webhooks: Clean up bot config and creation forms.

templates/zerver/development/integrations_dev_panel.html

@@ -69,6 +69,10 @@
             <label class="optional"><b>Topic</b></label>
             <input id="topic_name" type="text" />
         </div>
+        <div>
+            <label class="optional"><b>Webhook Secret</b></label>
+            <input id="webhook_secret" type="text" />
+        </div>
     </div>
 
     <br />

web/src/bot_type_values.ts

@@ -1,8 +1,9 @@
 // Bot type integer values from the API.
-export const GENERIC_BOT_TYPE = 1;
+export const GENERIC_BOT_TYPE_INT = 1;
 export const INCOMING_WEBHOOK_BOT_TYPE_INT = 2;
 export const OUTGOING_WEBHOOK_BOT_TYPE_INT = 3;
 
 // String forms used as HTML form values.
+export const GENERIC_BOT_TYPE = "1";
 export const OUTGOING_WEBHOOK_BOT_TYPE = "3";
 export const EMBEDDED_BOT_TYPE = "4";

web/src/portico/integrations_dev_panel.ts

@@ -25,6 +25,7 @@ type HTMLSelectOneElement = HTMLSelectElement & {type: "select-one"};
 type ClearHandlers = {
     stream_name: string;
     topic_name: string;
+    webhook_secret: string;
     URL: string;
     results_notice: string;
     bot_name: () => void;
@@ -47,6 +48,8 @@ const integrations_api_response_schema = z.object({
     result: z.string(),
 });
 
+let last_computed_header_key: string | null = null; // Tracks the current signature header for auto-clearing when switching integrations
+
 type ServerResponse = z.infer<typeof integrations_api_response_schema>;
 
 const loaded_fixtures = new Map<string, Fixtures>();
@@ -56,6 +59,7 @@ const url_base = "/api/v1/external/";
 const clear_handlers: ClearHandlers = {
     stream_name: "#stream_name",
     topic_name: "#topic_name",
+    webhook_secret: "#webhook_secret",
     URL: "#URL",
     results_notice: "#results_notice",
     bot_name() {
@@ -180,6 +184,8 @@ function load_fixture_body(fixture_name: string): void {
         null,
         4,
     );
+    const webhook_secret = $<HTMLInputElement>("input#webhook_secret").val()!;
+    sync_signature_headers(integration_name, webhook_secret);
 
     return;
 }
@@ -210,8 +216,8 @@ function load_fixture_options(integration_name: string): void {
 
 function update_url(): void {
     /* Construct the URL that the webhook should be targeting, using
-    the bot's API key and the integration name.  The stream and topic
-    are both optional, and for the sake of completeness, it should be
+    the bot's API key, the integration name, and webhook secret.  The stream, topic,
+    and webhook secret are all optional, and for the sake of completeness, it should be
     noted that the topic is irrelevant without specifying the
     stream. */
     const url_field = $<HTMLInputElement>("input#URL")[0];
@@ -231,11 +237,83 @@ function update_url(): void {
                 params.set("topic", topic_name);
             }
         }
+        const webhook_secret = $<HTMLInputElement>("input#webhook_secret").val()!;
         const url = `${url_base}${integration_name}?${params.toString()}`;
         url_field!.value = url;
+
+        sync_signature_headers(integration_name, webhook_secret);
     }
+}
 
