improvement(webhooks): share one Standard Webhooks verifier across providers

Author: waleedlatif1

apps/sim/app/api/webhooks/agentmail/route.test.ts

@@ -15,16 +15,8 @@ const { mockVerify, mockExecuteInboxTask } = vi.hoisted(() => ({
   mockExecuteInboxTask: vi.fn(),
 }))
 
-vi.mock('svix', () => ({
-  Webhook: class {
-    private readonly secret: string
-    constructor(secret: string) {
-      this.secret = secret
-    }
-    verify(payload: string, headers: Record<string, string>) {
-      return mockVerify(this.secret, payload, headers)
-    }
-  },
+vi.mock('@sim/security/standard-webhooks', () => ({
+  verifyStandardWebhook: mockVerify,
 }))
 
 vi.mock('@/lib/core/admission/gate', () => admissionGateMock)
@@ -92,9 +84,7 @@ describe('POST /api/webhooks/agentmail', () => {
 
     mockTryAdmit.mockReturnValue({ release: mockRelease })
     mockExecuteInboxTask.mockResolvedValue(undefined)
-    mockVerify.mockImplementation(() => {
-      throw new Error('signature mismatch')
-    })
+    mockVerify.mockReturnValue({ valid: false, reason: 'no_matching_signature' })
   })
 
   it('checks the signature against only the secret the payload routes to', async () => {
@@ -106,12 +96,14 @@ describe('POST /api/webhooks/agentmail', () => {
     expect(mockEq).toHaveBeenCalledWith(schemaMock.workspace.inboxProviderId, TARGET_INBOX_ID)
     expect(dbChainMockFns.limit).toHaveBeenCalledWith(1)
     expect(mockVerify).toHaveBeenCalledTimes(1)
-    expect(mockVerify).toHaveBeenCalledWith('whsec_b', expect.any(String), expect.any(Object))
+    expect(mockVerify).toHaveBeenCalledWith(
+      expect.objectContaining({ secret: 'whsec_b', headerPrefix: 'svix' })
+    )
   })
 
   it('rejects a payload naming an inbox no workspace owns, without hashing it', async () => {
     queueTableRows(schemaMock.workspace, [])
-    mockVerify.mockReturnValue(undefined)
+    mockVerify.mockReturnValue({ valid: true })
 
     const response = await POST(
       webhookRequest(envelope({ inbox_id: 'agent-unknown@agentmail.to' }))

apps/sim/app/api/webhooks/agentmail/route.ts

@@ -8,12 +8,12 @@ import {
   workspace,
 } from '@sim/db'
 import { createLogger } from '@sim/logger'
+import { verifyStandardWebhook } from '@sim/security/standard-webhooks'
 import { getErrorMessage } from '@sim/utils/errors'
 import { generateId } from '@sim/utils/id'
 import { tasks } from '@trigger.dev/sdk'
 import { and, eq, gt, ne, sql } from 'drizzle-orm'
 import { NextResponse } from 'next/server'
-import { Webhook } from 'svix'
 import {
   agentMailEnvelopeSchema,
   agentMailMessageSchema,
@@ -41,22 +41,8 @@ const MAX_EMAILS_PER_HOUR = 20
 
 const AGENTMAIL_BODY_LABEL = 'AgentMail webhook body'
 
-/** Svix throws on a bad signature, stale timestamp, or malformed header. */
-function verifiesAgainst(
-  secret: string,
-  rawBody: string,
-  headers: Record<string, string>
-): boolean {
-  try {
-    new Webhook(secret).verify(rawBody, headers)
-    return true
-  } catch {
-    return false
-  }
-}
-
 /**
- * Bound the unauthenticated AgentMail webhook body before buffering it for Svix
+ * Bound the unauthenticated AgentMail webhook body before buffering it for
  * signature verification, so an oversized payload cannot exhaust pod memory.
  */
 async function readAgentMailBody(req: Request): Promise<string> {
@@ -106,7 +92,7 @@ export const POST = withRouteHandler(async (req: Request) => {
     }
 
     /**
-     * Route to one tenant before hashing: svix HMACs the whole body synchronously,
+     * Route to one tenant before hashing: verification HMACs the whole body synchronously,
      * so checking every workspace secret would let one unauthenticated request cost
      * a hash per tenant. `inbox_id` is attacker-controlled but only selects which
      * secret to check — verification still binds the payload's inbox to the workspace.
@@ -129,7 +115,15 @@ export const POST = withRouteHandler(async (req: Request) => {
       .where(eq(workspace.inboxProviderId, inboxId))
       .limit(1)
 
