fix: secure webhook config endpoint and validate config on Ombi enable/test

- Add requireAuth to GET /api/webhook/config to enforce authentication
- Add SOFARR_BASE_URL and SOFARR_WEBHOOK_SECRET validation to POST /api/ombi/webhook/enable and /test
- Return 400 with descriptive errors when webhook config is missing on Ombi routes
- Clean up test environment in webhook.test.js afterEach
- Add regression tests for all new validation logic
- Update CHANGELOG.md with security fixes

server/routes/ombi.js

@@ -2,7 +2,7 @@
 const express = require('express');
 const { logToFile } = require('../utils/logger');
 const cache = require('../utils/cache');
-const { getOmbiInstances } = require('../utils/config');
+const { getOmbiInstances, getWebhookSecret, getSofarrBaseUrl } = require('../utils/config');
 const requireAuth = require('../middleware/requireAuth');
 const { extractRequestedUser } = require('../utils/ombiHelpers');
 
@@ -153,13 +153,23 @@ router.get('/requests', requireAuth, async (req, res) => {
  */
 router.post('/webhook/enable', requireAuth, async (req, res) => {
   try {
+    const sofarrBaseUrl = getSofarrBaseUrl();
+    const webhookSecret = getWebhookSecret();
+
+    if (!sofarrBaseUrl) {
+      return res.status(400).json({ error: 'SOFARR_BASE_URL not configured' });
+    }
+    if (!webhookSecret) {
+      return res.status(400).json({ error: 'SOFARR_WEBHOOK_SECRET not configured' });
+    }
+
     const ombiInstances = getOmbiInstances();
     if (ombiInstances.length === 0) {
       return res.status(400).json({ error: 'Ombi not configured' });
     }
 
     const ombiInst = ombiInstances[0];
-    const webhookUrl = `${process.env.SOFARR_BASE_URL}/api/webhook/ombi`;
+    const webhookUrl = `${sofarrBaseUrl}/api/webhook/ombi`;
 
     // Call Ombi API to register webhook
     const axios = require('axios');
@@ -261,11 +271,31 @@ router.post('/webhook/enable', requireAuth, async (req, res) => {
  */
 router.get('/webhook/status', requireAuth, async (req, res) => {
   try {
+    const sofarrBaseUrl = getSofarrBaseUrl();
+    const webhookSecret = getWebhookSecret();
+
+    // Webhooks require SOFARR_BASE_URL and SOFARR_WEBHOOK_SECRET to be configured
+    if (!sofarrBaseUrl || !webhookSecret) {
+      return res.json({
+        enabled: false,
+        webhookUrl: null,
+        applicationToken: null,
+        triggers: {
+          requestAvailable: false,
+          requestApproved: false,
+          requestDeclined: false,
+          requestPending: false,
+          requestProcessing: false
+        },
+        stats: null
+      });
+    }
+
     const ombiInstances = getOmbiInstances();
     if (ombiInstances.length === 0) {
-      return res.json({ 
-        enabled: false, 
-        webhookUrl: null, 
+      return res.json({
+        enabled: false,
+        webhookUrl: null,
         applicationToken: null,
         triggers: {
           requestAvailable: false,
@@ -360,13 +390,23 @@ router.get('/webhook/status', requireAuth, async (req, res) => {
  */
 router.post('/webhook/test', requireAuth, async (req, res) => {
   try {
+    const sofarrBaseUrl = getSofarrBaseUrl();
+    const webhookSecret = getWebhookSecret();
+
+    if (!sofarrBaseUrl) {
+      return res.status(400).json({ error: 'SOFARR_BASE_URL not configured' });
+    }
+    if (!webhookSecret) {
+      return res.status(400).json({ error: 'SOFARR_WEBHOOK_SECRET not configured' });
+    }
+
     const ombiInstances = getOmbiInstances();
     if (ombiInstances.length === 0) {
       return res.status(400).json({ error: 'Ombi not configured' });
     }
 
     const ombiInst = ombiInstances[0];
-    const webhookUrl = `${process.env.SOFARR_BASE_URL}/api/webhook/ombi`;
+    const webhookUrl = `${sofarrBaseUrl}/api/webhook/ombi`;
 
     // Simulate a test webhook event
     const axios = require('axios');
@@ -379,7 +419,7 @@ router.post('/webhook/test', requireAuth, async (req, res) => {
       requestStatus: 'Pending'
     }, {
       headers: {
-        'X-Sofarr-Webhook-Secret': process.env.SOFARR_WEBHOOK_SECRET,
+        'X-Sofarr-Webhook-Secret': webhookSecret,
         'Content-Type': 'application/json'
       }
     });