archicore 0.1.9 → 0.2.1

package/dist/semantic-memory/embedding-service.js

@@ -5,7 +5,9 @@ export class EmbeddingService {
     config;
     initialized = false;
     _isAvailable = false;
-    jinaApiKey;
+    jinaApiKeys = [];
+    currentKeyIndex = 0;
+    keyFailures = new Map();
     embeddingDimension = 1024; // Jina default, OpenAI small = 1536
     constructor(config) {
         this.config = config;
@@ -23,16 +25,21 @@ export class EmbeddingService {
         }
         try {
             if (this.config.provider === 'jina') {
-                // Jina AI - free embeddings
-                this.jinaApiKey = process.env.JINA_API_KEY;
-                if (!this.jinaApiKey) {
-                    Logger.warn('JINA_API_KEY not set - semantic search disabled');
+                // Jina AI - free embeddings with key rotation support
+                // Support multiple keys: JINA_API_KEYS (comma-separated) or JINA_API_KEY (single)
+                const keysEnv = process.env.JINA_API_KEYS || process.env.JINA_API_KEY || '';
+                this.jinaApiKeys = keysEnv
+                    .split(',')
+                    .map(k => k.trim())
+                    .filter(k => k.length > 0);
+                if (this.jinaApiKeys.length === 0) {
+                    Logger.warn('JINA_API_KEY(S) not set - semantic search disabled');
                     Logger.info('Get free API key at: https://jina.ai/embeddings/');
                     return;
                 }
                 this.embeddingDimension = 1024;
                 this._isAvailable = true;
-                Logger.success('Jina AI embeddings enabled');
+                Logger.success(`Jina AI embeddings enabled (${this.jinaApiKeys.length} key${this.jinaApiKeys.length > 1 ? 's' : ''} configured)`);
             }
             else {
                 // OpenAI embeddings
@@ -51,6 +58,45 @@ export class EmbeddingService {
             Logger.warn('Embedding init failed: ' + error);
         }
     }
+    getCurrentJinaKey() {
+        if (this.jinaApiKeys.length === 0)
+            return undefined;
+        return this.jinaApiKeys[this.currentKeyIndex];
+    }
+    rotateToNextKey() {
+        if (this.jinaApiKeys.length <= 1)
+            return false;
+        const oldIndex = this.currentKeyIndex;
+        this.currentKeyIndex = (this.currentKeyIndex + 1) % this.jinaApiKeys.length;
+        // Track failure for old key
+        const failure = this.keyFailures.get(oldIndex) || { count: 0, lastFail: new Date() };
+        failure.count++;
+        failure.lastFail = new Date();
+        this.keyFailures.set(oldIndex, failure);
+        Logger.warn(`Jina API key ${oldIndex + 1} exhausted/failed, rotating to key ${this.currentKeyIndex + 1}`);
+        return true;
+    }
+    shouldSkipKey(index) {
+        const failure = this.keyFailures.get(index);
+        if (!failure)
+            return false;
+        // Skip key if it failed recently (within 5 minutes) and has many failures
+        const fiveMinutesAgo = new Date(Date.now() - 5 * 60 * 1000);
+        return failure.count >= 3 && failure.lastFail > fiveMinutesAgo;
+    }
+    findWorkingKeyIndex() {
+        const startIndex = this.currentKeyIndex;
+        for (let i = 0; i < this.jinaApiKeys.length; i++) {
+            const index = (startIndex + i) % this.jinaApiKeys.length;
+            if (!this.shouldSkipKey(index)) {
+                return index;
+            }
+        }
+        // All keys are marked as failed, reset failures and try first key
+        Logger.warn('All Jina API keys marked as failed, resetting failure counters');
+        this.keyFailures.clear();
+        return 0;
+    }
     isAvailable() {
         this.ensureInitialized();
         return this._isAvailable;
@@ -60,7 +106,7 @@ export class EmbeddingService {
         if (!this._isAvailable)
             return new Array(this.embeddingDimension).fill(0);
         try {
-            if (this.config.provider === 'jina' && this.jinaApiKey) {
+            if (this.config.provider === 'jina' && this.jinaApiKeys.length > 0) {
                 return await this.generateJinaEmbedding(text);
             }
             else if (this.openai) {
@@ -73,28 +119,51 @@ export class EmbeddingService {
             return new Array(this.embeddingDimension).fill(0);
         }
     }
-    async generateJinaEmbedding(text) {
-        if (!this.jinaApiKey)
+    async generateJinaEmbedding(text, retryCount = 0) {
+        const maxRetries = this.jinaApiKeys.length;
+        // Find a working key index before first attempt
+        if (retryCount === 0) {
+            this.currentKeyIndex = this.findWorkingKeyIndex();
+        }
+        const apiKey = this.getCurrentJinaKey();
