feat(trogon-gateway): unify Notion ingress#118
Merged
Conversation
Member
yordis
commented
Apr 13, 2026
yordis
commented
- Bring Notion into the shared gateway so workspace activity can flow through the same ingress path and downstream routing model as the other sources.
- Preserve Notion's verification handshake so the integration can be onboarded without a separate bootstrap service or manual code changes between setup and steady state.
- Surface the required operator configuration in compose and gateway docs so the integration can be enabled consistently and with less setup friction.
PR SummaryMedium Risk Overview Introduces a new Updates local Docker Compose and gateway docs to expose the required Reviewed by Cursor Bugbot for commit 8eb07fa. Bugbot is set up for automated code reviews on this repo. Configure here. |
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 8 minutes and 6 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (16)
WalkthroughAdds a new Notion webhook source: new Docker Compose/env variables and docs, a new Rust crate Changes
Sequence DiagramsequenceDiagram
participant Notion as Notion Service
participant Gateway as trogon-gateway (/notion/webhook)
participant Sig as Signature Verifier
participant NATS as NATS JetStream
Note over Notion,Gateway: POST /notion/webhook (body, X-Notion-Signature)
Notion->>Gateway: POST /notion/webhook (body, X-Notion-Signature)
Gateway->>Sig: verify(secret, body, X-Notion-Signature)
alt Subscription verification (no "type")
Gateway->>NATS: publish {prefix}.subscription.verification (raw body)
NATS-->>Gateway: ack
Gateway-->>Notion: 200 OK
else Signature missing/invalid
Sig-->>Gateway: Error
Gateway->>NATS: publish {prefix}.unroutable (reject reason)
Gateway-->>Notion: 401/200 (per flow)
else Normal event (signature valid)
Gateway->>Gateway: parse JSON, extract type -> NotionEventType
alt Invalid JSON or missing/invalid type
Gateway->>NATS: publish {prefix}.unroutable (reject reason)
NATS-->>Gateway: ack
Gateway-->>Notion: 200 OK
else Valid event
Gateway->>NATS: publish {prefix}.{event_type} (with headers)
NATS-->>Gateway: ack / error
Gateway-->>Notion: 200 OK / 500
end
end
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Code Coverage SummaryDetailsDiff against mainResults for commit: 8eb07fa Minimum allowed coverage is ♻️ This comment has been updated with latest results |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit b8c97af. Configure here.
yordis
force-pushed
the
yordis/feat-notion-webhooks
branch
from
b8c97af to
f91239d
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@rsworkspace/crates/trogon-source-notion/src/server.rs`:
- Around line 217-237: The current branch treats
verification_request.verification_token from parse_verification_request as the
HMAC key (used by signature::verify) which lets an attacker craft valid
signatures; change this by gating the bootstrap verification flow so the server
only accepts a verification_token-derived signature during an explicit bootstrap
mode (add a boolean like NotionConfig.bootstrap or state.bootstrap_flag and
check it before using verification_request.verification_token and before calling
publish_verification). Update server.rs to: check state.bootstrap_flag (or a
NotionConfig field on state) at the start of the parse_verification_request /
signature::verify branch, reject or UNAUTHORIZED when not in bootstrap mode, and
keep publish_verification, state.publisher and state.nats_ack_timeout unchanged
for bootstrap-only paths; if you need rotation later, carry that
bootstrap/trusted-bootstrap mode in NotionConfig rather than inferring trust
from the incoming payload.
In `@rsworkspace/crates/trogon-source-notion/src/signature.rs`:
- Around line 35-47: The verify function currently accepts a raw &str allowing
unchecked tokens into the crypto boundary; change the signature of verify (the
verify function in signature.rs) to accept the NotionVerificationToken value
object instead of &str, use the token's inner bytes/string when constructing
HmacSha256, and update call sites (e.g., bootstrap payload parsing) to
parse/construct NotionVerificationToken before calling verify so malformed
tokens are rejected at construction time; ensure the NotionVerificationToken
type enforces validity in its constructor so verify can rely on a valid token
type.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: b3ffa174-61b1-40f1-8184-8ccfbf404cc2
⛔ Files ignored due to path filters (1)
rsworkspace/Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (16)
devops/docker/compose/.env.exampledevops/docker/compose/compose.ymldevops/docker/compose/services/trogon-gateway/README.mdrsworkspace/Cargo.tomlrsworkspace/crates/trogon-gateway/Cargo.tomlrsworkspace/crates/trogon-gateway/src/config.rsrsworkspace/crates/trogon-gateway/src/http.rsrsworkspace/crates/trogon-gateway/src/streams.rsrsworkspace/crates/trogon-source-notion/Cargo.tomlrsworkspace/crates/trogon-source-notion/src/config.rsrsworkspace/crates/trogon-source-notion/src/constants.rsrsworkspace/crates/trogon-source-notion/src/lib.rsrsworkspace/crates/trogon-source-notion/src/notion_event_type.rsrsworkspace/crates/trogon-source-notion/src/notion_verification_token.rsrsworkspace/crates/trogon-source-notion/src/server.rsrsworkspace/crates/trogon-source-notion/src/signature.rs
There was a problem hiding this comment.
