fix(twitterapiio): fail closed when webhook secret is missing

[ambikeesshh]

TwitterApiIO webhooks accept requests when no signing secret is set.

keyBuilder does return res ?? '', and the verifier treats an empty secret plus a missing signature as valid:

if (!signature) {
  if (!secret) return { valid: true };
}

Handlers still persist tweets after that. Same class of bug as GitLab's empty-secret fail-open.

Fix

• empty/missing secret should return { valid: false, error: '...' }
• keyBuilder should throw (or otherwise fail) when webhook signature is missing, not return ''

Check

• missing secret is rejected
• missing signature with a configured secret is rejected
• no DB write on failed verification
• small unit test for the reject path

pnpm --filter @corsair-dev/twitterapiio test

[yuvanvk]

@ambikeesshh would like to work on this, could you assign it me?

[Dhirenderchoudhary]

@yuvanvk Hey Just letting you know that all of your PRs were closed automatically because the head repository was deleted.
You may need to recreate the repository/fork and open the PRs again if you still want Contribute.