partage/ghl-nextcloud-integration
1
0
Fork 0
Code Issues 8 Pull requests Projects Releases Packages Wiki Activity

Webhook Improvements — idempotency + secret rotation #6

New issue
Open
opened 2026-07-13 04:28:52 +00:00 by francois · 0 comments
francois commented 2026-07-13 04:28:52 +00:00
Owner
Copy link

Problem

  • No idempotency: same webhook event received twice creates duplicate NC entities
  • No webhook secret rotation support

Requirements

  • Idempotency: store processed webhook IDs in a dedup table (TTL-based to avoid unlimited growth)
  • Secret rotation: support multiple active secrets so admins can rotate without downtime
  • X-Hub-Signature-256 fallback: also check X-GHL-Signature header
  • Logging: log webhook receipt with event type and timestamp

Files

lib/Controller/WebhookController.php

Acceptance

  • Same event received twice within TTL window is rejected
  • Admin can set a new secret while old one still works
  • All supported signature formats logged on failure
## Problem - No idempotency: same webhook event received twice creates duplicate NC entities - No webhook secret rotation support ## Requirements - Idempotency: store processed webhook IDs in a dedup table (TTL-based to avoid unlimited growth) - Secret rotation: support multiple active secrets so admins can rotate without downtime - X-Hub-Signature-256 fallback: also check X-GHL-Signature header - Logging: log webhook receipt with event type and timestamp ## Files lib/Controller/WebhookController.php ## Acceptance - [ ] Same event received twice within TTL window is rejected - [ ] Admin can set a new secret while old one still works - [ ] All supported signature formats logged on failure
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
partage/ghl-nextcloud-integration#6
No description provided.