fix(webhooks): harden audited provider triggers by waleedlatif1 · Pull Request #3997 · simstudioai/sim

waleedlatif1 · 2026-04-06T20:51:35Z

Summary

harden audited webhook providers across Salesforce, Zoom, Resend, Linear, Vercel, Greenhouse, Gong, and Notion
add missing provider lifecycle behavior such as server-side event matching, secure verification, retry/idempotency handling, trigger wiring, and runtime/output alignment
improve provider setup guidance and add targeted tests plus a reusable trigger-alignment script for ongoing audits

Test plan

Ran targeted webhook/provider tests
Verified integrated suite passes: 56 tests across provider, processor, route, and idempotency coverage
Checked lints for touched provider and trigger files
Reviewed implementation against provider docs during the audit/fix pass
Full repository test suite not run
Full repository type-check still has unrelated pre-existing failures outside this scope

vercel · 2026-04-06T20:51:41Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Apr 7, 2026 3:30am

cursor · 2026-04-06T20:51:41Z

PR Summary

Medium Risk
Touches webhook authentication/challenge handling and provider-specific event matching across multiple integrations, so mistakes could drop or incorrectly accept deliveries. Changes are contained to webhook ingestion/providers with added tests to reduce regression risk.

Overview
Hardens webhook ingestion and provider handlers by passing rawBody into provider challenge handlers (notably Zoom) and tightening provider-level verifyAuth logic (e.g., JWT auth for Gong, timestamp-bound signature checks for Linear, explicit secrets for Resend/Vercel/Salesforce).

Improves correctness and deduplication by adding/standardizing matchEvent behavior (fail-closed on unknown trigger IDs for Linear/Greenhouse, new matchers for Vercel/Notion/Salesforce, Zoom rejects validation payload execution) and expanding idempotency key sources (Svix/Resend, Linear, Greenhouse, plus new per-provider extractIdempotencyId implementations).

Adds Salesforce webhook support and trigger wiring via a new salesforce provider handler, pending-verification support, and trigger config updates (required secrets + optional object filtering). Zoom block is wired to expose available triggers.

Developer tooling/docs: introduces apps/sim/scripts/check-trigger-alignment.ts for provider-specific output vs formatInput alignment checks, updates trigger authoring docs accordingly, and adds targeted provider/unit tests (Gong/Linear/Notion/Vercel/Salesforce/Zoom/Greenhouse/idempotency).

^{Reviewed by Cursor Bugbot for commit 41b0348. Configure here.}

greptile-apps · 2026-04-06T20:56:54Z

Greptile Summary

This PR hardens webhook provider integrations for Salesforce, Zoom, Resend, Linear, Vercel, Greenhouse, Gong, and Notion. It adds missing lifecycle behaviour — server-side event matching, HMAC/JWT signature verification, retry-safe idempotency, subscription create/delete flows, and standardised output schemas — along with targeted tests and a trigger-alignment audit script.

Key improvements:

Linear: replay window raised to 5 min (prior review finding resolved), HMAC secret generated on subscription creation, matchEvent filters by resource type/action for v1 triggers
Vercel: full subscription lifecycle (create + delete), SHA-1 HMAC verification, per-trigger event filtering
Zoom: CRC challenge handler DB-resolves env-backed secrets; block trigger wiring corrected
Resend: Svix signing scheme correctly implemented (5-min replay window, base64 secret decode, multi-signature loop)
Gong: optional RS256 JWT verification with body_sha256 body-integrity and webhook_url URL-binding claims
Salesforce: shared-secret auth (Bearer + custom header), broad eventType normalisation, stable SHA-256 fallback idempotency fingerprint
Greenhouse / Notion: HMAC verifiers via createHmacVerifier, event matching, idempotency extraction
Idempotency service: atomic Redis SET NX and PostgreSQL ON CONFLICT DO NOTHING claims; in-progress polling; 7-day TTL

Findings:

P1 (utils.ts): createHmacVerifier returns null (grants access) when no secret is configured, causing Greenhouse and Notion webhooks to silently accept any request. Salesforce and Vercel fail closed with 401 — the factory should be consistent.
P2 (service.ts): IdempotencyResult.previousResult, ProcessingResult.result, and all additionalContext parameters use any instead of unknown, violating the project's TypeScript rules.
P2 (vercel.test.ts): Re-mocks @sim/logger which is globally provided by vitest.setup.ts and must not be re-mocked per testing guidelines.
P2 (salesforce.test.ts): Missing @vitest-environment node annotation that vercel.test.ts (same PR) correctly includes.