-    if (!result || !verifiesAgainst(result.webhookSecret, rawBody, headersResult.data)) {
+    if (
+      !result ||
+      !verifyStandardWebhook({
+        secret: result.webhookSecret,
+        rawBody,
+        headers: req.headers,
+        headerPrefix: 'svix',
+      }).valid
+    ) {
       logger.warn('Webhook signature verification failed', { payloadInboxId: inboxId })
       return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
     }

apps/sim/app/api/webhooks/agentmail/thread-scope.integration.ts

@@ -4,7 +4,7 @@ import { deleteWorkspaceFixture, insertWorkspaceFixture } from '@sim/db/testing/
  * `In-Reply-To` header — a value every recipient of the agent's reply holds. Against
  * real PostgreSQL, a reply delivered to one workspace's inbox must never reach a chat,
  * task, or transcript owned by another workspace, while a reply inside the workspace
- * still continues its thread. The webhook is signed with the real Svix scheme.
+ * still continues its thread. The webhook is signed per the Standard Webhooks spec.
  */
 import { authBanMock } from '@sim/testing/mocks/auth-ban.mock'
 import {
@@ -40,6 +40,7 @@ vi.mock('@/lib/mothership/inbox/executor', () => ({
   executeInboxTask: mockExecuteInboxTask,
 }))
 
+import { createHmac } from 'node:crypto'
 import { db } from '@sim/db'
 import {
   copilotChats,
@@ -53,7 +54,6 @@ import {
 import { generateId } from '@sim/utils/id'
 import { and, eq, inArray } from 'drizzle-orm'
 import { NextRequest } from 'next/server'
-import { Webhook } from 'svix'
 import { persistCopilotChatTurn } from '@/lib/mothership/chat/messages-store'
 import { buildPersistedUserMessage } from '@/lib/mothership/chat/persisted-message'
 import { POST } from '@/app/api/webhooks/agentmail/route'
@@ -142,15 +142,19 @@ async function deliver(
     },
   })
   const svixId = `msg_${generateId()}`
-  const timestamp = new Date()
+  const timestamp = String(Math.floor(Date.now() / 1000))
+  const key = Buffer.from(ws.secret.slice('whsec_'.length), 'base64')
+  const signature = createHmac('sha256', key)
+    .update(`${svixId}.${timestamp}.${body}`)
+    .digest('base64')
   return POST(
     new NextRequest('http://localhost:3000/api/webhooks/agentmail', {
       method: 'POST',
       headers: {
         'content-type': 'application/json',
         'svix-id': svixId,
-        'svix-timestamp': String(Math.floor(timestamp.getTime() / 1000)),
-        'svix-signature': new Webhook(ws.secret).sign(svixId, timestamp, body),
+        'svix-timestamp': timestamp,
+        'svix-signature': `v1,${signature}`,
       },
       body,
     }),

apps/sim/lib/webhooks/providers/clerk.ts

@@ -1,6 +1,5 @@
 import { createLogger } from '@sim/logger'
-import { safeCompare } from '@sim/security/compare'
-import { hmacSha256Base64 } from '@sim/security/hmac'
+import { verifyStandardWebhook } from '@sim/security/standard-webhooks'
 import { NextResponse } from 'next/server'
 import type {
   AuthContext,
@@ -12,46 +11,6 @@ import type {
 
 const logger = createLogger('WebhookProvider:Clerk')
 
-/**
- * Verify a Clerk webhook signature using the Svix signing scheme.
- * Clerk uses Svix under the hood: HMAC-SHA256 of `${svix-id}.${svix-timestamp}.${body}`
- * signed with the base64-decoded `whsec_...` secret, compared against the
- * space-delimited, versioned (`v1,<sig>`) `svix-signature` header.
- */
-function verifySvixSignature(
-  secret: string,
-  msgId: string,
-  timestamp: string,
-  signatures: string,
-  rawBody: string
-): boolean {
-  try {
-    const ts = Number.parseInt(timestamp, 10)
-    const now = Math.floor(Date.now() / 1000)
-    if (Number.isNaN(ts) || Math.abs(now - ts) > 5 * 60) {
-      return false
-    }
-
-    const secretBytes = Buffer.from(secret.replace(/^whsec_/, ''), 'base64')
-    const toSign = `${msgId}.${timestamp}.${rawBody}`
-    const expectedSignature = hmacSha256Base64(toSign, secretBytes)
-
-    const providedSignatures = signatures.split(' ')
-    for (const versionedSig of providedSignatures) {
-      const parts = versionedSig.split(',')
-      if (parts.length !== 2) continue
-      const sig = parts[1]
-      if (safeCompare(sig, expectedSignature)) {
-        return true
-      }
-    }
-    return false
-  } catch (error) {
-    logger.error('Error verifying Clerk Svix signature:', error)
-    return false
-  }
-}
-
 export const clerkHandler: WebhookProviderHandler = {
   async verifyAuth({
     request,
@@ -65,17 +24,20 @@ export const clerkHandler: WebhookProviderHandler = {
       return new NextResponse('Unauthorized - Clerk signing secret is required', { status: 401 })
     }
 
