fix(zoom): return error string when webhook signing secret is missing

[siddhanttiwari19]

Description

Fixes #520. Zoom's webhook signature verification (verifyZoomWebhookSignature in packages/zoom/webhooks/types.ts) already returned { valid: false } when the signing secret was missing, but unlike Slack/Zendesk it omitted the error field. This brings Zoom in line with that pattern:

if (!signingSecret) {
  return { valid: false, error: 'Missing webhook signing secret configuration' };
}

Added a unit test covering this branch in packages/zoom/webhooks/types.test.ts.

Checklist

• I have run pnpm lint and all checks pass (3 pre-existing warnings in unrelated files, no errors)
• I have run pnpm typecheck and there are no TypeScript errors
• I have run pnpm build and all packages build successfully (packages/zoom builds cleanly; a handful of unrelated plugin packages fail on Windows due to a pre-existing rm -rf Unix-only build script, unaffected by this change)
• I have run pnpm test and all tests pass (new test in packages/zoom/webhooks/types.test.ts passes; the pre-existing api.test.ts integration test and a few unrelated plugin packages require live API credentials not available locally)
• I have added or updated tests where applicable
• I have added or updated necessary documentation (not applicable — no user-facing docs affected)

Screenshots / Demos (if applicable)

Screen.Recording.2026-08-03.182313.mp4

Additional Notes

Not a breaking change — only adds a field to an already-optional error?: string property on the return type. Existing callers checking result.valid are unaffected.

Summary by CodeRabbit

• Bug Fixes
  • Improved webhook signature verification feedback when the signing secret is not configured.
  • Configuration errors now include a clear, descriptive message instead of only indicating an invalid signature.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
www	Skipped		Aug 6, 2026 2:05pm

[coderabbitai]

📝 Walkthrough

Walkthrough

Zoom webhook signature verification now returns a configuration error when no signing secret is provided. A test verifies the valid: false result and the exact error message.

Changes

Zoom webhook verification

Layer / File(s)	Summary
Missing-secret result and test packages/zoom/webhooks/types.ts, packages/zoom/webhooks/types.test.ts	verifyZoomWebhookSignature returns Missing webhook signing secret configuration when the signing secret is absent. The test validates the structured invalid result.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• corsairdev/corsair#555: Updates missing-signing-secret errors for a different webhook integration.

Suggested reviewers: devjain32

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The PR adds the required structured error and a unit test for missing Zoom webhook signing secrets [#520].
Out of Scope Changes check	✅ Passed	All changes support the linked issue by updating Zoom verification behavior and adding its focused unit test.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: returning an error string when the Zoom webhook signing secret is missing.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

The PR makes Zoom’s missing-signing-secret response consistent with other signature-verification failures.

• Adds the missing configuration error message to verifyZoomWebhookSignature.
• Adds a unit test asserting the structured failure response.

Confidence Score: 4/5

The PR appears safe to merge, with only a non-blocking documentation issue around the test fixture’s broad payload type.

The runtime change preserves the existing invalid result and additively supplies the intended error message; the only accepted concern is an unexplained unknown type in the new test.

Files Needing Attention: packages/zoom/webhooks/types.test.ts

Important Files Changed

Filename	Overview
packages/zoom/webhooks/types.ts	Adds an error string to the existing missing-secret failure response without changing signature-verification behavior.
packages/zoom/webhooks/types.test.ts	Covers the new response shape, but its unknown payload type lacks the explanation required by repository typing rules.

_{Reviews (1): Last reviewed commit: "fix(zoom): return error string when webh..." | Re-trigger Greptile}

[siddhanttiwari19]

Hey @Dhirenderchoudhary , the Plugin PR Gate check is failing for a reason unrelated to this PR's changes. From the job log, the gate script tries to post a scorecard comment via gh api, but PRs from forks get a read only GITHUB_TOKEN, so the POST fails with 403 Resource not accessible by integration. The script currently treats that as a fatal error and exits non-zero, which fails the whole gate.

This should affect any fork based PR, not just this one. The fix would live in scripts/pr-review/gate main.ts catching/ignoring the 403 on fork PRs instead of exiting non zero. Happy to open a separate issue for it if that's useful, but wanted to flag it here since it's currently blocking this PR from passing checks despite the actual change being unaffected.

[Dhirenderchoudhary]

LGTM for #520.
Please fix CI failures

[siddhanttiwari19]

Thanks @Dhirenderchoudhary Fixed both