Confidence Score: 4/5

PR is safe to merge after addressing the fail-open security inconsistency in createHmacVerifier for Greenhouse and Notion webhooks.

Score is 4 because the P1 finding (createHmacVerifier silently allowing all requests when no secret is configured) is a real security inconsistency that should be resolved before merging. The existing URL unguessability provides some defence-in-depth, but it is not a substitute for authentication. All other findings are non-blocking P2 style issues. The core webhook hardening logic is well-implemented: timing-safe HMAC comparisons, atomic idempotency claims, correct event filtering, and full subscription lifecycles.

apps/sim/lib/webhooks/providers/utils.ts (createHmacVerifier fail-open for Greenhouse and Notion), apps/sim/lib/core/idempotency/service.ts (any types), apps/sim/lib/webhooks/providers/vercel.test.ts (re-mocks global logger), apps/sim/lib/webhooks/providers/salesforce.test.ts (missing @vitest-environment node)

Important Files Changed

Filename	Overview
apps/sim/lib/webhooks/providers/utils.ts	createHmacVerifier factory passes (returns null) when secret is unconfigured — inconsistent with salesforce/vercel handlers that fail closed with 401.
apps/sim/lib/core/idempotency/service.ts	Atomic Redis SET NX and PG ON CONFLICT claims; 7-day TTL; in-progress polling. Uses `any` on previousResult, result, and additionalContext parameters.
apps/sim/lib/webhooks/providers/linear.ts	Replay window raised to 5 min; HMAC secret generated on subscription create; matchEvent filters resource type and action for v1 triggers.
apps/sim/lib/webhooks/providers/vercel.ts	Full subscription lifecycle (create/delete); SHA-1 HMAC verification; per-trigger event filtering; idempotency via top-level delivery id.
apps/sim/lib/webhooks/providers/gong.ts	Optional RS256 JWT verification with body_sha256 body-integrity and webhook_url URL-binding claim validation.
apps/sim/lib/webhooks/providers/zoom.ts	CRC challenge DB-resolves env-backed secrets; HMAC-SHA256 with 5-min timestamp window; matchEvent blocks url_validation delivery events.
apps/sim/lib/webhooks/providers/salesforce.ts	Shared-secret auth (Bearer + X-Sim-Webhook-Secret); broad eventType normalisation; stable SHA-256 fallback idempotency fingerprint.
apps/sim/lib/webhooks/providers/greenhouse.ts	HMAC-SHA256 via createHmacVerifier (fails open when unconfigured); event matching via trigger util; idempotency via application/offer/job ID.
apps/sim/lib/webhooks/providers/notion.ts	HMAC-SHA256 via createHmacVerifier (fails open when unconfigured); reachability test via verification_token; matchEvent delegates to trigger util.
apps/sim/lib/webhooks/providers/vercel.test.ts	Good verifyAuth and idempotency coverage; re-mocks @sim/logger which is globally provided by vitest.setup.ts.
apps/sim/lib/webhooks/providers/salesforce.test.ts	Good auth, event-matching, formatInput, and idempotency coverage; missing @vitest-environment node annotation.
apps/sim/app/api/webhooks/trigger/[path]/route.ts	Fan-out processing for credential sets; auth verified per webhook before reachability test; challenge handling runs both before and after body parsing.
apps/sim/lib/webhooks/providers/resend.ts	Svix signing scheme correctly implemented; full subscription lifecycle; per-trigger event filtering via RESEND_TRIGGER_TO_EVENT_TYPE.
apps/sim/triggers/salesforce/utils.ts	Broad event type normalisation via normalised-token Sets; objectType enforcement; output builders for all five trigger variants.
apps/sim/triggers/zoom/utils.ts	ZOOM_TRIGGER_EVENT_MAP maps trigger IDs to Zoom event names; isZoomEventMatch correctly passes zoom_webhook; complete output builders.

