fix(gong): JWT verification, trigger UX, alignment script

- Optional RS256 verification when Gong JWT public key is configured (webhook_url + body_sha256 per Gong docs); URL secrecy when unset.
- Document that Gong rules filter calls; payload has no event type; add eventType + callId outputs for discoverability.
- Refactor Gong triggers to buildTriggerSubBlocks + shared JWT field; setup copy matches security model.
- Add check-trigger-alignment.ts (Gong bundled; extend PROVIDER_CHECKS for others) and update add-trigger guidance paths.

Made-with: Cursor

Author: waleedlatif1

.agents/skills/add-trigger/SKILL.md

@@ -596,7 +596,7 @@ if (foundWebhook.provider === '{service}') {
 
 Run the alignment checker:
 ```bash
-bunx scripts/check-trigger-alignment.ts {service}
+bun run apps/sim/scripts/check-trigger-alignment.ts {service}
 ```
 
 ## Trigger Outputs
@@ -699,7 +699,7 @@ export const {service}WebhookTrigger: TriggerConfig = {
 ### Webhook Input Formatting
 - [ ] Added handler in `apps/sim/lib/webhooks/utils.server.ts` (if custom formatting needed)
 - [ ] Handler returns fields matching trigger `outputs` exactly
-- [ ] Run `bunx scripts/check-trigger-alignment.ts {service}` to verify alignment
+- [ ] Run `bun run apps/sim/scripts/check-trigger-alignment.ts {service}` to verify alignment
 
 ### Testing
 - [ ] Run `bun run type-check` to verify no TypeScript errors

.claude/commands/add-trigger.md

@@ -708,9 +708,9 @@ export const {service}Handler: WebhookProviderHandler = {
 
 ### Verify Alignment
 
-Run the alignment checker:
+Run the alignment checker (from the `sim` git root). Supported providers have a check in `apps/sim/scripts/check-trigger-alignment.ts` (`PROVIDER_CHECKS`); others exit 0 with a note to add a handler-only entry or verify manually.
 ```bash
-bunx scripts/check-trigger-alignment.ts {service}
+bun run apps/sim/scripts/check-trigger-alignment.ts {service}
 ```
 
 ## Trigger Outputs
@@ -820,7 +820,7 @@ export const {service}WebhookTrigger: TriggerConfig = {
 
 ### Testing
 - [ ] Run `bun run type-check` to verify no TypeScript errors
-- [ ] Run `bunx scripts/check-trigger-alignment.ts {service}` to verify output alignment
+- [ ] Run `bun run apps/sim/scripts/check-trigger-alignment.ts {service}` to verify output alignment
 - [ ] Restart dev server to pick up new triggers
 - [ ] Test trigger UI shows correctly in the block
 - [ ] Test automatic webhook creation works (if applicable)

