Remove inbound request signature verification (closes #279)

internal/database/migration_entrypoint_test.go

@@ -1,85 +0,0 @@
-package database_test
-
-import (
-	"net/http"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"sneak.berlin/go/webhooker/internal/database"
-	"sneak.berlin/go/webhooker/internal/signature"
-)
-
-// TestEntrypointSignatureColumnsMigrateToUnconfigured pins the
-// upgrade path for a deployment that already has entrypoints.
-//
-// The signature columns arrive through GORM's AutoMigrate, so every
-// row written before they existed acquires them with no value. That
-// has to land on "not configured", because the alternative is an
-// upgrade that rejects the traffic the operator was already
-// receiving — a self-inflicted outage on a receiver whose senders
-// cannot be told to start signing.
-//
-// The legacy schema is reproduced by dropping the columns from a
-// migrated database and writing a row through the old shape, so the
-// row really predates them rather than merely being blank.
-func TestEntrypointSignatureColumnsMigrateToUnconfigured(t *testing.T) {
-	t.Parallel()
-
-	db, lc := setupTestDB(t)
-	lc.RequireStart()
-
-	t.Cleanup(lc.RequireStop)
-
-	for _, column := range []string{
-		"signature_scheme", "signature_secret",
-	} {
-		require.NoError(
-			t,
-			db.DB().Exec(
-				"ALTER TABLE entrypoints DROP COLUMN "+column,
-			).Error,
-			"dropping %s to reproduce the pre-upgrade schema",
-			column,
-		)
-	}
-
-	const legacyID = "legacy-entrypoint"
-
-	require.NoError(
-		t,
-		db.DB().Exec(
-			`INSERT INTO entrypoints
-			 (id, created_at, updated_at, webhook_id, path,
-			  description, active)
-			 VALUES (?, ?, ?, ?, ?, ?, ?)`,
-			legacyID, "2026-01-01 00:00:00", "2026-01-01 00:00:00",
-			"legacy-webhook", "legacy-path", "predates signatures",
-			true,
-		).Error,
-	)
-
-	// The upgrade.
-	require.NoError(t, db.Migrate())
-
-	var ep database.Entrypoint
-
-	require.NoError(
-		t,
-		db.DB().Where("id = ?", legacyID).First(&ep).Error,
-		"the migrated row must still load; a NULL landing in a "+
-			"string column would fail here",
-	)
-
-	assert.Equal(t, database.SignatureSchemeNone, ep.SignatureScheme)
-	assert.Empty(t, ep.SignatureSecret)
-	assert.False(t, ep.SignatureConfigured())
-	assert.True(t, ep.Active, "the row's other columns survive")
-
-	// The behaviour that actually matters: an unsigned request to
-	// this entrypoint is still accepted.
-	assert.NoError(
-		t,
-		signature.Verify(&ep, http.Header{}, []byte(`{"a":1}`)),
-	)
-}

internal/database/model_entrypoint.go

@@ -1,71 +1,20 @@
 package database
 
-// SignatureScheme names the way an entrypoint authenticates inbound
-// requests. A scheme fixes both the header the signature arrives in
-// and the algorithm used to check it, so an operator cannot pair one
-// sender's header with another sender's comparison.
-type SignatureScheme string
-
-// Signature scheme values. The empty scheme means the entrypoint
-// performs no inbound verification: it is the default, and it is the
-// state every entrypoint created before this column existed migrates
-// to, so an existing deployment keeps accepting the requests it
-// accepted before.
-const (
-	SignatureSchemeNone   SignatureScheme = ""
-	SignatureSchemeGitHub SignatureScheme = "github"
-	SignatureSchemeGitLab SignatureScheme = "gitlab"
-)
-
 // Entrypoint represents an inbound URL endpoint that feeds into a webhook
 type Entrypoint struct {
 	BaseModel
 
 	WebhookID string `gorm:"type:uuid;not null" json:"webhookId"`
 
-	// Path is the URL path for this entrypoint.
+	// Path is the URL path for this entrypoint. It is the
+	// entrypoint's only credential: possession of the UUID
+	// authorises submission, so the receiver checks nothing else
+	// about the sender.
 	Path string `gorm:"uniqueIndex;not null" json:"path"`
 
