Reject invalid webhook events

lib/pleroma/webhook.ex

@@ -37,7 +37,6 @@ defmodule Pleroma.Webhook do
     |> cast(params, [:url, :events, :enabled, :internal])
     |> validate_required([:url, :events])
     |> unique_constraint(:url)
-    |> strip_events()
     |> put_secret()
   end
 
@@ -45,7 +44,6 @@ defmodule Pleroma.Webhook do
     webhook
     |> cast(params, [:url, :events, :enabled, :internal])
     |> unique_constraint(:url)
-    |> strip_events()
   end
 
   def create(params) do
@@ -75,16 +73,6 @@ defmodule Pleroma.Webhook do
     |> Repo.update()
   end
 
-  defp strip_events(changeset) do
-    case get_change(changeset, :events) do
-      nil ->
-        changeset
-
-      events ->
-        put_change(changeset, :events, Enum.filter(events, &(&1 in @event_types)))
-    end
-  end
-
   defp put_secret(changeset) do
     changeset
     |> put_change(:secret, generate_secret())

test/pleroma/webhook_test.exs

@@ -23,6 +23,16 @@ defmodule Pleroma.WebhookTest do
     assert %{events: [:"account.created"]} = Webhook.get(id)
   end
 
+  test "rejects invalid events" do
+    assert {:error, _changeset} =
+             Webhook.create(%{url: "https://example.com/webhook", events: [:"status.created"]})
+
+    {:ok, webhook} =
+      Webhook.create(%{url: "https://example.com/valid-webhook", events: [:"report.created"]})
+
+    assert {:error, _changeset} = Webhook.update(webhook, %{events: [:"status.created"]})
+  end
+
   test "filter webhooks by type" do
     {:ok, %{id: id1}} =
       Webhook.create(%{url: "https://example.com/webhook1", events: [:"report.created"]})