From 9cc36dae596782990e589a6758307d1545248cc5 Mon Sep 17 00:00:00 2001
From: Ben Allfree <ben@benallfree.com>
Date: Wed, 26 Nov 2025 09:25:13 -0800
Subject: [PATCH] feat: implement bearer token verification for GitHub webhook
 to enhance security

---
 .github/workflows/custom_build.yml |  2 ++
 convex/http.ts                     | 20 ++++++++++++++++++--
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/custom_build.yml b/.github/workflows/custom_build.yml
index 0ff1b58..89ab3f9 100644
--- a/.github/workflows/custom_build.yml
+++ b/.github/workflows/custom_build.yml
@@ -33,6 +33,7 @@ jobs:
     env:
       CONVEX_URL: ${{ inputs.convex_url }}
       BUILD_ID: ${{ inputs.build_id }}
+      CONVEX_BUILD_TOKEN: ${{ secrets.CONVEX_BUILD_TOKEN }}
     steps:
       - name: Setup status update helper
         shell: bash
@@ -47,6 +48,7 @@ jobs:
             fi
             curl -sSf -X POST "$CONVEX_URL/github-webhook" \
               -H "Content-Type: application/json" \
+              -H "Authorization: Bearer $CONVEX_BUILD_TOKEN" \
               -d "$payload" || true
           }
           EOF
diff --git a/convex/http.ts b/convex/http.ts
index a5ee5e2..462ebba 100644
--- a/convex/http.ts
+++ b/convex/http.ts
@@ -11,9 +11,25 @@ http.route({
   path: '/github-webhook',
   method: 'POST',
   handler: httpAction(async (ctx, request) => {
-    const payload = await request.json()
+    // Verify bearer token
+    const buildToken = process.env.CONVEX_BUILD_TOKEN
+    if (!buildToken) {
+      return new Response('CONVEX_BUILD_TOKEN not configured', { status: 500 })
+    }
 
-    // Verify signature (TODO: Add HMAC verification)
+    const authHeader = request.headers.get('Authorization')
+    if (!authHeader || !authHeader.startsWith('Bearer ')) {
+      return new Response('Missing or invalid Authorization header', {
+        status: 401,
+      })
+    }
+
+    const token = authHeader.substring(7) // Remove 'Bearer ' prefix
+    if (token !== buildToken) {
+      return new Response('Invalid token', { status: 401 })
+    }
+
+    const payload = await request.json()
 
     // Validate build_id and state are present
     if (!payload.build_id || !payload.state) {