diff --git a/skyvern/forge/agent.py b/skyvern/forge/agent.py index 235ea599..1c00d482 100644 --- a/skyvern/forge/agent.py +++ b/skyvern/forge/agent.py @@ -3397,7 +3397,7 @@ class ForgeAgent: "Sending task response to webhook callback url", task_id=task.task_id, webhook_callback_url=task.webhook_callback_url, - payload=signed_data.signed_payload, + payload=signed_data.payload_for_log, headers=signed_data.headers, ) diff --git a/skyvern/forge/sdk/core/security.py b/skyvern/forge/sdk/core/security.py index 5b63cfb5..f93ea94c 100644 --- a/skyvern/forge/sdk/core/security.py +++ b/skyvern/forge/sdk/core/security.py @@ -59,18 +59,29 @@ def generate_skyvern_signature( return hash_obj.hexdigest() +MAX_WEBHOOK_PAYLOAD_LOG_SIZE = 8000 # ~8KB – keeps Datadog log entries manageable + + @dataclass class WebhookSignature: timestamp: str signature: str signed_payload: str headers: dict[str, str] + # Truncated version of signed_payload safe for logging + payload_for_log: str def generate_skyvern_webhook_signature(payload: dict, api_key: str) -> WebhookSignature: payload_str = _normalize_json_dumps(payload) signature = generate_skyvern_signature(payload=payload_str, api_key=api_key) timestamp = str(int(datetime.utcnow().timestamp())) + if len(payload_str) > MAX_WEBHOOK_PAYLOAD_LOG_SIZE: + payload_for_log = ( + payload_str[:MAX_WEBHOOK_PAYLOAD_LOG_SIZE] + f"... (truncated, original size: {len(payload_str)})" + ) + else: + payload_for_log = payload_str return WebhookSignature( timestamp=timestamp, signature=signature, @@ -80,4 +91,5 @@ def generate_skyvern_webhook_signature(payload: dict, api_key: str) -> WebhookSi "x-skyvern-signature": signature, "Content-Type": "application/json", }, + payload_for_log=payload_for_log, ) diff --git a/skyvern/forge/sdk/workflow/service.py b/skyvern/forge/sdk/workflow/service.py index f6d29d9a..8fb3891d 100644 --- a/skyvern/forge/sdk/workflow/service.py +++ b/skyvern/forge/sdk/workflow/service.py @@ -3176,7 +3176,7 @@ class WorkflowService: workflow_id=workflow_id, workflow_run_id=workflow_run.workflow_run_id, webhook_callback_url=workflow_run.webhook_callback_url, - payload=signed_data.signed_payload, + payload=signed_data.payload_for_log, headers=signed_data.headers, ) try: @@ -3204,7 +3204,7 @@ class WorkflowService: "Webhook failed", workflow_id=workflow_id, workflow_run_id=workflow_run.workflow_run_id, - webhook_data=signed_data.signed_payload, + webhook_data=signed_data.payload_for_log, resp=resp, resp_code=resp.status_code, resp_text=resp.text,