fix standard webhooks signature: use dot separators per spec

Author: isala404

crates/forge-runtime/src/webhook/handler.rs

@@ -10,7 +10,10 @@ use axum::{
     http::{HeaderMap, StatusCode},
     response::IntoResponse,
 };
-use base64::{Engine as _, engine::{DecodePaddingMode, GeneralPurpose, GeneralPurposeConfig, general_purpose}};
+use base64::{
+    Engine as _,
+    engine::{DecodePaddingMode, GeneralPurpose, GeneralPurposeConfig, general_purpose},
+};
 use ed25519_dalek::{Signature as Ed25519Signature, Verifier as _, VerifyingKey};
 use forge_core::CircuitBreakerClient;
 use forge_core::function::JobDispatch;
@@ -382,12 +385,12 @@ fn validate_standard_webhooks(
         Err(_) => return false,
     };
 
-    // Build the signed content: "{id}\n{timestamp}\n{body}"
+    // Build the signed content per Standard Webhooks spec: "{id}.{timestamp}.{body}"
     let mut signed = Vec::with_capacity(msg_id.len() + msg_timestamp.len() + body.len() + 2);
     signed.extend_from_slice(msg_id.as_bytes());
-    signed.push(b'\n');
+    signed.push(b'.');
     signed.extend_from_slice(msg_timestamp.as_bytes());
-    signed.push(b'\n');
+    signed.push(b'.');
     signed.extend_from_slice(body);
 
     let mut mac =
@@ -805,9 +808,9 @@ mod tests {
 
         let mut signed = Vec::new();
         signed.extend_from_slice(msg_id.as_bytes());
-        signed.push(b'\n');
+        signed.push(b'.');
         signed.extend_from_slice(msg_timestamp.as_bytes());
-        signed.push(b'\n');
+        signed.push(b'.');
         signed.extend_from_slice(body);
 
         let mut mac = Hmac::<Sha256>::new_from_slice(raw_key).unwrap();