♻️ Duplicate comments (1)
rsworkspace/crates/trogon-source-notion/src/server.rs (1)
217-238:⚠️ Potential issue | 🔴 CriticalDon't authenticate the bootstrap path with a key taken from the same request.
Line 220 uses
verification_request.verification_tokenfrom the untrusted body as the HMAC key. Any caller can choose that token, compute a matchingX-Notion-Signature, and reach the publish path, leaving*.subscription.verificationpublicly writable even after steady state. Gate this branch behind explicit bootstrap mode; carry that mode inNotionConfigrather than inferring trust from the payload.,
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@rsworkspace/crates/trogon-source-notion/src/server.rs` around lines 217 - 238, The current code uses verification_request.verification_token (from parse_verification_request) as the HMAC key, allowing any caller to craft a matching X-Notion-Signature and reach publish_verification; change this by adding an explicit bootstrap flag to your NotionConfig (e.g., NotionConfig.bootstrap_mode) and require that bootstrap_mode is true before accepting verification requests that use the body-supplied token. Modify the branch around parse_verification_request / signature::verify / publish_verification to check state.config.bootstrap_mode (or an equivalent field on state) and reject requests when that flag is false, and keep verification_request.verification_token validation only for bootstrap_mode=true; ensure steady-state verification uses a server-held secret instead of the token from the payload.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In `@rsworkspace/crates/trogon-source-notion/src/server.rs`:
- Around line 217-238: The current code uses
verification_request.verification_token (from parse_verification_request) as the
HMAC key, allowing any caller to craft a matching X-Notion-Signature and reach
publish_verification; change this by adding an explicit bootstrap flag to your
NotionConfig (e.g., NotionConfig.bootstrap_mode) and require that bootstrap_mode
is true before accepting verification requests that use the body-supplied token.
Modify the branch around parse_verification_request / signature::verify /
publish_verification to check state.config.bootstrap_mode (or an equivalent
field on state) and reject requests when that flag is false, and keep
verification_request.verification_token validation only for bootstrap_mode=true;
ensure steady-state verification uses a server-held secret instead of the token
from the payload.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 186c74e6-acb8-453b-9eb9-ba9ddb17cb83
⛔ Files ignored due to path filters (1)
rsworkspace/Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (16)
devops/docker/compose/.env.exampledevops/docker/compose/compose.ymldevops/docker/compose/services/trogon-gateway/README.mdrsworkspace/Cargo.tomlrsworkspace/crates/trogon-gateway/Cargo.tomlrsworkspace/crates/trogon-gateway/src/config.rsrsworkspace/crates/trogon-gateway/src/http.rsrsworkspace/crates/trogon-gateway/src/streams.rsrsworkspace/crates/trogon-source-notion/Cargo.tomlrsworkspace/crates/trogon-source-notion/src/config.rsrsworkspace/crates/trogon-source-notion/src/constants.rsrsworkspace/crates/trogon-source-notion/src/lib.rsrsworkspace/crates/trogon-source-notion/src/notion_event_type.rsrsworkspace/crates/trogon-source-notion/src/notion_verification_token.rsrsworkspace/crates/trogon-source-notion/src/server.rsrsworkspace/crates/trogon-source-notion/src/signature.rs
✅ Files skipped from review due to trivial changes (7)
- rsworkspace/crates/trogon-gateway/Cargo.toml
- devops/docker/compose/.env.example
- rsworkspace/Cargo.toml
- devops/docker/compose/compose.yml
- rsworkspace/crates/trogon-source-notion/Cargo.toml
- rsworkspace/crates/trogon-source-notion/src/constants.rs
- rsworkspace/crates/trogon-source-notion/src/lib.rs
🚧 Files skipped from review as they are similar to previous changes (7)
- rsworkspace/crates/trogon-gateway/src/http.rs
- devops/docker/compose/services/trogon-gateway/README.md
- rsworkspace/crates/trogon-source-notion/src/config.rs
- rsworkspace/crates/trogon-gateway/src/config.rs
- rsworkspace/crates/trogon-source-notion/src/signature.rs
- rsworkspace/crates/trogon-source-notion/src/notion_verification_token.rs
- rsworkspace/crates/trogon-source-notion/src/notion_event_type.rs
yordis
force-pushed
the
yordis/feat-notion-webhooks
branch
from
f91239d to
dc1c52a
Compare
There was a problem hiding this comment.
