cortexdb-connectors 0.2.12__tar.gz → 0.2.13__tar.gz

{cortexdb_connectors-0.2.12 → cortexdb_connectors-0.2.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cortexdb-connectors
-Version: 0.2.12
+Version: 0.2.13
 Summary: Data connectors for CortexDB — ingest from Slack, GitHub, GitLab, Jira, Linear, Confluence, Notion, PagerDuty, Discord, Teams, Google Workspace, Salesforce, HubSpot, Zendesk, Intercom, and ServiceNow into the v1 memory API.
 Author-email: CortexDB Team <team@cortexdb.ai>
 License-Expression: Apache-2.0

{cortexdb_connectors-0.2.12 → cortexdb_connectors-0.2.13}/cortexdb_connectors/base.py

@@ -107,7 +107,7 @@ class VisibilityLevel(str, Enum):
 @dataclass(frozen=True)
 class Source:
     system: str
-    connector_version: str = "0.2.12"
+    connector_version: str = "0.2.13"
 
 
 @dataclass(frozen=True)

{cortexdb_connectors-0.2.12 → cortexdb_connectors-0.2.13}/cortexdb_connectors/webhooks.py

@@ -536,13 +536,17 @@ def _verify_hmac_sha256(secret: str, body: bytes, signature: str) -> bool:
 
 
 class _HmacWebhookHandler:
-    """Shared base for HMAC-signed webhooks (Jira, Freshdesk, tl;dv).
-
-    The provider is configured to sign the webhook body with HMAC-SHA256 under
-    a shared secret, sent as ``sha256=<hex>`` in ``signature_header``. The
-    base verifies the signature, parses JSON, calls the subclass ``normalize``
-    (which may return ``None`` to skip an irrelevant event), and ingests the
-    resulting Episode via ``POST /v1/experience``.
+    """Shared base for provider webhook receivers (Jira, Freshdesk, tl;dv).
+
+    Authentication is per-provider via ``verify()``: the default checks an
+    HMAC-SHA256 body signature (``sha256=<hex>``) under ``signature_header``
+    — but each provider names its own header (Jira signs under
+    ``X-Hub-Signature``, not GitHub's ``X-Hub-Signature-256``), and some
+    don't body-sign at all (see ``_StaticHeaderWebhookHandler``), so
+    subclasses override the header name or the whole scheme. Everything
+    after auth is scheme-agnostic and shared: parse JSON, redact on delete
+    events, else call the subclass ``normalize`` (which may return ``None``
+    to skip an irrelevant event) and ingest via ``POST /v1/experience``.
     """
 
     signature_header = "X-Hub-Signature-256"
@@ -562,11 +566,18 @@ class _HmacWebhookHandler:
         self.scope = scope
         self.actor = actor or os.environ.get("CORTEXDB_ACTOR", "")
 
+    def verify(self, headers: Any, body: bytes) -> bool:
+        """True when the delivery is authentic. Default: HMAC-SHA256 body
+        signature under ``signature_header``. Providers with a different
+        auth scheme override this; ``handle()`` is scheme-agnostic."""
+        return _verify_hmac_sha256(
+            self.secret, body, headers.get(self.signature_header, "")
+        )
+
     async def handle(self, request: Request) -> JSONResponse:
         body = await request.body()
-        signature = request.headers.get(self.signature_header, "")
-        if not _verify_hmac_sha256(self.secret, body, signature):
-            logger.warning("%s signature verification failed", self.provider)
+        if not self.verify(request.headers, body):
+            logger.warning("%s webhook authentication failed", self.provider)
             return JSONResponse({"error": "invalid signature"}, status_code=401)
         try:
             payload = json.loads(body)
@@ -638,6 +649,29 @@ class _HmacWebhookHandler:
         return None
 