+        if (!apiKey)
             throw new Error('Jina API key not set');
-        const response = await fetch('https://api.jina.ai/v1/embeddings', {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'Authorization': `Bearer ${this.jinaApiKey}`
-            },
-            body: JSON.stringify({
-                model: this.config.model || 'jina-embeddings-v3',
-                task: 'text-matching',
-                dimensions: 1024,
-                input: [text.substring(0, 8000)]
-            })
-        });
-        if (!response.ok) {
-            const error = await response.text();
-            throw new Error(`Jina API error: ${response.status} ${error}`);
+        try {
+            const response = await fetch('https://api.jina.ai/v1/embeddings', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'Authorization': `Bearer ${apiKey}`
+                },
+                body: JSON.stringify({
+                    model: this.config.model || 'jina-embeddings-v3',
+                    task: 'text-matching',
+                    dimensions: 1024,
+                    input: [text.substring(0, 8000)]
+                })
+            });
+            if (!response.ok) {
+                const errorText = await response.text();
+                // Check for rate limit or auth errors - try next key
+                if (response.status === 429 || response.status === 401 || response.status === 403) {
+                    if (retryCount < maxRetries - 1 && this.rotateToNextKey()) {
+                        Logger.warn(`Jina API key error (${response.status}), trying next key...`);
+                        return this.generateJinaEmbedding(text, retryCount + 1);
+                    }
+                }
+                throw new Error(`Jina API error: ${response.status} ${errorText}`);
+            }
+            const data = await response.json();
+            return data.data[0].embedding;
+        }
+        catch (error) {
+            // Network error or other issue - try next key
+            if (retryCount < maxRetries - 1 && this.rotateToNextKey()) {
+                Logger.warn(`Jina API request failed, trying next key...`);
+                return this.generateJinaEmbedding(text, retryCount + 1);
+            }
+            throw error;
         }
-        const data = await response.json();
-        return data.data[0].embedding;
     }
     /**
      * Generate embeddings for multiple texts - uses true batch API when available
@@ -110,30 +179,13 @@ export class EmbeddingService {
         Logger.progress(`Generating embeddings for ${texts.length} texts...`);
         try {
             // Use true batch API for Jina (much faster!)
-            if (this.config.provider === 'jina' && this.jinaApiKey) {
+            if (this.config.provider === 'jina' && this.jinaApiKeys.length > 0) {
                 const BATCH_SIZE = 500;
                 const allEmbeddings = [];
                 for (let i = 0; i < texts.length; i += BATCH_SIZE) {
                     const batch = texts.slice(i, i + BATCH_SIZE).map(t => t.substring(0, 8000));
-                    const response = await fetch('https://api.jina.ai/v1/embeddings', {
-                        method: 'POST',
-                        headers: {
-                            'Content-Type': 'application/json',
-                            'Authorization': `Bearer ${this.jinaApiKey}`
-                        },
-                        body: JSON.stringify({
-                            model: this.config.model || 'jina-embeddings-v3',
-                            task: 'text-matching',
-                            dimensions: 1024,
-                            input: batch
-                        })
-                    });
-                    if (!response.ok) {
-                        const error = await response.text();
-                        throw new Error(`Jina API error: ${response.status} ${error}`);
-                    }
-                    const data = await response.json();
-                    allEmbeddings.push(...data.data.map(d => d.embedding));
+                    const batchEmbeddings = await this.generateJinaBatchWithRetry(batch);
+                    allEmbeddings.push(...batchEmbeddings);
                     if (progressCallback) {
                         progressCallback(Math.min(i + BATCH_SIZE, texts.length), texts.length);
                     }
@@ -161,6 +213,48 @@ export class EmbeddingService {
             return texts.map(() => new Array(this.embeddingDimension).fill(0));
         }
     }
+    async generateJinaBatchWithRetry(batch, retryCount = 0) {
+        const maxRetries = this.jinaApiKeys.length;
