fix(frontend): use per-instance webhook secret in copy-URL field#293
Merged
Conversation
The webhook URL shown in each Arr-instance row was hardcoded to the
master API key:
/api/webhook/<id>?apikey=${apiKeyData?.api_key}
When the instance has a per-instance webhook_secret (the default for
any instance created after the per-instance-secret migration), the
backend rejects requests authenticated with the master API key:
401 Unauthorized {"error":"Invalid webhook secret"}
The user who reported #286 copied the URL verbatim from the Healarr
UI into Sonarr's webhook config and got exactly that rejection.
Fix the per-row URL to prefer arr.webhook_secret over the master
api_key, and revise the Config-page master-key card to call itself
a 'Master API Key' (fallback only) so users don't try to use it
for webhooks on instances that have moved to per-instance secrets.
Closes #286
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThe PR adds per-instance webhook secret support to Healarr. ChangesPer-Instance Webhook Secret Support
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~4 minutes Possibly related PRs
Poem
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This was referenced Jun 3, 2026
Merged
mescon
added a commit
that referenced
this pull request
Jun 4, 2026
… (#299) The path-matching logic between *arr-reported paths and configured scan paths required the post-prefix remainder to begin with a forward slash. On Windows, Sonarr/Radarr report paths verbatim with UNC roots and backslash separators, e.g.: \\alexpr4100\\media\\Movies\\High Strung (2016)\\film.mkv With a scan path configured as \\alexpr4100\\media\\Movies, the HasPrefix match succeeded but the remainder validation (which only accepted '/') rejected the match. Every Windows-hosted setup got: Webhook path mapping failed: *arr reported path '...' but no matching scan path found even with a correctly configured scan path. Fix: accept either / or \\ as the directory-boundary separator after a prefix match, and strip either as a trailing separator at load time. Helpers are factored out (pathSeparators, hasSepPrefix, trimTrailingSep) so the rule is named once and applied consistently across Reload / ToArrPath / ToLocalPath. Reported by alex882001 in #298. The earlier per-instance webhook secret fix (#293, v1.3.6) was a prerequisite for this report — without it the request would have been rejected at the auth gate before ever reaching path mapping. Closes #298 Co-authored-by: mescon <mescon@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The webhook URL shown in each Arr-instance row was hardcoded to the master API key:
When the instance has a per-instance `webhook_secret` (default for any instance created after the per-instance-secret migration), the backend at `handlers_webhook.go:86-97` rejects requests authenticated with the master key:
#286 reports exactly this: user copied the URL verbatim from the UI into Sonarr's webhook config, Sonarr's connection test failed with the 401.
Fix
Closes #286.
Test plan
Summary by CodeRabbit
New Features
Documentation