 
+class _StaticHeaderWebhookHandler(_HmacWebhookHandler):
+    """Auth for providers that cannot HMAC-sign the body (T47).
+
+    tl;dv and Freshdesk send a static, user-configured header with every
+    delivery instead of a body signature — configure the provider to send
+    ``auth_header`` with the shared secret as its value (a ``Bearer ``
+    prefix is accepted) and set the same secret on the handler. Fail-closed:
+    with no secret configured every delivery is rejected, same as the HMAC
+    path. Static-header auth carries no body integrity or replay binding —
+    it is what these providers offer, not an equivalent to a signature.
+    """
+
+    auth_header = "Authorization"
+
+    def verify(self, headers: Any, body: bytes) -> bool:
+        if not self.secret:
+            return False
+        supplied = headers.get(self.auth_header, "")
+        if supplied.startswith("Bearer "):
+            supplied = supplied[len("Bearer "):]
+        return bool(supplied) and hmac.compare_digest(supplied, self.secret)
+
+
 def _parse_iso(value: Any) -> datetime:
     """Parse an ISO-8601 string (Z or offset) → aware datetime; fall back to now.
 
@@ -659,6 +693,11 @@ class JiraWebhookHandler(_HmacWebhookHandler):
     """Jira Cloud webhook → Episode. Configure the webhook with an HMAC secret."""
 
     provider = "jira"
+    # T47-family: Jira signs the body with the same sha256=<hex> HMAC scheme
+    # but sends it under WebSub-style X-Hub-Signature, not GitHub's
+    # X-Hub-Signature-256 — reading the wrong header 401'd every correctly
+    # signed delivery.
+    signature_header = "X-Hub-Signature"
 
     def deletion_entity(self, payload: dict[str, Any]) -> str | None:
         # C2: jira:issue_deleted → redact the issue (its key is what the
@@ -718,8 +757,11 @@ class JiraWebhookHandler(_HmacWebhookHandler):
         )
 
 
-class FreshdeskWebhookHandler(_HmacWebhookHandler):
-    """Freshdesk webhook/automation → Episode (HMAC over body)."""
+class FreshdeskWebhookHandler(_StaticHeaderWebhookHandler):
+    """Freshdesk automation webhook → Episode.
+
+    Freshdesk automations don't HMAC-sign the body; auth is a custom header
+    configured on the automation rule (static-header scheme, T47-family)."""
 
     provider = "freshdesk"
 
@@ -754,8 +796,13 @@ class FreshdeskWebhookHandler(_HmacWebhookHandler):
         )
 
 
-class TldvWebhookHandler(_HmacWebhookHandler):
-    """tl;dv webhook (e.g. recording-ready) → Episode (HMAC over body).
+class TldvWebhookHandler(_StaticHeaderWebhookHandler):
+    """tl;dv webhook (MeetingReady / TranscriptReady) → Episode.
+
+    tl;dv does not HMAC-sign deliveries — its webhook auth is a static
+    custom header configured in Settings → Webhooks (T47), so this uses the
+    static-header scheme: configure tl;dv to send
+    ``Authorization: Bearer <TLDV_WEBHOOK_SECRET>``.
 
     Builds its episode through the SAME ``build_meeting_episode`` as the
     poll connector (T3): same content shape, same versioned idempotency key
@@ -788,7 +835,26 @@ class TldvWebhookHandler(_HmacWebhookHandler):
         return None
 
     def normalize(self, payload: dict[str, Any]) -> Episode | None:
-        from cortexdb_connectors.tldv import build_meeting_episode
+        from cortexdb_connectors.tldv import build_meeting_episode, parse_tldv_ts
+
+        # T46: TranscriptReady's `data` is a transcript envelope
+        # {id: <transcriptId>, meetingId, data: [segments]} — its `id` is the
+        # TRANSCRIPT id, so letting _extract_meeting treat it as the meeting
+        # mis-keys the episode and drops the segments. Key by the meeting id
+        # and feed the envelope through as the transcript instead.
+        data = payload.get("data")
+        if isinstance(data, dict) and data.get("meetingId"):
+            return build_meeting_episode(
+                {"id": data["meetingId"]},
+                data,
+                self.scope,
+                occurred_at=parse_tldv_ts(payload.get("executedAt")),
+                raw_payload=payload,
+                extra_metadata={
+                    "event": payload.get("event", ""),
+                    "transcript_id": data.get("id"),
+                },
+            )
 