+        const apiKey = this.getCurrentJinaKey();
+        if (!apiKey)
+            throw new Error('Jina API key not set');
+        try {
+            const response = await fetch('https://api.jina.ai/v1/embeddings', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'Authorization': `Bearer ${apiKey}`
+                },
+                body: JSON.stringify({
+                    model: this.config.model || 'jina-embeddings-v3',
+                    task: 'text-matching',
+                    dimensions: 1024,
+                    input: batch
+                })
+            });
+            if (!response.ok) {
+                const errorText = await response.text();
+                // Check for rate limit or auth errors - try next key
+                if (response.status === 429 || response.status === 401 || response.status === 403) {
+                    if (retryCount < maxRetries - 1 && this.rotateToNextKey()) {
+                        Logger.warn(`Jina API batch error (${response.status}), trying next key...`);
+                        return this.generateJinaBatchWithRetry(batch, retryCount + 1);
+                    }
+                }
+                throw new Error(`Jina API error: ${response.status} ${errorText}`);
+            }
+            const data = await response.json();
+            return data.data.map(d => d.embedding);
+        }
+        catch (error) {
+            // Network error or other issue - try next key
+            if (retryCount < maxRetries - 1 && this.rotateToNextKey()) {
+                Logger.warn(`Jina API batch request failed, trying next key...`);
+                return this.generateJinaBatchWithRetry(batch, retryCount + 1);
+            }
+            throw error;
+        }
+    }
     async generateOpenAIEmbedding(text) {
         if (!this.openai)
             throw new Error('OpenAI client not initialized');

package/dist/server/index.js

@@ -25,6 +25,9 @@ import { adminRouter } from './routes/admin.js';
 import { developerRouter } from './routes/developer.js';
 import { githubRouter } from './routes/github.js';
 import deviceAuthRouter from './routes/device-auth.js';
+import { cache } from './services/cache.js';
+import { db } from './services/database.js';
+import { AuthService } from './services/auth-service.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 // CORS whitelist - настройте под свои домены
@@ -156,6 +159,7 @@ export class ArchiCoreServer {
         this.app.use(express.static(publicPath, {
             maxAge: process.env.NODE_ENV === 'production' ? '1d' : 0,
             etag: true,
+            index: false, // Отключаем автоматический index.html - используем явные маршруты
         }));
     }
     setupRoutes() {
@@ -187,7 +191,54 @@ export class ArchiCoreServer {
             const deviceAuthPath = path.join(__dirname, '../../public/device-auth.html');
             res.sendFile(deviceAuthPath);
         });
-        // SPA fallback - все остальные маршруты отдают index.html
+        // Clean URL routing
+        // Landing page (главная)
+        this.app.get('/', (_req, res) => {
+            res.sendFile(path.join(__dirname, '../../public/landing.html'));
+        });
+        // Dashboard (после авторизации)
+        this.app.get('/dashboard', (_req, res) => {
+            res.sendFile(path.join(__dirname, '../../public/index.html'));
+        });
+        // Add new project page
+        this.app.get('/new', (_req, res) => {
+            res.sendFile(path.join(__dirname, '../../public/index.html'));
+        });
+        // Pricing page
+        this.app.get('/pricing', (_req, res) => {
+            res.sendFile(path.join(__dirname, '../../public/pricing.html'));
+        });
+        // API Dashboard page
+        this.app.get('/api-dashboard', (_req, res) => {
+            res.sendFile(path.join(__dirname, '../../public/api-dashboard.html'));
+        });
+        // Auth page
+        this.app.get('/auth', (_req, res) => {
+            res.sendFile(path.join(__dirname, '../../public/auth.html'));
+        });
+        // Login alias
+        this.app.get('/login', (_req, res) => {
+            res.sendFile(path.join(__dirname, '../../public/auth.html'));
+        });
+        // Register alias
+        this.app.get('/register', (_req, res) => {
+            res.redirect('/auth?mode=register');
+        });
+        // Admin page
+        this.app.get('/admin', (_req, res) => {
+            res.sendFile(path.join(__dirname, '../../public/admin.html'));
+        });
+        // Legal pages
+        this.app.get('/privacy', (_req, res) => {
+            res.sendFile(path.join(__dirname, '../../public/privacy.html'));
+        });
