IFC-2257: add unit test for webhook signature validation

[polmichel]

Why

Webhook HMAC signature calculation has had two regressions in the past:

1. Signature was computed on str(dict) instead of json.dumps(dict)
2. json.dumps used default separators (, and : ) instead of compact (,, :) after HTTPX 0.28.x switch

The existing test_standard_webhook_header test only validates signing with an empty payload, which serializes identically regardless of format — so it catches neither regression.

Closes https://opsmill.atlassian.net/browse/IFC-2257

What changed

• Added test_webhook_signature_with_payload to backend/tests/unit/webhook/test_models.py
• Tests HMAC signature against a hardcoded expected value using a non-trivial nested payload
• Any change to JSON serialization format (spaced vs compact) or signing input (str vs JSON) breaks the test

How to review

Single test addition in backend/tests/unit/webhook/test_models.py. The hardcoded signature was verified by mutating the source to reintroduce both historical bugs and confirming the test fails in each case.

How to test

uv run invoke backend.test-unit -- -k test_webhook_signature_with_payload

Checklist

• Tests added/updated

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (4)

• main
• stable
• develop
• release-.*

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: bad24ca8-5038-4eed-abe7-a94218617331

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Tip

You can customize the tone of the review comments and chat replies.

Configure the tone_instructions setting to customize the tone of the review comments and chat replies. For example, you can set the tone to Act like a strict teacher, Act like a pirate and more.

[codspeed-hq]

Merging this PR will improve performance by 38.68%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 12 improved benchmarks

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
⚡	test_get_schema	324 ms	259.4 ms	+24.94%
⚡	test_relationshipmanager_getpeer	156.7 µs	134.5 µs	+16.52%
⚡	test_get_menu	245 ms	193.6 ms	+26.54%
⚡	test_schemabranch_duplicate	7.3 ms	5.8 ms	+25.96%
⚡	test_query_one_model	463.7 ms	353.4 ms	+31.24%
⚡	test_query_rel_one	662.6 ms	501 ms	+32.26%
⚡	test_query_rel_many	692.2 ms	524 ms	+32.11%
⚡	test_base_schema_duplicate_CoreProposedChange	2.1 ms	1.7 ms	+28.15%
⚡	test_graphql_generate_schema	516.2 ms	372.3 ms	+38.68%
⚡	test_nodemanager_querypeers	1.5 ms	1.3 ms	+21.66%
⚡	test_load_node_to_db_node_schema	66.3 ms	52.1 ms	+27.29%
⚡	test_schemabranch_process	1,027 ms	823.4 ms	+24.72%

---

_{Comparing pmi-20260314-serialization-unit-test-ifc2257 (f8d3e9d) with stable (43d16b8)¹}

Footnotes

1. No successful run was found on pmi-20260227-webhooks-ifc-2272 (4432cd4) during the generation of this report, so stable (43d16b8) was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[ogenstad]

LGTM, it would be nice if we could also capture any changes within the httpx package though.

[polmichel]

LGTM, it would be nice if we could also capture any changes within the httpx package though.

I added a new unit test package named external which as the following description
"""Unit tests for external and third-party library behavior that Infrahub depends on."""

A new unit test has been added testing the httpx serialization directly.

[ogenstad]

Thanks!