Add webhook plugin integration and configuration changes#1983
Add webhook plugin integration and configuration changes#1983AttriPardeep wants to merge 3 commits into
Conversation
Review Summary by QodoAdd webhook plugin integration with async sender and retry mechanism
WalkthroughsDescription• Add comprehensive webhook plugin for OCPP event integration • Implement async webhook sender with HMAC-SHA256 signing and retry logic • Create event models for connector status, transactions, and meter values • Configure HTTP client with connection pooling and smart meter filtering • Update production configuration with webhook settings and REST API endpoints Diagramflowchart LR
OCPP["OCPP Events<br/>StatusNotification<br/>StartTransaction<br/>StopTransaction<br/>MeterValues"]
Listener["OcppEventListener<br/>Converts to webhook events"]
Sender["WebhookSender<br/>HMAC-SHA256 signing<br/>Async execution"]
Retry["WebhookRetryQueue<br/>Exponential backoff<br/>Max 3 attempts"]
Backend["VoltStartEV Backend<br/>Webhook endpoint"]
OCPP -->|Spring events| Listener
Listener -->|sendAsync| Sender
Sender -->|success| Backend
Sender -->|failure| Retry
Retry -->|scheduled retry| Sender
File Changes1. steve-webhook-plugin/src/main/java/com/voltstartev/steve/plugin/SteveWebhookPluginApplication.java
|
Code Review by Qodo
1. db.password plaintext in prod
|
![qodo-free-for-open-source-projects[bot]](https://avatars.githubusercontent.com/in/1068000?s=60&v=4){kind=small}
| db.schema = stevedb | ||
| db.user = steve | ||
| db.password = changeme | ||
| db.password = StevePass2026! |
There was a problem hiding this comment.
1. db.password plaintext in prod 📘 Rule violation ⛨ Security
The production properties file now contains a hardcoded database password in plaintext. This violates boundary security hardening requirements and risks credential leakage via source control or deployments.
Agent Prompt
## Issue description
`application-prod.properties` contains a plaintext database password (`db.password`), which is prohibited for production secret storage.
## Issue Context
Compliance requires secrets not be persisted in plaintext in repo-tracked configuration.
## Fix Focus Areas
- src/main/resources/application-prod.properties[13-13]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| # Shared secret for HMAC-SHA256 signature (MUST MATCH backend) | ||
| voltstartev.webhook.secret=4c89055d36eefb7fd2422483544bd7a39dbb62d06b0b3c04bdc9dd709bf46fc8 | ||
|
|
There was a problem hiding this comment.
3. webhook.secret committed in plugin 📘 Rule violation ⛨ Security
The plugin’s application.properties commits a concrete HMAC secret value. This is plaintext secret persistence and risks credential exposure if the repository or artifacts are shared.
Agent Prompt
## Issue description
A real webhook HMAC secret is committed in `steve-webhook-plugin/src/main/resources/application.properties`.
## Issue Context
Per compliance, secrets must not be persisted in plaintext in repository configuration.
## Fix Focus Areas
- steve-webhook-plugin/src/main/resources/application.properties[8-10]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| #webapi.key = STEVE-API-KEY | ||
| #webapi.value = |
There was a problem hiding this comment.
4. Unresolved webapi placeholders 🐞 Bug ✓ Correctness
In prod, webapi.key and webapi.value are commented out, but application.yml still requires
${webapi.key}/${webapi.value}, which can prevent Spring from resolving placeholders and stop SteVe
from starting in the prod profile.
Agent Prompt
### Issue description
Prod profile comments out `webapi.key`/`webapi.value`, but `application.yml` still references `${webapi.key}`/`${webapi.value}`. This can lead to unresolved placeholders and application startup failure.
### Issue Context
`steve.auth.web-api-key` and `steve.auth.web-api-secret` are bound from these placeholders.
### Fix Focus Areas
- src/main/resources/application-prod.properties[20-25]
- src/main/resources/application.yml[38-47]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| #server.host = 0.0.0.0 | ||
| server.address = 0.0.0.0 | ||
| server.port = 8080 | ||
| server.gzip.enabled = true |
There was a problem hiding this comment.
5. Prod service exposed publicly 🐞 Bug ⛨ Security
application-prod.properties binds the server to 0.0.0.0 and enables extensive DEBUG logging, increasing exposure of the admin interface and sensitive operational data in logs.
Agent Prompt
### Issue description
Prod config binds on `0.0.0.0` and enables DEBUG logging broadly, while retaining weak default admin credentials.
### Issue Context
This combination significantly increases attack surface and risks log-based data exposure.
### Fix Focus Areas
- src/main/resources/application-prod.properties[15-19]
- src/main/resources/application-prod.properties[32-37]
- src/main/resources/application-prod.properties[90-98]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
1 participant
No description provided.