ReCloudStudio/WebHooker
1
0
Fork 0
mirror of https://github.com/ReCloudStudio/WebHooker.git synced 2026-09-23 00:21:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: prevent race conditions with KV locks in dispatch and group provisioning

Browse source
This commit is contained in:
RhenCloud 2026-08-15 12:04:37 +08:00
parent 17eefd3c8e
commit 7ebd9aa63f
No known key found for this signature in database
GPG key ID: A574A617378C4E0B
4 changed files with 194 additions and 79 deletions
Download patch file Download diff file Expand all files Collapse all files

11
server/lib/webhook.ts
View file

@ -50,7 +50,16 @@ export async function processWebhook(
return { status: 400, body: { error: "Unknown webhook provider" } };
}
if (!(await provider.verify(body, headers, effectiveEnv))) {
let verified = false;
try {
verified = await provider.verify(body, headers, effectiveEnv);
} catch (err) {
// A malformed secret or an unavailable crypto implementation must fail as
// a clean 401, never an uncaught 500.
log.warn({ provider: provider.id, err: String(err) }, "Webhook signature verification failed");
return { status: 401, body: { error: "Invalid signature" } };
}
if (!verified) {
// Log the actual cause: a missing provider secret is a deployment problem,
// while a mismatched signature usually means the sender used the wrong secret.
const secret =