cognova 0.2.21 → 0.2.22

package/.output/server/chunks/routes/api/webhooks/bluebubbles.post.mjs

@@ -1,4 +1,4 @@
-import { d as defineEventHandler, a6 as getAdapterByPlatform, c as createError, e as readBody } from '../../../nitro/nitro.mjs';
+import { d as defineEventHandler, a6 as getAdapterByPlatform, c as createError, i as getQuery, e as readBody } from '../../../nitro/nitro.mjs';
 import '@anthropic-ai/claude-agent-sdk';
 import 'module';
 import 'path';
@@ -44,6 +44,11 @@ const bluebubbles_post = defineEventHandler(async (event) => {
     throw createError({ statusCode: 404, message: "iMessage bridge not active" });
   }
   const adapter = entry.adapter;
+  const query = getQuery(event);
+  const providedSecret = query.secret;
+  if (!providedSecret || providedSecret !== adapter.secret) {
+    throw createError({ statusCode: 403, message: "Invalid webhook secret" });
+  }
   const body = await readBody(event);
   void adapter.handleWebhook(body).catch((error) => {
     console.error("[bluebubbles webhook] Error processing event:", error);

package/.output/server/chunks/routes/api/webhooks/bluebubbles.post.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"bluebubbles.post.mjs","sources":["../../../../../../server/api/webhooks/bluebubbles.post.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOA,yBAAA,kBAAA,CAAA,OAAA,KAAA,KAAA;AACA,EAAA,MAAA,KAAA,GAAA,qBAAA,UAAA,CAAA;AACA,EAAA,IAAA,CAAA,KAAA,EAAA;AACA,IAAA,MAAA,YAAA,EAAA,UAAA,EAAA,GAAA,EAAA,OAAA,EAAA,8BAAA,CAAA;AAAA,EACA;AAEA,EAAA,MAAA,UAAA,KAAA,CAAA,OAAA;AACA,EAAA,MAAA,IAAA,GAAA,MAAA,QAAA,CAAA,KAAA,CAAA;AAGA,EAAA,KAAA,QAAA,aAAA,CAAA,IAAA,CAAA,CAAA,KAAA,CAAA,CAAA,KAAA,KAAA;AACA,IAAA,OAAA,CAAA,KAAA,CAAA,iDAAA,KAAA,CAAA;AAAA,EACA,CAAA,CAAA;AAEA,EAAA,OAAA,EAAA,IAAA,IAAA,EAAA;AACA,CAAA,CAAA;;;;"}
+{"version":3,"file":"bluebubbles.post.mjs","sources":["../../../../../../server/api/webhooks/bluebubbles.post.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOA,yBAAA,kBAAA,CAAA,OAAA,KAAA,KAAA;AACA,EAAA,MAAA,KAAA,GAAA,qBAAA,UAAA,CAAA;AACA,EAAA,IAAA,CAAA,KAAA,EAAA;AACA,IAAA,MAAA,YAAA,EAAA,UAAA,EAAA,GAAA,EAAA,OAAA,EAAA,8BAAA,CAAA;AAAA,EACA;AAEA,EAAA,MAAA,UAAA,KAAA,CAAA,OAAA;AAGA,EAAA,MAAA,KAAA,GAAA,SAAA,KAAA,CAAA;AACA,EAAA,MAAA,iBAAA,KAAA,CAAA,MAAA;AACA,EAAA,IAAA,CAAA,cAAA,IAAA,cAAA,KAAA,OAAA,CAAA,MAAA,EAAA;AACA,IAAA,MAAA,YAAA,EAAA,UAAA,EAAA,GAAA,EAAA,OAAA,EAAA,0BAAA,CAAA;AAAA,EACA;AAEA,EAAA,MAAA,IAAA,GAAA,MAAA,QAAA,CAAA,KAAA,CAAA;AAGA,EAAA,KAAA,QAAA,aAAA,CAAA,IAAA,CAAA,CAAA,KAAA,CAAA,CAAA,KAAA,KAAA;AACA,IAAA,OAAA,CAAA,KAAA,CAAA,iDAAA,KAAA,CAAA;AAAA,EACA,CAAA,CAAA;AAEA,EAAA,OAAA,EAAA,IAAA,IAAA,EAAA;AACA,CAAA,CAAA;;;;"}

