chore: import upstream snapshot with attribution

apps/sim/lib/webhooks/providers/gong.ts

@@ -0,0 +1,164 @@
+import { createLogger } from '@sim/logger'
+import { sha256Hex } from '@sim/security/hash'
+import { toError } from '@sim/utils/errors'
+import * as jose from 'jose'
+import { NextResponse } from 'next/server'
+import type {
+  AuthContext,
+  FormatInputContext,
+  FormatInputResult,
+  WebhookProviderHandler,
+} from '@/lib/webhooks/providers/types'
+
+const logger = createLogger('WebhookProvider:Gong')
+
+/** providerConfig key: PEM or raw base64 RSA public key from Gong (Signed JWT header auth). */
+export const GONG_JWT_PUBLIC_KEY_CONFIG_KEY = 'gongJwtPublicKeyPem'
+
+/**
+ * Gong automation webhooks support either URL secrecy (token in path) or a signed JWT in
+ * `Authorization` (see https://help.gong.io/docs/create-a-webhook-rule).
+ * When {@link GONG_JWT_PUBLIC_KEY_CONFIG_KEY} is set, we verify RS256 per Gong's JWT guide.
+ * When unset, only the unguessable Sim webhook path authenticates the request (same as before).
+ */
+export function normalizeGongPublicKeyPem(input: string): string | null {
+  const trimmed = input.trim()
+  if (!trimmed) return null
+  if (trimmed.includes('BEGIN PUBLIC KEY')) {
+    return trimmed
+  }
+  const b64 = trimmed.replace(/\s/g, '')
+  if (!/^[A-Za-z0-9+/]+=*$/.test(b64)) {
+    return null
+  }
+  const chunked = b64.match(/.{1,64}/g)?.join('\n') ?? b64
+  return `-----BEGIN PUBLIC KEY-----\n${chunked}\n-----END PUBLIC KEY-----`
+}
+
+function normalizeUrlForGongJwtClaim(url: string): string {
+  try {
+    const u = new URL(url)
+    let path = u.pathname
+    if (path.length > 1 && path.endsWith('/')) {
+      path = path.slice(0, -1)
+    }
+    return `${u.protocol}//${u.host.toLowerCase()}${path}`
+  } catch {
+    return url.trim()
+  }
+}
+
+function parseAuthorizationJwt(authHeader: string | null): string | null {
+  if (!authHeader) return null
+  const trimmed = authHeader.trim()
+  if (trimmed.toLowerCase().startsWith('bearer ')) {
+    return trimmed.slice(7).trim() || null
+  }
+  return trimmed || null
+}
+
+export async function verifyGongJwtAuth(ctx: AuthContext): Promise<NextResponse | null> {
+  const { request, rawBody, requestId, providerConfig } = ctx
+  const rawKey = providerConfig[GONG_JWT_PUBLIC_KEY_CONFIG_KEY]
+  if (typeof rawKey !== 'string') {
+    return null
+  }
+
+  const pem = normalizeGongPublicKeyPem(rawKey)
+  if (!pem) {
+    logger.warn(`[${requestId}] Gong JWT public key configured but could not be normalized`)
+    return new NextResponse('Unauthorized - Invalid Gong JWT public key configuration', {
+      status: 401,
+    })
+  }
+
+  const token = parseAuthorizationJwt(request.headers.get('authorization'))
+  if (!token) {
+    logger.warn(`[${requestId}] Gong JWT verification enabled but Authorization header missing`)
+    return new NextResponse('Unauthorized - Missing Gong JWT', { status: 401 })
+  }
+
+  let payload: jose.JWTPayload
+  try {
+    const key = await jose.importSPKI(pem, 'RS256')
+    const verified = await jose.jwtVerify(token, key, { algorithms: ['RS256'] })
+    payload = verified.payload
+  } catch (error) {
+    logger.warn(`[${requestId}] Gong JWT verification failed`, {
+      message: toError(error).message,
+    })
+    return new NextResponse('Unauthorized - Invalid Gong JWT', { status: 401 })
+  }
+
+  const claimUrl = payload.webhook_url
+  if (typeof claimUrl !== 'string' || !claimUrl) {
+    logger.warn(`[${requestId}] Gong JWT missing webhook_url claim`)
+    return new NextResponse('Unauthorized - Invalid Gong JWT claims', { status: 401 })
+  }
+
+  const claimDigest = payload.body_sha256
+  if (typeof claimDigest !== 'string' || !claimDigest) {
+    logger.warn(`[${requestId}] Gong JWT missing body_sha256 claim`)
+    return new NextResponse('Unauthorized - Invalid Gong JWT claims', { status: 401 })
+  }
+
+  const expectedDigest = sha256Hex(rawBody)
+  if (claimDigest !== expectedDigest) {
+    logger.warn(`[${requestId}] Gong JWT body_sha256 mismatch`)
+    return new NextResponse('Unauthorized - Gong JWT body mismatch', { status: 401 })
+  }
+
+  const receivedNorm = normalizeUrlForGongJwtClaim(request.url)
+  const claimNorm = normalizeUrlForGongJwtClaim(claimUrl)
+  if (receivedNorm !== claimNorm) {
+    logger.warn(`[${requestId}] Gong JWT webhook_url mismatch`, {
+      receivedNorm,
+      claimNorm,
+    })
+    return new NextResponse('Unauthorized - Gong JWT URL mismatch', { status: 401 })
+  }
+
+  return null
+}
+
+export const gongHandler: WebhookProviderHandler = {
+  verifyAuth: verifyGongJwtAuth,
+
+  extractIdempotencyId(body: unknown): string | null {
+    const obj = body as Record<string, unknown>
+    const callData = obj.callData as Record<string, unknown> | undefined
+    const metaData = callData?.metaData as Record<string, unknown> | undefined
+    const id = metaData?.id
+    if (typeof id === 'string' && id) {
+      return `gong:${id}`
+    }
+    if (typeof id === 'number') {
+      return `gong:${id}`
+    }
+    return null
+  },
+
+  async formatInput({ body }: FormatInputContext): Promise<FormatInputResult> {
+    const b = body as Record<string, unknown>
+    const callData = b.callData as Record<string, unknown> | undefined
+    const metaData = (callData?.metaData as Record<string, unknown>) || {}
+    const content = callData?.content as Record<string, unknown> | undefined
+    const callId =
+      typeof metaData.id === 'string' || typeof metaData.id === 'number' ? String(metaData.id) : ''
+
+    return {
+      input: {
+        isTest: b.isTest ?? false,
+        callData,
+        metaData,
+        parties: (callData?.parties as unknown[]) || [],
+        context: (callData?.context as unknown[]) || [],
+        trackers: (content?.trackers as unknown[]) || [],
+        topics: (content?.topics as unknown[]) || [],
+        highlights: (content?.highlights as unknown[]) || [],
+        eventType: 'gong.automation_rule',
+        callId,
+      },
+    }
+  },
+}