From 9b5647a0557ed27600c3e9897c9eac4c0863b707 Mon Sep 17 00:00:00 2001
From: Graham McIntie <graham@mcintire.me>
Date: Sat, 14 Feb 2026 13:34:32 -0600
Subject: [PATCH] fix: Gaiia webhook secret is user-pasted from Gaiia, not
 auto-generated; update setup instructions

---
 lib/towerops_web/live/org/settings_live.ex    | 18 +++++----------
 .../live/org/settings_live.html.heex          | 22 +++++++++++++++++++
 2 files changed, 28 insertions(+), 12 deletions(-)

diff --git a/lib/towerops_web/live/org/settings_live.ex b/lib/towerops_web/live/org/settings_live.ex
index d32028aa..f23b4625 100644
--- a/lib/towerops_web/live/org/settings_live.ex
+++ b/lib/towerops_web/live/org/settings_live.ex
@@ -348,16 +348,14 @@ defmodule ToweropsWeb.Org.SettingsLive do
   end
 
   @impl true
-  def handle_event("regenerate_webhook_secret", _params, socket) do
+  def handle_event("save_webhook_secret", %{"value" => secret}, socket) do
     case Map.get(socket.assigns.integrations, "gaiia") do
       nil ->
         {:noreply, socket}
 
       integration ->
-        new_secret = generate_webhook_secret()
-
         updated_credentials =
-          Map.put(integration.credentials, "webhook_secret", new_secret)
+          Map.put(integration.credentials, "webhook_secret", String.trim(secret))
 
         case Integrations.update_integration(integration, %{credentials: updated_credentials}) do
           {:ok, _updated} ->
@@ -366,10 +364,10 @@ defmodule ToweropsWeb.Org.SettingsLive do
             {:noreply,
              socket
              |> assign(:integrations, integrations)
-             |> put_flash(:info, "Webhook secret regenerated")}
+             |> put_flash(:info, "Webhook secret saved")}
 
           {:error, _changeset} ->
-            {:noreply, put_flash(socket, :error, "Failed to regenerate webhook secret")}
+            {:noreply, put_flash(socket, :error, "Failed to save webhook secret")}
         end
     end
   end
@@ -434,11 +432,11 @@ defmodule ToweropsWeb.Org.SettingsLive do
 
     webhook_secret =
       case existing_integration do
-        %Integration{credentials: %{"webhook_secret" => secret}} when secret != "" ->
+        %Integration{credentials: %{"webhook_secret" => secret}} when is_binary(secret) ->
           secret
 
         _ ->
-          generate_webhook_secret()
+          ""
       end
 
     attrs = %{credentials: %{"api_key" => api_key, "webhook_secret" => webhook_secret}}
@@ -450,10 +448,6 @@ defmodule ToweropsWeb.Org.SettingsLive do
     end
   end
 
-  defp generate_webhook_secret do
-    32 |> :crypto.strong_rand_bytes() |> Base.encode16(case: :lower)
-  end
-
   defp webhook_url(organization_id) do
     ToweropsWeb.Endpoint.url() <> "/api/v1/webhooks/gaiia/#{organization_id}"
   end
diff --git a/lib/towerops_web/live/org/settings_live.html.heex b/lib/towerops_web/live/org/settings_live.html.heex
index 7287540f..e9fc7db6 100644
--- a/lib/towerops_web/live/org/settings_live.html.heex
+++ b/lib/towerops_web/live/org/settings_live.html.heex
@@ -1139,6 +1139,26 @@
                 </div>
               </div>
 
+              <div>
+                <label class="block text-xs font-medium text-gray-700 dark:text-gray-300">
+                  Webhook Secret
+                </label>
+                <p class="mt-0.5 text-xs text-gray-500 dark:text-gray-400">
+                  Paste the secret key generated by Gaiia when you create the webhook.
+                </p>
+                <div class="mt-1 flex items-center gap-2">
+                  <input
+                    id="gaiia-webhook-secret"
+                    type="password"
+                    name="webhook_secret"
+                    value={get_credential(@integrations["gaiia"], "webhook_secret")}
+                    placeholder="Paste the secret from Gaiia"
+                    phx-blur="save_webhook_secret"
+                    class="block w-full rounded-md border-gray-300 py-1.5 font-mono text-sm text-gray-900 shadow-xs sm:leading-6 dark:border-white/10 dark:bg-white/5 dark:text-white"
+                  />
+                </div>
+              </div>
+
               <div class="rounded-md bg-blue-50 p-3 dark:bg-blue-900/20">
                 <h5 class="text-xs font-medium text-blue-800 dark:text-blue-300">
                   Setup Instructions
@@ -1148,6 +1168,8 @@
                   <li>Click &quot;Add Webhook&quot;</li>
                   <li>Paste the Webhook URL above</li>
                   <li>Under Events, select &quot;All Events&quot;</li>
+                  <li>Gaiia will generate a secret key — copy it</li>
+                  <li>Paste the secret key into the Webhook Secret field above</li>
                   <li>Save the webhook</li>
                 </ol>
                 <p class="mt-2 text-xs text-blue-600 dark:text-blue-400">