAA,MACpB,WAAW;AAAA,QACT;AAAA,UACE,KAAK;AAAA,UACL,OAAO;AAAA,UACP,MAAM;AAAA,UACN,aAAa;AAAA,UACb,uBAAuB,CAAC,QAAQ,aAAa,cAAc,MAAM;AAAA,UACjE,gBAAgB;AAAA,YACd;AAAA,cACE,KAAK;AAAA,cACL,OAAO;AAAA,cACP,MAAM;AAAA,cACN,UAAU;AAAA,cACV,SAAS;AAAA,gBACP,EAAE,OAAO,QAAQ,OAAO,OAAO;AAAA,gBAC/B,EAAE,OAAO,aAAa,OAAO,YAAY;AAAA,cAC3C;AAAA,YACF;AAAA,YACA;AAAA,cACE,KAAK;AAAA,cACL,OAAO;AAAA,cACP,MAAM;AAAA,cACN,UAAU;AAAA,cACV,SAAS;AAAA,gBACP,EAAE,OAAO,QAAQ,OAAO,OAAO;AAAA,gBAC/B,EAAE,OAAO,aAAa,OAAO,YAAY;AAAA,gBACzC,EAAE,OAAO,cAAc,OAAO,aAAa;AAAA,gBAC3C,EAAE,OAAO,QAAQ,OAAO,OAAO;AAAA,cACjC;AAAA,YACF;AAAA,YACA;AAAA,cACE,KAAK;AAAA,cACL,OAAO;AAAA,cACP,MAAM;AAAA,cACN,UAAU;AAAA,cACV,SAAS;AAAA,gBACP,EAAE,OAAO,QAAQ,OAAO,OAAO;AAAA,gBAC/B,EAAE,OAAO,eAAe,OAAO,cAAc;AAAA,gBAC7C,EAAE,OAAO,SAAS,OAAO,QAAQ;AAAA,cACnC;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MACA,cAAc;AAAA,MACd,mBAAmB,CAAC,wBAAwB;AAAA,IAC9C;AAAA,EACF,CAAC;AAED,YAAU,SAAS;AAAA,IACjB,mBAAmB,QAAQ,iBAAiB;AAAA,EAC9C,CAAC;AACH;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/gateway-stripe",
-  "version": "0.9.1-develop.7519.1.38f51f8dbb",
+  "version": "0.9.1-develop.7532.1.8eac7e198f",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -62,21 +62,21 @@
     }
   },
   "dependencies": {
-    "@open-mercato/core": "0.9.1-develop.7519.1.38f51f8dbb",
-    "@open-mercato/queue": "0.9.1-develop.7519.1.38f51f8dbb",
-    "@open-mercato/ui": "0.9.1-develop.7519.1.38f51f8dbb",
+    "@open-mercato/core": "0.9.1-develop.7532.1.8eac7e198f",
+    "@open-mercato/queue": "0.9.1-develop.7532.1.8eac7e198f",
+    "@open-mercato/ui": "0.9.1-develop.7532.1.8eac7e198f",
     "@stripe/react-stripe-js": "^6.8.2",
     "@stripe/stripe-js": "^9.14.0",
     "stripe": "^22.3.1"
   },
   "peerDependencies": {
     "@mikro-orm/postgresql": "^7.0.14",
-    "@open-mercato/shared": "0.9.1-develop.7519.1.38f51f8dbb",
+    "@open-mercato/shared": "0.9.1-develop.7532.1.8eac7e198f",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.9.1-develop.7519.1.38f51f8dbb",
+    "@open-mercato/shared": "0.9.1-develop.7532.1.8eac7e198f",
     "@types/jest": "^30.0.0",
     "@types/react": "^19.2.18",
     "@types/react-dom": "^19.2.5",

package/src/modules/gateway_stripe/__tests__/webhook-route.body-limit.test.ts

@@ -0,0 +1,224 @@
+/** @jest-environment node */
+import Stripe from 'stripe'
+import { POST } from '@open-mercato/core/modules/payment_gateways/api/webhook/[provider]/route'
+import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { getWebhookHandler } from '@open-mercato/shared/modules/payment_gateways/types'
+import { DEFAULT_WEBHOOK_BODY_LIMIT_BYTES } from '@open-mercato/shared/lib/webhooks'
+import { register } from '../di'
+import { readStripeSessionIdHint, verifyStripeWebhook } from '../lib/webhook-handler'
+
+const mockResolve = jest.fn()
+const mockRateLimiterService = { trustProxyDepth: 1, consume: jest.fn() }
+const mockEnqueue = jest.fn(async () => undefined)
+const mockCredentialsResolve = jest.fn(async () => ({}))
+
+jest.mock('@open-mercato/shared/lib/di/container', () => ({
+  createRequestContainer: jest.fn(async () => ({ resolve: mockResolve })),
+}))
+
+jest.mock('@open-mercato/shared/lib/encryption/find', () => ({
+  findWithDecryption: jest.fn(async () => []),
+}))
+
+jest.mock('@open-mercato/core/modules/payment_gateways/lib/queue', () => ({
+  getPaymentGatewayQueue: jest.fn(() => ({ enqueue: mockEnqueue })),
+}))
+
+jest.mock('../lib/webhook-handler', () => {
+  const actual = jest.requireActual('../lib/webhook-handler')
+  return {
+    ...actual,
+    verifyStripeWebhook: jest.fn(actual.verifyStripeWebhook),
+    readStripeSessionIdHint: jest.fn(actual.readStripeSessionIdHint),
+  }
+})
+
+const WEBHOOK_URL = 'http://localhost/api/payment_gateways/webhook/stripe'
+
+function chunkedBody(totalBytes: number, chunkBytes = 64 * 1024): ReadableStream<Uint8Array> {
+  let sent = 0
+  return new ReadableStream<Uint8Array>({
+    pull(controller) {
