feat(webhooks): [APLAT-589] wire PagerDuty webhook end-to-end by shivanshtamrakar-s1 · Pull Request #51 · martiner/spdreport

shivanshtamrakar-s1 · 2026-05-21T13:01:30Z

Add POST /webhooks/pagerduty/incident — verifies the X-PagerDuty-
Signature, parses the v3 incident.responder.added payload, filters for
the watched escalation policy, and posts a Slack notification when it
matches. Returns 401 on bad/missing signature, 200 on signed bodies
regardless of match (200-on-no-match prevents PagerDuty retry storms).

Components: PagerDutyWebhookController (HTTP entrypoint),
PagerDutyWebhookService (verify-parse-filter-notify orchestration),
WebhookBodySizeFilter (rejects /webhooks/* POSTs >64KB with 413 to
mitigate DoS via large bodies).

Security wiring: WebSecurityConfig CSRF-exempts the single exact path
/webhooks/pagerduty/incident (tighter than a wildcard). Controller
reads raw bytes and decodes UTF-8 explicitly so signature verification
matches what PagerDuty signed regardless of Content-Type charset.
PagerDutySignatureVerifier now logs ERROR (was WARN) when the secret
is unconfigured and rejects all requests instead of throwing during
context initialization.

application.properties adds three properties with empty env-var
defaults so the application context still starts when secrets are not
provisioned locally.

5 web slice tests (200 match, 200 no-match, 401 missing sig, 401 bad
sig, CSRF-exempt path), 3 filter unit tests, plus one new verifier
case covering the empty-secret behavior. Full suite goes from a
pre-existing failure to 81/81 green — the empty-secret tolerance
also fixes SpdreportApplicationTests.contextLoads.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

martiner · 2026-05-29T16:25:44Z

+    fun send(incident: MatchedIncident) {
+        val subject = ":pager: Escalation policy $watchedPolicyId added to incident — ${incident.title}"
+        val email = Email(
+            recipient = InternetAddress(channelEmail),


this could throw an exception - better move it into the try block

moved this to try block

martiner · 2026-05-29T16:26:04Z

+    properties = [
+        "pagerduty.webhook.secret=test-secret",
+        "pagerduty.escalation-policy.watch-id=PQ5P8WD",
+        "slack.webhook.url=http://slack.test/hook",


seems unused

martiner · 2026-05-29T16:26:34Z

 spring.mail.properties[mail.smtp.starttls.enable]=true
+
+pagerduty.webhook.secret=${PAGERDUTY_WEBHOOK_SECRET:}
+pagerduty.escalation-policy.watch-id=${WATCH_ID:}


Suggested change

pagerduty.escalation-policy.watch-id=${WATCH_ID:}

pagerduty.escalation-policy.watch-id=${PAGERDUTY_WATCH_ID:}

for consistency

martiner · 2026-06-02T07:23:09Z

+pagerduty.webhook.secret=${PAGERDUTY_WEBHOOK_SECRET:}
+pagerduty.escalation-policy.watch-id=${PAGERDUTY_WATCH_ID:}
+slack.channel.email=${SLACK_CHANNEL_EMAIL:}


Suggested change

pagerduty.webhook.secret=${PAGERDUTY_WEBHOOK_SECRET:}

pagerduty.escalation-policy.watch-id=${PAGERDUTY_WATCH_ID:}

slack.channel.email=${SLACK_CHANNEL_EMAIL:}

pagerduty.webhook.secret=${PAGERDUTY_WEBHOOK_SECRET}

pagerduty.escalation-policy.watch-id=${PAGERDUTY_WATCH_ID}

slack.channel.email=${SLACK_CHANNEL_EMAIL}

martiner · 2026-06-07T13:26:54Z

+    private fun sendEmail(subject: String, htmlBody: String, logContext: String) {
+        try {
+            val email = Email(
+                recipient = InternetAddress(channelEmail),


