From ba895b0ca22846aba19a43a5795c2e5a994eebd2 Mon Sep 17 00:00:00 2001 From: Graham McIntie Date: Sat, 14 Feb 2026 16:25:55 -0600 Subject: [PATCH] =?UTF-8?q?Remove=20Gaiia=20webhook=20secret=20verificatio?= =?UTF-8?q?n=20entirely=20=E2=80=94=20Gaiia=20has=20no=20signing=20mechani?= =?UTF-8?q?sm?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../api/v1/gaiia_webhook_controller.ex | 26 ++----------------- 1 file changed, 2 insertions(+), 24 deletions(-) diff --git a/lib/towerops_web/controllers/api/v1/gaiia_webhook_controller.ex b/lib/towerops_web/controllers/api/v1/gaiia_webhook_controller.ex index 545e203e..8241a5e7 100644 --- a/lib/towerops_web/controllers/api/v1/gaiia_webhook_controller.ex +++ b/lib/towerops_web/controllers/api/v1/gaiia_webhook_controller.ex @@ -19,9 +19,8 @@ defmodule ToweropsWeb.Api.V1.GaiiaWebhookController do require Logger - def create(conn, %{"organization_id" => organization_id} = params) do - with {:ok, integration} <- get_gaiia_integration(organization_id), - :ok <- verify_secret(integration, params), + def create(conn, %{"organization_id" => organization_id}) do + with {:ok, _integration} <- get_gaiia_integration(organization_id), {:ok, event} <- get_event(conn.body_params) do # Gaiia sends object data in "payload" field data = Map.get(conn.body_params, "payload", Map.get(conn.body_params, "data", %{})) @@ -41,24 +40,6 @@ defmodule ToweropsWeb.Api.V1.GaiiaWebhookController do end end - defp verify_secret(integration, params) do - case get_in(integration.credentials, ["webhook_secret"]) do - nil -> - # No secret configured — accept all requests - :ok - - "" -> - :ok - - expected_secret -> - if Plug.Crypto.secure_compare(params["secret"] || "", expected_secret) do - :ok - else - {:error, :invalid_secret} - end - end - end - defp get_event(%{"eventName" => event}) when is_binary(event), do: {:ok, event} defp get_event(%{"event" => event}) when is_binary(event), do: {:ok, event} defp get_event(_), do: {:error, :missing_event} @@ -69,9 +50,6 @@ defmodule ToweropsWeb.Api.V1.GaiiaWebhookController do {:error, :not_found} -> conn |> put_status(:not_found) |> json(%{error: "Gaiia integration not found"}) - {:error, :invalid_secret} -> - conn |> put_status(:unauthorized) |> json(%{error: "Invalid webhook secret"}) - {:error, :missing_event} -> conn |> put_status(:bad_request) |> json(%{error: "Missing event field"})