Sequence Diagram

sequenceDiagram
    participant Client
    participant Route as /api/webhooks/trigger/[path]
    participant Processor
    participant Provider as Provider Handler
    participant Idempotency
    participant Queue

    Client->>Route: POST body
    Route->>Processor: handleProviderChallenges({})
    Note over Processor: Early CRC/challenge (Zoom etc.)
    Route->>Processor: parseWebhookBody()
    Route->>Processor: handleProviderChallenges(body)
    Note over Processor: Challenge with parsed body
    Route->>Processor: findAllWebhooksForPath()
    loop each webhook (credential fan-out)
        Route->>Provider: verifyAuth()
        Note over Provider: HMAC / RS256 JWT / Bearer check
        Provider-->>Route: null (pass) or 401
        Route->>Provider: handleReachabilityTest()
        Note over Provider: Notion verification_token etc.
        Route->>Processor: checkWebhookPreprocessing()
        Route->>Provider: matchEvent()
        Note over Provider: Event type / resource filter
        Route->>Idempotency: extractIdempotencyId(body)
        Idempotency->>Idempotency: atomicallyClaim(Redis NX / PG conflict)
        Idempotency-->>Route: claimed or duplicate
        Route->>Queue: queueWebhookExecution()
    end
    Route-->>Client: 200 Webhook processed

Comments Outside Diff (1)

apps/sim/lib/webhooks/providers/utils.ts, line 32-36 (link)

createHmacVerifier fails open when secret is unconfigured

createHmacVerifier returns null (grants access) when providerConfig[configKey] is absent. Both greenhouseHandler and notionHandler use this factory, meaning a webhook deployed without a configured secret accepts all inbound requests with no authentication.

This is inconsistent with salesforceHandler.verifyAuth and vercelHandler.verifyAuth, which both reject with HTTP 401 when their secrets are missing. If Greenhouse and Notion signatures should be required, change the factory to fail closed:
```
const secret = providerConfig[configKey] as string | undefined
if (!secret) {
  logger.warn(`[${requestId}] ${providerLabel} webhook missing ${configKey} — rejecting`)
  return new NextResponse(`Unauthorized - ${providerLabel} secret not configured`, { status: 401 })
}
```
If signature verification is intentionally opt-in for these providers (e.g. because the URL itself is unguessable), a TSDoc comment explaining this design decision would prevent future confusion and drift.

_{Reviews (4): Last reviewed commit: "fix(webhooks): address remaining review ..." | Re-trigger Greptile}

Align the Greenhouse webhook matcher with provider conventions and clarify the Notion webhook secret setup text after the audit review. Made-with: Cursor

Add salesforce WebhookProviderHandler with required shared secret auth, matchEvent filtering, formatInput aligned to trigger outputs, and idempotency keys. Require webhook secret and document JSON-only Flow setup; enforce objectType when configured. Zoom: pass raw body into URL validation signature check, try all active webhooks on a path for secret match, add extractIdempotencyId, tighten event matching for specialized triggers. Wire Zoom triggers into the Zoom block. Extend handleChallenge with optional rawBody. Register Salesforce pending verification probes for pre-save URL checks.

…outputs) - Dedupe Resend deliveries via svix-id and Linear via Linear-Delivery in idempotency keys - Require Resend signing secret; validate createSubscription id and signing_secret - Single source for Resend event maps in triggers/utils; fail closed on unknown trigger IDs - Add raw event data to Resend trigger outputs and formatInput - Linear: remove body-based idempotency key; timestamp skew after HMAC verify; format url and actorType - Tighten isLinearEventMatch for unknown triggers; clarify generic webhook copy; fix header examples - Add focused tests for idempotency headers and Linear matchEvent

Require Vercel signing secret and validate x-vercel-signature; add matchEvent with dynamic import, delivery idempotency, strict createSubscription trigger IDs, and formatInput aligned to string IDs. Greenhouse: dynamic import in matchEvent, strict unknown trigger IDs, Greenhouse-Event-ID idempotency header, body fallback keys, clearer optional secret copy. Update generic trigger wording and add tests.

