Function handleChallenge

apps/sim/lib/webhooks/providers/zoom.ts:165–222

* Handle Zoom endpoint URL validation challenges. * Zoom sends an `endpoint.url_validation` event with a `plainToken` that must * be hashed with the app's secret token and returned alongside the original token.

(
    body: unknown,
    request: NextRequest,
    requestId: string,
    path: string,
    rawBody?: string
  )

   * be hashed with the app's secret token and returned alongside the original token.
   */
  async handleChallenge(
    body: unknown,
    request: NextRequest,
    requestId: string,
    path: string,
    rawBody?: string
  ) {
    const obj = body as Record<string, unknown> | null
    if (obj?.event !== 'endpoint.url_validation') {
      return null
    }

    const payload = obj.payload as Record<string, unknown> | undefined
    const plainToken = payload?.plainToken as string | undefined
    if (!plainToken) {
      return null
    }

    logger.info(`[${requestId}] Zoom URL validation request received for path: ${path}`)

    const signature = request.headers.get('x-zm-signature')
    const timestamp = request.headers.get('x-zm-request-timestamp')
    if (!signature || !timestamp) {
      logger.warn(`[${requestId}] Zoom challenge request missing signature headers — rejecting`)
      return null
    }

    const bodyForSignature =
      rawBody !== undefined && rawBody !== null ? rawBody : JSON.stringify(body)

    let rows: Array<{ secretToken: string }> = []
    try {
      rows = await resolveZoomChallengeSecrets(path, requestId)
    } catch (err) {
      logger.warn(`[${requestId}] Failed to look up webhook secret for Zoom validation`, err)
      return null
    }

    for (const row of rows) {
      const secretToken = row.secretToken
      if (
        secretToken &&
        validateZoomSignature(secretToken, signature, timestamp, bodyForSignature)
      ) {
        const hashForValidate = hmacSha256Hex(plainToken, secretToken)

        return NextResponse.json({
          plainToken,
          encryptedToken: hashForValidate,
        })
      }
    }

    logger.warn(
      `[${requestId}] Zoom challenge: no matching secret for path ${path} (${rows.length} webhook row(s))`
    )
    return null
  },