Remove inbound request signature verification (closes #279)

internal/database/model_secrets_test.go

@@ -34,8 +34,6 @@ func marshalModel(t *testing.T, v any) string {
 //   - APIKey.Key is a bearer token outright.
 //   - Setting.Value holds the session encryption key.
 //   - User.Password holds the Argon2 hash, and was already tagged.
-//   - Entrypoint.SignatureSecret is the secret its senders sign with,
-//     stored in the clear because HMAC verification needs the key.
 func TestModelsDoNotMarshalTheirSecrets(t *testing.T) {
 	t.Parallel()
 
@@ -74,14 +72,6 @@ func TestModelsDoNotMarshalTheirSecrets(t *testing.T) {
 				Password: marker,
 			},
 		},
-		{
-			name: "entrypoint signature secret",
-			model: database.Entrypoint{
-				Description:     keptField,
-				SignatureScheme: database.SignatureSchemeGitHub,
-				SignatureSecret: marker,
-			},
-		},
 	}
 
 	for _, tc := range cases {
@@ -115,24 +105,3 @@ func TestWebhookMarshalsNoTargetConfig(t *testing.T) {
 	assert.NotContains(t, encoded, marker)
 	assert.Contains(t, encoded, keptField)
 }
-
-// TestWebhookMarshalsNoEntrypointSecret covers the same nested case
-// for the entrypoint's inbound signature secret, which reaches a
-// marshalled webhook through the Entrypoints association.
-func TestWebhookMarshalsNoEntrypointSecret(t *testing.T) {
-	t.Parallel()
-
-	const marker = "QQENTRYPOINTMARKERQQ"
-
-	encoded := marshalModel(t, database.Webhook{
-		Name: keptField,
-		Entrypoints: []database.Entrypoint{{
-			Path:            "some-uuid",
-			SignatureScheme: database.SignatureSchemeGitLab,
-			SignatureSecret: marker,
-		}},
-	})
-
-	assert.NotContains(t, encoded, marker)
-	assert.Contains(t, encoded, keptField)
-}