- Optional RS256 verification when Gong JWT public key is configured (webhook_url + body_sha256 per Gong docs); URL secrecy when unset. - Document that Gong rules filter calls; payload has no event type; add eventType + callId outputs for discoverability. - Refactor Gong triggers to buildTriggerSubBlocks + shared JWT field; setup copy matches security model. - Add check-trigger-alignment.ts (Gong bundled; extend PROVIDER_CHECKS for others) and update add-trigger guidance paths. Made-with: Cursor

Handle Notion verification requests safely, expose the documented webhook fields in the trigger contract, and update setup guidance so runtime data and user-facing configuration stay aligned. Made-with: Cursor

Close the remaining pre-merge caveats by tightening Salesforce, Zoom, and Linear behavior, and follow through on the deferred provider and tooling cleanup for Vercel, Greenhouse, Gong, and Notion. Made-with: Cursor

Move provider subscription helpers alongside the subscription lifecycle module and add targeted TSDoc so the file placement matches the responsibility boundaries in the webhook architecture. Made-with: Cursor

Use the same env-aware secret resolution path for Zoom endpoint validation as regular delivery verification so URL validation works correctly when the secret token is stored via env references. Made-with: Cursor

waleedlatif1 · 2026-04-07T01:20:51Z

Follow-up Hardening Checklist

This PR looks reasonable to merge. The items below are follow-up hardening/cleanup work, not current blockers.

Salesforce: consolidate duplicated object-type parsing and improve fallback dedupe behavior when Flow payloads omit stable record identity.
Zoom: fail closed when triggerId is missing and consider rejecting malformed generic payloads with empty event.
Resend: revisit failed-idempotency behavior for repeated svix-id deliveries and add dedicated provider tests.
Linear: decide whether unsigned v1 mode should remain allowed and whether missing action should fail closed.
Vercel: tighten per-trigger outputs so they align more strictly with the shared formatInput contract.
Greenhouse: improve body-fallback idempotency for rare no-header scenarios and keep schema docs aligned with less common payload variants.
Gong: decide whether JWT misconfiguration should fail harder instead of silently falling back to URL secrecy.
Notion: revisit auth-before-reachability ordering during verification and decide whether more data_source.* events should get dedicated named triggers.
Shared lifecycle: consider making challenge handling less hardcoded than CHALLENGE_PROVIDERS, revisit failed-idempotency caching semantics, and continue expanding alignment checks.

waleedlatif1 · 2026-04-07T01:34:29Z

@greptile

waleedlatif1 · 2026-04-07T01:34:32Z

@cursor review

apps/sim/lib/webhooks/providers/salesforce.ts

apps/sim/lib/webhooks/providers/resend.ts

Remove dead code in the Salesforce provider and move shared object-type extraction into a single helper so trigger matching and input shaping stay in sync. Made-with: Cursor

waleedlatif1 · 2026-04-07T01:49:23Z

@greptile

waleedlatif1 · 2026-04-07T01:49:26Z

@cursor review

apps/sim/lib/webhooks/providers/linear.ts

apps/sim/lib/webhooks/providers/notion.ts

Loosen Linear's replay window to better tolerate delayed retries and make Notion event mismatches return false consistently with the rest of the hardened providers. Made-with: Cursor

apps/sim/lib/webhooks/providers/linear.ts

waleedlatif1 · 2026-04-07T02:15:22Z

@greptile

waleedlatif1 · 2026-04-07T02:15:27Z

@cursor review

cursor

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 41b0348. Configure here.}

apps/sim/lib/webhooks/providers/salesforce.test.ts

apps/sim/lib/webhooks/providers/notion.ts

Move Zoom provider coverage into its own test file and strip undeclared Notion type fields from normalized output objects so the runtime shape better matches the trigger contract. Made-with: Cursor

Document and pass through Vercel links, regions, deployment.meta, and domain.delegated; add top-level Greenhouse applicationId, candidateId, and jobId aligned with webhook common attributes. Extend alignment checker for greenhouse, update provider docs, and add formatInput tests. Made-with: Cursor

…docs - Resend: expose broadcast_id, template_id, tags, and data_created_at from payload data (per Resend webhook docs); keep alignment with formatInput. - Add resend entry to check-trigger-alignment and unit test for formatInput. - Notion: tighten output descriptions for authors, entity types, parent types, attempt_number, and accessible_by per Notion webhooks event reference. Made-with: Cursor

- Zoom: add formatInput passthrough, fix nested TriggerOutput shape (drop invalid `properties` wrappers), document host_email, join_url, agenda, status, meeting_type on recordings, participant duration, and alignment checker entry. - Gong: flatten topics/highlights from callData.content in formatInput, extend metaData and trigger outputs per API docs, tests and alignment keys updated. - Docs: add English webhook trigger sections for Zoom and Gong tools pages.