         meeting = self._extract_meeting(payload)
         if meeting is None:
@@ -803,7 +869,7 @@ class TldvWebhookHandler(_HmacWebhookHandler):
             return None
         return build_meeting_episode(
             meeting,
-            None,  # webhooks never carry the transcript
+            None,  # MeetingReady-style deliveries carry no transcript
             self.scope,
             raw_payload=payload,
             extra_metadata={"event": payload.get("event", "")},
@@ -973,9 +1039,11 @@ class WebhookServer:
             scope=self.scope,
             actor=self.actor,
         )
-        # HMAC-signed handlers for the Limechat pilot sources. Each reads its
-        # own *_WEBHOOK_SECRET; the provider must be configured to sign the
-        # body with HMAC-SHA256 under that secret (sha256=<hex> header).
+        # Handlers for the Limechat pilot sources. Each reads its own
+        # *_WEBHOOK_SECRET; auth matches what the provider actually sends —
+        # Jira signs the body (sha256=<hex> under X-Hub-Signature), while
+        # tl;dv and Freshdesk send the secret as a static header
+        # (Authorization: Bearer <secret>).
         self.jira_handler = JiraWebhookHandler(
             secret=os.environ.get("JIRA_WEBHOOK_SECRET", ""),
             cortexdb_url=self.cortexdb_url,

{cortexdb_connectors-0.2.12 → cortexdb_connectors-0.2.13}/cortexdb_connectors.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cortexdb-connectors
-Version: 0.2.12
+Version: 0.2.13
 Summary: Data connectors for CortexDB — ingest from Slack, GitHub, GitLab, Jira, Linear, Confluence, Notion, PagerDuty, Discord, Teams, Google Workspace, Salesforce, HubSpot, Zendesk, Intercom, and ServiceNow into the v1 memory API.
 Author-email: CortexDB Team <team@cortexdb.ai>
 License-Expression: Apache-2.0

{cortexdb_connectors-0.2.12 → cortexdb_connectors-0.2.13}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cortexdb-connectors"
-version = "0.2.12"
+version = "0.2.13"
 description = "Data connectors for CortexDB — ingest from Slack, GitHub, GitLab, Jira, Linear, Confluence, Notion, PagerDuty, Discord, Teams, Google Workspace, Salesforce, HubSpot, Zendesk, Intercom, and ServiceNow into the v1 memory API."
 readme = "README.md"
 requires-python = ">=3.10"

{cortexdb_connectors-0.2.12 → cortexdb_connectors-0.2.13}/tests/test_jira_findings_0_2_9.py

@@ -286,7 +286,7 @@ class TestDeletion:
         sig = "sha256=" + hmac_mod.new(b"s", body, hashlib.sha256).hexdigest()
 
         class _Req:
-            headers = {"X-Hub-Signature-256": sig}
+            headers = {"X-Hub-Signature": sig}
 
             async def body(self):
                 return body

{cortexdb_connectors-0.2.12 → cortexdb_connectors-0.2.13}/tests/test_tldv_findings_0_2_12.py

