jerry/buzz
1
0
Fork 0
mirror of https://github.com/block/buzz.git synced 2026-10-27 12:40:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

Expect generic 404 for wrong webhook secret in ban regression

Browse Source 
Main now answers a missing or invalid webhook secret with the same
non-disclosing 404 as an unknown workflow. The merged Postgres
regression still expected 401, so it stopped at its first assertion
before exercising the ban, tenant-scope, unban and lookup-failure arms.

Co-authored-by: Elrond <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Luke Tornquist <tornquist@squareup.com>
This commit is contained in:
Luke Tornquist
2026-10-26 14:20:25 -04:00
parent 9eb5e07d1b
commit 81c367f481
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
crates/buzz-relay/src/api/bridge/workflow_webhook_postgres_tests.rs
View File

@@ -252,12 +252,13 @@ async fn webhook_admission_enforces_owner_ban_tenant_scope_and_lookup_failure()
let (state, audit_shutdown) = app_state(db.clone(), &pool).await;
let (status, _) = post_webhook(&state, workflow_id, &host_a, "wrong-secret").await;
let (status, body) = post_webhook(&state, workflow_id, &host_a, "wrong-secret").await;
assert_eq!(
status,
StatusCode::UNAUTHORIZED,
"the secret remains required"
StatusCode::NOT_FOUND,
"the secret remains required and is denied generically"
);
assert_eq!(body["error"], "workflow not found");
assert_eq!(workflow_run_count(&pool, community_a, workflow_id).await, 0);
let (status, _) = post_webhook(&state, workflow_id, &host_a, &secret).await;