Host-neutral help (deployment-specific facts removed), registered with
HelpBundles, gated by HelpBundleAssertions. QQQ 4.1.0-RC.7.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Help bundle for the app and all five tables (how rows get created, where
event types come from), applied by WebhooksHelp. Setup card on the home.
WebhooksTablesGuardrailTest. Test that an expired secret stops signing
before it is retired. Nothing is seeded (owner choices and logs).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Delete the local shared/signing package (WebhookSigner, WebhookVerifier,
WebhookSecret, WebhookVerificationException) and use core
com.kingsrook.qqq.backend.core.utils.webhooks from QQQ 4.1.0-RC.5.
Delivery signing, inbound verification and secret generation and rotation
all go through core. The wire format is unchanged: same headers, v1,
prefix, whsec_ secrets and timestamp tolerance. Endpoints, secret storage
and delivery stay in this qbit.
Refs QRun-IO/qqq#1160 (this repo has issues disabled), architecture review
QRun-IO/qqq#1150 finding F11.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The README now matches the code. docs/DESIGN.md covers the signing format,
SSRF policy, event sources, delivery semantics, data model and the phase 2
inbound design; docs/RECEIVERS.md has verification code for Java, Node.js
and Python.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
james.maesandClaude Opus 5.5