feat: accept callback_secret in RequestValidator, deprecate api_key by Skumring · Pull Request #45 · didww/didww-api-3-python-sdk

Skumring · 2026-10-06T15:31:43Z

DIDWW signs callbacks with the callback secret that is enabled in the User Panel under APIs → DIDWW API 3 → Callback Secrets. The validator is keyed with that value, and this PR names it so.

What changed

RequestValidator: __init__(self, callback_secret=None, *, api_key=None); the HMAC is keyed with the callback secret. The signature algorithm (HMAC-SHA1), the X-DIDWW-Signature header and the URL/payload normalisation are unchanged.
README, Webhook Signature Validation: the example passes the callback secret, and one sentence says where it comes from.

Compatibility

Positional calls keep working. Python exposes keyword arguments and attributes, so api_key= and validator.api_key stay as deprecated aliases that emit DeprecationWarning (reading and writing the attribute both work). Passing both, or neither, raises TypeError. Tests cover each case.

Checks

CI is green; locally the whole suite passes (309 tests, 31 of them for the validator).

Merge order

Merge only after callback secrets are available in the User Panel and the public documentation describing them is published: until then the User Panel section the README points to does not exist. The version bump and the changelog are left to the release.

coderabbitai · 2026-10-06T15:31:59Z

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 17 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 607b5aff-7aae-4c59-88d1-e7fbb1a49336

📥 Commits

Reviewing files that changed from the base of the PR and between 7bd0f43 and 4789ed5.

📒 Files selected for processing (3)

README.md
src/didww/callback/request_validator.py
tests/test_request_validator.py

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 7c7d8bfd-ef7e-44e3-a0a6-000eb8591222

📥 Commits

Reviewing files that changed from the base of the PR and between 123e13d and 7bd0f43.

📒 Files selected for processing (3)

README.md
src/didww/callback/request_validator.py
tests/test_request_validator.py

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

RequestValidator now accepts callback_secret as its primary credential and supports api_key as a deprecated alias. Signature computation uses the callback secret. The README example and constructor tests reflect the updated arguments.

Changes

Callback secret validation

Layer / File(s)	Summary
Credential handling and example `src/didww/callback/request_validator.py`, `tests/test_request_validator.py`, `README.md`	`RequestValidator` accepts `callback_secret`, warns when callers provide `api_key`, and raises `TypeError` if neither is provided. Signature computation uses `callback_secret`. Tests and the README example cover the updated credential.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to 7bd0f

The callback-secret update has no established merge-blocking issue. Merge after the platform release introducing callback secrets, as planned.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 2 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the primary change: `RequestValidator` accepts `callback_secret` and deprecates `api_key`.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 2 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Copilot

Copilot review overview

🟡 Changes recommended

Constructor ambiguity and removal of the public api_key attribute create avoidable compatibility risks.

Review effort: Balanced
Findings: 1

Open (1)

Reject simultaneous api_key and callback_secret values · New

What changed in this PR

Renames the webhook validation credential to callback_secret while preserving deprecated api_key constructor compatibility.

Changes:

Adds callback-secret initialization and deprecated alias handling.
Updates validator tests and webhook documentation.

File	Description
`src/didww/callback/request_validator.py`	Renames the HMAC credential and adds compatibility handling.
`tests/test_request_validator.py`	Tests new and deprecated constructor arguments.
`README.md`	Documents callback secret configuration and usage.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

The validator is keyed with the callback secret enabled in the DIDWW User Panel (APIs -> DIDWW API 3 -> Callback Secrets). The constructor argument and attribute are now callback_secret. The api_key keyword argument and attribute stay as deprecated aliases (DeprecationWarning); passing both, or neither, raises TypeError. The README example and its introduction say where the value comes from. Positional calls, the signature algorithm and the header are unchanged.

sonarqubecloud · 2026-10-06T16:14:57Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Copilot

Copilot review overview

🟡 Changes recommended

Explicit None allows both constructor arguments without the promised conflict error.

Review effort: Balanced
Findings: 1

Open (1)

Use a sentinel to detect explicitly supplied callback_secret · New

Resolved since last review (1)

Reject simultaneous api_key and callback_secret values

Skumring requested a balanced review from Copilot October 6, 2026 15:45

Copilot started reviewing on behalf of Skumring October 6, 2026 15:46

View session

Copilot AI reviewed Oct 6, 2026

View reviewed changes

Comment thread src/didww/callback/request_validator.py Resolved

Skumring force-pushed the feat/callback-secret branch 3 times, most recently from 34423f3 to 63b30c3 Compare October 6, 2026 16:02

Skumring force-pushed the feat/callback-secret branch from 63b30c3 to 4789ed5 Compare October 6, 2026 16:14

Skumring requested a balanced review from Copilot October 6, 2026 16:21

Copilot started reviewing on behalf of Skumring October 6, 2026 16:21

View session

Copilot AI reviewed Oct 6, 2026

View reviewed changes

Comment thread src/didww/callback/request_validator.py Resolved

Skumring self-assigned this Oct 7, 2026

Skumring requested a review from Fivell October 7, 2026 09:12

Skumring merged commit 473fa37 into main Oct 7, 2026
15 checks passed

Skumring deleted the feat/callback-secret branch October 7, 2026 12:47

Skumring mentioned this pull request Oct 7, 2026

Release 3.2.0 #46

Merged

Navigation Menu

Repository navigation

feat: accept callback_secret in RequestValidator, deprecate api_key - #45

feat: accept callback_secret in RequestValidator, deprecate api_key#45
Skumring merged 1 commit into
mainfrom
feat/callback-secret

Skumring commented Oct 6, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 6, 2026 •

edited

Loading

Review limit reached

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

sonarqubecloud Bot commented Oct 6, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Skumring commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changed

Compatibility

Checks

Merge order

Uh oh!

coderabbitai Bot commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

sonarqubecloud Bot commented Oct 6, 2026

Quality Gate passed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Skumring commented Oct 6, 2026 •

edited

Loading

coderabbitai Bot commented Oct 6, 2026 •

edited

Loading