add hmac webhook secret

spec/jobs/send_submission_created_webhook_request_job_spec.rb

@@ -57,6 +57,23 @@ RSpec.describe SendSubmissionCreatedWebhookRequestJob do
       ).once
     end
 
+    it 'signs the request with the HMAC secret' do
+      captured_body = nil
+      captured_signature = nil
+      stub_request(:post, webhook_url.url).with do |req|
+        captured_body = req.body
+        captured_signature = req.headers['X-Docuseal-Signature']
+      end.to_return(status: 200)
+
+      described_class.new.perform('submission_id' => submission.id, 'webhook_url_id' => webhook_url.id,
+                                  'event_uuid' => SecureRandom.uuid)
+
+      expect(captured_signature).to be_present
+      expect(WebhookUrls::Signatures.verify(webhook_url.hmac_secret,
+                                            body: captured_body,
+                                            header: captured_signature)).to be(true)
+    end
+
     it "doesn't send a webhook request if the event is not in the webhook's events" do
       webhook_url.update!(events: ['submission.completed'])
 

spec/system/webhook_settings_spec.rb

@@ -49,7 +49,7 @@ RSpec.describe 'Webhook Settings' do
     expect(page).to have_field('webhook_url[url]', type: 'url', with: webhook_url.url)
     expect(page).to have_button('Save')
     expect(page).to have_button('Delete')
-    expect(page).to have_link('Add Secret')
+    expect(page).to have_link('Security')
 
     WebhookUrl::EVENTS.each do |event|
       expect(page).to have_field(event, type: 'checkbox', checked: webhook_url.events.include?(event))
@@ -123,7 +123,7 @@ RSpec.describe 'Webhook Settings' do
 
     expect(webhook_url.secret).to eq({})
 
-    click_link 'Add Secret'
+    click_link 'Security'
 
     within '#modal' do
       fill_in 'Key', with: 'X-Signature'
@@ -136,7 +136,7 @@ RSpec.describe 'Webhook Settings' do
       expect(webhook_url.secret).to eq({ 'X-Signature' => 'secret-value' })
     end
 
-    expect(page).to have_link('Edit Secret')
+    expect(page).to have_link('Security')
     expect(page).to have_content('Webhook Secret has been saved.')
   end
 
@@ -145,7 +145,7 @@ RSpec.describe 'Webhook Settings' do
 
     visit settings_webhooks_path
 
-    click_link 'Edit Secret'
+    click_link 'Security'
 
     within '#modal' do
       fill_in 'Key', with: ''
@@ -158,10 +158,26 @@ RSpec.describe 'Webhook Settings' do
       expect(webhook_url.secret).to eq({})
     end
 
-    expect(page).to have_link('Add Secret')
+    expect(page).to have_link('Security')
     expect(page).to have_content('Webhook Secret has been saved.')
   end
 
+  it 'shows the HMAC signing secret on the HMAC tab' do
+    webhook_url = create(:webhook_url, account:)
+
+    visit settings_webhooks_path
+
+    click_link 'Security'
+
+    within '#modal' do
+      click_link 'HMAC'
+
+      expect(page).to have_field('hmac_secret')
+    end
+
+    expect(webhook_url.reload.hmac_secret).to start_with('whsec_')
+  end
+
   context 'when testing the webhook' do
     let!(:webhook_url) { create(:webhook_url, account:) }
     let!(:template) { create(:template, account:, author: user) }