kjjfgdsf

sfdsfsdf

server/index.mjs

@@ -59,9 +59,9 @@ app.use('/api', limiters.api)
 // Static files
 app.use(express.static(join(__dirname, '..', 'public')))
 
-// Gitea webhook: raw body for X-Gitea-Signature verification (must be before JSON parser)
-// Limit 2mb so large Gitea payloads (full repo JSON) don't get rejected and cause 502
-app.use('/api/webhook', express.raw({ type: 'application/json', limit: '2mb' }))
+// Gitea webhook: raw body for X-Gitea-Signature (must match signed bytes exactly).
+// type: () => true — Gitea may send application/json; charset=utf-8 or similar; strict 'application/json' can skip parsing and leave body empty.
+app.use('/api/webhook', express.raw({ type: () => true, limit: '2mb' }))
 app.use('/api/webhook', webhookRoutes)
 
 // Body parsing (BEFORE routes, AFTER static)