Alerting: Add HMAC signature config to the webhook integration (#100960)

Adds HMAC-SHA256 signature support to webhook notifications, providing a way to verify the authenticity and integrity of webhook requests. The implementation allows to specify the header in which the signature will be sent. The signature is calculated from the request body.

An optional timestamp header name can be provided. If set, the HMAC signature will be generated by concatenating the timestamp, a ":" and the request body: {timestamp}:{body}. The timestamp will also be sent in the provided header name.

pkg/services/ngalert/notifier/channels_config/available_channels.go

@@ -1016,6 +1016,42 @@ func GetAvailableNotifiers() []*NotifierPlugin {
 						},
 					},
 				},
+				{
+					Label:        "HMAC Signature",
+					PropertyName: "hmacConfig",
+					Description:  "HMAC signature configuration options",
+					Element:      ElementTypeSubform,
+					SubformOptions: []NotifierOption{
+						{
+							Label:        "Secret",
+							Element:      ElementTypeInput,
+							Description:  "",
+							InputType:    InputTypeText,
+							PropertyName: "secret",
+							Required:     true,
+							Secure:       true,
+						},
+						{
+							Label:        "Header",
+							Element:      ElementTypeInput,
+							Description:  "The header in which the HMAC signature will be included.",
+							InputType:    InputTypeText,
+							PropertyName: "header",
+							Placeholder:  "X-Grafana-Alerting-Signature",
+							Required:     false,
+							Secure:       false,
+						},
+						{
+							Label:        "Timestamp header",
+							Element:      ElementTypeInput,
+							Description:  "If set, the timestamp will be included in the HMAC signature. The value should be the name of the header to use.",
+							InputType:    InputTypeText,
+							PropertyName: "timestampHeader",
+							Required:     false,
+							Secure:       false,
+						},
+					},
+				},
 			},
 		},
 		{

pkg/services/ngalert/notifier/channels_config/available_channels_test.go

@@ -22,7 +22,7 @@ func TestGetSecretKeysForContactPointType(t *testing.T) {
 		{receiverType: "sensugo", expectedSecretFields: []string{"apikey"}},
 		{receiverType: "teams", expectedSecretFields: []string{}},
 		{receiverType: "telegram", expectedSecretFields: []string{"bottoken"}},
-		{receiverType: "webhook", expectedSecretFields: []string{"password", "authorization_credentials", "tlsConfig.caCertificate", "tlsConfig.clientCertificate", "tlsConfig.clientKey"}},
+		{receiverType: "webhook", expectedSecretFields: []string{"password", "authorization_credentials", "tlsConfig.caCertificate", "tlsConfig.clientCertificate", "tlsConfig.clientKey", "hmacConfig.secret"}},
 		{receiverType: "wecom", expectedSecretFields: []string{"url", "secret"}},
 		{receiverType: "prometheus-alertmanager", expectedSecretFields: []string{"basicAuthPassword"}},
 		{receiverType: "discord", expectedSecretFields: []string{"url"}},