feat: ds

app/Http/Controllers/Hooks/TokenviewWebhookController.php

@@ -15,25 +15,25 @@ class TokenviewWebhookController extends Controller
         $raw = $request->getContent();
         $signature = $request->header('X-Tokenview-Signature');
 
-        if (! $monitor->verifySignature($raw, $signature)) {
-            Log::warning('tokenview webhook bad signature');
-
-            return response('invalid signature', 401);
-        }
-
         $payload = $request->json()->all();
         if (! is_array($payload) || $payload === []) {
             $decoded = json_decode($raw, true);
             $payload = is_array($decoded) ? $decoded : [];
         }
 
-        try {
-            $monitor->handleWebhook($payload);
-        } catch (\Throwable $e) {
-            Log::warning('tokenview webhook handle failed: '.$e->getMessage());
+        // Tokenview probes the webhook (often unsigned GET/POST) before a
+        // sign key exists. Always 200 + non-empty body; only skip ingest.
+        $signed = $monitor->verifySignature($raw, $signature);
+        if (! $signed) {
+            Log::warning('tokenview webhook bad signature (acked 200, skipped ingest)');
+        } elseif ($payload !== []) {
+            try {
+                $monitor->handleWebhook($payload);
+            } catch (\Throwable $e) {
+                Log::warning('tokenview webhook handle failed: '.$e->getMessage());
+            }
         }
 
-        // Tokenview requires HTTP 200 + non-empty body.
         return response('ok', 200)->header('Content-Type', 'text/plain; charset=UTF-8');
     }
 }