Val Town Project with Webhook Authentication

This project implements a dual authentication system:

• User Authentication: For regular web routes using LastLogin
• Webhook Authentication: For webhook endpoints using X-API-KEY header

The authentication middleware is applied in this specific order:

1. Webhook Authentication (/tasks/* routes) - X-API-KEY validation
2. User Authentication (/api/*, /views/*, / routes) - LastLogin validation
3. Route Handlers

• Scope: Only applies to POST requests under /tasks/*
• Header: Requires X-API-KEY header
• Secret: Validates against NOTION_WEBHOOK_SECRET environment variable
• Security: Uses constant-time comparison to prevent timing attacks

Set the following environment variable in your Val Town settings:

NOTION_WEBHOOK_SECRET=your-webhook-secret-here

• POST /tasks/test - Test webhook authentication
• POST /tasks/notion-webhook - Main Notion webhook handler

• GET /tasks/debug-webhook - Check webhook secret configuration

• GET / - Dashboard (requires user login)
• GET /api/health - Health check (public)
• Other /api/* and /views/* routes require user authentication

curl -X POST https://your-val.web.val.run/tasks/test

curl -X POST https://your-val.web.val.run/tasks/test \
  -H "X-API-KEY: wrong-key"

curl -X POST https://your-val.web.val.run/tasks/test \
  -H "X-API-KEY: your-configured-secret-value"

curl https://your-val.web.val.run/tasks/debug-webhook

• Constant-time comparison: Prevents timing attacks on API key validation
• Generic error messages: Don't reveal authentication mechanism details
• Request logging: Failed authentication attempts are logged for monitoring
• Method-specific auth: Webhook auth only applies to POST requests
• Route separation: Complete separation between webhook and user authentication

├── backend/
│   ├── routes/
│   │   ├── authCheck.ts           # User authentication middleware
│   │   ├── webhookAuthCheck.ts    # Webhook authentication middleware
│   │   ├── tasks/                 # Webhook endpoints
│   │   ├── api/                   # User-authenticated API endpoints
│   │   └── views/                 # User-authenticated view endpoints
│   └── ...
├── main.tsx                       # Main application with middleware setup
└── README.md

• Webhook routes are designed for POST requests (as webhooks typically send POST)
• GET requests to /tasks/* bypass webhook authentication (useful for debug endpoints)
• User authentication still applies to all other routes as expected
• The middleware order is critical - webhook auth must come before user auth for /tasks/* routes