✨ server: decouple panda webhook verification from api key

[nfmelendez]

Summary by CodeRabbit

• New Features

  • Added support for configuring multiple Panda webhook signing keys.
  • Added secure runtime configuration for Panda webhook authentication.
  • Panda webhook requests now validate signatures directly and provide clear responses for malformed or unauthorized requests.

• Bug Fixes

  • Improved webhook signature verification so it operates independently from API key configuration.

• Tests

  • Expanded webhook coverage for multiple signing keys and signature validation scenarios.

[changeset-bot]

🦋 Changeset detected

Latest commit: 3e1f653

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@exactly/server	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 819d87f0-7a87-4388-a1ce-53eb38524773

📥 Commits

Reviewing files that changed from the base of the PR and between 9382d17 and 3e1f653.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (3)

• package.json
• server/index.ts
• server/test/hooks/panda.test.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The Panda webhook now receives comma-separated secret keys from runtime configuration and verifies request signatures inside the hook. The previous Panda utility header validator is removed, and tests cover the new verification path.

Changes

Panda webhook verification

Layer / File(s)	Summary
Runtime key configuration .do/app.yaml, server/index.ts, server/vitest.config.mts, package.json, .changeset/quiet-otters-rotate.md	The runtime adds PANDA_WEBHOOKS_KEY as a secret. The server parses comma-separated keys and passes them to the Panda hook. Tests define the variable, devalue@5 is pinned, and a patch changeset is added.
Inline signature verification server/hooks/panda.ts, server/utils/panda.ts, server/utils/verifySignature.ts	The Panda hook validates the signature header, reads the body, and checks each configured key. Invalid headers return 400 "bad request", and failed verification returns 401 "unauthorized". The previous utility validator is removed.
Verification test wiring server/test/hooks/panda.test.ts, server/test/mocks/panda.ts	The hook test supplies two keys and checks missing or invalid signatures. Mocks remove the old validator and stub verifySignature.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant RuntimeEnv
  participant serverIndex
  participant pandaHook
  participant verifySignature
  RuntimeEnv->>serverIndex: Provide PANDA_WEBHOOKS_KEY
  serverIndex->>pandaHook: Pass parsed pandaWebhookKeys
  pandaHook->>pandaHook: Validate header and read body
  pandaHook->>verifySignature: Verify signature with each key
  verifySignature-->>pandaHook: Return verification result
  pandaHook-->>pandaHook: Return error or continue

Loading

Suggested reviewers: aguxez, mainqueg

Merge Risk: ⚪ Minimal · up to 3e1f6

The changed webhook verification path has no established remaining failure or security risk requiring resolution before merge.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: separating Panda webhook verification from API key handling.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

✨ Simplify code

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 3bbf021f-1817-4c97-aca4-5932b88c79c1

📥 Commits

Reviewing files that changed from the base of the PR and between 73fdca5 and 9382d17.

📒 Files selected for processing (9)

• .changeset/quiet-otters-rotate.md
• .do/app.yaml
• server/hooks/panda.ts
• server/index.ts
• server/test/hooks/panda.test.ts
• server/test/mocks/panda.ts
• server/utils/panda.ts
• server/utils/verifySignature.ts
• server/vitest.config.mts

💤 Files with no reviewable changes (1)

• server/utils/panda.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ef8392cfa1

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 71.57%. Comparing base (73fdca5) to head (1183590).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1317      +/-   ##
==========================================
- Coverage   72.14%   71.57%   -0.58%     
==========================================
  Files         279      279              
  Lines       11278    10977     -301     
  Branches     3806     3680     -126     
==========================================
- Hits         8137     7857     -280     
+ Misses       2895     2882      -13     
+ Partials      246      238       -8     

Flag	Coverage Δ
e2e	46.96% <0.00%> (-25.19%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.