Harden webhook authentication and document architecture

[stevenschling13]

Summary

• add a strongly typed configuration loader and share config through Fastify
• harden the /analyze route with reusable HMAC helpers and deterministic history keys
• document the service architecture and add focused unit tests for mapping and security utilities

Testing

• npm test -- --run
• npm run typecheck

---

https://chatgpt.com/codex/tasks/task_e_69069b3d237c832c828730c816ab76ea

[Copilot]

Pull Request Overview

This PR introduces a comprehensive configuration and testing infrastructure to the Notion-Grow-Ops application. The changes establish secure HMAC-based authentication, centralized configuration management, and a robust test suite.

Key Changes

• Configuration Management: Adds src/config.ts with Zod-based validation for environment variables, supporting optional Notion integration with interdependency checks
• Security Refactoring: Extracts HMAC functionality into src/security/hmac.ts with timing-safe verification and hex format validation
• Test Suite: Implements comprehensive unit tests for HMAC verification, request mapping utilities, and HTTP endpoint authentication
• Server Enhancement: Updates server initialization to support config overrides and decorates the Fastify instance with typed configuration
• Documentation: Adds extensive README with architecture overview, configuration reference, and troubleshooting guide

Reviewed Changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/config.ts	New configuration loader with Zod schema validation and interdependent Notion field checks
src/security/hmac.ts	Extracted HMAC signing and verification with timing-safe comparison and format validation
src/server.ts	Updated to accept config overrides, decorated Fastify instance with config, and configurable log level
src/routes/analyze.ts	Refactored to use centralized HMAC verification and config, integrated buildHistoryKey helper
src/domain/mapping.ts	Added buildHistoryKey function for deterministic SHA-256 key generation and updated buildHistoryProps signature
src/index.ts	Enhanced error handling with catch block and process exit on startup failure
test/security/hmac.test.ts	New tests for HMAC signature generation and verification edge cases
test/mapping.test.ts	New tests for writeback mapping and history property building
test/hmac.test.ts	Added silent logging configuration for cleaner test output
README.md	Comprehensive documentation covering architecture, configuration, testing, and troubleshooting
pnpm-lock.yaml	Updated lockfile with new dependencies and version updates

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported