fix: Load the svix library the webhook verifier depends on - #577
Open
razor-x wants to merge 1 commit into
Open
Conversation
Seam::Webhook required only svix/webhook and svix/errors, but Svix::Webhook#verify calls Svix.secure_compare, which lives in svix/util and is loaded by the svix entry point. Unless the application happened to require svix itself, every verification of a correctly signed payload raised NoMethodError instead of returning the event. Nothing caught it because the webhook verifier had no specs. Require svix and add the first webhook specs, signing payloads offline with the svix library so they cover a valid event, mixed-case headers, a tampered payload, a wrong secret, an expired timestamp, and each missing header. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SQW83gyXeUG61RDrHEky97
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Found while writing the webhook specs the audit asked for (M5, "zero tests").
lib/seam/webhook.rbrequired onlysvix/webhookandsvix/errors.Svix::Webhook#verifycallsSvix.secure_compare, which is defined insvix/utiland loaded by thesvixentry point, so unless the application happened torequire "svix"itself, verifying a correctly signed payload raised:Forged payloads still raised
Seam::WebhookVerificationError(that check runs before the comparison), so the documented rescue path looked fine while the success path was broken.Fix
require "svix".Tests
New
spec/webhook_spec.rb, signing payloads offline withSvix::Webhook#sign: a valid event parses to itsSeamEventsubclass, mixed-case header names are accepted, a tampered payload, a wrong secret, an expired timestamp, and each missing header raiseSeam::WebhookVerificationErrorwith the exact svix message, and the re-export is the svix class.Revert-check against
main: 5 failures, allNoMethodError: undefined method 'secure_compare' for module Svix.🤖 Generated with Claude Code
https://claude.ai/code/session_01SQW83gyXeUG61RDrHEky97
Generated by Claude Code