Summary

Three independent fixes to the /government/admin/link-checker-api-callback endpoint:

• Skip auth filter on Admin::ErrorsController. Error pages inherited authenticate_user! from Admin::BaseController, so when Rails routed an unhandled exception through exceptions_app to an error action, the filter ran during error rendering and surfaced as a bare 500 for unauthenticated clients (e.g. GET on this URL).
• Fail closed when the webhook secret is missing. verify_signature returned silently when the configured secret was nil, letting any unsigned POST mark a LinkCheckerApiReport as completed. Reply 503 instead so the callback action never runs without a secret.
• Return 401 for an invalid signature. A correctly-formed request with the wrong signature is an authentication failure, not a malformed request. gds-sso mounts Warden with intercept_401, which would otherwise turn the 401 into a redirect to /auth/gds; the controller opts out via warden.custom_failure!. Added an integration test so the full middleware stack is exercised.

Jira

Test plan

Run against integration (whitehall-admin.integration.publishing.service.gov.uk).

• GET on the callback URL (errors-controller fix). Before: HTTP/2 500. After: HTTP/2 404.

  curl -sI \
    https://whitehall-admin.integration.publishing.service.gov.uk/government/admin/link-checker-api-callback

  Expected: status 404, body is the admin "There is a mistake in the URL" page.

• POST with no signature header (existing 400, unchanged).

  curl -si -X POST -H 'Content-Type: application/json' \
    -d '{"id":99999999}' \
    https://whitehall-admin.integration.publishing.service.gov.uk/government/admin/link-checker-api-callback

  Expected: status 400, empty body.

• POST with a wrong signature (was 400, now 401).

  curl -si -X POST -H 'Content-Type: application/json' \
    -H 'X-LinkCheckerApi-Signature: invalid' \
    -d '{"id":99999999}' \
    https://whitehall-admin.integration.publishing.service.gov.uk/government/admin/link-checker-api-callback

  Expected: status 401, empty body.

• POST with a valid signature (happy path, unchanged). Trigger a real link-check from the Whitehall integration admin UI (edit a publication, save). In the link-checker-api logs, confirm the outbound webhook returns 204 and the corresponding LinkCheckerApiReport row updates to status: "completed".