jhheider / agentmail-rs / 29476705446

81%

push

github

feat: webhook get/update + optional Svix signature verification (#6)

Adds get_webhook and update_webhook (org-scoped PATCH with add/remove inbox and
pod deltas), and rounds out the Webhook/CreateWebhook types (pod_ids,
client_id, timestamps). Behind the off-by-default webhook-verify feature, adds
verify_webhook_signature and verify_webhook_timestamp in a pure verify module:
correct Svix scheme (HMAC-SHA256 over {id}.{timestamp}.{body}, whsec_ base64
secret, any v1,<base64> candidate, constant-time via ring::hmac::verify), and
it never passes open on an empty or malformed secret. ring is already the
rustls provider and base64 is already transitive, so the feature adds no new
crates; CI's --all-features build/test/coverage picks it up. Wiremock tests for
get/update plus the canonical Svix test vector.



Claude-Session: https://claude.ai/code/session_01CcYsnLASyk9cN6DTktGH7h

Co-authored-by: DeepSeek <noreply@deepseek.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

102 of 105 new or added lines in 2 files covered. (97.14%)

666 of 730 relevant lines covered (91.23%)

5.91 hits per line