nodebb-plugin-onekite-calendar 2.0.93 → 2.0.94

package/lib/shared.js

@@ -399,7 +399,6 @@ module.exports = {
   autoCreatorGroupForYear,
 
   // HMAC / signing
-  hmacSecret,
   signCalendarLink,
 
   // Dates

package/library.js

@@ -127,24 +127,16 @@ Plugin.init = async function (params) {
   // Purge outings by year
   router.post(`${adminBase}/outings/purge`, ...adminMws, admin.purgeOutingsByYear);
 
-  // HelloAsso callback endpoint (hardened)
-  // - Only accepts POST
+  // HelloAsso webhook endpoint (hardened)
   // - Verifies x-ha-signature (HMAC SHA-256) using the configured client secret
-  // - Basic replay protection
-  // NOTE: we capture the raw body for signature verification.
+  // - Basic replay protection; raw body captured for signature verification
   const helloassoJson = bodyParser.json({
     verify: (req, _res, buf) => {
       req.rawBody = buf;
     },
     type: ['application/json', 'application/*+json'],
   });
-  // Accept webhook on both legacy root path and namespaced plugin path.
-  // Some reverse proxies block unknown root paths, so /plugins/... is recommended.
-  router.post('/helloasso', helloassoJson, helloassoWebhook.handler);
   router.post('/plugins/calendar-onekite/helloasso', helloassoJson, helloassoWebhook.handler);
-
-  // Optional: health checks
-  router.get('/helloasso', (req, res) => res.json({ ok: true }));
   router.get('/plugins/calendar-onekite/helloasso', (req, res) => res.json({ ok: true }));
 
   scheduler.start();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodebb-plugin-onekite-calendar",
-  "version": "2.0.93",
+  "version": "2.0.94",
   "description": "FullCalendar-based equipment reservation workflow with admin approval & HelloAsso payment for NodeBB",
   "main": "library.js",
   "license": "MIT",