fix(webapp): reject webhook verification configs that can never verify

Two configs were accepted but would then fail-close every delivery.

The dashboard secret-generation action minted a shared secret for any endpoint,
including asymmetric (public-key) ones, overwriting the stored public key. It now
rejects generation for asymmetric endpoints, matching the public API route.

url-secret verification with path placement can never match on the hosted ingress
URL, whose last path segment is the fixed opaque endpoint id, so deploy-sync now
rejects it with a clear error instead of letting every inbound event 400.

Author: ericallam

apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.webhooks.endpoints.$endpointParam/route.tsx

@@ -176,6 +176,17 @@ export const action = async ({ request, params }: ActionFunctionArgs) => {
   // Generate (integrator-supplied secret): mint a strong secret, store it, and return it so the
   // UI can reveal it ONCE for the integrator to paste into their provider.
   if (intent === "generate-secret") {
+    const verifier = WebhookVerifierArtifact.safeParse(endpoint.verifierArtifact);
+    if (
+      verifier.success &&
+      "config" in verifier.data &&
+      verifier.data.config.scheme === "asymmetric"
+    ) {
+      return {
+        success: false as const,
+        error: "Cannot generate a secret for an asymmetric endpoint; set its public key instead.",
+      };
+    }
     const secret = `whsec_${randomBytes(32).toString("hex")}`;
     await secretStore.setSecret(secretKey, { secret });
     await webhookPrisma.webhookEndpoint.update({

apps/webapp/app/v3/services/createBackgroundWorker.server.ts

@@ -708,6 +708,16 @@ export async function syncDeclarativeWebhooks(
 
     missing.delete(wh.id);
 
+    if (
+      "config" in wh.verifierArtifact &&
+      wh.verifierArtifact.config.scheme === "url-secret" &&
+      wh.verifierArtifact.config.placement === "path"
+    ) {
+      throw new ServiceValidationError(
+        `Webhook "${wh.id}" uses url-secret verification with path placement, which cannot be verified on the hosted ingress URL. Use query placement or a header-based scheme.`
+      );
+    }
+
     // Compile `filter` into a FilterAst, once here at sync. A bad filter fails the deploy with a clear
     // message rather than surfacing at ingest. Re-deploying without a filter nulls the columns.
     let filterNode: FilterAst | undefined;