From c001d132671e17778b73c85ecdfa77e79e4ff19b Mon Sep 17 00:00:00 2001
From: Postil Maintainer <morgaesis+git@morgaes.is>
Date: Sun, 18 Oct 2026 18:05:07 +0000
Subject: [PATCH] Preserve webhook size rejection during stream cancellation

Return 413 after detecting excess bytes without waiting for cancellation
cleanup. Consume cancellation rejections and release the reader lock.

Cover pending cleanup and immediate or delayed cancellation rejection.
---
 src/lib/crypto/webhook.ts  |  2 +-
 tests/webhook-hmac.test.ts | 64 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 65 insertions(+), 1 deletion(-)

diff --git a/src/lib/crypto/webhook.ts b/src/lib/crypto/webhook.ts
index cf1b4d02..c1142650 100644
--- a/src/lib/crypto/webhook.ts
+++ b/src/lib/crypto/webhook.ts
@@ -37,7 +37,7 @@ export async function readBoundedWebhookBody(
       if (chunk.done) break;
       bytesRead += chunk.value.byteLength;
       if (bytesRead > maxBytes) {
-        await reader.cancel();
+        void reader.cancel().catch(() => undefined);
         return { ok: false, status: 413 };
       }
       chunks.push(chunk.value);
diff --git a/tests/webhook-hmac.test.ts b/tests/webhook-hmac.test.ts
index a2ade683..ec9eee3f 100644
--- a/tests/webhook-hmac.test.ts
+++ b/tests/webhook-hmac.test.ts
@@ -85,4 +85,68 @@ describe("webhook signature verification", () => {
     expect(result.body.equals(body)).toBe(true);
     expect(verifyWebhookSignature(result.body, signWebhookBody(body, SECRET), SECRET)).toBe(true);
   });
+
+  test("rejects excess bytes before pending cancellation completes", async () => {
+    const cleanup = Promise.withResolvers<void>();
+    const entered = Promise.withResolvers<void>();
+    const deadline = Promise.withResolvers<null>();
+    let cancels = 0;
+    const request = new Request("https://example.test/webhook", {
+      method: "POST",
+      body: new ReadableStream<Uint8Array>({
+        start(controller) { controller.enqueue(crypto.getRandomValues(new Uint8Array(9))); },
+        cancel() { cancels++; entered.resolve(); return cleanup.promise; },
+      }),
+    });
+    const result = readBoundedWebhookBody(request, 8);
+    const timer = setTimeout(() => deadline.resolve(null), 250);
+    try {
+      await Promise.race([entered.promise, deadline.promise]);
+      expect(cancels).toBe(1);
+      expect(await Promise.race([result, deadline.promise])).toEqual({ ok: false, status: 413 });
+      expect(request.body!.locked).toBe(false);
+    } finally {
+      clearTimeout(timer);
+      cleanup.resolve();
+      await result;
+    }
+  });
+
+  test("preserves excess-byte rejection when cancellation rejects immediately or later", async () => {
+    const unhandled: unknown[] = [];
+    const onUnhandled = (reason: unknown) => { unhandled.push(reason); };
+    process.on("unhandledRejection", onUnhandled);
+    try {
+      for (const late of [false, true]) {
+        const cleanup = Promise.withResolvers<void>();
+        const deadline = Promise.withResolvers<null>();
+        const failure = new Error(crypto.randomUUID());
+        let cancels = 0;
+        const request = new Request("https://example.test/webhook", {
+          method: "POST",
+          body: new ReadableStream<Uint8Array>({
+            start(controller) { controller.enqueue(crypto.getRandomValues(new Uint8Array(9))); },
+            cancel() { cancels++; return late ? cleanup.promise : Promise.reject(failure); },
+          }),
+        });
+        const result = readBoundedWebhookBody(request, 8);
+        const timer = setTimeout(() => deadline.resolve(null), 250);
+        try {
+          expect(await Promise.race([result, deadline.promise])).toEqual({ ok: false, status: 413 });
+          expect(cancels).toBe(1);
+          expect(request.body!.locked).toBe(false);
+          if (late) cleanup.reject(failure);
+        } finally {
+          clearTimeout(timer);
+          cleanup.resolve();
+          await result;
+          await new Promise<void>((resolve) => setImmediate(resolve));
+          await new Promise<void>((resolve) => setImmediate(resolve));
+        }
+        expect(unhandled).toEqual([]);
+      }
+    } finally {
+      process.off("unhandledRejection", onUnhandled);
+    }
+  });
 });