use env vars for client id/secret

Author: arcoraven

src/utils/env.ts

@@ -107,6 +107,8 @@ export const env = createEnv({
      */
     ENABLE_KEYPAIR_AUTH: boolEnvSchema(false),
     ENABLE_CUSTOM_HMAC_AUTH: boolEnvSchema(false),
+    CUSTOM_HMAC_AUTH_CLIENT_ID: z.string().optional(),
+    CUSTOM_HMAC_AUTH_CLIENT_SECRET: z.string().optional(),
   },
   clientPrefix: "NEVER_USED",
   client: {},
@@ -148,6 +150,8 @@ export const env = createEnv({
     METRICS_ENABLED: process.env.METRICS_ENABLED,
     ENABLE_KEYPAIR_AUTH: process.env.ENABLE_KEYPAIR_AUTH,
     ENABLE_CUSTOM_HMAC_AUTH: process.env.ENABLE_CUSTOM_HMAC_AUTH,
+    CUSTOM_HMAC_AUTH_CLIENT_ID: process.env.CUSTOM_HMAC_AUTH_CLIENT_ID,
+    CUSTOM_HMAC_AUTH_CLIENT_SECRET: process.env.CUSTOM_HMAC_AUTH_CLIENT_SECRET,
   },
   onValidationError: (error: ZodError) => {
     console.error(

src/utils/webhook.ts

@@ -1,4 +1,5 @@
 import type { Webhooks } from "@prisma/client";
+import assert from "node:assert";
 import crypto, { randomUUID } from "node:crypto";
 import { Agent, fetch } from "undici";
 import { getConfig } from "./cache/getConfig";
@@ -24,14 +25,22 @@ const generateAuthorization = (args: {
 }): string => {
   const { webhook, timestampSeconds, body } = args;
   if (env.ENABLE_CUSTOM_HMAC_AUTH) {
+    assert(
+      env.CUSTOM_HMAC_AUTH_CLIENT_ID,
+      'Missing "CUSTOM_HMAC_AUTH_CLIENT_ID".',
+    );
+    assert(
+      env.CUSTOM_HMAC_AUTH_CLIENT_SECRET,
+      'Missing "CUSTOM_HMAC_AUTH_CLIENT_SECRET"',
+    );
+
     return generateSecretHmac256({
       webhookUrl: webhook.url,
       body,
       timestampSeconds,
       nonce: randomUUID(),
-      // DEBUG
-      clientId: "@TODO: UNIMPLEMENTED",
-      clientSecret: "@TODO: UNIMPLEMENTED",
+      clientId: env.CUSTOM_HMAC_AUTH_CLIENT_ID,
+      clientSecret: env.CUSTOM_HMAC_AUTH_CLIENT_SECRET,
     });
   }
   return `Bearer ${webhook.secret}`;