[codex] Harden dashboard and Discord security boundaries

Squash merge PR #324.

Author: michaelmwu

.env.example

@@ -66,8 +66,12 @@ WEB_HOST_BIND=127.0.0.1
 # `WEB_PORT` with a deterministic per-worktree port automatically.
 # Deprecated fallback names still work: WEBHOOK_INGEST_HOST, WEBHOOK_INGEST_PORT,
 # WEBHOOK_INGEST_HOST_BIND, WEBHOOK_INGEST_HOST_PORT.
-# Required: ingest requests are rejected when unset
+# Required for protected non-dashboard API routes. Webhook routes use this only
+# when WEBHOOK_SHARED_SECRET is unset.
 API_SHARED_SECRET=
+# Optional: separate secret for external /webhooks/* callers. When unset or
+# blank, webhook routes fall back to API_SHARED_SECRET for compatibility.
+WEBHOOK_SHARED_SECRET=
 # Authentik admin API (required for /create-sso-user and /create-user-accounts)
 # Base URL can omit /api/v3; the client adds it automatically.
 AUTHENTIK_API_BASE_URL=

apps/api/src/five08/backend/api.py

@@ -410,19 +410,51 @@ def _get_agent_orchestrator() -> AgentOrchestrator:
     return _AGENT_ORCHESTRATOR
 
 
-def _is_authorized(request: Request) -> bool:
-    """Validate shared API secret."""
-    if not settings.api_shared_secret:
-        logger.error("Rejecting request: API_SHARED_SECRET is not configured")
+def _is_authorized_with_secret(
+    request: Request,
+    *,
+    configured_secret: str | None,
+    setting_name: str,
+) -> bool:
+    """Validate an X-API-Secret header against one configured secret."""
+    secret = (configured_secret or "").strip()
+    if not secret:
+        logger.error("Rejecting request: %s is not configured", setting_name)
         return False
 
     provided_secret = request.headers.get("X-API-Secret", "")
-    if secrets.compare_digest(provided_secret, settings.api_shared_secret):
+    if secrets.compare_digest(provided_secret, secret):
         return True
-    logger.warning("Rejecting request: invalid X-API-Secret")
+    logger.warning("Rejecting request: invalid X-API-Secret for %s", setting_name)
     return False
 
 
+def _is_authorized(request: Request) -> bool:
+    """Validate the internal shared API secret."""
+    return _is_authorized_with_secret(
+        request,
+        configured_secret=settings.api_shared_secret,
+        setting_name="API_SHARED_SECRET",
+    )
+
+
+def _is_webhook_authorized(request: Request) -> bool:
+    """Validate the external webhook secret, with legacy API secret fallback."""
+    webhook_secret = (settings.webhook_shared_secret or "").strip()
+    if webhook_secret:
+        return _is_authorized_with_secret(
+            request,
+            configured_secret=webhook_secret,
+            setting_name="WEBHOOK_SHARED_SECRET",
+        )
+
+    return _is_authorized_with_secret(
+        request,
+        configured_secret=settings.api_shared_secret,
+        setting_name="API_SHARED_SECRET",
+    )
+
+
 def _agent_request_rate_limited(discord_user_id: str) -> bool:
     now = time.monotonic()
     window_start = now - _AGENT_REQUEST_RATE_LIMIT_WINDOW_SECONDS
@@ -2411,7 +2443,7 @@ async def health_handler(request: Request) -> JSONResponse:
 
 async def ingest_handler(request: Request, source: str) -> JSONResponse:
     """Validate and enqueue incoming webhook payloads."""
-    if not _is_authorized(request):
+    if not _is_webhook_authorized(request):
         return JSONResponse({"error": "unauthorized"}, status_code=401)
 
     try:
@@ -2446,7 +2478,7 @@ async def ingest_handler(request: Request, source: str) -> JSONResponse:
 
 async def espocrm_webhook_handler(request: Request) -> JSONResponse:
     """Validate EspoCRM webhook payload and enqueue per-contact jobs."""
-    if not _is_authorized(request):
+    if not _is_webhook_authorized(request):
         return JSONResponse({"error": "unauthorized"}, status_code=401)
 
     try:
@@ -5856,7 +5888,7 @@ async def dashboard_sync_people_handler(request: Request) -> JSONResponse:
 
 async def espocrm_people_sync_webhook_handler(request: Request) -> JSONResponse:
     """Queue per-contact people cache sync jobs from CRM webhook events."""
-    if not _is_authorized(request):
+    if not _is_webhook_authorized(request):
         return JSONResponse({"error": "unauthorized"}, status_code=401)
 
     try:
@@ -5910,7 +5942,7 @@ async def docuseal_webhook_handler(request: Request) -> JSONResponse:
     Job payload contract for the queue is:
     completed_at = "YYYY-MM-DD HH:mm:ss" in UTC.
     """
-    if not _is_authorized(request):
+    if not _is_webhook_authorized(request):
         return JSONResponse({"error": "unauthorized"}, status_code=401)
 
     try:
@@ -6027,7 +6059,7 @@ async def docuseal_webhook_handler(request: Request) -> JSONResponse:
 
 async def google_forms_intake_webhook_handler(request: Request) -> JSONResponse:
     """Validate a Google Forms intake submission and enqueue a processing job."""
-    if not _is_authorized(request):
+    if not _is_webhook_authorized(request):
         return JSONResponse({"error": "unauthorized"}, status_code=401)
 
     try: