GitHub webhook endpoint returns `UNAUTHORIZED` before signature validation

[1jmj]

When configuring the GitHub integration on a self-hosted BugPin instance, GitHub webhook deliveries fail with HTTP authentication errors:

{
  "success": false,
  "error": "UNAUTHORIZED",
  "message": "Authentication required"
}

Expected behaviour

POST /api/webhooks/github/:integrationId should be a public endpoint. Authentication of the incoming GitHub request should be performed by validating the X-Hub-Signature-256 signature against the configured webhook secret.

Actual behaviour

The request appears to be intercepted by BugPin's normal authenticated /api/webhooks middleware before it reaches the GitHub webhook handler.

In src/server/routes/index.ts, the generic webhook routes are mounted before the GitHub-specific route:

api.route('/webhooks', webhooksRoutes);

// ...

// Mount GitHub webhook routes (public, no auth)
api.route('/webhooks/github', githubWebhookRoutes);

However, webhooksRoutes applies authentication middleware:

webhooks.use('*', authMiddleware);
webhooks.use('*', authorize(['admin']));
webhooks.use('*', requireEEFeature('webhooks'));

Consequently a GitHub request to:

POST /api/webhooks/github/:integrationId

appears to match /webhooks/* first and is rejected because GitHub does not have a BugPin authenticated session.

This also appears consistent with the response: the GitHub webhook handler itself returns errors such as Missing signature or Invalid signature, whereas the observed response is the application's generic UNAUTHORIZED / Authentication required response.

Possible fix

Mount the public GitHub webhook route before the authenticated generic webhook routes, e.g.:

// Public GitHub webhook must be registered first
api.route('/webhooks/github', githubWebhookRoutes);

if (!eeRoutePaths.has('/webhooks')) {
  api.route('/webhooks', webhooksRoutes);
}

Environment

• Self-hosted BugPin
• Docker image: registry.arantic.cloud/bugpin/bugpin:latest
• GitHub repository integration
• GitHub webhook deliveries reach BugPin successfully but receive the UNAUTHORIZED response above.

[ar4ntic]

Thanks. Will look into it.