 	Description string `json:"description"`
 	Active      bool   `gorm:"default:true" json:"active"`
 
-	// SignatureScheme selects how inbound requests to this
-	// entrypoint are authenticated. Empty means unauthenticated,
-	// which is what a UUID-only entrypoint has always been.
-	SignatureScheme SignatureScheme `gorm:"default:''" json:"signatureScheme"`
-
-	// SignatureSecret is the secret shared with the sender.
-	//
-	// It is stored in the clear because HMAC verification needs the
-	// key itself: a hash of it cannot recompute the sender's digest.
-	// It is therefore a live credential, and json:"-" keeps it out of
-	// any handler that marshals the model, the way APIKey.Key and
-	// Target.Config are kept out. handlers.EntrypointView is the
-	// matching barrier for the HTML path.
-	SignatureSecret string `gorm:"default:''" json:"-"`
-
 	// Relations
 	Webhook Webhook `json:"webhook,omitzero"`
 }
-
-// SignatureConfigured reports whether this entrypoint verifies
-// inbound requests. Both halves must be present: a scheme without a
-// secret, or a secret without a scheme, is a broken configuration
-// rather than a configured one, and signature.Verify fails those
-// closed rather than treating them as "off".
-func (e *Entrypoint) SignatureConfigured() bool {
-	return e.SignatureScheme != SignatureSchemeNone &&
-		e.SignatureSecret != ""
-}
-
-// SignatureHalfConfigured reports whether exactly one half of the
-// scheme/secret pair is present. The receiver refuses such a row on
-// every request, so the UI must not describe it as unverified. It
-// reports the state without exposing the secret, which is why it
-// lives here rather than in the display projection.
-func (e *Entrypoint) SignatureHalfConfigured() bool {
-	hasScheme := e.SignatureScheme != SignatureSchemeNone
-	hasSecret := e.SignatureSecret != ""
-
-	return hasScheme != hasSecret
-}

internal/database/model_secrets_test.go

@@ -34,8 +34,6 @@ func marshalModel(t *testing.T, v any) string {
 //   - APIKey.Key is a bearer token outright.
 //   - Setting.Value holds the session encryption key.
 //   - User.Password holds the Argon2 hash, and was already tagged.
-//   - Entrypoint.SignatureSecret is the secret its senders sign with,
-//     stored in the clear because HMAC verification needs the key.
 func TestModelsDoNotMarshalTheirSecrets(t *testing.T) {
 	t.Parallel()
 
@@ -74,14 +72,6 @@ func TestModelsDoNotMarshalTheirSecrets(t *testing.T) {
 				Password: marker,
 			},
 		},
-		{
-			name: "entrypoint signature secret",
-			model: database.Entrypoint{
-				Description:     keptField,
-				SignatureScheme: database.SignatureSchemeGitHub,
-				SignatureSecret: marker,
-			},
-		},
 	}
 
 	for _, tc := range cases {
@@ -115,24 +105,3 @@ func TestWebhookMarshalsNoTargetConfig(t *testing.T) {
 	assert.NotContains(t, encoded, marker)
 	assert.Contains(t, encoded, keptField)
 }
-
-// TestWebhookMarshalsNoEntrypointSecret covers the same nested case
-// for the entrypoint's inbound signature secret, which reaches a
-// marshalled webhook through the Entrypoints association.
-func TestWebhookMarshalsNoEntrypointSecret(t *testing.T) {
-	t.Parallel()
-
-	const marker = "QQENTRYPOINTMARKERQQ"
-
-	encoded := marshalModel(t, database.Webhook{
-		Name: keptField,
-		Entrypoints: []database.Entrypoint{{
-			Path:            "some-uuid",
-			SignatureScheme: database.SignatureSchemeGitLab,
-			SignatureSecret: marker,
-		}},
-	})
-
-	assert.NotContains(t, encoded, marker)
-	assert.Contains(t, encoded, keptField)
-}