From 51587566506906679e4ee645ac3534064a9a6608 Mon Sep 17 00:00:00 2001
From: Dries Augustyns <inbox@driaug.com>
Date: Mon, 1 Dec 2025 16:47:06 +0100
Subject: [PATCH] Automatic SNS verification

---
 apps/api/src/controllers/Webhooks.ts | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/apps/api/src/controllers/Webhooks.ts b/apps/api/src/controllers/Webhooks.ts
index f2ac0e0..87f61d4 100644
--- a/apps/api/src/controllers/Webhooks.ts
+++ b/apps/api/src/controllers/Webhooks.ts
@@ -25,12 +25,7 @@ export class Webhooks {
   @CatchAsync
   public async receiveSNSWebhook(req: Request, res: Response, next: NextFunction) {
     try {
-      // Parse the SNS message body
-      const body = JSON.parse(req.body.Message);
-      const eventType = body.eventType as 'Bounce' | 'Delivery' | 'Open' | 'Complaint' | 'Click';
-      const messageId = body.mail?.messageId;
-
-      // Handle SNS subscription confirmation
+      // Handle SNS subscription confirmation FIRST (before parsing Message field)
       if (req.body.Type === 'SubscriptionConfirmation') {
         signale.info('SNS Subscription Confirmation received');
         signale.info('Subscribe URL:', req.body.SubscribeURL);
@@ -62,6 +57,17 @@ export class Webhooks {
         }
       }
 
+      // Handle SNS notification messages - parse the Message field
+      if (req.body.Type !== 'Notification') {
+        signale.warn('[WEBHOOK] Unknown SNS message type:', req.body.Type);
+        return res.status(200).json({success: false, message: 'Unknown message type'});
+      }
+
+      // Parse the nested SES event from the Message field
+      const body = JSON.parse(req.body.Message);
+      const eventType = body.eventType as 'Bounce' | 'Delivery' | 'Open' | 'Complaint' | 'Click';
+      const messageId = body.mail?.messageId;
+
       if (!messageId) {
         signale.warn('[WEBHOOK] No messageId found in SNS notification');
         return res.status(400).json({success: false, error: 'No messageId found'});