-    return;
+function sync_signature_headers(integration_name: string, webhook_secret: string): void {
+    const $custom_headers_field = $<HTMLTextAreaElement>("textarea#custom_http_headers");
+    const current_headers_raw = $custom_headers_field.val()?.toString().trim() ?? "";
+
+    let headers_object: Record<string, string> = {};
+    if (current_headers_raw !== "") {
+        try {
+            headers_object = z
+                .record(z.string(), z.string())
+                .parse(JSON.parse(current_headers_raw));
+        } catch {
+            headers_object = {};
+        }
+    }
+
+    if (last_computed_header_key && last_computed_header_key in headers_object) {
+        Reflect.deleteProperty(headers_object, last_computed_header_key);
+    }
+
+    if (webhook_secret.trim() === "") {
+        last_computed_header_key = null;
+        if (Object.keys(headers_object).length === 0) {
+            $custom_headers_field.val("{}");
+        } else {
+            $custom_headers_field.val(JSON.stringify(headers_object, null, 4));
+        }
+        return;
+    }
+
+    const raw_payload = $<HTMLTextAreaElement>("textarea#fixture_body").val() ?? "";
+    let cleaned_payload = raw_payload;
+
+    try {
+        cleaned_payload = JSON.stringify(JSON.parse(raw_payload));
+    } catch {
+        cleaned_payload = raw_payload.trim();
+    }
+
+    channel.post({
+        url: "/devtools/integrations/recalculate_signature",
+        data: JSON.stringify({
+            secret: webhook_secret,
+            payload: cleaned_payload,
+            integration_name,
+        }),
+        success(raw_data: unknown) {
+            const data = z
+                .object({
+                    supported: z.optional(z.boolean()),
+                    clear_signature: z.optional(z.boolean()),
+                    header_key: z.string(),
+                    signature: z.string(),
+                })
+                .parse(raw_data);
+
+            if (!data.supported || data.clear_signature) {
+                last_computed_header_key = null;
+                if (Object.keys(headers_object).length === 0) {
+                    $custom_headers_field.val("{}");
+                } else {
+                    $custom_headers_field.val(JSON.stringify(headers_object, null, 4));
+                }
+            } else {
+                headers_object[data.header_key] = data.signature;
+                last_computed_header_key = data.header_key;
+                $custom_headers_field.val(JSON.stringify(headers_object, null, 4));
+            }
+        },
+    });
 }
 
 // API callers: These methods handle communicating with the Python backend API.
@@ -440,4 +518,6 @@ $(() => {
     $("#stream_name").on("change", update_url);
 
     $("#topic_name").on("change", update_url);
+
+    $("#webhook_secret").on("change", update_url);
 });

web/src/settings_bots.ts

@@ -1,4 +1,4 @@
-import $ from "jquery";
+import {$} from "jquery";
 import assert from "minimalistic-assert";
 import type * as tippy from "tippy.js";
 
@@ -12,7 +12,7 @@ import type {Bot} from "./bot_data.ts";
 import * as bot_helper from "./bot_helper.ts";
 import {
     EMBEDDED_BOT_TYPE,
-    GENERIC_BOT_TYPE,
+    GENERIC_BOT_TYPE_INT,
     INCOMING_WEBHOOK_BOT_TYPE_INT,
     OUTGOING_WEBHOOK_BOT_TYPE,
     OUTGOING_WEBHOOK_BOT_TYPE_INT,
@@ -455,7 +455,7 @@ function bot_info(bot_user_id: number): BotInfo {
             : {
                   bot_owner_id: null,
               }),
-        show_download_zuliprc_button: is_bot_owner && bot_user.bot_type === GENERIC_BOT_TYPE,
+        show_download_zuliprc_button: is_bot_owner && bot_user.bot_type === GENERIC_BOT_TYPE_INT,
         show_generate_integration_url_button:
             can_modify_bot && bot_user.bot_type === INCOMING_WEBHOOK_BOT_TYPE_INT,
     };
@@ -742,11 +742,11 @@ function set_up_bot_handlers($container: JQuery): void {
         add_a_new_bot();
     });
 
-    $container.find(".download-botserverrc-file").on("click", (e) => {
+    $container.find(".download-botserverrc-file").on("click", function () {
         void (async () => {
             let content = "";
-            buttons.show_button_loading_indicator($(e.currentTarget));
-            $(e.currentTarget).prop("disabled", true);
+            buttons.show_button_loading_indicator($(this));
+            $(this).prop("disabled", true);
             for (const bot of bot_data.get_all_bots_for_current_user()) {
                 if (bot.is_active && bot.bot_type === OUTGOING_WEBHOOK_BOT_TYPE_INT) {
                     const bot_token = bot_helper.get_outgoing_webhook_token(bot.user_id);
@@ -755,15 +755,15 @@ function set_up_bot_handlers($container: JQuery): void {
                         $("#admin-your-bots-list .bot-list-error"),
                     );
                     if (!api_key) {
-                        buttons.hide_button_loading_indicator($(e.currentTarget));
-                        $(e.currentTarget).prop("disabled", false);
+                        buttons.hide_button_loading_indicator($(this));
+                        $(this).prop("disabled", false);
                         return;
                     }
                     content += generate_botserverrc_content(bot.email, api_key, bot_token);
                 }
             }
-            buttons.hide_button_loading_indicator($(e.currentTarget));
-            $(e.currentTarget).prop("disabled", false);
+            buttons.hide_button_loading_indicator($(this));
+            $(this).prop("disabled", false);
 
