fix(deploy-webhook): keep DEPLOY_WEBHOOK_REQUIRE_TIMESTAMP's meaning, add a signature-only flag

DEPLOY_WEBHOOK_REQUIRE_TIMESTAMP had been changed to mean signed requests
only, so an operator who set it for a sender that adds a timestamp but cannot
sign would have had every deploy notification refused after the upgrade. It
means the secret header plus a fresh timestamp again. Signature-only, the
setting that stops a replay, is DEPLOY_WEBHOOK_REQUIRE_SIGNATURE, on the
compose whitelist, in the env manifest and examples, and in the deploy
guide.

src/app/api/internal/deploy-webhook/__tests__/route.test.ts

@@ -444,12 +444,18 @@ describe("POST /api/internal/deploy-webhook (timestamp replay protection)", () =
  */
 describe("POST /api/internal/deploy-webhook (signed requests)", () => {
   const ORIGINAL_REQUIRE = process.env.DEPLOY_WEBHOOK_REQUIRE_TIMESTAMP;
+  const ORIGINAL_SIGNATURE = process.env.DEPLOY_WEBHOOK_REQUIRE_SIGNATURE;
   afterEach(() => {
     if (ORIGINAL_REQUIRE === undefined) {
       delete process.env.DEPLOY_WEBHOOK_REQUIRE_TIMESTAMP;
     } else {
       process.env.DEPLOY_WEBHOOK_REQUIRE_TIMESTAMP = ORIGINAL_REQUIRE;
     }
+    if (ORIGINAL_SIGNATURE === undefined) {
+      delete process.env.DEPLOY_WEBHOOK_REQUIRE_SIGNATURE;
+    } else {
+      process.env.DEPLOY_WEBHOOK_REQUIRE_SIGNATURE = ORIGINAL_SIGNATURE;
+    }
   });
 
   async function signed(
@@ -491,8 +497,8 @@ describe("POST /api/internal/deploy-webhook (signed requests)", () => {
     expect(auditLog).not.toHaveBeenCalled();
   });
 
-  it("in strict mode accepts only a signed request, not the bare secret with a fresh timestamp", async () => {
-    process.env.DEPLOY_WEBHOOK_REQUIRE_TIMESTAMP = "true";
+  it("with DEPLOY_WEBHOOK_REQUIRE_SIGNATURE accepts only a signed request, not the bare secret with a fresh timestamp", async () => {
+    process.env.DEPLOY_WEBHOOK_REQUIRE_SIGNATURE = "true";
     const unsigned = jsonRequest(
       { status: "success" },
       {
@@ -503,4 +509,24 @@ describe("POST /api/internal/deploy-webhook (signed requests)", () => {
     expect((await POST(unsigned)).status).toBe(401);
     expect((await POST(await signed('{"status":"success"}'))).status).toBe(200);
   });
+
+  it("keeps DEPLOY_WEBHOOK_REQUIRE_TIMESTAMP meaning the secret plus a fresh timestamp", async () => {
+    // What the flag meant before 1.46, and what an operator who set it with
+    // a sender that timestamps but cannot sign still gets.
+    process.env.DEPLOY_WEBHOOK_REQUIRE_TIMESTAMP = "true";
+    const fresh = jsonRequest(
+      { status: "success" },
+      {
+        "x-deploy-webhook-secret": "test-secret",
+        "x-deploy-webhook-timestamp": String(Math.floor(Date.now() / 1000)),
+      },
+    );
+    expect((await POST(fresh)).status).toBe(200);
+    const bare = jsonRequest(
+      { status: "success" },
+      { "x-deploy-webhook-secret": "test-secret" },
+    );
+    expect((await POST(bare)).status).toBe(401);
+    expect((await POST(await signed('{"status":"success"}'))).status).toBe(200);
+  });
 });

src/app/api/internal/deploy-webhook/route.ts

@@ -110,9 +110,15 @@ function normalizePayload(payload: CoolifyDeployPayload): NormalizedEvent {
  *   - Default: a signed request is verified as above; an unsigned one
  *     authenticates with the secret header, as Coolify's stock sender does,
  *     and a timestamp it carries must still be fresh.
- *   - `DEPLOY_WEBHOOK_REQUIRE_TIMESTAMP=true`: only a signed request is
- *     accepted. The name predates the signature; requiring a timestamp
- *     without one would not make a replay any harder.
+ *   - `DEPLOY_WEBHOOK_REQUIRE_TIMESTAMP=true`: what it has always meant, the
+ *     secret header plus a fresh timestamp; an unsigned request without one
+ *     is refused. It keeps a stale capture out, not a fresh forgery by
+ *     someone who saw the secret. A signed request is accepted as above.
+ *   - `DEPLOY_WEBHOOK_REQUIRE_SIGNATURE=true`: only a signed request is
+ *     accepted; the secret header alone is refused. This is the setting
+ *     that stops a replay. It has its own name so that an operator who set
+ *     the timestamp flag, with a sender that adds a timestamp but cannot
+ *     sign, keeps the behaviour they asked for.
  *
  * See docs/ops/deploy.md ("Deploy-status webhook") for the operator
  * guidance.
@@ -132,7 +138,11 @@ function checkTimestampFreshness(
   now: number = Date.now(),
 ): { ok: boolean; reason?: string } {
   const raw = request.headers.get("x-deploy-webhook-timestamp");
-  if (raw === null || raw === "") return { ok: true };
+  if (raw === null || raw === "") {
+    return flagSet("DEPLOY_WEBHOOK_REQUIRE_TIMESTAMP")
+      ? { ok: false, reason: "timestamp_missing" }
+      : { ok: true };
+  }
   const ts = parseTimestamp(raw);
   if (ts === null) return { ok: false, reason: "timestamp_invalid" };
   if (Math.abs(now - ts) > TIMESTAMP_WINDOW_MS) {
@@ -141,11 +151,11 @@ function checkTimestampFreshness(
   return { ok: true };
 }
 
-function strictMode(): boolean {
-  return (
-    process.env.DEPLOY_WEBHOOK_REQUIRE_TIMESTAMP === "true" ||
-    process.env.DEPLOY_WEBHOOK_REQUIRE_TIMESTAMP === "1"
-  );
+function flagSet(
+  name: "DEPLOY_WEBHOOK_REQUIRE_TIMESTAMP" | "DEPLOY_WEBHOOK_REQUIRE_SIGNATURE",
+): boolean {
+  const value = process.env[name]?.trim().toLowerCase();
+  return value === "true" || value === "1";
 }
 
 /**
@@ -296,7 +306,10 @@ export const POST = apiHandler(async (request: NextRequest) => {
     getEvent()?.setAuth({ auth_method: "webhook_secret" });
     annotate({ meta: { deploy_webhook_auth: "signature" } });
   } else {
-    if (strictMode() || !hasValidSecret(request)) {
+    if (
+      flagSet("DEPLOY_WEBHOOK_REQUIRE_SIGNATURE") ||
+      !hasValidSecret(request)
+    ) {
       return NextResponse.json({ status: "unauthorized" }, { status: 401 });
     }
     // Freshness AFTER the secret check: an unauthenticated caller learns