4d1dbb4098
Webhook ingest endpoint was completely unauthenticated. Add an optional `secret` field to BoardWebhook. When configured, inbound requests must include a valid HMAC-SHA256 signature in X-Hub-Signature-256 or X-Webhook-Signature headers. Uses hmac.compare_digest for timing safety. Includes migration to add the secret column. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
29 lines
909 B
Python
29 lines
909 B
Python
"""Board webhook configuration model."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from datetime import datetime
|
|
from uuid import UUID, uuid4
|
|
|
|
from sqlmodel import Field
|
|
|
|
from app.core.time import utcnow
|
|
from app.models.base import QueryModel
|
|
|
|
RUNTIME_ANNOTATION_TYPES = (datetime,)
|
|
|
|
|
|
class BoardWebhook(QueryModel, table=True):
|
|
"""Inbound webhook endpoint configuration for a board."""
|
|
|
|
__tablename__ = "board_webhooks" # pyright: ignore[reportAssignmentType]
|
|
|
|
id: UUID = Field(default_factory=uuid4, primary_key=True)
|
|
board_id: UUID = Field(foreign_key="boards.id", index=True)
|
|
agent_id: UUID | None = Field(default=None, foreign_key="agents.id", index=True)
|
|
description: str
|
|
enabled: bool = Field(default=True, index=True)
|
|
secret: str | None = Field(default=None)
|
|
created_at: datetime = Field(default_factory=utcnow)
|
|
updated_at: datetime = Field(default_factory=utcnow)
|