From e4b0261f350d786d05afed62ce73fdc48801d9c5 Mon Sep 17 00:00:00 2001
From: Drew DeVault <sir@cmpwn.com>
Date: Fri, 24 Jan 2025 10:40:44 +0100
Subject: [PATCH] Export webhooks public key via api-meta.json

---
 crypto/crypto.go | 7 ++++---
 server/server.go | 8 ++++++--
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/crypto/crypto.go b/crypto/crypto.go
index bd6dc78f9cc7d922e8fb383cc01d83ee217bad8f..3fd31e0534b286ee9d38a8d66cb872a3d9116c7e 100644
--- a/crypto/crypto.go
+++ b/crypto/crypto.go
@@ -15,9 +15,10 @@ import (
 	"github.com/vaughan0/go-ini"
 )
 
+var WebhookPubkey ed25519.PublicKey
+
 var (
 	webhookSk ed25519.PrivateKey
-	webhookPk ed25519.PublicKey
 	bearerKey []byte
 	fernetKey *fernet.Key
 )
@@ -32,7 +33,7 @@ func InitCrypto(config ini.File) {
 		log.Fatalf("base64 decode webhooks private key: %v", err)
 	}
 	webhookSk = ed25519.NewKeyFromSeed(seed)
-	webhookPk, _ = webhookSk.Public().(ed25519.PublicKey)
+	WebhookPubkey, _ = webhookSk.Public().(ed25519.PublicKey)
 
 	b64fernet, ok := config.Get("sr.ht", "network-key")
 	if !ok {
@@ -52,7 +53,7 @@ func Sign(payload []byte) []byte {
 }
 
 func Verify(payload, signature []byte) bool {
-	return ed25519.Verify(webhookPk, payload, signature)
+	return ed25519.Verify(WebhookPubkey, payload, signature)
 }
 
 func Encrypt(payload []byte) []byte {
diff --git a/server/server.go b/server/server.go
index 252aad4498388c54cdddddbe2883a473816917ba..8a8b749069cef78eb028fe66730d53ccfd8c8b47 100644
--- a/server/server.go
+++ b/server/server.go
@@ -3,6 +3,7 @@ package server
 import (
 	"context"
 	"database/sql"
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"log"
@@ -30,6 +31,7 @@ import (
 
 	"git.sr.ht/~sircmpwn/core-go/auth"
 	"git.sr.ht/~sircmpwn/core-go/config"
+	"git.sr.ht/~sircmpwn/core-go/crypto"
 	"git.sr.ht/~sircmpwn/core-go/database"
 	"git.sr.ht/~sircmpwn/core-go/email"
 	"git.sr.ht/~sircmpwn/core-go/redis"
@@ -124,9 +126,11 @@ func (server *Server) WithSchema(
 
 		r.Handle("/query/metrics", promhttp.Handler())
 		r.Get("/query/api-meta.json", func(w http.ResponseWriter, r *http.Request) {
+			pkey := base64.StdEncoding.EncodeToString(crypto.WebhookPubkey)
 			info := struct {
-				Scopes []string `json:"scopes"`
-			}{scopes}
+				Scopes       []string `json:"scopes"`
+				WebhookPulic string   `json:"webhook-pubkey"`
+			}{scopes, pkey}
 
 			j, err := json.Marshal(&info)
 			if err != nil {