Snapshot Webhook Update

libs/adapters/src/config.ts

@@ -296,9 +296,7 @@ export const config = configure(
       })
       .refine(
         (data) => {
-          if (
-            !['local', 'CI', 'discobot', 'snapshot'].includes(target.APP_ENV)
-          ) {
+          if (!['local', 'CI'].includes(target.APP_ENV)) {
             return (
               !!LOAD_TESTING_AUTH_TOKEN &&
               data.AUTH_TOKEN !== DEFAULTS.LOAD_TESTING_AUTH_TOKEN

libs/core/src/config.ts

@@ -18,8 +18,6 @@ const AppEnvironments = [
   'beta',
   'demo',
   'production',
-  'discobot',
-  'snapshot',
 ] as const;
 type Environment = (typeof Environments)[number];
 type AppEnvironment = (typeof AppEnvironments)[number];

packages/commonwealth/server/api/integration-router.ts

@@ -1,6 +1,8 @@
 import { express } from '@hicommonwealth/adapters';
+import { AppError } from '@hicommonwealth/core';
 import { ChainEvents, Snapshot } from '@hicommonwealth/model';
 import { Router, raw } from 'express';
+import { config } from '../config';
 
 const PATH = '/api/integration';
 
@@ -26,6 +28,16 @@ function build() {
 
   router.post(
     '/snapshot/webhook',
+    (req, _, next) => {
+      const headerSecret = req.headers['authentication'];
+      if (
+        config.SNAPSHOT_WEBHOOK_SECRET &&
+        headerSecret !== config.SNAPSHOT_WEBHOOK_SECRET
+      ) {
+        throw new AppError('Unauthorized', 401);
+      }
+      return next();
+    },
     express.command(Snapshot.CreateSnapshotProposal()),
   );
 

packages/commonwealth/server/config.ts

@@ -156,5 +156,12 @@ export const config = configure(
       EVM_CE_POLL_INTERVAL_MS: z.number().int().positive(),
     }),
     PEER_ID: z.string().optional(),
+    SNAPSHOT_WEBHOOK_SECRET: z
+      .string()
+      .optional()
+      .refine(
+        (data) => !(!['local', 'CI'].includes(model_config.APP_ENV) && !data),
+        'SNAPSHOT_WEBHOOK_SECRET is required in public environments',
+      ),
   }),
 );