graham/towerops
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Remove Gaiia webhook secret verification entirely — Gaiia has no signing mechanism

Browse source
This commit is contained in:
Graham McIntire 2026-02-14 16:25:55 -06:00
parent 646a8accf3
commit ba895b0ca2
1 changed files with 2 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
lib/towerops_web/controllers/api/v1/gaiia_webhook_controller.ex
View file

@ -19,9 +19,8 @@ defmodule ToweropsWeb.Api.V1.GaiiaWebhookController do
require Logger
def create(conn, %{"organization_id" => organization_id} = params) do
with {:ok, integration} <- get_gaiia_integration(organization_id),
:ok <- verify_secret(integration, params),
def create(conn, %{"organization_id" => organization_id}) do
with {:ok, _integration} <- get_gaiia_integration(organization_id),
{:ok, event} <- get_event(conn.body_params) do
# Gaiia sends object data in "payload" field
data = Map.get(conn.body_params, "payload", Map.get(conn.body_params, "data", %{}))
@ -41,24 +40,6 @@ defmodule ToweropsWeb.Api.V1.GaiiaWebhookController do
end
end
defp verify_secret(integration, params) do
case get_in(integration.credentials, ["webhook_secret"]) do
nil ->
# No secret configured — accept all requests
:ok
"" ->
:ok
expected_secret ->
if Plug.Crypto.secure_compare(params["secret"] || "", expected_secret) do
:ok
else
{:error, :invalid_secret}
end
end
end
defp get_event(%{"eventName" => event}) when is_binary(event), do: {:ok, event}
defp get_event(%{"event" => event}) when is_binary(event), do: {:ok, event}
defp get_event(_), do: {:error, :missing_event}
@ -69,9 +50,6 @@ defmodule ToweropsWeb.Api.V1.GaiiaWebhookController do
{:error, :not_found} ->
conn |> put_status(:not_found) |> json(%{error: "Gaiia integration not found"})
{:error, :invalid_secret} ->
conn |> put_status(:unauthorized) |> json(%{error: "Invalid webhook secret"})
{:error, :missing_event} ->
conn |> put_status(:bad_request) |> json(%{error: "Missing event field"})