feat: add per-webhook secret with backfill migration (#13573)

db/migrate/20260218075101_add_secret_to_webhooks.rb

@@ -0,0 +1,5 @@
+class AddSecretToWebhooks < ActiveRecord::Migration[7.1]
+  def change
+    add_column :webhooks, :secret, :string
+  end
+end

db/migrate/20260226084618_backfill_webhook_secrets.rb

@@ -0,0 +1,11 @@
+class BackfillWebhookSecrets < ActiveRecord::Migration[7.1]
+  def up
+    Webhook.find_each do |webhook|
+      webhook.update!(secret: SecureRandom.urlsafe_base64(24))
+    end
+  end
+
+  def down
+    # no-op: removing the column in the previous migration handles cleanup
+  end
+end

db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[7.1].define(version: 2026_01_30_061021) do
+ActiveRecord::Schema[7.1].define(version: 2026_02_26_084618) do
   # These extensions should be enabled to support this database
   enable_extension "pg_stat_statements"
   enable_extension "pg_trgm"
@@ -1250,6 +1250,7 @@ ActiveRecord::Schema[7.1].define(version: 2026_01_30_061021) do
     t.integer "webhook_type", default: 0
     t.jsonb "subscriptions", default: ["conversation_status_changed", "conversation_updated", "conversation_created", "contact_created", "contact_updated", "message_created", "message_updated", "webwidget_triggered"]
     t.string "name"
+    t.string "secret"
     t.index ["account_id", "url"], name: "index_webhooks_on_account_id_and_url", unique: true
   end