fix(agent_api_keys): validate webhook path before create

Author: danielmillerp

agentex/openapi.yaml

@@ -4615,7 +4615,9 @@ components:
           - type: string
           - type: 'null'
           title: Secret
-          description: Optional signing secret; if unset, one is generated and returned.
+          description: Signing secret. For GitHub, omit to generate one, or provide
+            an existing webhook secret. For Slack, this is required and must be the
+            Slack app's Signing Secret.
         base_url:
           anyOf:
           - type: string

agentex/src/api/routes/agent_api_keys.py

@@ -160,6 +160,13 @@ async def create_webhook_trigger(
             ),
         )
 
+    forward_path = request.forward_path.lstrip("/")
+    if _has_control_chars(forward_path):
+        raise HTTPException(
+            status_code=400,
+            detail="forward_path must not contain control characters.",
+        )
+
     secret = request.secret if request.secret is not None else secrets.token_hex(32)
     agent_api_key_entity = await agent_api_key_use_case.create(
         agent_id=agent.id,
@@ -168,12 +175,6 @@ async def create_webhook_trigger(
         api_key_type=request.source,
     )
 
-    forward_path = request.forward_path.lstrip("/")
-    if _has_control_chars(forward_path):
-        raise HTTPException(
-            status_code=400,
-            detail="forward_path must not contain control characters.",
-        )
     encoded_agent_name = quote(request.agent_name, safe="")
     encoded_forward_path = quote(forward_path, safe="/")
     webhook_path = f"/agents/forward/name/{encoded_agent_name}/{encoded_forward_path}"

agentex/tests/unit/api/test_webhook_trigger.py

@@ -104,15 +104,30 @@ async def test_forward_path_reserved_chars_are_url_encoded(self, monkeypatch):
         assert resp.webhook_url == f"https://sgp.example.com{resp.webhook_path}"
 
     async def test_forward_path_control_chars_rejected(self, monkeypatch):
+        monkeypatch.setattr(mod, "_check_agent_or_collapse_to_404", AsyncMock())
+
         req = CreateWebhookTriggerRequest(
             agent_name="a",
             source=AgentAPIKeyType.GITHUB,
             name="o/r",
             forward_path="github-pr/cfg-9\nnext",
         )
+        agent_use_case = MagicMock()
+        agent_use_case.get = AsyncMock(return_value=MagicMock(id="agent-1"))
+
+        akuc = MagicMock()
+        akuc.get_by_agent_id_and_name = AsyncMock(return_value=None)
+        akuc.create = AsyncMock()
+
         with pytest.raises(HTTPException) as exc:
-            await self._call(monkeypatch, req)
+            await create_webhook_trigger(
+                request=req,
+                agent_api_key_use_case=akuc,
+                agent_use_case=agent_use_case,
+                authorization_service=MagicMock(),
+            )
         assert exc.value.status_code == 400
+        akuc.create.assert_not_awaited()
 
     async def test_conflict_when_key_exists(self, monkeypatch):
         req = CreateWebhookTriggerRequest(