+      if (sent >= totalBytes) {
+        controller.close()
+        return
+      }
+      const size = Math.min(chunkBytes, totalBytes - sent)
+      controller.enqueue(new Uint8Array(size).fill(0x20))
+      sent += size
+    },
+  })
+}
+
+function streamedRequest(totalBytes: number, headers: Record<string, string> = {}): Request {
+  return new Request(WEBHOOK_URL, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', 'stripe-signature': 't=1,v1=00', ...headers },
+    body: chunkedBody(totalBytes),
+    duplex: 'half',
+  } as RequestInit & { duplex: 'half' })
+}
+
+function paddedEventJson(totalBytes: number): string {
+  const prefix = '{"id":"evt_test","type":"payment_intent.succeeded","data":{"object":{"id":"pi_test"}},"pad":"'
+  const suffix = '"}'
+  return prefix + 'x'.repeat(totalBytes - prefix.length - suffix.length) + suffix
+}
+
+describe('Stripe webhook body limit', () => {
+  const originalLimitEnv = process.env.OM_WEBHOOK_MAX_BODY_BYTES
+
+  beforeAll(() => {
+    delete process.env.OM_WEBHOOK_MAX_BODY_BYTES
+  })
+
+  afterAll(() => {
+    if (originalLimitEnv === undefined) delete process.env.OM_WEBHOOK_MAX_BODY_BYTES
+    else process.env.OM_WEBHOOK_MAX_BODY_BYTES = originalLimitEnv
+  })
+
+  beforeEach(() => {
+    register({ register: jest.fn() } as never)
+    jest.clearAllMocks()
+    mockRateLimiterService.consume.mockResolvedValue({
+      allowed: true,
+      remainingPoints: 59,
+      msBeforeNext: 0,
+      consumedPoints: 1,
+    })
+    mockResolve.mockImplementation((token: string) => {
+      if (token === 'rateLimiterService') return mockRateLimiterService
+      if (token === 'em') return {}
+      if (token === 'paymentGatewayService') return {}
+      if (token === 'integrationCredentialsService') return { resolve: mockCredentialsResolve }
+      if (token === 'integrationLogService') return {}
+      throw new Error(`[internal] Unexpected token: ${token}`)
+    })
+  })
+
+  test('the Stripe registration caps bodies at the shared webhook limit', () => {
+    expect(getWebhookHandler('stripe')?.maxBodyBytes).toBe(DEFAULT_WEBHOOK_BODY_LIMIT_BYTES)
+  })
+
+  test.each([
+    ['4096', 4096],
+    [String(10 * 1024 * 1024), DEFAULT_WEBHOOK_BODY_LIMIT_BYTES],
+  ])('honours OM_WEBHOOK_MAX_BODY_BYTES=%s only when it is lower than 1 MiB', (envValue, expected) => {
+    const previous = process.env.OM_WEBHOOK_MAX_BODY_BYTES
+    process.env.OM_WEBHOOK_MAX_BODY_BYTES = envValue
+    try {
+      jest.isolateModules(() => {
+        const isolatedTypes = require('@open-mercato/shared/modules/payment_gateways/types') as typeof import('@open-mercato/shared/modules/payment_gateways/types')
+        const isolatedDi = require('../di') as typeof import('../di')
+        isolatedDi.register({ register: jest.fn() } as never)
+        expect(isolatedTypes.getWebhookHandler('stripe')?.maxBodyBytes).toBe(expected)
+      })
+    } finally {
+      if (previous === undefined) delete process.env.OM_WEBHOOK_MAX_BODY_BYTES
+      else process.env.OM_WEBHOOK_MAX_BODY_BYTES = previous
+      register({ register: jest.fn() } as never)
+    }
+  })
+
+  test('rejects a body whose Content-Length exceeds the limit without verifying or locating', async () => {
+    const response = await POST(
+      new Request(WEBHOOK_URL, {
+        method: 'POST',
+        headers: {
+          'content-type': 'application/json',
+          'content-length': String(DEFAULT_WEBHOOK_BODY_LIMIT_BYTES + 1),
+        },
+        body: '{}',
+      }),
+      { params: { provider: 'stripe' } },
+    )
+
+    expect(response.status).toBe(413)
+    await expect(response.json()).resolves.toEqual({ error: 'Webhook payload too large' })
+    expect(readStripeSessionIdHint).not.toHaveBeenCalled()
+    expect(verifyStripeWebhook).not.toHaveBeenCalled()
+    expect(findWithDecryption).not.toHaveBeenCalled()
+  })
+
+  test('rejects an oversized chunked body without a Content-Length', async () => {
+    const response = await POST(streamedRequest(DEFAULT_WEBHOOK_BODY_LIMIT_BYTES * 4), { params: { provider: 'stripe' } })
+
+    expect(response.status).toBe(413)
+    expect(readStripeSessionIdHint).not.toHaveBeenCalled()
+    expect(verifyStripeWebhook).not.toHaveBeenCalled()
+    expect(findWithDecryption).not.toHaveBeenCalled()
+  })
+
+  test('rejects an oversized body that declares a small Content-Length', async () => {
+    const response = await POST(
+      streamedRequest(DEFAULT_WEBHOOK_BODY_LIMIT_BYTES + 1, { 'content-length': '2' }),
+      { params: { provider: 'stripe' } },
+    )
+
+    expect(response.status).toBe(413)
+    expect(readStripeSessionIdHint).not.toHaveBeenCalled()
+    expect(verifyStripeWebhook).not.toHaveBeenCalled()
+    expect(findWithDecryption).not.toHaveBeenCalled()
+  })
+
+  test('still reads an event of exactly the limit and looks up its transaction', async () => {
+    const response = await POST(
+      new Request(WEBHOOK_URL, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', 'stripe-signature': 't=1,v1=00' },
+        body: paddedEventJson(DEFAULT_WEBHOOK_BODY_LIMIT_BYTES),
+      }),
+      { params: { provider: 'stripe' } },
+    )
+
+    expect(response.status).toBe(401)
+    expect(readStripeSessionIdHint).toHaveBeenCalledTimes(1)
+    expect(findWithDecryption).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.anything(),
+      expect.objectContaining({ providerKey: 'stripe', providerSessionId: 'pi_test' }),
+      expect.anything(),
+    )
+  })
+
+  test('accepts a correctly signed event just under the limit and queues it', async () => {
+    const previousStrategy = process.env.QUEUE_STRATEGY
+    process.env.QUEUE_STRATEGY = 'async'
+    const webhookSecret = 'whsec_body_limit_test'
+    const payload = paddedEventJson(DEFAULT_WEBHOOK_BODY_LIMIT_BYTES - 4096)
+    const signature = new Stripe('sk_test_body_limit').webhooks.generateTestHeaderString({ payload, secret: webhookSecret })
+    ;(findWithDecryption as jest.Mock).mockResolvedValueOnce([
+      {
+        id: 'transaction-1',
+        paymentId: 'payment-1',
+        providerSessionId: 'pi_test',
+        amount: '10.00',
+        currencyCode: 'USD',
+        organizationId: 'org-1',
+        tenantId: 'tenant-1',
+      },
+    ])
+    mockCredentialsResolve.mockResolvedValueOnce({ secretKey: 'sk_test_body_limit', webhookSecret })
+    try {
+      const response = await POST(
+        new Request(WEBHOOK_URL, {
+          method: 'POST',
+          headers: { 'content-type': 'application/json', 'stripe-signature': signature },
+          body: payload,
+        }),
+        { params: { provider: 'stripe' } },
+      )
+
+      expect(response.status).toBe(202)
+      expect(verifyStripeWebhook).toHaveBeenCalledTimes(1)
+      expect(mockEnqueue).toHaveBeenCalledWith(expect.objectContaining({
+        providerKey: 'stripe',
+        transactionId: 'transaction-1',
+        event: expect.objectContaining({ eventId: 'evt_test', eventType: 'payment_intent.succeeded' }),
+      }))
+    } finally {
+      if (previousStrategy === undefined) delete process.env.QUEUE_STRATEGY
+      else process.env.QUEUE_STRATEGY = previousStrategy
+    }
+  })
+})

package/src/modules/gateway_stripe/di.ts

@@ -1,5 +1,6 @@
 import { asValue } from 'awilix'
 import type { AppContainer } from '@open-mercato/shared/lib/di/container'
+import { DEFAULT_WEBHOOK_BODY_LIMIT_BYTES, resolveWebhookBodyLimitBytes } from '@open-mercato/shared/lib/webhooks'
 import {
   registerGatewayAdapter,
   registerPaymentGatewayDescriptor,
@@ -18,6 +19,7 @@ export function register(container: AppContainer) {
   registerWebhookHandler('stripe', verifyStripeWebhook, {
     queue: 'stripe-webhook',
     readSessionIdHint: readStripeSessionIdHint,
+    maxBodyBytes: Math.min(resolveWebhookBodyLimitBytes(), DEFAULT_WEBHOOK_BODY_LIMIT_BYTES),
   })
   registerPaymentGatewayDescriptor({
     providerKey: 'stripe',