Salesforce: expose simEventType alongside eventType; pass OwnerId and SystemModstamp on record lifecycle inputs; add AccountId/OwnerId for Opportunity and AccountId/ContactId/OwnerId for Case. Align trigger output docs with Flow JSON payloads and formatInput. Linear: document actor email and profile url per official webhook payload; add Comment data.edited from Linear's sample payload. Tests: extend Salesforce formatInput coverage for new fields.

Extend the trigger alignment checker to cover additional webhook providers so output contracts are verified across more of the recently added trigger surface. Made-with: Cursor

* fix(triggers): apply webhook audit follow-ups Align the Greenhouse webhook matcher with provider conventions and clarify the Notion webhook secret setup text after the audit review. Made-with: Cursor * fix(webhooks): Salesforce provider handler, Zoom CRC and block wiring Add salesforce WebhookProviderHandler with required shared secret auth, matchEvent filtering, formatInput aligned to trigger outputs, and idempotency keys. Require webhook secret and document JSON-only Flow setup; enforce objectType when configured. Zoom: pass raw body into URL validation signature check, try all active webhooks on a path for secret match, add extractIdempotencyId, tighten event matching for specialized triggers. Wire Zoom triggers into the Zoom block. Extend handleChallenge with optional rawBody. Register Salesforce pending verification probes for pre-save URL checks. * fix(webhooks): harden Resend and Linear triggers (idempotency, auth, outputs) - Dedupe Resend deliveries via svix-id and Linear via Linear-Delivery in idempotency keys - Require Resend signing secret; validate createSubscription id and signing_secret - Single source for Resend event maps in triggers/utils; fail closed on unknown trigger IDs - Add raw event data to Resend trigger outputs and formatInput - Linear: remove body-based idempotency key; timestamp skew after HMAC verify; format url and actorType - Tighten isLinearEventMatch for unknown triggers; clarify generic webhook copy; fix header examples - Add focused tests for idempotency headers and Linear matchEvent * fix(webhooks): harden Vercel and Greenhouse trigger handlers Require Vercel signing secret and validate x-vercel-signature; add matchEvent with dynamic import, delivery idempotency, strict createSubscription trigger IDs, and formatInput aligned to string IDs. Greenhouse: dynamic import in matchEvent, strict unknown trigger IDs, Greenhouse-Event-ID idempotency header, body fallback keys, clearer optional secret copy. Update generic trigger wording and add tests. * fix(gong): JWT verification, trigger UX, alignment script - Optional RS256 verification when Gong JWT public key is configured (webhook_url + body_sha256 per Gong docs); URL secrecy when unset. - Document that Gong rules filter calls; payload has no event type; add eventType + callId outputs for discoverability. - Refactor Gong triggers to buildTriggerSubBlocks + shared JWT field; setup copy matches security model. - Add check-trigger-alignment.ts (Gong bundled; extend PROVIDER_CHECKS for others) and update add-trigger guidance paths. Made-with: Cursor * fix(notion): align webhook lifecycle and outputs Handle Notion verification requests safely, expose the documented webhook fields in the trigger contract, and update setup guidance so runtime data and user-facing configuration stay aligned. Made-with: Cursor * fix(webhooks): tighten remaining provider hardening Close the remaining pre-merge caveats by tightening Salesforce, Zoom, and Linear behavior, and follow through on the deferred provider and tooling cleanup for Vercel, Greenhouse, Gong, and Notion. Made-with: Cursor * refactor(webhooks): move subscription helpers out of providers Move provider subscription helpers alongside the subscription lifecycle module and add targeted TSDoc so the file placement matches the responsibility boundaries in the webhook architecture. Made-with: Cursor * fix(zoom): resolve env-backed secrets during validation Use the same env-aware secret resolution path for Zoom endpoint validation as regular delivery verification so URL validation works correctly when the secret token is stored via env references. Made-with: Cursor * fix build * consolidate tests * refactor(salesforce): share payload object type parsing Remove dead code in the Salesforce provider and move shared object-type extraction into a single helper so trigger matching and input shaping stay in sync. Made-with: Cursor * fix(webhooks): address remaining review follow-ups Loosen Linear's replay window to better tolerate delayed retries and make Notion event mismatches return false consistently with the rest of the hardened providers. Made-with: Cursor * test(webhooks): separate Zoom coverage and clean Notion output shape Move Zoom provider coverage into its own test file and strip undeclared Notion type fields from normalized output objects so the runtime shape better matches the trigger contract. Made-with: Cursor * feat(triggers): enrich Vercel and Greenhouse webhook output shapes Document and pass through Vercel links, regions, deployment.meta, and domain.delegated; add top-level Greenhouse applicationId, candidateId, and jobId aligned with webhook common attributes. Extend alignment checker for greenhouse, update provider docs, and add formatInput tests. Made-with: Cursor * feat(webhooks): enrich Resend trigger outputs; clarify Notion output docs - Resend: expose broadcast_id, template_id, tags, and data_created_at from payload data (per Resend webhook docs); keep alignment with formatInput. - Add resend entry to check-trigger-alignment and unit test for formatInput. - Notion: tighten output descriptions for authors, entity types, parent types, attempt_number, and accessible_by per Notion webhooks event reference. Made-with: Cursor * feat(webhooks): enrich Zoom and Gong trigger output schemas - Zoom: add formatInput passthrough, fix nested TriggerOutput shape (drop invalid `properties` wrappers), document host_email, join_url, agenda, status, meeting_type on recordings, participant duration, and alignment checker entry. - Gong: flatten topics/highlights from callData.content in formatInput, extend metaData and trigger outputs per API docs, tests and alignment keys updated. - Docs: add English webhook trigger sections for Zoom and Gong tools pages. * feat(triggers): enrich Salesforce and Linear webhook output schemas Salesforce: expose simEventType alongside eventType; pass OwnerId and SystemModstamp on record lifecycle inputs; add AccountId/OwnerId for Opportunity and AccountId/ContactId/OwnerId for Case. Align trigger output docs with Flow JSON payloads and formatInput. Linear: document actor email and profile url per official webhook payload; add Comment data.edited from Linear's sample payload. Tests: extend Salesforce formatInput coverage for new fields. * remove from mdx * chore(webhooks): expand trigger alignment coverage Extend the trigger alignment checker to cover additional webhook providers so output contracts are verified across more of the recently added trigger surface. Made-with: Cursor * updated skills * updated file naming semantics * rename file

