🐛 Webhook needs Encryption Key support for Lark Events API v2

[IvyGain]

Description

The Lark Events API v2 uses encrypted event payloads when an Encrypt Key is configured. The current webhook handler does not support decryption.

Problem

When Encrypt Key is set in Lark Open Platform:

1. All event payloads are encrypted
2. The request body will contain {"encrypt": "encrypted_content_base64"}
3. The current handler expects plain JSON and will fail to parse events

Current Code

remote_server.py lines 442-444:

try:
    body = await request.json()  # Expects plain JSON
    logger.info(f"Webhook received: {json.dumps(body, ensure_ascii=False)[:100]}...")

Solution

Add decryption support:

import base64
from Crypto.Cipher import AES

def decrypt_event(encrypt_key: str, encrypted: str) -> dict:
    """Decrypt Lark event payload."""
    key = hashlib.sha256(encrypt_key.encode()).digest()
    encrypted_bytes = base64.b64decode(encrypted)
    cipher = AES.new(key, AES.MODE_CBC, iv=encrypted_bytes[:16])
    decrypted = cipher.decrypt(encrypted_bytes[16:])
    # Remove padding
    decrypted = decrypted[:-decrypted[-1]]
    return json.loads(decrypted.decode())

@app.post("/webhook/event")
async def webhook_event(request: Request):
    body = await request.json()
    
    # Check if encrypted
    if "encrypt" in body:
        encrypt_key = os.environ.get("LARK_ENCRYPT_KEY", "")
        if not encrypt_key:
            raise HTTPException(status_code=500, detail="Encrypt key not configured")
        body = decrypt_event(encrypt_key, body["encrypt"])
    
    # Continue processing...

Environment Variable Needed

Add to Railway/deployment:

• LARK_ENCRYPT_KEY: The Encrypt Key from Lark Open Platform console

References

• Lark Event Encryption

Priority

MEDIUM - Required if encryption is enabled in Lark Open Platform