+        this.app.get('/terms', (_req, res) => {
+            res.sendFile(path.join(__dirname, '../../public/terms.html'));
+        });
+        this.app.get('/security', (_req, res) => {
+            res.sendFile(path.join(__dirname, '../../public/security.html'));
+        });
+        // SPA fallback - все остальные маршруты отдают index.html (dashboard)
         this.app.get('/*splat', (_req, res) => {
             const indexPath = path.join(__dirname, '../../public/index.html');
             res.sendFile(indexPath);
@@ -208,6 +259,17 @@ export class ArchiCoreServer {
         });
     }
     async start() {
+        // Initialize database
+        try {
+            await db.init();
+            const authService = AuthService.getInstance();
+            await authService.initDatabase();
+        }
+        catch (error) {
+            Logger.warn('Database initialization failed, using JSON fallback:', error);
+        }
+        // Initialize cache
+        await cache.connect();
         return new Promise((resolve) => {
             this.server = createServer(this.app);
             const host = this.config.host || '0.0.0.0';
@@ -221,6 +283,9 @@ export class ArchiCoreServer {
         });
     }
     async stop() {
+        // Disconnect cache and database
+        await cache.disconnect();
+        await db.close();
         return new Promise((resolve) => {
             if (this.server) {
                 this.server.close(() => {

package/dist/server/routes/admin.js

@@ -2,14 +2,33 @@
  * Admin API Routes for ArchiCore
  */
 import { Router } from 'express';
+import rateLimit from 'express-rate-limit';
 import { AuthService } from '../services/auth-service.js';
+import { auditService } from '../services/audit-service.js';
 import { authMiddleware, adminMiddleware } from './auth.js';
 import { Logger } from '../../utils/logger.js';
 export const adminRouter = Router();
 const authService = AuthService.getInstance();
-// All admin routes require authentication and admin role
+// Stricter rate limiting for admin routes (30 requests per minute)
+const adminRateLimiter = rateLimit({
+    windowMs: 60 * 1000, // 1 minute
+    max: 30, // 30 requests per minute
+    message: { error: 'Too many admin requests, please slow down', retryAfter: 60 },
+    standardHeaders: true,
+    legacyHeaders: false,
+    handler: (_req, res) => {
+        Logger.warn('Admin rate limit exceeded');
+        res.status(429).json({
+            error: 'Too many admin requests',
+            message: 'Please wait before making more admin API calls',
+            retryAfter: 60
+        });
+    }
+});
+// All admin routes require authentication, admin role, and rate limiting
 adminRouter.use(authMiddleware);
 adminRouter.use(adminMiddleware);
+adminRouter.use(adminRateLimiter);
 /**
  * GET /api/admin/users
  * Get all users
@@ -49,6 +68,8 @@ adminRouter.get('/users/:id', async (req, res) => {
  * Update user's subscription tier
  */
 adminRouter.put('/users/:id/tier', async (req, res) => {
+    const ip = req.ip || req.headers['x-forwarded-for'] || 'unknown';
+    const userAgent = req.headers['user-agent'];
     try {
         const { id } = req.params;
         const { tier } = req.body;
@@ -57,11 +78,28 @@ adminRouter.put('/users/:id/tier', async (req, res) => {
             res.status(400).json({ error: 'Invalid tier. Valid tiers: ' + validTiers.join(', ') });
             return;
         }
+        // Get old tier for audit
+        const oldUser = await authService.getUser(id);
+        const oldTier = oldUser?.tier;
         const updated = await authService.updateUserTier(id, tier);
         if (!updated) {
             res.status(404).json({ error: 'User not found' });
             return;
         }
+        // Audit log
+        await auditService.log({
+            userId: req.user?.id,
+            username: req.user?.username,
+            action: 'admin.tier_change',
+            ip,
+            userAgent,
+            details: {
+                targetUserId: id,
+                targetUsername: oldUser?.username,
+                oldTier,
+                newTier: tier
+            }
+        });
         res.json({ success: true });
     }
     catch (error) {
@@ -74,13 +112,30 @@ adminRouter.put('/users/:id/tier', async (req, res) => {
  * Delete user
  */
 adminRouter.delete('/users/:id', async (req, res) => {
+    const ip = req.ip || req.headers['x-forwarded-for'] || 'unknown';
+    const userAgent = req.headers['user-agent'];
     try {
         const { id } = req.params;
+        // Get user info before deletion for audit
+        const userToDelete = await authService.getUser(id);
         const deleted = await authService.deleteUser(id);
