Spaces:
Sleeping
Sleeping
Commit History
-
feat(api): add support for relaying to both prod and test
- allow "both" as an env to relay to prod and test simultaneously - update admin endpoint and docs to reflect new "both" option - refactor relay logic to fan out requests to multiple targets when needed This enables sending webhook requests to both production and test endpoints at once by specifying "both" as the environment. The documentation and endpoint validation are updated accordingly.1220bb2
-
feat(api): harden relay security and logging
- redact relay secret from logged URLs - enforce allowed content-types to prevent injection - add SSRF guard for protocol-relative/absolute URLs - use constant-time secret verification with SHA-256 - add 30s timeout to upstream fetch requests - simplify health endpoint output - always forward original HTTP method in relay51866f6 -
feat(api): redact sensitive info from logged URLs
Add censorUrl utility to mask URL paths, queries, and fragments in logs for improved security and privacy. Replace direct URL logging with redacted output in relay and startup logs.b005996 -
feat(api): add security hardening with IP allowlist, CORS, and rate limits
- add optional IP allowlist and CORS origin checks for /relay and /admin routes - implement per-route rate limiting for sensitive endpoints - update .env.example with new security-related environment variables These enhancements provide configurable security controls to restrict access, limit abuse, and support browser-based integrations. All features are optional and disabled by default for backward compatibility.25932e4 -
feat(api): add dual webhook env support and admin switching
- support both prod and test n8n webhook URLs with runtime switching - add /admin/env endpoints to get/set active environment without restart - update config, docs, and logging for dual-URL and env switching - remove Slack signature verification and related config BREAKING CHANGE: Slack signature verification is removed; relay now requires X-Relay-Secret for all requests. Environment variables for webhook URLs have changed to TARGET_WEBHOOK_URL_PROD and TARGET_WEBHOOK_URL_TEST.a3191bd
-
fix(api): add content-type to sanitized header exclusions
- prevent duplicate content-type headers by excluding it from forwardingff72d7d -
feat(api): forward query params to target URL in relay
- add logic to forward query params (excluding 'secret') to upstream webhook - update logging and fetch to use constructed target URL This ensures query parameters are relayed securely without leaking sensitive data.da5a57d -
feat(api): add Slack request signature verification
- add SLACK_SIGNING_SECRET to config and .env.example - implement verifySlackSignature for authenticating Slack requests - update relay endpoints to accept Slack-signed requests as valid authentication This enables secure integration with Slack by verifying incoming requests using HMAC-SHA256 signatures, preventing spoofed or replayed requests.f428242 -
feat(api): add detailed logging for relay endpoints
- log incoming requests and outgoing payloads for /relay and /relay/:path - redact authorization headers and sensitive info in logs Adds visibility into request and forwarding details for debugging and auditing.cb58ce6 -
feat(config): add TRUST_PROXY env and express trust proxy config
- add TRUST_PROXY to .env.example for proxy hop configuration - configure express app to use TRUST_PROXY for client IP handling This enables proper client IP detection behind reverse proxies and improves rate limiting accuracy. See Express docs for proxy trust details.c83b7d0 -
feat(api): handle Slack URL verification challenge
- add support for Slack url_verification in /relay and /relay/:path endpoints This change allows the server to properly respond to Slack's URL verification challenge, enabling integration with Slack event subscriptions.1702df9 -
feat(api): add secure webhook relay service with docs and docker
- add initial webhook relay server with authentication and rate limiting - provide Dockerfile for deployment on Hugging Face Spaces - include example environment config and .gitignore - add documentation and package manifests This introduces a secure relay for forwarding webhooks with authentication headers, suitable for use with private endpoints like n8n on Hugging Face Spaces. The service includes security best practices, rate limiting, and is ready for containerized deployment.a0f543d