Enum WebhookAuth 

pub enum WebhookAuth {
    None,
    Header {
        name: String,
        expected: String,
    },
    HmacSha256 {
        header: String,
        secret: String,
    },
}

Authentication strategy for a webhook endpoint.

Each variant describes how to verify that an incoming request is legitimate. Use the constructor methods (WebhookAuth::none, WebhookAuth::header, WebhookAuth::github, WebhookAuth::gitlab) rather than building variants manually, as they normalise header names and apply the correct defaults.

Examples

use ironflow_runtime::webhook::WebhookAuth;

// No authentication
let auth = WebhookAuth::none();

// GitHub HMAC-SHA256 authentication
let auth = WebhookAuth::github("my-webhook-secret");

// GitLab static-token authentication
let auth = WebhookAuth::gitlab("my-gitlab-token");

// Custom header authentication
let auth = WebhookAuth::header("x-api-key", "secret-value");

Variants

None

No authentication - every request is accepted.

Header

Static header comparison.

The request must contain a header whose value exactly matches expected. The header name is stored in lower-case.

Fields

name: String

Lower-cased header name.

expected: String

Expected header value.

HmacSha256

HMAC-SHA256 signature verification.

The request must contain a header whose value is a hex-encoded HMAC-SHA256 digest prefixed with sha256=. The digest is computed over the raw request body using secret as the HMAC key.

Fields

header: String

Header name that carries the signature (e.g. x-hub-signature-256).

secret: String

Shared secret used to compute the HMAC.

Implementations

impl WebhookAuth

pub fn none() -> Self

Creates an authentication strategy that accepts every request.

Examples

use ironflow_runtime::webhook::WebhookAuth;

let auth = WebhookAuth::none();

pub fn header(name: &str, expected: &str) -> Self

Creates a static-header authentication strategy.

The name is automatically lower-cased so that look-ups are case-insensitive (HTTP headers are case-insensitive by spec).

Examples

use ironflow_runtime::webhook::WebhookAuth;

let auth = WebhookAuth::header("x-api-key", "super-secret");

pub fn gitlab(secret: &str) -> Self

Preset for GitLab webhooks.

GitLab sends the secret token in the X-Gitlab-Token header as a plain-text value. This is a convenience wrapper around WebhookAuth::header.

Examples

use ironflow_runtime::webhook::WebhookAuth;

let auth = WebhookAuth::gitlab("my-gitlab-secret");

pub fn github(secret: &str) -> Self

Preset for GitHub webhooks.

GitHub signs the payload body with HMAC-SHA256 and sends the result in the X-Hub-Signature-256 header, prefixed with sha256=. This constructor configures the correct header name and stores the shared secret.

Examples

use ironflow_runtime::webhook::WebhookAuth;

let auth = WebhookAuth::github("my-github-webhook-secret");

pub fn verify(&self, headers: &HeaderMap, body: &[u8]) -> bool

Verifies an incoming request against this authentication strategy.

Returns true if the request is authentic, false otherwise.

Behaviour per variant

Variant	Verification
None	Always returns true.
Header	Checks that the named header equals the expected value.
HmacSha256	Strips the sha256= prefix, hex-decodes the signature, computes HMAC-SHA256 over body, and compares in constant time.

Examples

use axum::http::HeaderMap;
use ironflow_runtime::webhook::WebhookAuth;

let auth = WebhookAuth::none();
let headers = HeaderMap::new();
assert!(auth.verify(&headers, b"any body"));

Trait Implementations

impl Clone for WebhookAuth

fn clone(&self) -> WebhookAuth

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for WebhookAuth

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.