🧹 Nitpick comments (1)
rsworkspace/crates/trogon-gateway/src/streams.rs (1)
114-114: Strengthen the test to assert Notion stream identity, not just count.Line 114 can still pass if the wrong stream set is created. Consider asserting the Notion stream (or Notion subject prefix) exists in
created_streams()in addition tolen() == 8.Possible test refinement
- assert_eq!(js.created_streams().len(), 8); + let streams = js.created_streams(); + assert_eq!(streams.len(), 8); + assert!( + streams.iter().any(|s| s.name.contains("notion")), + "expected Notion stream to be provisioned", + );🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@rsworkspace/crates/trogon-gateway/src/streams.rs` at line 114, The test currently only checks js.created_streams().len() == 8; update it to also verify the Notion stream identity is present by asserting that at least one element in js.created_streams() matches the Notion subject/prefix (e.g., contains or starts_with "notion:" or the exact Notion stream name used elsewhere in the test); use created_streams().iter().any(...) (or the equivalent helper) to perform the check so the test fails if the wrong streams set is produced.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@rsworkspace/crates/trogon-gateway/src/streams.rs`:
- Line 114: The test currently only checks js.created_streams().len() == 8;
update it to also verify the Notion stream identity is present by asserting that
at least one element in js.created_streams() matches the Notion subject/prefix
(e.g., contains or starts_with "notion:" or the exact Notion stream name used
elsewhere in the test); use created_streams().iter().any(...) (or the equivalent
helper) to perform the check so the test fails if the wrong streams set is
produced.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 65f8420d-1584-4574-8bad-27564d4560c0
⛔ Files ignored due to path filters (1)
rsworkspace/Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (16)
devops/docker/compose/.env.exampledevops/docker/compose/compose.ymldevops/docker/compose/services/trogon-gateway/README.mdrsworkspace/Cargo.tomlrsworkspace/crates/trogon-gateway/Cargo.tomlrsworkspace/crates/trogon-gateway/src/config.rsrsworkspace/crates/trogon-gateway/src/http.rsrsworkspace/crates/trogon-gateway/src/streams.rsrsworkspace/crates/trogon-source-notion/Cargo.tomlrsworkspace/crates/trogon-source-notion/src/config.rsrsworkspace/crates/trogon-source-notion/src/constants.rsrsworkspace/crates/trogon-source-notion/src/lib.rsrsworkspace/crates/trogon-source-notion/src/notion_event_type.rsrsworkspace/crates/trogon-source-notion/src/notion_verification_token.rsrsworkspace/crates/trogon-source-notion/src/server.rsrsworkspace/crates/trogon-source-notion/src/signature.rs
✅ Files skipped from review due to trivial changes (10)
- rsworkspace/Cargo.toml
- devops/docker/compose/.env.example
- rsworkspace/crates/trogon-gateway/Cargo.toml
- devops/docker/compose/services/trogon-gateway/README.md
- rsworkspace/crates/trogon-source-notion/src/config.rs
- rsworkspace/crates/trogon-source-notion/src/notion_verification_token.rs
- rsworkspace/crates/trogon-source-notion/src/lib.rs
- rsworkspace/crates/trogon-source-notion/Cargo.toml
- rsworkspace/crates/trogon-source-notion/src/constants.rs
- rsworkspace/crates/trogon-source-notion/src/server.rs
🚧 Files skipped from review as they are similar to previous changes (3)
- rsworkspace/crates/trogon-gateway/src/http.rs
- devops/docker/compose/compose.yml
- rsworkspace/crates/trogon-gateway/src/config.rs
Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
yordis
force-pushed
the
yordis/feat-notion-webhooks
branch
from
dc1c52a to
8eb07fa
Compare
yordis
added
the
rust:coverage-baseline-reset
This was referenced Apr 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.