@@ -264,3 +264,90 @@ def test_jira_webhook_flattens_adf_description():
     )
     assert ep is not None
     assert "the actual body" in ep.content
+
+
+# ── T46: TranscriptReady keyed by meeting id, transcript kept ────────────────
+
+_TRANSCRIPT_READY = {
+    "event": "TranscriptReady",
+    "data": {
+        "id": "TRANSCRIPT-999",
+        "meetingId": "MEETING-123",
+        "data": [{"startTime": 0, "endTime": 18, "speaker": "A", "text": "the real transcript"}],
+    },
+    "id": "web-job-x",
+    "executedAt": "2026-07-29T10:27:14.729Z",
+}
+
+
+def _tldv_handler():
+    from cortexdb_connectors.webhooks import TldvWebhookHandler
+
+    return TldvWebhookHandler(
+        secret="whsec_test", cortexdb_url="u", cortexdb_api_key="k", scope="s", actor="a"
+    )
+
+
+def test_transcript_ready_keys_by_meeting_id_and_keeps_transcript():
+    ep = _tldv_handler().normalize(_TRANSCRIPT_READY)
+    assert ep is not None
+    # Keyed by the MEETING id, never the transcript id.
+    assert ep.entities[0].entity_id == "MEETING-123"
+    assert ep.idempotency_key.startswith("tldv:MEETING-123:")
+    assert "TRANSCRIPT-999" not in ep.idempotency_key
+    # The segments land in the ingested content.
+    assert "A: the real transcript" in ep.content
+    # Chronology from the delivery's executedAt, not now().
+    assert ep.occurred_at == datetime(2026, 7, 29, 10, 27, 14, 729000, tzinfo=timezone.utc)
+    assert ep.metadata["transcript_id"] == "TRANSCRIPT-999"
+
+
+def test_transcript_ready_without_segments_still_keys_by_meeting_id():
+    payload = {
+        "event": "TranscriptReady",
+        "data": {"id": "TRANSCRIPT-1", "meetingId": "MEETING-7"},
+        "executedAt": "2026-07-29T10:27:14.729Z",
+    }
+    ep = _tldv_handler().normalize(payload)
+    assert ep is not None
+    assert ep.idempotency_key.startswith("tldv:MEETING-7:")
+
+
+# ── T47: provider auth matches what the provider actually sends ──────────────
+
+
+def test_tldv_static_header_auth():
+    h = _tldv_handler()
+    body = b"{}"
+    assert h.verify({"Authorization": "Bearer whsec_test"}, body)
+    assert h.verify({"Authorization": "whsec_test"}, body)
+    assert not h.verify({"Authorization": "Bearer wrong"}, body)
+    assert not h.verify({}, body)  # real tl;dv sends no X-Hub-Signature-256
+    assert not h.verify({"X-Hub-Signature-256": "sha256=deadbeef"}, body)
+
+
+def test_tldv_no_secret_fails_closed():
+    from cortexdb_connectors.webhooks import TldvWebhookHandler
+
+    h = TldvWebhookHandler(
+        secret="", cortexdb_url="u", cortexdb_api_key="k", scope="s", actor="a"
+    )
+    assert not h.verify({"Authorization": "Bearer anything"}, b"{}")
+    assert not h.verify({}, b"{}")
+
+
+def test_jira_signs_under_x_hub_signature():
+    import hashlib
+    import hmac as hmac_mod
+
+    from cortexdb_connectors.webhooks import JiraWebhookHandler
+
+    h = JiraWebhookHandler(
+        secret="s", cortexdb_url="u", cortexdb_api_key="k", scope="s", actor="a"
+    )
+    body = b'{"webhookEvent": "jira:issue_updated"}'
+    sig = "sha256=" + hmac_mod.new(b"s", body, hashlib.sha256).hexdigest()
+    # Jira sends WebSub-style X-Hub-Signature — that must verify...
+    assert h.verify({"X-Hub-Signature": sig}, body)
+    # ...and GitHub's X-Hub-Signature-256 (which Jira never sends) must not.
+    assert not h.verify({"X-Hub-Signature-256": sig}, body)

{cortexdb_connectors-0.2.12 → cortexdb_connectors-0.2.13}/tests/test_webhooks_replay.py

@@ -1,11 +1,14 @@
-"""Webhook replay tests for the HMAC-signed handlers (jira, freshdesk, tldv).
+"""Webhook replay tests for the provider handlers (jira, freshdesk, tldv).
 
