[codex] Harden dashboard and Discord security boundaries#324
Conversation
|
Warning Review limit reached
More reviews will be available in 4 minutes and 3 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (8)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR hardens security boundaries between internal dashboard/protected API routes and externally callable webhook endpoints, and reduces accidental Discord data disclosure by making CRM command followups explicitly ephemeral.
Changes:
- Make many Discord CRM followup responses explicitly
ephemeral=True(and update unit tests accordingly). - Split webhook authentication to prefer
WEBHOOK_SHARED_SECRET, falling back toAPI_SHARED_SECRETonly when the webhook secret is unset, plus add unit tests to assert the isolation. - Document the new
WEBHOOK_SHARED_SECRETconfiguration in docs and.env.example.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
apps/api/src/five08/backend/api.py |
Introduces separate webhook auth (_is_webhook_authorized) and refactors secret validation helper. |
packages/shared/src/five08/settings.py |
Adds webhook_shared_secret to shared settings. |
docs/configuration.md |
Documents WEBHOOK_SHARED_SECRET and fallback behavior. |
.env.example |
Adds WEBHOOK_SHARED_SECRET example and comments. |
apps/discord_bot/src/five08/discord_bot/cogs/crm.py |
Makes CRM-related Discord followup messages ephemeral across multiple commands/flows. |
tests/unit/test_backend_api.py |
Adds tests asserting webhook/internal secret isolation. |
tests/unit/test_crm.py |
Updates assertions to expect ephemeral followup sends. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| """Validate an X-API-Secret header against one configured secret.""" | ||
| if not configured_secret: | ||
| logger.error("Rejecting request: %s is not configured", setting_name) | ||
| return False | ||
|
|
||
| provided_secret = request.headers.get("X-API-Secret", "") | ||
| if secrets.compare_digest(provided_secret, settings.api_shared_secret): | ||
| if secrets.compare_digest(provided_secret, configured_secret): | ||
| return True | ||
| logger.warning("Rejecting request: invalid X-API-Secret") | ||
| logger.warning("Rejecting request: invalid X-API-Secret for %s", setting_name) | ||
| return False |
| def _is_webhook_authorized(request: Request) -> bool: | ||
| """Validate the external webhook secret, with legacy API secret fallback.""" | ||
| if settings.webhook_shared_secret: | ||
| return _is_authorized_with_secret( | ||
| request, | ||
| configured_secret=settings.webhook_shared_secret, | ||
| setting_name="WEBHOOK_SHARED_SECRET", | ||
| ) | ||
|
|
||
| return _is_authorized_with_secret( | ||
| request, | ||
| configured_secret=settings.api_shared_secret, | ||
| setting_name="API_SHARED_SECRET", | ||
| ) |
| # Required: ingest requests are rejected when unset | ||
| API_SHARED_SECRET= | ||
| # Optional: separate secret for external /webhooks/* callers. When unset, | ||
| # webhook routes fall back to API_SHARED_SECRET for compatibility. | ||
| WEBHOOK_SHARED_SECRET= |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a558d77c2e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ) | ||
|
|
||
| await interaction.followup.send(embed=embed) | ||
| await interaction.followup.send(embed=embed, ephemeral=True) |
There was a problem hiding this comment.
For the duplicate-resume confirmation button, this first followup still becomes the deferred original response because confirm_upload() deferred earlier with interaction.response.defer() rather than defer(ephemeral=True). Discord preserves the defer response's visibility and ignores ephemeral=True on that first followup, so accepting the upload can still publish the success embed with the contact name, file name, and CRM link to the channel instead of only to the clicking user.
Useful? React with 👍 / 👎.
Summary
Notes
Validation