package/.output/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognova-prod",
-  "version": "0.2.21",
+  "version": "0.2.22",
   "type": "module",
   "private": true,
   "dependencies": {

package/dist/cli/index.js

@@ -1751,6 +1751,9 @@ function generateEnvFile(config) {
     `BETTER_AUTH_SECRET=${config.auth.authSecret || crypto2.randomBytes(32).toString("base64")}`,
     `BETTER_AUTH_URL=${config.accessMode === "any" ? "" : config.appUrl}`,
     "",
+    "# Public URL for webhooks (BlueBubbles, Telegram, etc.)",
+    `NUXT_PUBLIC_URL=${config.accessMode === "any" ? "" : config.appUrl}`,
+    "",
     "# Admin (used on first startup to seed database)",
     `ADMIN_EMAIL=${config.auth.adminEmail}`,
     `ADMIN_PASSWORD=${config.auth.adminPassword}`,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "cognova",
   "type": "module",
-  "version": "0.2.21",
+  "version": "0.2.22",
   "description": "Personal knowledge management system with Claude Code integration",
   "repository": {
     "type": "git",

package/server/api/webhooks/bluebubbles.post.ts

@@ -12,6 +12,14 @@ export default defineEventHandler(async (event) => {
   }
 
   const adapter = entry.adapter as IMessageAdapter
+
+  // Validate webhook secret
+  const query = getQuery(event)
+  const providedSecret = query.secret as string | undefined
+  if (!providedSecret || providedSecret !== adapter.secret) {
+    throw createError({ statusCode: 403, message: 'Invalid webhook secret' })
+  }
+
   const body = await readBody<BlueBubblesWebhookEvent>(event)
 
   // Process asynchronously — return 200 quickly

package/server/bridge/adapters/imessage.ts

@@ -186,7 +186,7 @@ export class IMessageAdapter implements BridgeAdapter {
   private getWebhookUrl(): string | null {
     const baseUrl = process.env.NUXT_PUBLIC_URL || process.env.APP_URL
     if (baseUrl)
-      return `${baseUrl.replace(/\/$/, '')}/api/webhooks/bluebubbles`
+      return `${baseUrl.replace(/\/$/, '')}/api/webhooks/bluebubbles?secret=${this.webhookSecret}`
     return null
   }
 
@@ -194,7 +194,7 @@ export class IMessageAdapter implements BridgeAdapter {
     if (!this.bbUrl || !this.bbPassword) return
 
     try {
-      await fetch(`${this.bbUrl}/api/v1/webhook?password=${encodeURIComponent(this.bbPassword)}`, {
+      const resp = await fetch(`${this.bbUrl}/api/v1/webhook?password=${encodeURIComponent(this.bbPassword)}`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({
@@ -202,6 +202,13 @@ export class IMessageAdapter implements BridgeAdapter {
           events: ['new-message']
         })
       })
+
+      if (!resp.ok) {
+        const body = await resp.text()
+        console.warn(`[imessage] Failed to register BlueBubbles webhook: ${resp.status} ${body.substring(0, 200)}`)
+        return
+      }
+
       console.log(`[imessage] BlueBubbles webhook registered: ${url}`)
     } catch (error) {
       console.warn('[imessage] Failed to register BlueBubbles webhook:', error)

package/server/middleware/auth.ts

@@ -8,6 +8,7 @@ const publicPaths = [
   '/api/health', // Health check
   '/api/home', // Public home page content
   '/api/_mdc', // MDC syntax highlighting
+  '/api/webhooks', // External webhooks (BlueBubbles, Telegram, etc.)
   '/_nuxt', // Nuxt assets
   '/login', // Login page
   '/view' // Public document viewer

package/.output/public/_nuxt/builds/meta/36770554-14f7-4f3a-add8-2f51436e3d25.json

@@ -1 +0,0 @@
-{"id":"36770554-14f7-4f3a-add8-2f51436e3d25","timestamp":1771901252223,"matcher":{"static":{},"wildcard":{},"dynamic":{}},"prerendered":[]}