fix(twitterapiio): fail closed when webhook secret is missing

[yuvanvk]

Description

Fixes TwitterApiIO webhook signature handling so inbound webhook requests fail closed when webhook authentication is not configured correctly.

Changes include:

• Rejecting webhook verification when the webhook secret is missing
• Rejecting requests when a signature is missing but a webhook secret is configured
• Making the webhook keyBuilder fail when no stored webhook signature is available
• Ensuring failed verification returns before webhook handlers persist tweet/user data
• Adding unit coverage for the webhook signature reject path

Fixes #582

Checklist

Before submitting your PR, please verify the following:

• I have run pnpm lint and all checks pass
• I have run pnpm build and all packages build successfully
• I have added or updated tests where applicable

Screenshots / Demos

Additional Notes

This addresses a fail-open webhook verification path where missing webhook credentials could allow handlers to proceed without a valid signature.

Summary by CodeRabbit

• Bug Fixes

  • Improved webhook signature validation by rejecting requests when the signature or webhook secret is missing.
  • Added clear errors when webhook signatures cannot be verified.
  • Strengthened HMAC-SHA256 verification for invalid signatures.

• Tests

  • Expanded coverage for valid signatures, failed verification, missing secrets, and missing signature headers.

[vercel]

@yuvanvk is attempting to deploy a commit to the corsair Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 9701dafc-70c9-4869-84fd-a2cf7ea5d123

📥 Commits

Reviewing files that changed from the base of the PR and between d0efd06 and aa1c16a.

📒 Files selected for processing (1)

• packages/twitterapiio/webhook.test.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• packages/twitterapiio/webhook.test.ts

---

📝 Walkthrough

Walkthrough

TwitterApiIO webhook authentication now fails when the signature or webhook secret is missing. Tests cover valid signatures, failed verification, missing secrets, and missing signature headers.

Changes

TwitterApiIO webhook verification

Layer / File(s)	Summary
Fail-closed webhook verification packages/twitterapiio/index.ts, packages/twitterapiio/webhooks/types.ts	The key builder now throws when no webhook signature is available. Missing webhook secrets now return invalid verification with a Missing webhook secret error.
Verification regression tests packages/twitterapiio/webhook.test.ts	Mocked HMAC verification tests cover successful validation, failed validation, missing secrets, and missing signature headers.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• fix(twitter): webhook signature verification fails open when secret and signature header are both missing #596 — Addresses fail-open webhook signature verification for missing secrets or signatures in another Twitter integration.
• fix(zoom): return error string when webhook signing secret is missing #520 — Adds explicit errors for missing webhook secrets in another integration.

Possibly related PRs

• corsairdev/corsair#555 — Updates webhook HMAC verification and adds missing-secret signature-validation tests.
• corsairdev/corsair#566 — Adds explicit missing-secret errors and verification tests in another integration.
• corsairdev/corsair#593 — Applies fail-closed webhook HMAC verification with regression tests.

Suggested reviewers: yuvrxj-afk

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	The changes reject missing secrets and signatures and add tests, but the provided summary does not confirm prevention of database writes after failed verification [#582].	Provide evidence or tests that failed webhook verification returns before any tweet or user data is persisted.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the fail-closed TwitterApiIO webhook secret fix.
Out of Scope Changes check	✅ Passed	The implementation and tests remain focused on TwitterApiIO webhook authentication requirements [#582].
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

The PR makes TwitterApiIO webhook authentication fail closed when signature credentials are absent and adds focused verification tests.

• Rejects requests missing the webhook secret or signature header.
• Stops webhook dispatch when no stored webhook signature is available.
• Covers valid, invalid, and missing credential cases in unit tests.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
packages/twitterapiio/index.ts	Changes webhook key resolution to fail before handler execution when no configured or stored signature secret exists.
packages/twitterapiio/webhooks/types.ts	Changes missing-secret verification from fail-open to fail-closed while preserving HMAC validation for configured secrets.
packages/twitterapiio/webhook.test.ts	Adds assertions for valid and invalid signatures and for missing secret or signature rejection.

_{Reviews (3): Last reviewed commit: "Merge branch 'main' into fix/582-twitter..." | Re-trigger Greptile}

[yuvanvk]

@coderabbitai the keybuilder throws error if invalid signature, preventing DB persists.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

@yuvanvk Correct. keyBuilder throws when the webhook signature is invalid or missing. This stops verification before the webhook handlers can persist data. I withdraw the concern.

---

✏️ Learnings added

Learnt from: yuvanvk
URL: https://github.com/corsairdev/corsair/pull/607

Timestamp: 2026-08-05T05:25:15.870Z
Learning: In the TwitterApiIO webhook flow, `keyBuilder` throws when the stored webhook signature is invalid or missing. This prevents signature verification from succeeding and stops webhook handlers before they persist tweet or user data.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

_{You are interacting with an AI system.}

[yuvanvk]

@greptile-apps now the any type is replaced with WebhookRequest type

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
www	Skipped		Aug 6, 2026 2:58pm

[ambikeesshh]

@greptileai review

[ambikeesshh]

lgtm. thanks @yuvanvk