sincerely 1.1.4 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8145214d026bf9a3055f7192b694b84dceb0bfa89a4a78e526a5832dfb016675
-  data.tar.gz: 393c5f2ba30f47710726e86190f054a43502331444c3ca61e326304bb6ebb223
+  metadata.gz: 6f9d8077a60c896468257937b8386a6b02675d5540576207dfdfe6fde2d30327
+  data.tar.gz: bd84c37199b404102e2acfbf51a7835c10a53d41b83f8af2527d5e31b4c05f49
 SHA512:
-  metadata.gz: c50b3fd1d13596262f3aba63044c3348faa5c0fe87159cba4895ba25da90572f5c0e5e6ff8fbfca398774ad84c3c6edbbe163201091094afa135ac68fe207fa1
-  data.tar.gz: 6ae7839a324a550b09f3866609b5f6ba733da0e4a935267e8eefd7df122d712fe9e1738072b03570167b279928c00906bdc14153b22f9cdd7b0e101ee544c3b5
+  metadata.gz: 9ce92f5c1f802392aa081fa332baee7a0076b8708e309f3fc765f28c0dc62cce3759d40623cdf75838d2d8d3d0c007b1fb64b05970e5c8fb6d216cb5164283f3
+  data.tar.gz: a47d13e92e9acc43c98146ffc3b7ecbd10b53fdee81e6330046fd050b7759be39707dc7f9d611d21948208712660d07dd83136097d2707cd675c79ae1e110ce8

data/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.2.0] - 2026-09-22
+
+### Security
+- The AWS SES webhook now rejects SNS messages whose `TopicArn` is not the configured one, with `403 Forbidden`. Signature verification alone only proves that a message was signed by SNS, not that it came from our topic: any AWS account could subscribe the public endpoint, have the subscription auto-confirmed, and publish SES-shaped events for message ids it knows.
+
+### Added
+- `topic_arn` option for the email delivery method, holding the ARN of the SNS topic the SES configuration set publishes to
+
+### Changed
+- **Breaking**: the webhook rejects every message when `topic_arn` is not configured. Existing installations must add it to `config/sincerely.yml` before upgrading, or delivery events stop being processed.
+
 ## [1.1.4] - 2026-09-21
 
 ### Fixed

data/README.md

@@ -64,6 +64,7 @@ defaults: &defaults
         access_key_id: your_access_key_id
         secret_access_key: your_secret_access_key
         configuration_set_name: config_set
+        topic_arn: arn:aws:sns:region:account-id:your-topic
     sms:
 ```
 
@@ -71,6 +72,7 @@ defaults: &defaults
 * `access_key_id`: AWS access key id
 * `secret_access_key`: AWS secret access key
 * `configuration_set_name`: the name of the configuration set to use when sending the email, you don't need to specify the configuration set option if you don't want to handle SES email sending events
+* `topic_arn`: the ARN of the SNS topic the configuration set publishes events to. Required by the webhook described in the `Callbacks` section, which rejects messages coming from any other topic
 
 Sincerely uses the `aws-sdk-sesv2` gem to send emails. See [sesv2](https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/SESV2.html) for details.
 
@@ -150,7 +152,7 @@ Please note that the notification state is updated only if the event callback is
 
 `EmailAwsSes` delivery system handles SES email sending events. To enable it make sure:
 * you have run the `events` task described in the `Getting Started` section
-* you have set the `configuration_set_name` option described in the `Configuration` section
+* you have set the `configuration_set_name` and `topic_arn` options described in the `Configuration` section
 * you have run the following task that generates the webhook controller for you
 ```bash
 rails g sincerely:aws_ses_webhook_controller SES_WEBHOOK

data/lib/sincerely/mixins/webhooks/aws_ses_events.rb

@@ -18,6 +18,8 @@ module Sincerely
           def create
             verifier.authenticate!(request.raw_post)
 
+            return head :forbidden unless trusted_topic?
+
             case sns_message_type
             when 'SubscriptionConfirmation'
               confirm_subscription
@@ -52,6 +54,20 @@ module Sincerely
             posted_message_body['Token']
           end
 
+          def trusted_topic?
+            expected_topic_arn = delivery_options[:topic_arn]
+
+            if expected_topic_arn.blank?
+              logger&.error('[Sincerely] SNS webhook rejected: no topic_arn configured for the email delivery method')
+              return false
+            end
+
+            return true if topic_arn == expected_topic_arn
+
+            logger&.error("[Sincerely] SNS webhook rejected: unexpected TopicArn #{topic_arn.inspect}")
+            false
+          end
+
           def event_payload
             message = posted_message_body['Message']
             JSON.parse(message) if message.present?

data/lib/sincerely/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Sincerely
-  VERSION = '1.1.4'
+  VERSION = '1.2.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sincerely
 version: !ruby/object:Gem::Version
-  version: 1.1.4
+  version: 1.2.0
 platform: ruby
 authors:
 - 100 Starlings
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-09-21 00:00:00.000000000 Z
+date: 2026-09-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aasm