apps/sim/lib/webhooks/providers/gong.test.ts

@@ -0,0 +1,129 @@
+import { createHash } from 'node:crypto'
+import * as jose from 'jose'
+import { NextRequest } from 'next/server'
+import { describe, expect, it } from 'vitest'
+import {
+  GONG_JWT_PUBLIC_KEY_CONFIG_KEY,
+  gongHandler,
+  normalizeGongPublicKeyPem,
+  verifyGongJwtAuth,
+} from '@/lib/webhooks/providers/gong'
+
+describe('normalizeGongPublicKeyPem', () => {
+  it('passes through PEM', () => {
+    const pem = '-----BEGIN PUBLIC KEY-----\nabc\n-----END PUBLIC KEY-----'
+    expect(normalizeGongPublicKeyPem(pem)).toBe(pem)
+  })
+
+  it('wraps raw base64', () => {
+    const raw = 'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxfj3'
+    const out = normalizeGongPublicKeyPem(raw)
+    expect(out).toContain('BEGIN PUBLIC KEY')
+    expect(out).toContain('END PUBLIC KEY')
+    expect(out).toContain('MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxfj3')
+  })
+
+  it('returns null for garbage', () => {
+    expect(normalizeGongPublicKeyPem('not-base64!!!')).toBeNull()
+  })
+})
+
+describe('gongHandler verifyAuth (JWT)', () => {
+  it('returns null when JWT public key is not configured', async () => {
+    const request = new NextRequest('https://app.example.com/api/webhooks/trigger/abc', {
+      method: 'POST',
+      body: '{}',
+    })
+    const rawBody = '{}'
+    const res = await verifyGongJwtAuth({
+      webhook: {},
+      workflow: {},
+      request,
+      rawBody,
+      requestId: 't1',
+      providerConfig: {},
+    })
+    expect(res).toBeNull()
+  })
+
+  it('returns 401 when key is configured but Authorization is missing', async () => {
+    const { publicKey } = await jose.generateKeyPair('RS256')
+    const spki = await jose.exportSPKI(publicKey)
+    const request = new NextRequest('https://app.example.com/api/webhooks/trigger/abc', {
+      method: 'POST',
+      body: '{}',
+    })
+    const res = await verifyGongJwtAuth({
+      webhook: {},
+      workflow: {},
+      request,
+      rawBody: '{}',
+      requestId: 't2',
+      providerConfig: { [GONG_JWT_PUBLIC_KEY_CONFIG_KEY]: spki },
+    })
+    expect(res?.status).toBe(401)
+  })
+
+  it('accepts a valid Gong-style JWT', async () => {
+    const { publicKey, privateKey } = await jose.generateKeyPair('RS256')
+    const spki = await jose.exportSPKI(publicKey)
+    const url = 'https://app.example.com/api/webhooks/trigger/test-path'
+    const rawBody = '{"callData":{}}'
+    const bodySha = createHash('sha256').update(rawBody, 'utf8').digest('hex')
+
+    const jwt = await new jose.SignJWT({
+      webhook_url: url,
+      body_sha256: bodySha,
+    })
+      .setProtectedHeader({ alg: 'RS256' })
+      .setExpirationTime('1h')
+      .sign(privateKey)
+
+    const request = new NextRequest(url, {
+      method: 'POST',
+      body: rawBody,
+      headers: { Authorization: `Bearer ${jwt}` },
+    })
+
+    const res = await gongHandler.verifyAuth!({
+      webhook: {},
+      workflow: {},
+      request,
+      rawBody,
+      requestId: 't3',
+      providerConfig: { [GONG_JWT_PUBLIC_KEY_CONFIG_KEY]: spki },
+    })
+    expect(res).toBeNull()
+  })
+
+  it('rejects JWT when body hash does not match', async () => {
+    const { publicKey, privateKey } = await jose.generateKeyPair('RS256')
+    const spki = await jose.exportSPKI(publicKey)
+    const url = 'https://app.example.com/api/webhooks/trigger/x'
+    const rawBody = '{"a":1}'
+
+    const jwt = await new jose.SignJWT({
+      webhook_url: url,
+      body_sha256: 'deadbeef',
+    })
+      .setProtectedHeader({ alg: 'RS256' })
+      .setExpirationTime('1h')
+      .sign(privateKey)
+
+    const request = new NextRequest(url, {
+      method: 'POST',
+      body: rawBody,
+      headers: { Authorization: jwt },
+    })
+
+    const res = await verifyGongJwtAuth({
+      webhook: {},
+      workflow: {},
+      request,
+      rawBody,
+      requestId: 't4',
+      providerConfig: { [GONG_JWT_PUBLIC_KEY_CONFIG_KEY]: spki },
+    })
+    expect(res?.status).toBe(401)
+  })
+})

apps/sim/lib/webhooks/providers/gong.ts

@@ -1,15 +1,137 @@
+import { createHash } from 'node:crypto'
+import { createLogger } from '@sim/logger'
+import * as jose from 'jose'
+import { NextResponse } from 'next/server'
 import type {
+  AuthContext,
   FormatInputContext,
   FormatInputResult,
   WebhookProviderHandler,
 } from '@/lib/webhooks/providers/types'
 