-    const svixId = request.headers.get('svix-id')
-    const svixTimestamp = request.headers.get('svix-timestamp')
-    const svixSignature = request.headers.get('svix-signature')
-
-    if (!svixId || !svixTimestamp || !svixSignature) {
-      logger.warn(`[${requestId}] Clerk webhook missing Svix signature headers`)
-      return new NextResponse('Unauthorized - Missing Clerk signature headers', { status: 401 })
-    }
-
-    if (!verifySvixSignature(signingSecret, svixId, svixTimestamp, svixSignature, rawBody)) {
-      logger.warn(`[${requestId}] Clerk Svix signature verification failed`)
+    const verification = verifyStandardWebhook({
+      secret: signingSecret,
+      rawBody,
+      headers: request.headers,
+      headerPrefix: 'svix',
+    })
+    if (!verification.valid) {
+      if (verification.reason === 'missing_headers') {
+        logger.warn(`[${requestId}] Clerk webhook missing Svix signature headers`)
+        return new NextResponse('Unauthorized - Missing Clerk signature headers', { status: 401 })
+      }
+      logger.warn(`[${requestId}] Clerk Svix signature verification failed`, {
+        reason: verification.reason,
+      })
       return new NextResponse('Unauthorized - Invalid Clerk signature', { status: 401 })
     }
 

apps/sim/lib/webhooks/providers/granola.ts

@@ -1,6 +1,5 @@
 import { createLogger } from '@sim/logger'
-import { safeCompare } from '@sim/security/compare'
-import { hmacSha256Base64 } from '@sim/security/hmac'
+import { verifyStandardWebhook } from '@sim/security/standard-webhooks'
 import { toRecordOrNull } from '@sim/utils/object'
 import { NextResponse } from 'next/server'
 import { getNotificationUrl, getProviderConfig } from '@/lib/webhooks/provider-subscription-utils'
@@ -20,51 +19,9 @@ const logger = createLogger('WebhookProvider:Granola')
 
 const GRANOLA_WEBHOOK_ENDPOINTS_URL = 'https://public-api.granola.ai/v1/webhook-endpoints'
 
-/** Granola advises rejecting deliveries whose timestamp is more than a few minutes old. */
-const GRANOLA_WEBHOOK_TIMESTAMP_SKEW_SECONDS = 5 * 60
-
 /** Scopes used when the trigger leaves the field blank. */
 const DEFAULT_GRANOLA_SCOPES = ['personal', 'public']
 
-/**
- * Verify a Granola webhook signature using the Standard Webhooks scheme:
- * HMAC-SHA256 of `${webhook-id}.${webhook-timestamp}.${body}` keyed with the
- * base64-decoded signing secret (after the `whsec_` prefix), compared against
- * the `webhook-signature` header which may carry one or more space-separated
- * `v1,<base64sig>` entries.
- * @see https://docs.granola.ai/webhooks
- */
-function verifyGranolaSignature(
-  secret: string,
-  msgId: string,
-  timestamp: string,
-  signatures: string,
-  rawBody: string
-): boolean {
-  try {
-    const ts = Number.parseInt(timestamp, 10)
-    const now = Math.floor(Date.now() / 1000)
-    if (Number.isNaN(ts) || Math.abs(now - ts) > GRANOLA_WEBHOOK_TIMESTAMP_SKEW_SECONDS) {
-      return false
-    }
-
-    const secretBytes = Buffer.from(secret.replace(/^whsec_/, ''), 'base64')
-    const expectedSignature = hmacSha256Base64(`${msgId}.${timestamp}.${rawBody}`, secretBytes)
-
-    for (const versionedSig of signatures.split(' ')) {
-      const parts = versionedSig.split(',')
-      if (parts.length !== 2) continue
-      if (parts[0] === 'v1' && safeCompare(parts[1], expectedSignature)) {
-        return true
-      }
-    }
-    return false
-  } catch (error) {
-    logger.error('Error verifying Granola webhook signature:', error)
-    return false
-  }
-}
-
 /**
  * Parse a comma-separated or JSON-array trigger field into a string list.
  * Trigger fields are free text, so both forms are accepted.
@@ -187,19 +144,19 @@ export const granolaHandler: WebhookProviderHandler = {
       return new NextResponse('Unauthorized - Granola signing secret is required', { status: 401 })
     }
 
-    const webhookId = request.headers.get('webhook-id')
-    const webhookTimestamp = request.headers.get('webhook-timestamp')
-    const webhookSignature = request.headers.get('webhook-signature')
-
-    if (!webhookId || !webhookTimestamp || !webhookSignature) {
-      logger.warn(`[${requestId}] Granola webhook missing Standard Webhooks signature headers`)
-      return new NextResponse('Unauthorized - Missing Granola signature headers', { status: 401 })
-    }
-
-    if (
-      !verifyGranolaSignature(signingSecret, webhookId, webhookTimestamp, webhookSignature, rawBody)
-    ) {
-      logger.warn(`[${requestId}] Granola signature verification failed`)
+    const verification = verifyStandardWebhook({
+      secret: signingSecret,
+      rawBody,
+      headers: request.headers,
+    })
+    if (!verification.valid) {
+      if (verification.reason === 'missing_headers') {
+        logger.warn(`[${requestId}] Granola webhook missing Standard Webhooks signature headers`)
+        return new NextResponse('Unauthorized - Missing Granola signature headers', { status: 401 })
+      }
+      logger.warn(`[${requestId}] Granola signature verification failed`, {
+        reason: verification.reason,
+      })
       return new NextResponse('Unauthorized - Invalid Granola signature', { status: 401 })
     }