fix(notion): webhook verification handler can overwrite webhook signing secret and logs it to console

[Dhirenderchoudhary]

Same bug class as #583 (ZohoMail) and the companion Asana issue (#597): Notion's url_verification handler persists whatever verification_token arrives in the request payload, unconditionally, with no check that a secret isn't already configured.

packages/notion/webhooks/verification.ts:

handler: async (ctx, request) => {
	if (
		!('verification_token' in request.payload) ||
		!request.payload.verification_token
	) {
		return { success: false, data: undefined };
	}

	ctx.keys.set_webhook_signature(request.payload.verification_token);
	console.log(
		`Enter this key in your Notion webhook verification modal: ${ctx.key}`,
	);
	...

Two problems in this one handler:

1. Overwrite: an attacker who can POST to this endpoint with an arbitrary verification_token in the body gets it persisted as the new webhook signing secret, letting them forge future signed events — same root cause as fix(zohomail): handshake can overwrite webhook signing secret #583.
2. Secret logged to stdout: console.log prints ctx.key (the live signing secret) on every verification request. In a hosted/multi-tenant deployment this secret ends up in server logs, which is a separate exposure from the overwrite bug.

Fix

• Do not persist a new secret unless none is currently configured (or the request can otherwise prove authenticity for re-registration).
• Remove the console.log of the secret, or replace it with something that doesn't print the raw key (e.g. log that verification occurred, without the value).

Check

• An already-configured secret cannot be overwritten by an unsolicited verification POST
• The signing secret is never written to console/log output
• Legitimate first-time Notion webhook verification still works
• Unit test covering the overwrite attempt

pnpm --filter @corsair-dev/notion test

[Rudra2637]

Would like to work on this can you assign me ?