message: move the hook validation
diff: @@ -132,24 +132,6 @@ function Sparkbot(configuration) {
  };
  - // ensure that the encrypted signature from Cisco Spark matches our configured secret
  - // this will validate that the incoming webhook really came from Cisco.
  - controller.middleware.ingest.use(function validateSecret(bot, message, res, next) {
  -
  - if (controller.config.secret) {
  - var signature = req.headers['x-spark-signature'];
  - var hash = crypto.createHmac('sha1', controller.config.secret).update(JSON.stringify(message)).digest('hex');
  -
  - if (signature != hash) {
  - console.error('WARNING: Webhook received message with invalid signature. Potential malicious behavior!');
  - return false;
  - }
  - }
  -
  - next();
  -
  - });
  -
  controller.middleware.ingest.use(function limitUsers(bot, message, res, next) {
  if (controller.config.limit_to_org) {
  @@ -190,7 +172,6 @@ function Sparkbot(configuration) {
  controller.api.messages.get(message.data).then(function(decrypted_message) {
  -
  message.user = decrypted_message.personEmail;
  message.channel = decrypted_message.roomId;
  message.text = decrypted_message.text;
  @@ -282,6 +263,16 @@ function Sparkbot(configuration) {
  controller.handleWebhookPayload = function(req, res, bot) {
  + var payload = req.body;
  + if (controller.config.secret) {
  + var signature = req.headers['x-spark-signature'];
  + var hash = crypto.createHmac('sha1', controller.config.secret).update(JSON.stringify(payload)).digest('hex');
  + if (signature != hash) {
  + console.error('WARNING: Webhook received message with invalid signature. Potential malicious behavior!');
  + return false;
  + }
  + }
  +
  controller.ingest(bot, req.body, res);
  };
  