pigui/task-stream
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(api): accept Pireon webhooks from the password client too

Browse Source 
Pireon signs each webhook with the secret of the client that registered
it, and the API has two clients (the web app's and the password
grant's). Only PIREON_WEBHOOK_SECRET was accepted, so a token revoked
for someone signed in with a password went unheard. A delivery now
verifies with PIREON_WEBHOOK_SECRET or PIREON_PASSWORD_WEBHOOK_SECRET;
the same event arriving from both clients changes nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Josep Piguillem
2026-10-09 13:29:27 +02:00
parent 66b09ecf4d
commit 5ae1d05d30
9 changed files with 94 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
apps/api/openapi.json
View File

@@ -344,7 +344,7 @@
},
"/api/webhooks/pireon": {
"post": {
"description": "`user.deactivated` closes the user's sessions; `token.revoked` forgets the token. Disabled unless PIREON_WEBHOOK_SECRET is set.",
"description": "`user.deactivated` closes the user's sessions; `token.revoked` forgets the token. Disabled unless PIREON_WEBHOOK_SECRET or PIREON_PASSWORD_WEBHOOK_SECRET is set.",
"operationId": "PireonWebhookController_receive",
"parameters": [
{
@@ -358,7 +358,7 @@
{
"name": "X-Webhook-Signature",
"in": "header",
"description": "HMAC-SHA256 of the raw body with PIREON_WEBHOOK_SECRET (hex)",
"description": "HMAC-SHA256 of the raw body with the secret of the Pireon client that registered the webhook (hex)",
"required": true,
"schema": {
"type": "string"

2
apps/api/src/app/config.schema.ts
View File

@@ -23,6 +23,8 @@ export const configSchema = Joi.object({
// Pireon identity server
PIREON_BASE_URL: Joi.string().uri().default('https://oauth.pireon.dev'),
PIREON_WEBHOOK_SECRET: Joi.string().allow('').optional(),
// The password client registers its own webhook, signed with its own secret.
PIREON_PASSWORD_WEBHOOK_SECRET: Joi.string().allow('').optional(),
// OAuth clients of task-stream in Pireon (each Pireon client allows one grant type):
// authorization_code for "Sign in with Pireon" / Swagger UI…
PIREON_CLIENT_ID: Joi.string().allow('').optional(),

4
apps/mcp/src/app/api/taskstream.schema.ts
View File

@@ -123,7 +123,7 @@ export interface paths {
put?: never;
/**
* Pireon events (called by Pireon, not by apps)
* @description `user.deactivated` closes the user's sessions; `token.revoked` forgets the token. Disabled unless PIREON_WEBHOOK_SECRET is set.
* @description `user.deactivated` closes the user's sessions; `token.revoked` forgets the token. Disabled unless PIREON_WEBHOOK_SECRET or PIREON_PASSWORD_WEBHOOK_SECRET is set.
*/
post: operations["PireonWebhookController_receive"];
delete?: never;
@@ -2825,7 +2825,7 @@ export interface operations {
query?: never;
header: {
"x-webhook-signature": string;
/** @description HMAC-SHA256 of the raw body with PIREON_WEBHOOK_SECRET (hex) */
/** @description HMAC-SHA256 of the raw body with the secret of the Pireon client that registered the webhook (hex) */
"X-Webhook-Signature": string;
};
path?: never;