add hmac webhook secret

db/migrate/20260506120000_add_hmac_to_webhook_urls.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+class AddHmacToWebhookUrls < ActiveRecord::Migration[8.1]
+  class MigrationWebhookUrl < ApplicationRecord
+    self.table_name = 'webhook_urls'
+
+    encrypts :hmac_secret
+  end
+
+  def up
+    add_column :webhook_urls, :hmac_secret, :text
+
+    MigrationWebhookUrl.find_each do |webhook_url|
+      webhook_url.update_columns(hmac_secret: WebhookUrls::Signatures.generate_secret)
+    end
+
+    change_column_null :webhook_urls, :hmac_secret, false
+  end
+
+  def down
+    remove_column :webhook_urls, :hmac_secret
+  end
+end

db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[8.1].define(version: 2026_04_16_100000) do
+ActiveRecord::Schema[8.1].define(version: 2026_05_06_120000) do
   # These are extensions that must be enabled in order to support this database
   enable_extension "btree_gin"
   enable_extension "pg_catalog.plpgsql"
@@ -545,6 +545,7 @@ ActiveRecord::Schema[8.1].define(version: 2026_04_16_100000) do
     t.bigint "account_id", null: false
     t.datetime "created_at", null: false
     t.text "events", null: false
+    t.text "hmac_secret", null: false
     t.text "secret", null: false
     t.string "sha1", null: false
     t.datetime "updated_at", null: false