+const logger = createLogger('WebhookProvider:Gong')
+
+/** providerConfig key: PEM or raw base64 RSA public key from Gong (Signed JWT header auth). */
+export const GONG_JWT_PUBLIC_KEY_CONFIG_KEY = 'gongJwtPublicKeyPem'
+
+/**
+ * Gong automation webhooks support either URL secrecy (token in path) or a signed JWT in
+ * `Authorization` (see https://help.gong.io/docs/create-a-webhook-rule).
+ * When {@link GONG_JWT_PUBLIC_KEY_CONFIG_KEY} is set, we verify RS256 per Gong's JWT guide.
+ * When unset, only the unguessable Sim webhook path authenticates the request (same as before).
+ */
+export function normalizeGongPublicKeyPem(input: string): string | null {
+  const trimmed = input.trim()
+  if (!trimmed) return null
+  if (trimmed.includes('BEGIN PUBLIC KEY')) {
+    return trimmed
+  }
+  const b64 = trimmed.replace(/\s/g, '')
+  if (!/^[A-Za-z0-9+/]+=*$/.test(b64)) {
+    return null
+  }
+  const chunked = b64.match(/.{1,64}/g)?.join('\n') ?? b64
+  return `-----BEGIN PUBLIC KEY-----\n${chunked}\n-----END PUBLIC KEY-----`
+}
+
+function normalizeUrlForGongJwtClaim(url: string): string {
+  try {
+    const u = new URL(url)
+    let path = u.pathname
+    if (path.length > 1 && path.endsWith('/')) {
+      path = path.slice(0, -1)
+    }
+    return `${u.protocol}//${u.host.toLowerCase()}${path}`
+  } catch {
+    return url.trim()
+  }
+}
+
+function parseAuthorizationJwt(authHeader: string | null): string | null {
+  if (!authHeader) return null
+  const trimmed = authHeader.trim()
+  if (trimmed.toLowerCase().startsWith('bearer ')) {
+    return trimmed.slice(7).trim() || null
+  }
+  return trimmed || null
+}
+
+export async function verifyGongJwtAuth(ctx: AuthContext): Promise<NextResponse | null> {
+  const { request, rawBody, requestId, providerConfig } = ctx
+  const rawKey = providerConfig[GONG_JWT_PUBLIC_KEY_CONFIG_KEY]
+  if (typeof rawKey !== 'string') {
+    return null
+  }
+
+  const pem = normalizeGongPublicKeyPem(rawKey)
+  if (!pem) {
+    logger.warn(`[${requestId}] Gong JWT public key configured but could not be normalized`)
+    return new NextResponse('Unauthorized - Invalid Gong JWT public key configuration', {
+      status: 401,
+    })
+  }
+
+  const token = parseAuthorizationJwt(request.headers.get('authorization'))
+  if (!token) {
+    logger.warn(`[${requestId}] Gong JWT verification enabled but Authorization header missing`)
+    return new NextResponse('Unauthorized - Missing Gong JWT', { status: 401 })
+  }
+
+  let payload: jose.JWTPayload
+  try {
+    const key = await jose.importSPKI(pem, 'RS256')
+    const verified = await jose.jwtVerify(token, key, { algorithms: ['RS256'] })
+    payload = verified.payload
+  } catch (error) {
+    logger.warn(`[${requestId}] Gong JWT verification failed`, {
+      message: error instanceof Error ? error.message : String(error),
+    })
+    return new NextResponse('Unauthorized - Invalid Gong JWT', { status: 401 })
+  }
+
+  const claimUrl = payload.webhook_url
+  if (typeof claimUrl !== 'string' || !claimUrl) {
+    logger.warn(`[${requestId}] Gong JWT missing webhook_url claim`)
+    return new NextResponse('Unauthorized - Invalid Gong JWT claims', { status: 401 })
+  }
+
+  const claimDigest = payload.body_sha256
+  if (typeof claimDigest !== 'string' || !claimDigest) {
+    logger.warn(`[${requestId}] Gong JWT missing body_sha256 claim`)
+    return new NextResponse('Unauthorized - Invalid Gong JWT claims', { status: 401 })
+  }
+
+  const expectedDigest = createHash('sha256').update(rawBody, 'utf8').digest('hex')
+  if (claimDigest !== expectedDigest) {
+    logger.warn(`[${requestId}] Gong JWT body_sha256 mismatch`)
+    return new NextResponse('Unauthorized - Gong JWT body mismatch', { status: 401 })
+  }
+
+  const receivedNorm = normalizeUrlForGongJwtClaim(request.url)
+  const claimNorm = normalizeUrlForGongJwtClaim(claimUrl)
+  if (receivedNorm !== claimNorm) {
+    logger.warn(`[${requestId}] Gong JWT webhook_url mismatch`, {
+      receivedNorm,
+      claimNorm,
+    })
+    return new NextResponse('Unauthorized - Gong JWT URL mismatch', { status: 401 })
+  }
+
+  return null
+}
+
 export const gongHandler: WebhookProviderHandler = {
+  verifyAuth: verifyGongJwtAuth,
+
   async formatInput({ body }: FormatInputContext): Promise<FormatInputResult> {
     const b = body as Record<string, unknown>
     const callData = b.callData as Record<string, unknown> | undefined
     const metaData = (callData?.metaData as Record<string, unknown>) || {}
     const content = callData?.content as Record<string, unknown> | undefined
+    const callId =
+      typeof metaData.id === 'string' || typeof metaData.id === 'number'
+        ? String(metaData.id)
+        : null
 
     return {
       input: {
@@ -19,6 +141,8 @@ export const gongHandler: WebhookProviderHandler = {
         parties: (callData?.parties as unknown[]) || [],
         context: (callData?.context as unknown[]) || [],
         trackers: (content?.trackers as unknown[]) || [],
+        eventType: 'gong.automation_rule',
+        callId: callId ?? null,
       },
     }
   },