fix: add validation and proper decoding on send email hook (supabase#…

…1520)

## What kind of change does this PR introduce?

bug discovered while testing

internal/conf/configuration.go

@@ -473,7 +473,7 @@ type ExtensibilityPointConfiguration struct {
 	Enabled  bool   `json:"enabled"`
 	HookName string `json:"hook_name"`
 	// We use | as a separator for keys and : as a separator for keys within a keypair. For instance: v1,whsec_test|v1a,whpk_myother:v1a,whsk_testkey|v1,whsec_secret3
-	HTTPHookSecrets []string `json:"secrets" envconfig:"secrets"`
+	HTTPHookSecrets HTTPHookSecrets `json:"secrets" envconfig:"secrets"`
 }
 
 func (h *HookConfiguration) Validate() error {
@@ -482,6 +482,7 @@ func (h *HookConfiguration) Validate() error {
 		h.PasswordVerificationAttempt,
 		h.CustomAccessToken,
 		h.SendSMS,
+		h.SendEmail,
 	}
 	for _, point := range points {
 		if err := point.ValidateExtensibilityPoint(); err != nil {
@@ -588,6 +589,11 @@ func LoadGlobal(filename string) (*GlobalConfiguration, error) {
 			return nil, err
 		}
 	}
+	if config.Hook.SendEmail.Enabled {
+		if err := config.Hook.SendEmail.PopulateExtensibilityPoint(); err != nil {
+			return nil, err
+		}
+	}
 
 	if config.Hook.MFAVerificationAttempt.Enabled {
 		if err := config.Hook.MFAVerificationAttempt.PopulateExtensibilityPoint(); err != nil {

internal/conf/configuration_test.go

@@ -22,6 +22,7 @@ func TestGlobal(t *testing.T) {
 	os.Setenv("GOTRUE_JWT_SECRET", "secret")
 	os.Setenv("API_EXTERNAL_URL", "http://localhost:9999")
 	os.Setenv("GOTRUE_HOOK_MFA_VERIFICATION_ATTEMPT_URI", "pg-functions://postgres/auth/count_failed_attempts")
+	os.Setenv("GOTRUE_HOOK_SEND_SMS_SECRETS", "v1,whsec_aWxpa2VzdXBhYmFzZXZlcnltdWNoYW5kaWhvcGV5b3Vkb3Rvbw==")
 	gc, err := LoadGlobal("")
 	require.NoError(t, err)
 	require.NotNil(t, gc)