kandev/docs/plans/plugin-voice-extraction-host/task-05-authenticated-webhook-handler.md

id, title, status, wave, depends_on, plan, spec

id	title	status	wave	depends_on	plan	spec
05-authenticated-webhook-handler	Enforce authenticated webhooks	done	2	02-authenticated-webhook-manifest	plan.md	../../specs/plugins/voice-extraction-host.md

Task 05: Enforce Authenticated Webhooks

Acceptance

• The existing webhook handler enforces each declared key's access mode and effective body limit before invoking the existing HandleWebhook RPC.
• Authenticated webhooks require Kandev identity and accepted Origin for cookie-authenticated browser calls; public webhooks retain their current unauthenticated behavior.
• Integration tests cover legacy 4 MiB behavior, authenticated denial/success, Origin rejection, 10 MiB multipart success, >16 MiB rejection, cancellation, disabled plugin, and runtime failure.

Verification

cd apps/backend && go test ./internal/plugins ./internal/auth/httpmw ./internal/backendapp
make -C apps/backend lint

Follow RED-GREEN-REFACTOR, beginning with direct handler and middleware-boundary security tests.

Files Likely Touched

• apps/backend/internal/plugins/handlers.go
• apps/backend/internal/plugins/invoke.go and focused tests if cancellation/size wiring needs changes
• apps/backend/internal/auth/httpmw/*

Inputs And Risks

• ADR conditional webhook access decision.
• Because the webhook path is currently public at middleware level, handler authentication must use the canonical auth service and fail closed before reading or relaying the request body.