[pull] main from hookdeck:main - #175
Merged
Merged
Conversation
The generator injected env-var and YAML blocks into docs/pages/references/configuration.mdx between MDX placeholders. That page went away with the move to Markdoc, so the tool wrote to a path that no longer exists and `make docs/generate/config` failed outright. Its replacement, docs/content/self-hosting/configuration.mdoc, is curated — grouped into sections with prose around them — rather than one generated table, so there is nothing left for the generator to fill in. Closes #820 Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Every failure from the outpost CLI exited 1 with nothing on stderr. The command that suffers most is `outpost migrate`: a mistyped config path or an unreachable database is indistinguishable from any other failure, at the one step an upgrade depends on. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: add webhook signature verification guide
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs: clarify unauthenticated timestamp/event-id headers in verification guide
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs: scope verification guide to default config
The Customization section promised the guide "stays accurate with the
prefix substituted," which is wrong when an operator pins a header name
outright (DESTINATIONS_WEBHOOK_SIGNATURE_HEADER_NAME and friends).
State the assumption instead of enumerating knobs: the guide covers
default-mode signatures and default header naming, prefix substitution is
the one supported deviation, and anything else is the operator's scheme to
document. Link now points at Operator Configuration rather than the
destination-level Configuration anchor.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: guard the Node sample against a non-bytes body
verifySignature returns false for every other "cannot verify" case —
missing header, wrong prefix, no candidate match — but threw on a body
that wasn't bytes, so callers had to wrap it in try/catch to get a
trustworthy boolean.
Reachable through the sample as written: body-parser sets req.body = {}
before its content-type check, so a request that doesn't match
express.raw({ type: "application/json" }) reaches createHmac().update({})
and Express turns the throw into a 500 instead of a 401. Real deliveries
always match — destwebhook hardcodes Content-Type and reserves it from
custom_headers — so this only shows up on stray traffic, but the same
hole opens anywhere the body arrives undefined.
Accept strings as well as Buffers: crypto's update() handles both, and
rejecting strings would turn a valid body shape into a silent
verification failure.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: give the rotation window a duration and a link
"A rotation window" left readers no way to know how long they have to swap
the stored secret. Name the 24-hour default at first mention and point at
the destination page's Secret Rotation section, which already documents
the trigger, the sequence, and the field that sets the window.
Kept to a parenthetical: the receiving side accepts any matching candidate
regardless of the window length, so the duration is context rather than
something the verification code acts on.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* chore: update to debian13 base image * chore: upgrade to debian13 base image
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )