TW-4877: webhook server preflight UX + security hardening#63
Open
qasim-nylas wants to merge 1 commit intomainfrom
Open
TW-4877: webhook server preflight UX + security hardening#63qasim-nylas wants to merge 1 commit intomainfrom
qasim-nylas wants to merge 1 commit intomainfrom
Conversation
Originating issue: nylas webhook server displayed a localhost URL and told the user to register it with Nylas — but Nylas can't reach localhost, so events never fired (Slack #cli, 2026-04-27). Webhook preflight (the originating issue) - Interactive preflight when neither --tunnel nor --no-tunnel is set: detect cloudflared, offer brew install on macOS, prompt to enable tunnel, read secret with terminal echo disabled. - New --no-tunnel flag for non-interactive opt-out. - Loopback-only output no longer instructs user to register localhost. - Prompter interface so EOF (Ctrl-D) propagates cleanly instead of silently flipping into --allow-unsigned or auto-running brew install. Webhook server hardening (internal/adapters/webhookserver) - 1 MiB request body cap (http.MaxBytesReader). - Replay protection via MaxEventAge (CloudEvents `time` skew check). - Goroutine fanout bounded by 32-slot semaphore + per-handler recover(). - events_dropped surfaced in /health. - Event-display goroutine exits on ctx.Done() and recovers from panics. Other silent-failure fixes uncovered in review - pattern_learner: surface per-calendar errors instead of silent skip. - doctor_checks: propagate config/secret-store failures explicitly. - base_client.go: error on malformed tool-call JSON. - requestLocation: return error on bad timezone instead of UTC fallback. - admin.go: cycle guard + maxGrantPages ceiling on cursor pagination. Crypto hardening (internal/adapters/keyring) - Argon2id raised from t=1 to t=3. - NYLAS_FILE_STORE_PASSPHRASE minimum length 12. - Derived AES keys zeroed after use. Frontend (Air) - XSS fix: AI summary sentiment/category now escapeHtml-ed. - notetaker-open-external: scheme allow-list (https?://) + noopener. Tests - New unit tests for preflightTunnelChoice (mocked Prompter). - New webhookserver tests: oversized body 413, replay window, loopback bind, events_dropped in /health. - webguard middleware: Referer-only fallback path. - All packages pass go test -race; golangci-lint clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
nylas webhook server— detects cloudflared, offersbrew installon macOS, prompts to enable tunnel, reads secret with echo disabled.--no-tunnelflag; loopback-only output no longer instructs user to registerlocalhostwith Nylas.MaxEventAge), bounded handler goroutines,events_droppedin/health.t=1→t=3, 12-char passphrase floor, derived keys zeroed.notetaker-open-external.pattern_learner,doctor_checks,base_client.go,requestLocation,admin.gopagination.Origin: Slack #cli thread — Nick reported the localhost-URL UX issue.
Jira: TW-4877
Test plan
make cigreen (build, vet, lint, race, security, govulncheck)nylas webhook server(TTY, no flags) prompts for tunnel; Ctrl-D exits cleanlynylas webhook server --no-tunnelruns loopback-only without prompt