[mangeshraut712]

Summary

Resolves #105.

Allows xurl webhook start to answer X webhook CRC challenges using the selected app's stored OAuth 2.0 client secret (the recommended key per the X webhook documentation), while retaining full backwards compatibility with OAuth 1.0a consumer secrets for legacy integrations.

An OAuth2-only app with credentials stored via xurl auth apps add <app> --client-id ... --client-secret ... no longer needs unrelated OAuth1 consumer secrets or user authorization flows merely to start the webhook receiver and answer CRC challenges.

Changes

1. cli/webhook.go:
   • webhookSigningSecret() selects the signing secret for the active app, preferring the OAuth2 client secret when present and falling back to the OAuth1 consumer secret.
   • Rejects bearer and user access/refresh tokens as CRC signing keys.
   • Prevents cross-app credential leakage: querying a specific --app that lacks signing credentials fails with clear guidance rather than silently borrowing another app's secret.
   • Extracted handleWebhookCRC() to cleanly handle GET /webhook?crc_token=... requests.
2. cli/webhook_test.go:
   • Added 15 comprehensive unit tests covering:
     • OAuth2-only app (no user tokens required).
     • OAuth1-only legacy fallback.
     • Precedence of OAuth2 client secret over OAuth1 consumer secret when both are present.
     • --app selection override and isolation.
     • Rejection of client ID alone, bearer tokens, and user access tokens.
     • Uninitialized auth state handling.
     • Full HTTP CRC challenge response verification checking status 200, Content-Type, JSON structure, and exact HMAC-SHA256 signature against independent test vectors.
     • Handling of missing crc_token parameter (400 Bad Request).
3. README.md:
   • Documented the OAuth 2.0 client secret requirement, credential precedence, instructions for registering app credentials with xurl auth apps add/update, --app usage, and link to X documentation.
4. CHANGELOG.md:
   • Added entry under ## Unreleased -> ### Added.

Test Plan

• go build ./... passes cleanly
• go test ./... passes with all packages green (api, auth, cli, config, store)
• go test -v -race ./cli/... passes 15/15 tests
• Cryptographic verification: verified HMAC-SHA256 calculation matches the X webhook specification

[CLAassistant]

All committers have signed the CLA.

[mangeshraut712]

The CLA check now passes for dc69da0. Could a maintainer approve the Go workflow so the OAuth2 CRC change can receive hosted validation?