 Drives the real WebhookServer ASGI app with a Starlette TestClient and
-synthetic provider payloads (built from public sample shapes). Asserts:
-  * a bad/missing signature is rejected 401
-  * a correctly HMAC-signed body is accepted 200 and the event lands in the sink
-
-No live credentials; the only secret is the test's own HMAC key.
+synthetic provider payloads (built from public sample shapes), using each
+provider's REAL auth scheme (T47): Jira HMAC-signs the body under
+X-Hub-Signature; tl;dv and Freshdesk send a static Authorization header and
+no signature at all. Asserts:
+  * bad/missing auth is rejected 401
+  * a correctly authenticated delivery is accepted 200 and lands in the sink
+
+No live credentials; the only secret is the test's own key.
 """
 
 from __future__ import annotations
@@ -27,6 +30,20 @@ def _sign(body: bytes) -> str:
     return "sha256=" + hmac.new(_SECRET.encode(), body, hashlib.sha256).hexdigest()
 
 
+def _good_auth(provider: str, body: bytes) -> dict[str, str]:
+    """Each provider's real auth: Jira = body HMAC under X-Hub-Signature;
+    tl;dv/Freshdesk = static Authorization header, no signature."""
+    if provider == "jira":
+        return {"X-Hub-Signature": _sign(body)}
+    return {"Authorization": f"Bearer {_SECRET}"}
+
+
+def _bad_auth(provider: str) -> dict[str, str]:
+    if provider == "jira":
+        return {"X-Hub-Signature": "sha256=deadbeef"}
+    return {"Authorization": "Bearer wrong-secret"}
+
+
 # provider -> (secret_env_var, route, scope, payload, distinctive content word)
 CASES = {
     "jira": (
@@ -98,28 +115,39 @@ def _client(provider: str, sink, monkeypatch) -> tuple[TestClient, str, dict, st
 
 
 @pytest.mark.parametrize("provider", list(CASES), ids=list(CASES))
-def test_bad_signature_rejected(provider, cortex_sink, monkeypatch) -> None:
+def test_bad_auth_rejected(provider, cortex_sink, monkeypatch) -> None:
     client, route, payload, _ = _client(provider, cortex_sink, monkeypatch)
     body = json.dumps(payload).encode()
     r = client.post(
         route,
         content=body,
-        headers={"X-Hub-Signature-256": "sha256=deadbeef", "Content-Type": "application/json"},
+        headers={**_bad_auth(provider), "Content-Type": "application/json"},
+    )
+    assert r.status_code == 401, f"{provider}: bad auth should be 401, got {r.status_code}"
+
+
+@pytest.mark.parametrize("provider", list(CASES), ids=list(CASES))
+def test_missing_auth_rejected(provider, cortex_sink, monkeypatch) -> None:
+    client, route, payload, _ = _client(provider, cortex_sink, monkeypatch)
+    r = client.post(
+        route,
+        content=json.dumps(payload).encode(),
+        headers={"Content-Type": "application/json"},
     )
-    assert r.status_code == 401, f"{provider}: bad signature should be 401, got {r.status_code}"
+    assert r.status_code == 401, f"{provider}: missing auth should be 401, got {r.status_code}"
 
 
 @pytest.mark.parametrize("provider", list(CASES), ids=list(CASES))
-def test_good_signature_ingests(provider, cortex_sink, monkeypatch) -> None:
+def test_good_auth_ingests(provider, cortex_sink, monkeypatch) -> None:
     client, route, payload, scope = _client(provider, cortex_sink, monkeypatch)
     word = CASES[provider][4]
     body = json.dumps(payload).encode()
     r = client.post(
         route,
         content=body,
-        headers={"X-Hub-Signature-256": _sign(body), "Content-Type": "application/json"},
+        headers={**_good_auth(provider, body), "Content-Type": "application/json"},
     )
-    assert r.status_code == 200, f"{provider}: good signature should be 200, got {r.status_code} {r.text}"
+    assert r.status_code == 200, f"{provider}: good auth should be 200, got {r.status_code} {r.text}"
 
     items = []
     for _ in range(12):