waleedlatif1 added 6 commits April 6, 2026 14:15

fix(triggers): apply webhook audit follow-ups

2e89fe5

Align the Greenhouse webhook matcher with provider conventions and clarify the Notion webhook secret setup text after the audit review. Made-with: Cursor

fix(notion): align webhook lifecycle and outputs

729667a

Handle Notion verification requests safely, expose the documented webhook fields in the trigger contract, and update setup guidance so runtime data and user-facing configuration stay aligned. Made-with: Cursor

waleedlatif1 force-pushed the waleedlatif1/greenhouse-audit-followups branch from 5af8ade to 729667a Compare April 7, 2026 00:03

waleedlatif1 changed the title ~~fix(triggers): apply webhook audit follow-ups~~ fix(webhooks): harden audited provider triggers Apr 7, 2026

vercel bot deployed to Preview April 7, 2026 00:06 View deployment

fix(webhooks): tighten remaining provider hardening

e79c556

Close the remaining pre-merge caveats by tightening Salesforce, Zoom, and Linear behavior, and follow through on the deferred provider and tooling cleanup for Vercel, Greenhouse, Gong, and Notion. Made-with: Cursor

vercel bot deployed to Preview April 7, 2026 00:53 View deployment

refactor(webhooks): move subscription helpers out of providers

23ccc9b

Move provider subscription helpers alongside the subscription lifecycle module and add targeted TSDoc so the file placement matches the responsibility boundaries in the webhook architecture. Made-with: Cursor

vercel bot temporarily deployed to Preview April 7, 2026 01:04 Inactive

fix(zoom): resolve env-backed secrets during validation

e000c5b

Use the same env-aware secret resolution path for Zoom endpoint validation as regular delivery verification so URL validation works correctly when the secret token is stored via env references. Made-with: Cursor

