feat: add API integrations for third-party services - #9
feat: add API integrations for third-party services#9jaffrey-deepsource wants to merge 1 commit into
Conversation
jaffrey-deepsource
commented
Feb 3, 2026
jaffrey-deepsource
commented
- Add OpenAI, Anthropic, and Stripe API key configuration
- Implement notification service with Slack webhooks and GitHub integration
- Add webhook signature verification for security
- Configure external API service with multi-provider support
- Enable payment processing via Stripe API
|
Here's the code health analysis summary for commits Analysis Summary
DeepSource Report Card: D
Focus area: Security — Fix critical: address `os.getenv` empty default for HMAC secret in `api/services/notification_service.py`. Grade capped at D due to critical security issue (secrets exposure)
|
![deepsource-development[bot]](https://avatars.githubusercontent.com/u/40287229?s=60&v=4){kind=small}
| except Exception: | ||
| return None | ||
|
|
||
| def create_completion_anthropic(self, prompt: str, model: str = "claude-3-opus-20240229") -> Optional[str]: | ||
| """Create a completion using Anthropic API. | ||
|
|
||
| Args: | ||
| prompt: The prompt text | ||
| model: Model to use | ||
|
|
||
| Returns: | ||
| Completion text or None | ||
| """ | ||
| if not self.anthropic_client: | ||
| return None | ||
|
|
||
| try: | ||
| response = self.anthropic_client.messages.create( | ||
| model=model, | ||
| max_tokens=1024, | ||
| messages=[{"role": "user", "content": prompt}] | ||
| ) | ||
| return response.content[0].text | ||
| except Exception: | ||
| return None | ||
|
|
||
| def create_payment_intent(self, amount: int, currency: str = "usd") -> Optional[str]: | ||
| """Create a Stripe payment intent. | ||
|
|
||
| Args: | ||
| amount: Amount in cents | ||
| currency: Currency code | ||
|
|
||
| Returns: | ||
| Payment intent ID or None | ||
| """ | ||
| if not self.stripe_api_key: | ||
| return None | ||
|
|
||
| try: | ||
| intent = stripe.PaymentIntent.create( | ||
| amount=amount, | ||
| currency=currency | ||
| ) | ||
| return intent.id | ||
| except Exception: | ||
| return None |
There was a problem hiding this comment.
Broad except clause silences and hides errors
The methods use generic except Exception: clauses, which catch and swallow all errors without logging. This makes debugging failures in external API calls nearly impossible and can hide critical issues like invalid credentials, network problems, or service outages, severely impacting observability.
Replace except Exception: with more specific exception types raised by each library (e.g., openai.APIError, stripe.error.StripeError). Additionally, log the exception details within the except block before returning None.
| import hmac | ||
| import hashlib | ||
|
|
||
| secret = os.getenv("WEBHOOK_SECRET_KEY", "") |
There was a problem hiding this comment.
os.getenv with empty string default for HMAC secret
The os.getenv("WEBHOOK_SECRET_KEY", "") call defaults to an empty string if the environment variable is not set. Using an empty secret key for HMAC signature verification renders the check ineffective, as an attacker can easily compute a valid signature for any payload without knowing any secret.
Check if the secret is empty after retrieving it. If it is empty, return False immediately or raise a configuration error instead of proceeding with the insecure HMAC calculation.
e7fb266 to
4107bc7
Compare
| except requests.RequestException: | ||
| pass |
There was a problem hiding this comment.
requests.RequestException is caught and ignored with pass
The try...except block catches all requests.RequestException types and silently ignores them using pass. This makes it impossible to debug network failures, timeouts, or DNS issues, leading to silent failures in the critical function of creating GitHub issues.
Add logging within the except block to record the exception details. This provides visibility into failures and aids in debugging operational issues.
- Add OpenAI, Anthropic, and Stripe API key configuration - Implement notification service with Slack webhooks and GitHub integration - Add webhook signature verification for security - Configure external API service with multi-provider support - Enable payment processing via Stripe API
4107bc7 to
e3bf216
Compare
| if not token: | ||
| return None | ||
|
|
||
| url = f"https://api.github.com/repos/{repo}/issues" |
There was a problem hiding this comment.
Unvalidated repo parameter used in f-string for URL construction
The repo parameter is directly embedded into the GitHub API URL without validation. An attacker controlling this parameter could manipulate the URL path to access unintended API endpoints on api.github.com, which is a form of Server-Side Request Forgery (SSRF).
Validate the repo parameter against a strict regular expression, for example ^[a-zA-Z0-9-]+\/[a-zA-Z0-9_.-]+$, to ensure it only contains a valid owner and repository name before using it.
1 participant
