From 81c367f4815716f1c849e4dbe84775fa30537f57 Mon Sep 17 00:00:00 2001 From: Luke Tornquist Date: Mon, 26 Oct 2026 14:20:25 -0400 Subject: [PATCH] Expect generic 404 for wrong webhook secret in ban regression Main now answers a missing or invalid webhook secret with the same non-disclosing 404 as an unknown workflow. The merged Postgres regression still expected 401, so it stopped at its first assertion before exercising the ban, tenant-scope, unban and lookup-failure arms. Co-authored-by: Elrond <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz> Co-Authored-By: Claude Opus 5.5 Signed-off-by: Luke Tornquist --- .../src/api/bridge/workflow_webhook_postgres_tests.rs | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/crates/buzz-relay/src/api/bridge/workflow_webhook_postgres_tests.rs b/crates/buzz-relay/src/api/bridge/workflow_webhook_postgres_tests.rs index 2b60241ec3..fb5cd7ffc0 100644 --- a/crates/buzz-relay/src/api/bridge/workflow_webhook_postgres_tests.rs +++ b/crates/buzz-relay/src/api/bridge/workflow_webhook_postgres_tests.rs @@ -252,12 +252,13 @@ async fn webhook_admission_enforces_owner_ban_tenant_scope_and_lookup_failure() let (state, audit_shutdown) = app_state(db.clone(), &pool).await; - let (status, _) = post_webhook(&state, workflow_id, &host_a, "wrong-secret").await; + let (status, body) = post_webhook(&state, workflow_id, &host_a, "wrong-secret").await; assert_eq!( status, - StatusCode::UNAUTHORIZED, - "the secret remains required" + StatusCode::NOT_FOUND, + "the secret remains required and is denied generically" ); + assert_eq!(body["error"], "workflow not found"); assert_eq!(workflow_run_count(&pool, community_a, workflow_id).await, 0); let (status, _) = post_webhook(&state, workflow_id, &host_a, &secret).await;