mirror of
https://github.com/chatwoot/chatwoot.git
synced 2026-07-04 21:06:27 +08:00
95463230cb
Account webhooks sign outgoing payloads with HMAC-SHA256, but agent bot and API inbox webhooks were delivered unsigned. This PR adds the same signing to both. Each model gets a dedicated `secret` column rather than reusing the agent bot's `access_token` (for API auth back into Chatwoot) or the API inbox's `hmac_token` (for inbound contact identity verification). These serve different trust boundaries and shouldn't be coupled — rotating a signing secret shouldn't invalidate API access or contact verification. The existing `Webhooks::Trigger` already signs when a secret is present, so the backend change is just passing `secret:` through to the jobs. Shared token logic is extracted into a `WebhookSecretable` concern included by `Webhook`, `AgentBot`, and `Channel::Api`. The frontend reuses the existing `AccessToken` component for secret display. Secrets are admin-only and excluded from enterprise audit logs. ### How to test Point an agent bot or API inbox webhook URL at a request inspector. Send a message and verify `X-Chatwoot-Signature` and `X-Chatwoot-Timestamp` headers are present. Reset the secret from settings and confirm subsequent deliveries use the new value. --------- Co-authored-by: Sojan Jose <sojan@pepalo.com> |
||
|---|---|---|
| .. | ||
| captain | ||
| channel | ||
| enterprise | ||
| helpCenter | ||
| inbox | ||
| integrations | ||
| specs | ||
| account.js | ||
| accountActions.js | ||
| agentBots.js | ||
| agentCapacityPolicies.js | ||
| agents.js | ||
| ApiClient.js | ||
| assignableAgents.js | ||
| assignmentPolicies.js | ||
| attributes.js | ||
| auditLogs.js | ||
| auth.js | ||
| automation.js | ||
| bulkActions.js | ||
| CacheEnabledApiClient.js | ||
| campaigns.js | ||
| cannedResponse.js | ||
| changelog.js | ||
| channels.js | ||
| companies.js | ||
| contactNotes.js | ||
| contacts.js | ||
| conversations.js | ||
| csatReports.js | ||
| customRole.js | ||
| customViews.js | ||
| dashboardApps.js | ||
| endPoints.js | ||
| inboxes.js | ||
| inboxHealth.js | ||
| inboxMembers.js | ||
| integrations.js | ||
| labels.js | ||
| liveReports.js | ||
| macros.js | ||
| mfa.js | ||
| notifications.js | ||
| notificationSubscription.js | ||
| notion_auth.js | ||
| reports.js | ||
| samlSettings.js | ||
| search.js | ||
| sla.js | ||
| slaReports.js | ||
| summaryReports.js | ||
| teams.js | ||
| userNotificationSettings.js | ||
| webhooks.js | ||
| yearInReview.js | ||