It seems a different exception AddressException is thrown here. Maybe we can move it to constructor:

private val channelEmail: InternetAddress = InternetAddress(slackProperties.channel.email)

and throw the error right on the app start

martiner · 2026-06-07T13:48:37Z

+) {
+
+    private val keySpec: SecretKeySpec? = if (properties.webhook.secret.isEmpty()) {
+        logger.info { "pagerduty.webhook.secret is empty; all PagerDuty webhook deliveries will be rejected with 401" }


this is now unreachable code, with @ConfigurationProperties the "missing" value would be ${PAGERDUTY_WEBHOOK_SECRET}. There is a test, but it tests artificial behaviour that doesn't happen in the real world 😄

my bad , removing this one. thanks

Add POST /webhooks/pagerduty/incident — verifies the X-PagerDuty- Signature, parses the v3 incident.responder.added payload, filters for the watched escalation policy, and posts a Slack notification when it matches. Returns 401 on bad/missing signature, 200 on signed bodies regardless of match (200-on-no-match prevents PagerDuty retry storms). Components: PagerDutyWebhookController (HTTP entrypoint), PagerDutyWebhookService (verify-parse-filter-notify orchestration), WebhookBodySizeFilter (rejects /webhooks/* POSTs >64KB with 413 to mitigate DoS via large bodies). Security wiring: WebSecurityConfig CSRF-exempts the single exact path /webhooks/pagerduty/incident (tighter than a wildcard). Controller reads raw bytes and decodes UTF-8 explicitly so signature verification matches what PagerDuty signed regardless of Content-Type charset. PagerDutySignatureVerifier now logs ERROR (was WARN) when the secret is unconfigured and rejects all requests instead of throwing during context initialization. application.properties adds three properties with empty env-var defaults so the application context still starts when secrets are not provisioned locally. 5 web slice tests (200 match, 200 no-match, 401 missing sig, 401 bad sig, CSRF-exempt path), 3 filter unit tests, plus one new verifier case covering the empty-secret behavior. Full suite goes from a pre-existing failure to 81/81 green — the empty-secret tolerance also fixes SpdreportApplicationTests.contextLoads. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

shivanshtamrakar-s1 force-pushed the pd-slack-int branch from 07e13e6 to ac8ba33 Compare May 26, 2026 12:32

martiner requested changes May 29, 2026

View reviewed changes

martiner reviewed Jun 1, 2026

View reviewed changes

Comment thread src/main/kotlin/cz/geek/spdreport/pagerduty/PagerDutySignatureVerifier.kt Outdated

martiner reviewed Jun 2, 2026

View reviewed changes

shivanshtamrakar-s1 force-pushed the pd-slack-int branch 5 times, most recently from fcfbeea to ce4e0ce Compare June 4, 2026 10:04

martiner reviewed Jun 7, 2026

View reviewed changes

shivanshtamrakar-s1 force-pushed the pd-slack-int branch 3 times, most recently from 94ef613 to d0941f7 Compare June 8, 2026 12:41

shivanshtamrakar-s1 force-pushed the pd-slack-int branch from d0941f7 to 9f900a9 Compare June 8, 2026 14:00

martiner merged commit c7ac367 into martiner:master Jun 8, 2026
1 check passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(webhooks): [APLAT-589] wire PagerDuty webhook end-to-end#51

feat(webhooks): [APLAT-589] wire PagerDuty webhook end-to-end#51
martiner merged 1 commit into
martiner:masterfrom
shivanshtamrakar-s1:pd-slack-int

shivanshtamrakar-s1 commented May 21, 2026

Uh oh!

martiner May 29, 2026

Uh oh!

shivanshtamrakar-s1 Jun 1, 2026

Uh oh!

martiner May 29, 2026

Uh oh!

shivanshtamrakar-s1 Jun 1, 2026

Uh oh!

martiner May 29, 2026

Uh oh!

shivanshtamrakar-s1 Jun 1, 2026

Uh oh!

Uh oh!

martiner Jun 2, 2026

Uh oh!

shivanshtamrakar-s1 Jun 2, 2026

Uh oh!

martiner Jun 7, 2026

Uh oh!

martiner Jun 7, 2026

Uh oh!

shivanshtamrakar-s1 Jun 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	pagerduty.escalation-policy.watch-id=${WATCH_ID:}
	pagerduty.escalation-policy.watch-id=${PAGERDUTY_WATCH_ID:}

Uh oh!

Conversation

shivanshtamrakar-s1 commented May 21, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants