fix(webapp): strip client-supplied webhook actionSource on session input

Only the hosted webhook ingress may mark an action as webhook-sourced, which skips action-schema validation in the run loop. The session .in append route now strips a client-supplied actionSource: "webhook" from incoming records, so a caller with session write access cannot claim webhook trust for an unvalidated action.

Author: ericallam

apps/webapp/app/routes/realtime.v1.sessions.$session.$io.append.ts

@@ -10,6 +10,7 @@ import {
   resolveSessionWithWriterFallback,
 } from "~/services/realtime/sessions.server";
 import { getRealtimeStreamInstance } from "~/services/realtime/v1StreamsGlobal.server";
+import { stripClientWebhookActionSource } from "~/services/realtime/sanitizeSessionInput.server";
 import {
   claimSessionStreamPart,
   drainSessionStreamWaitpoints,
@@ -137,7 +138,11 @@ const { action, loader } = createActionApiRoute(
 
     const addressingKey = canonicalSessionAddressingKey(session, params.session);
 
-    const part = await request.text();
+    let part = await request.text();
+    if (params.io === "in") {
+      part = stripClientWebhookActionSource(part);
+    }
+
     const clientPartId = request.headers.get("X-Part-Id");
     const partId = clientPartId ?? nanoid(7);
 

apps/webapp/app/services/realtime/sanitizeSessionInput.server.ts

@@ -0,0 +1,25 @@
+/**
+ * Strip a client-forged `actionSource: "webhook"` from a session `.in` append part.
+ *
+ * Only the hosted webhook ingress may claim webhook trust, and it appends server-side rather than
+ * through the client append route. A client with session write access could otherwise send a record
+ * carrying `actionSource: "webhook"`, which the run loop uses to skip action-schema validation. We
+ * downgrade it here (delete the field) so the record is validated as a normal client action.
+ */
+export function stripClientWebhookActionSource(part: string): string {
+  if (!part.includes('"actionSource"')) return part;
+
+  let record: { payload?: { actionSource?: string } } | undefined;
+  try {
+    record = JSON.parse(part) as { payload?: { actionSource?: string } };
+  } catch {
+    return part;
+  }
+
+  if (record?.payload?.actionSource === "webhook") {
+    delete record.payload.actionSource;
+    return JSON.stringify(record);
+  }
+
+  return part;
+}

apps/webapp/test/sanitizeSessionInput.server.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, it } from "vitest";
+import { stripClientWebhookActionSource } from "~/services/realtime/sanitizeSessionInput.server";
+
+const record = (payload: Record<string, unknown>) => JSON.stringify({ kind: "message", payload });
+
+describe("stripClientWebhookActionSource", () => {
+  it("removes a client-forged webhook actionSource so the action is validated normally", () => {
+    const forged = record({
+      chatId: "c1",
+      trigger: "action",
+      actionSource: "webhook",
+      action: { type: "refund", amount: 9999 },
+    });
+
+    const cleaned = JSON.parse(stripClientWebhookActionSource(forged));
+    expect(cleaned.payload.actionSource).toBeUndefined();
+    expect(cleaned.payload.action).toEqual({ type: "refund", amount: 9999 });
+    expect(cleaned.payload.trigger).toBe("action");
+  });
+
+  it("leaves a non-webhook actionSource untouched", () => {
+    const part = record({ trigger: "action", actionSource: "client", action: { type: "ping" } });
+    expect(stripClientWebhookActionSource(part)).toBe(part);
+  });
+
+  it("leaves a normal message part untouched (fast path, no parse)", () => {
+    const part = record({ trigger: "submit-message", message: { role: "user", parts: [] } });
+    expect(stripClientWebhookActionSource(part)).toBe(part);
+  });
+
+  it("leaves a malformed part untouched", () => {
+    const part = '{"kind":"message","payload":{"actionSource":"webhook"';
+    expect(stripClientWebhookActionSource(part)).toBe(part);
+  });
+});