         if (!deleted) {
             res.status(400).json({ error: 'Cannot delete user (admin or not found)' });
             return;
         }
+        // Audit log
+        await auditService.log({
+            userId: req.user?.id,
+            username: req.user?.username,
+            action: 'admin.user_delete',
+            ip,
+            userAgent,
+            details: {
+                deletedUserId: id,
+                deletedUsername: userToDelete?.username,
+                deletedEmail: userToDelete?.email
+            }
+        });
         res.json({ success: true });
     }
     catch (error) {
@@ -120,4 +175,97 @@ adminRouter.get('/stats', async (_req, res) => {
         res.status(500).json({ error: 'Failed to get statistics' });
     }
 });
+// ===== AUDIT LOGS =====
+/**
+ * GET /api/admin/audit
+ * Get audit logs with filtering and pagination
+ */
+adminRouter.get('/audit', async (req, res) => {
+    try {
+        const { userId, action, severity, success, startDate, endDate, limit = '50', offset = '0' } = req.query;
+        // Log that admin is viewing audit logs
+        const ip = req.ip || req.headers['x-forwarded-for'] || 'unknown';
+        const userAgent = req.headers['user-agent'];
+        await auditService.log({
+            userId: req.user?.id,
+            username: req.user?.username,
+            action: 'admin.view_logs',
+            ip,
+            userAgent,
+            details: { filters: { userId, action, severity } }
+        });
+        const result = await auditService.query({
+            userId: userId,
+            action: action,
+            severity: severity,
+            success: success ? success === 'true' : undefined,
+            startDate: startDate ? new Date(startDate) : undefined,
+            endDate: endDate ? new Date(endDate) : undefined,
+            limit: parseInt(limit, 10),
+            offset: parseInt(offset, 10)
+        });
+        res.json(result);
+    }
+    catch (error) {
+        Logger.error('Failed to get audit logs:', error);
+        res.status(500).json({ error: 'Failed to get audit logs' });
+    }
+});
+/**
+ * GET /api/admin/audit/stats
+ * Get audit statistics
+ */
+adminRouter.get('/audit/stats', async (req, res) => {
+    try {
+        const days = parseInt(req.query.days || '7', 10);
+        const stats = await auditService.getStats(days);
+        res.json(stats);
+    }
+    catch (error) {
+        Logger.error('Failed to get audit stats:', error);
+        res.status(500).json({ error: 'Failed to get audit statistics' });
+    }
+});
+/**
+ * GET /api/admin/audit/user/:userId
+ * Get audit logs for specific user
+ */
+adminRouter.get('/audit/user/:userId', async (req, res) => {
+    try {
+        const { userId } = req.params;
+        const limit = parseInt(req.query.limit || '50', 10);
+        const logs = await auditService.getUserLogs(userId, limit);
+        res.json({ logs });
+    }
+    catch (error) {
+        Logger.error('Failed to get user audit logs:', error);
+        res.status(500).json({ error: 'Failed to get user audit logs' });
+    }
+});
+/**
+ * POST /api/admin/audit/cleanup
+ * Clean up old audit logs (retention policy)
+ */
+adminRouter.post('/audit/cleanup', async (req, res) => {
+    try {
+        const retentionDays = parseInt(req.body.retentionDays || '90', 10);
+        const ip = req.ip || req.headers['x-forwarded-for'] || 'unknown';
+        const userAgent = req.headers['user-agent'];
+        // Log cleanup action
+        await auditService.log({
+            userId: req.user?.id,
+            username: req.user?.username,
+            action: 'admin.view_logs',
+            ip,
+            userAgent,
+            details: { operation: 'cleanup', retentionDays }
+        });
+        const removed = await auditService.cleanup(retentionDays);
+        res.json({ success: true, removed });
+    }
+    catch (error) {
+        Logger.error('Failed to cleanup audit logs:', error);
+        res.status(500).json({ error: 'Failed to cleanup audit logs' });
+    }
+});
 //# sourceMappingURL=admin.js.map

package/dist/server/routes/auth.js

@@ -3,6 +3,7 @@
  */
 import { Router } from 'express';
 import { AuthService } from '../services/auth-service.js';
+import { auditService } from '../services/audit-service.js';
 import { Logger } from '../../utils/logger.js';
 export const authRouter = Router();
 const authService = AuthService.getInstance();
@@ -35,6 +36,8 @@ export async function adminMiddleware(req, res, next) {
  * Register new user
  */
 authRouter.post('/register', async (req, res) => {
+    const ip = req.ip || req.headers['x-forwarded-for'] || 'unknown';
