feat(triggers): add Intercom webhook triggers

[waleedlatif1]

Summary

• Add 6 Intercom webhook triggers: conversation created, conversation reply, conversation closed, contact created, user created, and generic webhook
• Add Intercom provider handler with X-Hub-Signature (HMAC-SHA1) verification, ping event handling, topic-based event matching, and idempotency extraction
• Wire triggers into IntercomV2Block with dropdown selector and webhook secret field

Type of Change

• New feature

Testing

Tested manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[cursor]

PR Summary

Medium Risk
Adds a new Intercom webhook provider with signature verification and event matching, plus wires multiple new triggers into the Intercom integration; mistakes could cause missed/extra executions or rejected webhooks. Security-sensitive HMAC validation and idempotency handling increase the need for careful review and testing.

Overview
Adds first-class Intercom webhook triggers for conversation created/replied/closed, contact created, user created, and an all-events webhook, including shared trigger utilities (topic mapping, outputs, setup instructions, and webhook secret field).

Introduces an intercom webhook provider handler that verifies X-Hub-Signature (HMAC-SHA1) against a configured client secret, short-circuits Intercom ping reachability events, matches events by topic per trigger, and extracts an idempotency key from notification events.

Wires these triggers into IntercomV2Block (adds trigger subBlocks via getTrigger, enables triggers, and lists available trigger IDs) and updates the integrations catalog entry to advertise the new Intercom triggers.

^{Reviewed by Cursor Bugbot for commit c26f773. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Apr 6, 2026 6:31pm

[greptile-apps]

Greptile Summary

This PR adds 6 Intercom webhook triggers (conversation_created, conversation_reply, conversation_closed, contact_created, user_created, and a catch-all webhook) wired into the IntercomV2Block. It includes an HMAC-SHA1 signature verification provider handler, topic-based event matching, and idempotency extraction based on the notification_event ID. Previous review concerns around unknown trigger ID handling and duplicated output builder functions have been addressed in a follow-up commit.

• 6 new trigger configs registered in triggers/registry.ts and exposed via IntercomV2Block
• intercomHandler in lib/webhooks/providers/intercom.ts handles signature verification, ping reachability tests, topic filtering, and idempotency
• Shared buildIntercomBaseOutputs helper correctly factors out the common 7-field output schema
• INTERCOM_TRIGGER_TOPIC_MAP with explicit undefined-vs-empty-array distinction now defensively rejects unknown trigger IDs
• webhookSecret subblock is missing paramVisibility: 'user-only', which is required for all user-provided credentials in this codebase"

Confidence Score: 4/5

PR is nearly ready to merge; one P1 finding (missing credential visibility flag) should be addressed first.

The implementation is well-structured, previous review concerns have been resolved, and the provider handler logic is sound. The single remaining issue — missing paramVisibility: 'user-only' on the webhookSecret field — directly violates the project's credential-visibility rule and could result in incorrect handling of user-provided secrets. Once fixed, this PR is safe to merge.

apps/sim/triggers/intercom/utils.ts — the buildIntercomExtraFields function needs paramVisibility: 'user-only' added to the webhookSecret subblock config.

Important Files Changed

Filename	Overview
apps/sim/lib/webhooks/providers/intercom.ts	Clean HMAC-SHA1 signature verifier, ping handler, topic-based event matching via dynamic import, and idempotency extractor — all well-structured
apps/sim/triggers/intercom/utils.ts	Core shared utilities look solid after refactoring; missing paramVisibility: 'user-only' on webhookSecret SubBlockConfig violates project credential-visibility rule
apps/sim/triggers/intercom/webhook.ts	Generic catch-all trigger wired correctly; subBlocks and outputs delegate to shared helpers
apps/sim/triggers/intercom/conversation_created.ts	Primary trigger (includes dropdown); correctly uses buildIntercomConversationOutputs and buildIntercomExtraFields
apps/sim/triggers/intercom/user_created.ts	Uses buildIntercomContactOutputs for user events, matching Intercom's API semantics; documented intent is clear
apps/sim/blocks/blocks/intercom.ts	IntercomV2Block spreads all 6 trigger subBlock sets and lists them in triggers.available; wiring is correct
apps/sim/triggers/registry.ts	All 6 new Intercom triggers registered correctly alongside existing entries
apps/sim/lib/webhooks/providers/registry.ts	intercom provider handler registered correctly; alphabetical ordering maintained

Sequence Diagram

sequenceDiagram
participant IC as Intercom
participant WH as Webhook Handler
participant PR as Intercom Provider
participant EM as Event Matcher
participant WF as Workflow Engine
IC->>WH: POST /webhook (X-Hub-Signature: sha1=...)
WH->>PR: verifyAuth(rawBody, secret)
alt secret configured
PR->>PR: HMAC-SHA1 verify
PR-->>WH: null (pass) or 401
else no secret
PR-->>WH: null (skip check)
end
WH->>PR: handleReachabilityTest(body)
alt topic === 'ping'
PR-->>WH: 200 {status: ok}
WH-->>IC: 200 (no workflow)
else normal event
PR-->>WH: null
WH->>PR: matchEvent(triggerId, topic)
alt triggerId is intercom_webhook or falsy
PR-->>WH: true (accept all)
else specific trigger
PR->>EM: isIntercomEventMatch(triggerId, topic)
EM->>EM: INTERCOM_TRIGGER_TOPIC_MAP lookup
EM-->>PR: true/false
PR-->>WH: true/false
end
WH->>PR: extractIdempotencyId(body)
PR-->>WH: notification ID or null
WH->>WF: Execute workflow with body as input
WF-->>IC: 200
end

Loading

_{Reviews (2): Last reviewed commit: "fix(triggers): address PR review feedbac..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit c26f773. Configure here.}