fix: encrypt webhook secrets before storage in MongoDB (#3956)

[atul-upadhyay-7]

Summary

This PR fixes the vulnerability where webhook signing secrets were stored in plaintext in MongoDB. Secrets are now encrypted before storage and never exposed in API responses after creation.

Changes

New: lib/webhook/crypto.js

• AES-256-GCM encryption for storing secrets in the database
• HMAC-SHA256 hashing for secret verification
• Timing-safe comparison to prevent timing attacks
• Encryption key derived from WEBHOOK_ENCRYPTION_KEY or CRON_SECRET env var

Updated: lib/models/webhookModel.js

• Secrets are now encrypted (encryptedSecret) and hashed (secretHash) before storage
• serializeWebhook() strips secret, secretHash, and encryptedSecret from all responses
• New getWebhookSecretForSigning() function retrieves decrypted secrets for the dispatcher
• updateWebhook() re-encrypts secrets when updated

Updated: lib/webhook/dispatcher.js

• Uses getWebhookSecretForSigning() to retrieve decrypted secrets for signing
• Skips webhooks with decryption failures (logs error)

Updated: app/api/webhooks/route.js

• POST response now includes the raw secret with a warning: "Save this secret securely. It will not be shown again."
• GET/list responses never include secrets

Security Model

Operation	Before	After
Storage	Plaintext secret field	Encrypted encryptedSecret + hashed secretHash
GET/List	Secret exposed in response	Secret stripped from response
POST	Secret exposed in response	Secret returned once with save warning
Signing	Dispatcher reads plaintext from DB	Dispatcher decrypts from DB

Environment Setup

Set WEBHOOK_ENCRYPTION_KEY in production (falls back to CRON_SECRET):

WEBHOOK_ENCRYPTION_KEY=your-256-bit-secret-here

Testing

1. Create a webhook via POST /api/webhooks — raw secret returned once in response
2. List webhooks via GET /api/webhooks — no secret in response
3. Get webhook by ID — no secret in response
4. Trigger a webhook event — signature is correctly computed using decrypted secret

Related Issue

Fixes #3956