vercel bot temporarily deployed to Preview April 7, 2026 01:18 Inactive

fix build

b50a902

vercel bot temporarily deployed to Preview April 7, 2026 01:27 Inactive

consolidate tests

732755a

vercel bot temporarily deployed to Preview April 7, 2026 01:36 Inactive

cursor bot reviewed Apr 7, 2026

View reviewed changes

apps/sim/lib/webhooks/providers/salesforce.ts Show resolved Hide resolved

apps/sim/lib/webhooks/providers/salesforce.ts Show resolved Hide resolved

apps/sim/lib/webhooks/providers/resend.ts Show resolved Hide resolved

refactor(salesforce): share payload object type parsing

7c31044

Remove dead code in the Salesforce provider and move shared object-type extraction into a single helper so trigger matching and input shaping stay in sync. Made-with: Cursor

vercel bot temporarily deployed to Preview April 7, 2026 01:46 Inactive

cursor bot reviewed Apr 7, 2026

View reviewed changes

apps/sim/lib/webhooks/providers/linear.ts Outdated Show resolved Hide resolved

apps/sim/lib/webhooks/providers/notion.ts Show resolved Hide resolved

fix(webhooks): address remaining review follow-ups

41b0348

Loosen Linear's replay window to better tolerate delayed retries and make Notion event mismatches return false consistently with the rest of the hardened providers. Made-with: Cursor

vercel bot temporarily deployed to Preview April 7, 2026 02:08 Inactive

greptile-apps bot reviewed Apr 7, 2026

View reviewed changes

apps/sim/lib/webhooks/providers/linear.ts Show resolved Hide resolved

cursor bot reviewed Apr 7, 2026

View reviewed changes

apps/sim/lib/webhooks/providers/salesforce.test.ts Outdated Show resolved Hide resolved

apps/sim/lib/webhooks/providers/notion.ts Show resolved Hide resolved

test(webhooks): separate Zoom coverage and clean Notion output shape

cae9c8b

Move Zoom provider coverage into its own test file and strip undeclared Notion type fields from normalized output objects so the runtime shape better matches the trigger contract. Made-with: Cursor

vercel bot temporarily deployed to Preview April 7, 2026 02:27 Inactive

waleedlatif1 added 4 commits April 6, 2026 19:47

vercel bot deployed to Preview April 7, 2026 02:51 View deployment

remove from mdx

1cd27d8

vercel bot deployed to Preview April 7, 2026 02:55 View deployment

chore(webhooks): expand trigger alignment coverage

e0580f7

Extend the trigger alignment checker to cover additional webhook providers so output contracts are verified across more of the recently added trigger surface. Made-with: Cursor

vercel bot temporarily deployed to Preview April 7, 2026 02:56 Inactive

updated skills

3e7a046

vercel bot deployed to Preview April 7, 2026 03:15 View deployment

updated file naming semantics

d3fcf04

vercel bot deployed to Preview April 7, 2026 03:24 View deployment

rename file

2897ce1

vercel bot temporarily deployed to Preview April 7, 2026 03:30 Inactive

waleedlatif1 merged commit 64c6cd9 into staging Apr 7, 2026
6 checks passed

waleedlatif1 deleted the waleedlatif1/greenhouse-audit-followups branch April 7, 2026 03:30

waleedlatif1 mentioned this pull request Apr 7, 2026

v0.6.27: new triggers, mothership improvements, files archive, queueing improvements, posthog, secrets mutations #4006

Merged

Conversation

waleedlatif1 commented Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

vercel bot commented Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor bot commented Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-apps bot commented Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 4/5

Important Files Changed

Sequence Diagram

Comments Outside Diff (1)

Uh oh!

waleedlatif1 commented Apr 7, 2026

Follow-up Hardening Checklist

Uh oh!

waleedlatif1 commented Apr 7, 2026

Uh oh!

waleedlatif1 commented Apr 7, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Apr 7, 2026

Uh oh!

waleedlatif1 commented Apr 7, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Apr 7, 2026

Uh oh!

waleedlatif1 commented Apr 7, 2026

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

waleedlatif1 commented Apr 6, 2026 •

edited

Loading

vercel bot commented Apr 6, 2026 •

edited

Loading

cursor bot commented Apr 6, 2026 •

edited

Loading

greptile-apps bot commented Apr 6, 2026 •

edited

Loading