[New Feature] Webhook HMAC signing

[mfyz]

Index webhooks can now opt into HMAC-SHA256 request signing. Existing webhooks remain unsigned unless the new setting is enabled, so this is backward compatible.

The webhook configuration UI/screen now includes a Security section where users can enable signing and enter a secret. The secret is stored using the existing secure token storage instead of the regular webhook preferences.

Signed requests include:

• X-Index-Webhook-Version
• X-Index-Signature
• X-Index-Timestamp
• X-Index-Delivery

The signature covers the webhook version, timestamp, delivery ID, trigger, test status, and exact request body. The webhook API documentation includes the complete verification protocol and a Python example.

Implementation

• Added the signing controls to the existing webhook screen.
• Added shared signing-input and header logic, with platform-specific HMAC implementations for Android and iOS.
• Stored signing secrets separately using Android Keystore-backed encrypted storage and Apple Keychain.
• Added signature headers when sending regular and test webhook requests.
• Filtered reserved webhook headers from user-defined headers.
• Documented the protocol in INDEX_WEBHOOK_API.md.

Tests

Added focused tests in:

• IndexWebhookSigningTest.kt: RFC 4231 vector, signing-input construction, signature formatting, request changes, reserved headers, and per-gesture secrets.
• IndexWebhookSettingsViewModelTest.kt: secure secret storage, copied configurations, test events, and secret deletion.
• IndexWebhookPreferencesTest.kt: backward compatibility and signed-configuration persistence.

Android build, unit tests, host tests, JVM tests, and lint pass. The app was also installed and tested on a physical Android device.

Screenshots

Signing disabled (default state)

Signing enabled, shows secret field

Disclosure: This implementation was developed with AI assistance (codex, 5.6-sol-xh). I reviewed the complete diff, iterated on it multiple times to get the UI/UX, documentation, contract right. I tested the Android build on Pixel Fold Pro 9, an my Index 01 device, and reviewed the webhook signing protocol and security behavior. Implemented it on my agentic back-end, and successfully using it in production.

[CLAassistant]

All committers have signed the CLA.

[ericmigi]

thanks @mfyz !