Fix webhooks (route protection and cache invalidation on Unpublish)

[peterjaap]

This fixes the Invalid return type 500 error on the webhooks;

Exception #0 (InvalidArgumentException): Invalid return type                                                                                                                                                       
<pre>#1 Magento\Framework\App\Http\Interceptor->___callParent() called at [vendor/magento/framework/Interception/Interceptor.php:138]                                                                              
#2 Magento\Framework\App\Http\Interceptor->Magento\Framework\Interception\{closure}() called at [vendor/justbetter/magento2-sentry/Plugin/GlobalExceptionCatcher.php:57]                                           
#3 JustBetter\Sentry\Plugin\GlobalExceptionCatcher->aroundLaunch() called at [vendor/magento/framework/Interception/Interceptor.php:135]                                                                           
#4 Magento\Framework\App\Http\Interceptor->Magento\Framework\Interception\{closure}() called at [vendor/magento/framework/Interception/Interceptor.php:153]                                                        
#5 Magento\Framework\App\Http\Interceptor->___callPlugins() called at [generated/code/Magento/Framework/App/Http/Interceptor.php:23]                                                                               
#6 Magento\Framework\App\Http\Interceptor->launch() called at [vendor/magento/framework/App/Bootstrap.php:264]                                                                                                     
#7 Magento\Framework\App\Bootstrap->run() called at [pub/index.php:30]                                                                                                                                             
</pre> 

You can test this fix by checking out this branch (or applying the patch) and hitting the webhook locally. Create a payload.json:

{
  "secret": "secretgoeshere"
}

Then hit the controller;

curl --insecure -XPOST  -H 'Content-Type: application/json' -d @payload.json https://yourlocalurl.localhost/prismicio/webhook/cache

This should then return {"success":true}.

[sanderjongsma]

ah nice, so it was coming from the protectRoute function.

[peterjaap]

@sanderjongsma yeah apparently they moved the location of the secret from the POST request to the actual JSON payload.