[$50] Add authentication for a new Nylas Page webhook.

[maxceem]

We've implemented a new Nylas Page webhook which works like this:

• When creating a Nylas page we set URL which has to be triggered when a meeting is scheduled using this Nylas Page https://github.com/topcoder-platform/taas-apis/blob/dev/src/services/NylasService.js#L136
• Then we listen to this endpoint and handle events inside method InterviewService.partiallyUpdateInterviewByWebhook
• As a result endpoint POST /v5/updateInterview/${interview.id}/nylas-webhooks is not protected and anyone may call it and change our Interview

Task

We have to implement authentication in some way which would ensure, that when this webhook is called it's done by Nylas for us, not by a random person.

Idea:

• Generate some token and pass it to the webhook URL in https://github.com/topcoder-platform/taas-apis/blob/dev/src/services/NylasService.js#L136 example:
  • https://e344-77-120-181-211.ngrok.io/api/v5/updateInterview/${interview.id}/nylas-webhooks?authToken={authToken}
  • then inside POST /v5/updateInterview/${interview.id}/nylas-webhooks endpoint we have to check that this token was really generated by us and is valid

This is just an idea, any other ideas are highly welcome.

I believe that for this issue we would need to use some secret. Please. create a new env variable for the secret like https://github.com/topcoder-platform/taas-apis/blob/dev/config/default.js#L342, don't use any existent secret.

[maxceem]

@mahidulalvi-bonic do you have ideas how to implement this?
If so, could you please work on it before #609, so we complete this webhook stuff first.

Working on this, looking into scheduler API.

Hi @maxceem, I pushed the fixes in PR #622.

@maxceem, I think there might be an issue in the future with this method.

So currently, the token is set in scheduler page record at the time of creating invite/interview record. If the invitation was sent on the 1st day of a month, and the candidate/host later schedules the interview on the 7th day.

On the 3rd day, lets say you want to change the token set in env var(as a secure practise/due to compromised secret) - then webhooks for all scheduling invitation created before 3rd day will fail authentication.

I think storing the token/token hash in the DB in the associated Interview record in a new column might solve it. But the current implementation works fine as long as this case doesn't occur. Let me know.

[maxceem]

@mahidulalvi-bonic paid via https://www.topcoder.com/challenges/59891b55-735d-455c-bd59-ae2722f89404