feat(backend): Add event_attributes to Webhook type #6162
Conversation
🦋 Changeset detectedLatest commit: cd2ea92 The changes in this PR will be included in the next version bump. This PR includes changesets to release 11 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
@jaredpiedt is attempting to deploy a commit to the Clerk Production Team on Vercel. A member of the Team first needs to authorize it. |
📝 WalkthroughWalkthroughThe changes introduce a new field, Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🔭 Outside diff range comments (1)
packages/backend/src/webhooks.ts (1)
83-85: Critical: Fix inverted signature verification logic.The signature verification logic is inverted. Currently, it throws an error when the constructed signature IS found in the svix signature list, which means it rejects valid signatures and accepts invalid ones. This is a critical security vulnerability.
Apply this fix:
- if (svixSignature.split(' ').includes(constructedSignature)) { + if (!svixSignature.split(' ').includes(constructedSignature)) { return errorThrower.throw('Incoming webhook does not have a valid signature'); }
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
.changeset/sixty-regions-camp.md(1 hunks)packages/backend/src/api/resources/Webhooks.ts(1 hunks)packages/backend/src/webhooks.ts(1 hunks)
🔇 Additional comments (3)
packages/backend/src/api/resources/Webhooks.ts (2)
16-21: Well-structured type definition for HTTP request metadata.The
WebhookEventAttributestype properly encapsulates HTTP request information with appropriate nesting underhttp_request.
23-23: Verify backward compatibility for required event_attributes property.Adding
event_attributesas a required property to theWebhooktype could be a breaking change if existing webhook payloads don't include this field. Consider making it optional initially or ensure all webhook sources provide this field.#!/bin/bash # Description: Search for existing Webhook type usage to assess potential breaking changes # Expected: Find usages that might be affected by the new required property echo "Searching for Webhook type usage patterns..." rg -A 3 -B 3 "Webhook<" --type ts echo -e "\nSearching for webhook payload parsing..." rg -A 5 -B 5 "JSON\.parse.*payload|payload.*JSON\.parse" --type ts echo -e "\nSearching for webhook event creation/construction..." rg -A 5 -B 5 "type.*event.*object.*data" --type ts.changeset/sixty-regions-camp.md (1)
1-6: Changeset documentation looks good.The changeset correctly documents this as a patch-level change with a clear description.
| @@ -90,5 +90,6 @@ export async function verifyWebhook(request: Request, options: VerifyWebhookOpti | |||
| type: payload.type, | |||
| object: 'event', | |||
| data: payload.data, | |||
| event_attributes: payload.event_attributes, | |||
There was a problem hiding this comment.
🛠️ Refactor suggestion
Add null safety for event_attributes extraction.
The code assumes payload.event_attributes exists, but it should handle cases where this property might be missing from older webhook payloads to maintain backward compatibility.
Apply this diff to add null safety:
- event_attributes: payload.event_attributes,
+ event_attributes: payload.event_attributes || { http_request: { client_ip: '', user_agent: '' } },Or make the property optional in the type definition if it's acceptable for it to be undefined.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| event_attributes: payload.event_attributes, | |
| event_attributes: payload.event_attributes || { http_request: { client_ip: '', user_agent: '' } }, |
🤖 Prompt for AI Agents
In packages/backend/src/webhooks.ts at line 93, the code accesses
payload.event_attributes without checking if it exists, which can cause errors
with older webhook payloads. To fix this, add a null check or use optional
chaining when extracting event_attributes to safely handle cases where it might
be undefined. Alternatively, update the type definition to make event_attributes
optional if that aligns with the expected data structure.
Description
This adds the
event_attributesproperty to webhook events.Checklist
pnpm testruns as expected.pnpm buildruns as expected.Type of change
Summary by CodeRabbit