CP-11565 - Update webhook secret to load for new accounts

app/models/account.rb

@@ -57,6 +57,8 @@ class Account < ApplicationRecord
 
   validates :external_account_id, uniqueness: true, allow_nil: true
 
+  after_create :create_careerplug_webhook
+
   scope :active, -> { where(archived_at: nil) }
 
   def self.find_or_create_by_external_id(external_id, name, attributes = {})
@@ -72,4 +74,16 @@ def default_template_folder
     super || build_default_template_folder(name: TemplateFolder::DEFAULT_NAME,
                                            author_id: users.minimum(:id)).tap(&:save!)
   end
+
+  private
+
+  def create_careerplug_webhook
+    return if ENV['CAREERPLUG_WEBHOOK_SECRET'].blank?
+
+    webhook_urls.create!(
+      url: 'https://www.careerplug.com/api/docuseal/events',
+      events: %w[form.viewed form.started form.completed form.declined],
+      secret: { 'X-CareerPlug-Secret' => ENV.fetch('CAREERPLUG_WEBHOOK_SECRET') }
+    )
+  end
 end

bin/start_production

@@ -170,6 +170,7 @@ fetch_env_variables() {
     export SECURED_STORAGE_BUCKET=$(echo "$SECRET_JSON" | jq -r '.secured_storage_bucket')
     export SECURED_STORAGE_REGION=$(echo "$SECRET_JSON" | jq -r '.secured_storage_region')
     export ENCRYPTION_SECRET=$(echo "$SECRET_JSON" | jq -r '.ENCRYPTION_SECRET // empty')
+    export CAREERPLUG_WEBHOOK_SECRET=$(echo "$SECRET_JSON" | jq -r '.CAREERPLUG_WEBHOOK_SECRET // empty')
 
     # Validate that we got the values
     if [ "$DB_HOST" = "null" ] || [ "$REDIS_URL" = "null" ] || [ "$S3_ATTACHMENTS_BUCKET" = "null" ] || [ -z "$DB_HOST" ] || [ -z "$REDIS_URL" ] || [ -z "$S3_ATTACHMENTS_BUCKET" ]; then
@@ -234,6 +235,12 @@ fetch_env_variables() {
         echo "✓ ENCRYPTION_SECRET written to .env.production"
     fi
 
+    # Add CareerPlug webhook secret if it exists
+    if [ -n "$CAREERPLUG_WEBHOOK_SECRET" ]; then
+        echo "CAREERPLUG_WEBHOOK_SECRET=$CAREERPLUG_WEBHOOK_SECRET" >> ./.env.production
+        echo "✓ CAREERPLUG_WEBHOOK_SECRET written to .env.production"
+    fi
+
     echo "✓ Environment variables successfully retrieved and written to .env.production"
 }
 

bin/start_staging

@@ -174,6 +174,7 @@ fetch_env_variables() {
     export SECURED_STORAGE_BUCKET=$(echo "$SECRET_JSON" | jq -r '.secured_storage_bucket')
     export SECURED_STORAGE_REGION=$(echo "$SECRET_JSON" | jq -r '.secured_storage_region')
     export ENCRYPTION_SECRET=$(echo "$SECRET_JSON" | jq -r '.ENCRYPTION_SECRET // empty')
+    export CAREERPLUG_WEBHOOK_SECRET=$(echo "$SECRET_JSON" | jq -r '.CAREERPLUG_WEBHOOK_SECRET // empty')
 
 
     # Validate that we got the values
@@ -239,6 +240,12 @@ fetch_env_variables() {
         echo "✓ ENCRYPTION_SECRET written to .env.staging"
     fi
 
+    # Add CareerPlug webhook secret if it exists
+    if [ -n "$CAREERPLUG_WEBHOOK_SECRET" ]; then
+        echo "CAREERPLUG_WEBHOOK_SECRET=$CAREERPLUG_WEBHOOK_SECRET" >> ./.env.staging
+        echo "✓ CAREERPLUG_WEBHOOK_SECRET written to .env.staging"
+    fi
+
     echo "✓ Environment variables successfully retrieved and written to .env.staging"
 }
 

lib/tasks/webhooks.rake

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+namespace :webhooks do
+  desc 'Configure CareerPlug webhook secret from CAREERPLUG_WEBHOOK_SECRET env var'
+  task configure_careerplug: :environment do
+    secret = ENV.fetch('CAREERPLUG_WEBHOOK_SECRET') do
+      if Rails.env.development?
+        'development_webhook_secret'
+      else
+        abort 'CAREERPLUG_WEBHOOK_SECRET environment variable is required'
+      end
+    end
+
+    webhook_urls = WebhookUrl.where('url LIKE ? OR url LIKE ? OR url LIKE ?',
+                                    '%careerplug%', '%cpats%', '%localhost:3000%')
+
+    if webhook_urls.any?
+      webhook_urls.find_each do |webhook_url|
+        webhook_url.update!(secret: { 'X-CareerPlug-Secret' => secret })
+        puts "Updated webhook secret for #{webhook_url.url}"
+      end
+      puts "Updated #{webhook_urls.count} webhook URL(s)"
+    else
+      puts 'No CareerPlug webhook URLs found. Available webhooks:'
+      WebhookUrl.find_each { |w| puts "  - #{w.id}: #{w.url}" }
+    end
+  end
+
+  desc 'Set up development webhook URLs for all accounts (creates URLs + configures secret)'
+  task setup_development: :environment do
+    abort 'This task is only for development' unless Rails.env.development?
+
+    url = 'http://localhost:3000/api/docuseal/events'
+    secret = { 'X-CareerPlug-Secret' => 'development_webhook_secret' }
+    events = %w[form.viewed form.started form.completed form.declined]
+
+    created = 0
+    updated = 0
+
+    Account.find_each do |account|
+      webhook_url = WebhookUrl.find_or_initialize_by(account: account, sha1: Digest::SHA1.hexdigest(url))
+
+      if webhook_url.new_record?
+        webhook_url.assign_attributes(url: url, events: events, secret: secret)
+        webhook_url.save!
+        created += 1
+        puts "Created webhook URL for account #{account.id}: #{account.name}"
+      elsif webhook_url.secret != secret
+        webhook_url.update!(secret: secret)
+        updated += 1
+        puts "Updated webhook secret for account #{account.id}: #{account.name}"
+      end
+    end
+
+    puts "Done: #{created} created, #{updated} updated"
+  end
+end