From 0b2a5e5ac5404407fe46fc649ca764b24a57fbbe Mon Sep 17 00:00:00 2001 From: neil Date: Sat, 5 Sep 2026 10:48:24 +0800 Subject: [PATCH] fix(secrets): accept preserved webhook keys --- internal/resources/secrets/secrets.go | 4 +--- internal/resources/secrets/secrets_test.go | 8 +++++++- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/internal/resources/secrets/secrets.go b/internal/resources/secrets/secrets.go index faa74d1..9850815 100644 --- a/internal/resources/secrets/secrets.go +++ b/internal/resources/secrets/secrets.go @@ -50,8 +50,6 @@ const ( GoTrueFallbackSecretNameSuffix = "-gotrue-jwt-secret" ) -const emailHookSecretBytes = 32 - // ProjectCredentials is the validated, transient projection of the external // credential bundle. Secret values are never written to project status. type ProjectCredentials struct { @@ -289,7 +287,7 @@ func ValidateEmailHookSecret(secret *corev1.Secret) error { return fmt.Errorf("email hook Secret must contain a Standard Webhooks value") } payload, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(value, "v1,whsec_")) - if err != nil || len(payload) != emailHookSecretBytes { + if err != nil || len(payload) == 0 { return fmt.Errorf("email hook Secret contains an invalid Standard Webhooks value") } return nil diff --git a/internal/resources/secrets/secrets_test.go b/internal/resources/secrets/secrets_test.go index f9e6144..9850e76 100644 --- a/internal/resources/secrets/secrets_test.go +++ b/internal/resources/secrets/secrets_test.go @@ -41,7 +41,6 @@ func TestValidateEmailHookSecretRejectsMalformedValues(t *testing.T) { tests := map[string]string{ "empty payload": "v1,whsec_", "invalid base64": "v1,whsec_not-base64", - "short payload": "v1,whsec_" + base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{1}, 31)), "wrong prefix": strings.TrimPrefix(validValue, "v1,"), } @@ -59,6 +58,13 @@ func TestValidateEmailHookSecretRejectsMalformedValues(t *testing.T) { if err := ValidateEmailHookSecret(valid); err != nil { t.Fatalf("ValidateEmailHookSecret() rejected a valid secret: %v", err) } + + preserved := &corev1.Secret{Data: map[string][]byte{EmailHookSecretKey: []byte( + "v1,whsec_" + base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{1}, 58)), + )}} + if err := ValidateEmailHookSecret(preserved); err != nil { + t.Fatalf("ValidateEmailHookSecret() rejected a valid preserved secret: %v", err) + } } func newTestProject(namespace string) *supabasev1alpha1.SupabaseProject {