             $container
                 .find(".hidden-botserverrc-download")

web/src/user_profile.ts

@@ -1,6 +1,7 @@
 import ClipboardJS from "clipboard";
 import {parseISO} from "date-fns";
-import $ from "jquery";
+import {parseOneAddress} from "email-addresses";
+import {$} from "jquery";
 import _ from "lodash";
 import assert from "minimalistic-assert";
 import type * as tippy from "tippy.js";
@@ -850,7 +851,11 @@ export function show_edit_bot_info_modal(user_id: number, $container: JQuery): v
 
     assert(bot.is_bot);
     // Extract short_name from email (format: {short_name}-bot@domain)
-    const short_name = bot.email.split("@")[0]!.slice(0, -4);
+    const parsed_address = parseOneAddress(bot.email);
+    assert(parsed_address?.type === "mailbox");
+    const short_name = parsed_address.local.endsWith("-bot")
+        ? parsed_address.local.slice(0, -"-bot".length)
+        : parsed_address.local;
     const modal_content_html = render_edit_bot_form({
         user_id,
         is_active,

web/styles/portico/integrations_dev_panel.css

@@ -105,7 +105,8 @@
 }
 
 #stream_name,
-#topic_name {
+#topic_name,
+#webhook_secret {
     width: 206px;
 }
 

zerver/actions/users.py

@@ -827,15 +827,15 @@ def do_update_outgoing_webhook_service(
 def do_update_bot_config_data(bot_profile: UserProfile, config_data: dict[str, str]) -> None:
     for key, value in config_data.items():
         set_bot_config(bot_profile, key, value)
-    updated_config_data = get_bot_config(bot_profile)
+    service_dicts = get_service_dicts_for_bot(bot_profile.id)
     send_event_on_commit(
         bot_profile.realm,
         dict(
             type="realm_bot",
             op="update",
             bot=dict(
                 user_id=bot_profile.id,
-                services=[dict(config_data=updated_config_data)],
+                services=service_dicts,
             ),
         ),
         bot_owner_user_ids(bot_profile),

zerver/decorator.py

@@ -54,7 +54,9 @@
 from zerver.lib.utils import has_api_key_format
 from zerver.lib.webhooks.common import (
     MissingHTTPEventHeaderError,
+    WebhookSignatureConfig,
     notify_bot_owner_about_invalid_json,
+    validate_webhook_signature,
 )
 from zerver.models import UserProfile
 from zerver.models.clients import get_client
@@ -372,6 +374,7 @@ def webhook_view(
     webhook_client_name: str,
     notify_bot_owner_on_invalid_json: bool = True,
     all_event_types: Sequence[str] | None = None,
+    signature_config: WebhookSignatureConfig | None = None,
 ) -> Callable[[Callable[..., HttpResponse]], Callable[..., HttpResponse]]:
     # Unfortunately, callback protocols are insufficient for this:
     # https://mypy.readthedocs.io/en/stable/protocols.html#callback-protocols
@@ -391,6 +394,13 @@ def _wrapped_func_arguments(
                 client_name=full_webhook_client_name(webhook_client_name),
             )
 
+            if signature_config and settings.VERIFY_WEBHOOK_SIGNATURES:
+                validate_webhook_signature(
+                    user_profile,
+                    request,
+                    signature_config,
+                )
+
             request_notes = RequestNotes.get_notes(request)
             request_notes.is_webhook_view = True
 

zerver/lib/integrations.py

@@ -14,7 +14,12 @@
 from typing_extensions import override
 
 from zerver.lib.storage import static_path
-from zerver.lib.webhooks.common import PresetUrlOption, WebhookConfigOption, WebhookUrlOption
+from zerver.lib.webhooks.common import (
+    PresetUrlOption,
+    WebhookConfigOption,
+    WebhookSignatureConfig,
+    WebhookUrlOption,
+)
 from zerver.webhooks import fixtureless_integrations
 
 """This module declares all of the (documented) integrations available
@@ -1187,6 +1192,15 @@ def is_enabled_in_catalog(self) -> bool:
     }
 )
 
+WEBHOOK_SIGNATURE_CONFIGS: dict[str, WebhookSignatureConfig] = {
+    "github": WebhookSignatureConfig(
+        integration_name="github",
+        header="X-Hub-Signature-256",
+        algorithm="sha256",
+        prefix="sha256=",
+    ),
+}
+
 NO_SCREENSHOT_CONFIG = INTEGRATIONS_MISSING_SCREENSHOT_CONFIG | INTEGRATIONS_WITHOUT_SCREENSHOTS