+    const userAgent = req.headers['user-agent'];
     try {
         const { email, username, password } = req.body;
         if (!email || !username || !password) {
@@ -46,6 +49,17 @@ authRouter.post('/register', async (req, res) => {
             return;
         }
         const result = await authService.register(email, username, password);
+        // Audit log
+        if (result.success && result.user) {
+            await auditService.log({
+                userId: result.user.id,
+                username: result.user.username,
+                action: 'auth.register',
+                ip,
+                userAgent,
+                details: { email }
+            });
+        }
         res.json(result);
     }
     catch (error) {
@@ -58,6 +72,8 @@ authRouter.post('/register', async (req, res) => {
  * Login with email/password
  */
 authRouter.post('/login', async (req, res) => {
+    const ip = req.ip || req.headers['x-forwarded-for'] || 'unknown';
+    const userAgent = req.headers['user-agent'];
     try {
         const { email, password } = req.body;
         if (!email || !password) {
@@ -65,10 +81,30 @@ authRouter.post('/login', async (req, res) => {
             return;
         }
         const result = await authService.login(email, password);
+        // Audit log
+        await auditService.log({
+            userId: result.user?.id,
+            username: result.user?.username,
+            action: 'auth.login',
+            ip,
+            userAgent,
+            details: { email },
+            success: result.success,
+            errorMessage: result.success ? undefined : result.error
+        });
         res.json(result);
     }
     catch (error) {
         Logger.error('Login error:', error);
+        // Audit failed login attempt
+        await auditService.log({
+            action: 'auth.login',
+            ip,
+            userAgent,
+            details: { email: req.body.email },
+            success: false,
+            errorMessage: 'Login failed'
+        });
         res.status(500).json({ success: false, error: 'Login failed' });
     }
 });
@@ -77,11 +113,21 @@ authRouter.post('/login', async (req, res) => {
  * Logout current user
  */
 authRouter.post('/logout', authMiddleware, async (req, res) => {
+    const ip = req.ip || req.headers['x-forwarded-for'] || 'unknown';
+    const userAgent = req.headers['user-agent'];
     try {
         const token = req.headers.authorization?.substring(7);
         if (token) {
             await authService.logout(token);
         }
+        // Audit log
+        await auditService.log({
+            userId: req.user?.id,
+            username: req.user?.username,
+            action: 'auth.logout',
+            ip,
+            userAgent
+        });
         res.json({ success: true });
     }
     catch (error) {

package/dist/server/routes/github.js

@@ -449,7 +449,7 @@ githubRouter.post('/repositories/:id/analyze', authMiddleware, async (req, res)
 githubRouter.post('/webhook', async (req, res) => {
     try {
         const event = req.headers['x-github-event'];
-        // signature available at req.headers['x-hub-signature-256'] for verification
+        const signature = req.headers['x-hub-signature-256'];
         const payload = req.body;
         if (!event || !payload) {
             res.status(400).json({ error: 'Invalid webhook' });
@@ -467,9 +467,22 @@ githubRouter.post('/webhook', async (req, res) => {
             res.status(200).json({ message: 'Repository not connected' });
             return;
         }
-        // Verify signature (if webhook secret is set)
-        // Note: In production, you'd verify the signature properly using:
-        // githubService.verifyWebhookSignature(JSON.stringify(req.body), signature, secret)
+        // Verify webhook signature (HMAC-SHA256)
+        if (repo.webhookSecret) {
+            if (!signature) {
+                Logger.warn(`Webhook missing signature for ${fullName}`);
+                res.status(401).json({ error: 'Missing signature' });
+                return;
+            }
+            const secret = githubService.getWebhookSecret(repo.webhookSecret);
+            const payloadBody = JSON.stringify(payload);
+            if (!githubService.verifyWebhookSignature(payloadBody, signature, secret)) {
+                Logger.warn(`Invalid webhook signature for ${fullName}`);
+                res.status(401).json({ error: 'Invalid signature' });
+                return;
+            }
+            Logger.debug(`Webhook signature verified for ${fullName}`);
+        }
         Logger.info(`Webhook received: ${event} for ${fullName}`);
         // Handle different events
         switch (event) {