minzeyaphyo/MySMSAPio
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

[Rushtik integration] SMS delivery webhooks need MYSMSAPIO_WEBHOOK_SECRET configured #1

New Issue
Open
opened 2026-08-25 16:11:22 +00:00 by git_admin · 1 comment
git_admin commented 2026-08-25 16:11:22 +00:00
Copy Link

Context

The Rushtik API receives async SMS delivery callbacks from this gateway at POST /api/v1/webhooks/sms (Api::V1::Webhooks::SmsController). The endpoint has no JWT auth — it authenticates only by HMAC signature over the raw body:

X-Webhook-Signature = hex(HMAC-SHA256(MYSMSAPIO_WEBHOOK_SECRET, raw_body))

Payload events: sms_sent, sms_failed (fields: event, message_id, error_message). Valid signatures update RushTik's NotificationOutbox rows.

Problem

The shared secret is not configured on either side yet:

  • rushtik-api deployment: MYSMSAPIO_WEBHOOK_SECRET unset → all webhooks 401 (mirror issue filed in code2lab/Rushtik)
  • MySMSAPio (this repo): confirm the outbound webhook signer uses the same MYSMSAPIO_WEBHOOK_SECRET env var and sends the X-Webhook-Signature header; if signing is not implemented, implement it

Fix

  • Verify/implement HMAC-SHA256 signing of rushtik webhook bodies in this codebase (X-Webhook-Signature header, lowercase hex digest)
  • Add MYSMSAPIO_WEBHOOK_SECRET=<shared secret> to this app's environment (Coolify env vars), matching the value set in rushtik-api
  • Restart app, trigger a test SMS, verify rushtik-api returns 200 and outbox row updates

Note: keep the secret out of git — env var only.

## Context The Rushtik API receives async SMS delivery callbacks from this gateway at `POST /api/v1/webhooks/sms` (`Api::V1::Webhooks::SmsController`). The endpoint has no JWT auth — it authenticates **only** by HMAC signature over the raw body: ``` X-Webhook-Signature = hex(HMAC-SHA256(MYSMSAPIO_WEBHOOK_SECRET, raw_body)) ``` Payload events: `sms_sent`, `sms_failed` (fields: `event`, `message_id`, `error_message`). Valid signatures update RushTik's `NotificationOutbox` rows. ## Problem The shared secret is not configured on either side yet: - rushtik-api deployment: `MYSMSAPIO_WEBHOOK_SECRET` unset → all webhooks 401 (mirror issue filed in code2lab/Rushtik) - MySMSAPio (this repo): confirm the outbound webhook signer uses the same `MYSMSAPIO_WEBHOOK_SECRET` env var and sends the `X-Webhook-Signature` header; if signing is not implemented, implement it ## Fix - [ ] Verify/implement HMAC-SHA256 signing of rushtik webhook bodies in this codebase (`X-Webhook-Signature` header, lowercase hex digest) - [ ] Add `MYSMSAPIO_WEBHOOK_SECRET=<shared secret>` to this app's environment (Coolify env vars), matching the value set in rushtik-api - [ ] Restart app, trigger a test SMS, verify rushtik-api returns 200 and outbox row updates Note: keep the secret out of git — env var only.
git_admin commented 2026-08-25 16:11:35 +00:00
Author
Copy Link

Mirror (receiver side): code2lab/Rushtik#35

Mirror (receiver side): code2lab/Rushtik#35
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
ZinBoThit minzeyaphyo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: minzeyaphyo/MySMSAPio#1
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?