apply security fix

apps/api/src/services/amanpayService.ts

@@ -85,11 +85,15 @@ export async function refundTransaction(transactionId: string, amount: number, r
 
 export function verifyWebhookSignature(rawBody: string, signature: string): boolean {
   if (!WEBHOOK_SECRET) return false
+  if (!/^[a-f0-9]{64}$/i.test(signature)) return false
   const expected = crypto
     .createHmac('sha256', WEBHOOK_SECRET)
     .update(rawBody)
     .digest('hex')
-  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))
+  const received = Buffer.from(signature, 'hex')
+  const expectedBuffer = Buffer.from(expected, 'hex')
+  if (received.length !== expectedBuffer.length) return false
+  return crypto.timingSafeEqual(received, expectedBuffer)
 }
 
 export function isConfigured(): boolean {