Answers.Body: <p>The Mandrill extension was not designed to support multiple sites. </p>
  
  <p>It is a reasonable use case to enhance it to support dev and prod instances of the same site. </p>
  
  <p>@Chris Burgess workarounds are likely best approach in absence of funding to do this. </p>
  
  <p>Without reviewing Mandrill docs etc I think the approach needed is to figure out somehow whether the instance receiving a callback is the one that sent out the mailing. One way might be to add another field containing the baseurl of the sending instance to each email, then check that value which you can get on the webhook callback. </p>
  
  <p>Note: code contributions are welcome!</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-11-15T04:27:25.613Z
Answers.Text: _One way might be to add another field containing the baseurl of the sending instance to each email_ - I did this as a first trial before posting this question by adding CIVICRM_SITE_KEY to the headers created in [altermailparam() hook](https://github.com/JMAConsulting/biz.jmaconsulting.mte/blob/master/mte.php#L308), but most of the click or open event wasn't containing this headers information(not even civicrm mandrill id) in response :(
Answers.UserDisplayName: jitendra - fuzion
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-11-14T17:42:08.410Z
Answers.LastActivityDate: 2017-11-14T17:42:08.410Z
Answers.UserDisplayName: Joe Murray
Answers.Body: <p>If you must use the same account on both environments, Drupal/CiviCRM hooks could potentially support this? <em>(All of this answer is likely more work than just using the provider's supported test mode, though!)</em></p>
  
  <p>You can pick any hook that fires before <code>Mte.callback</code> gets fired, and trigger rejection / invalidation based on any of the incoming data including the secret key or contact details in the request.</p>
  
  <p>CMS boot hooks (eg Drupal <a href="https://api.drupal.org/api/drupal/modules%21system%21system.api.php/function/hook_init/7.x" rel="nofollow noreferrer"><code>hook_init</code></a>) or CRM config hook (<a href="https://docs.civicrm.org/dev/en/latest/hooks/hook_civicrm_config/" rel="nofollow noreferrer"><code>hook_civicrm_config</code></a>) happen early but on many requests so will add overhead; if possible I'd do this as late and specifically as possible - <a href="https://docs.civicrm.org/dev/en/latest/hooks/hook_civicrm_apiWrappers/" rel="nofollow noreferrer"><code>hook_civicrm_apiWrappers</code></a> could be just the ticket if it works for this usage? Alternatively you could just throw some interception in <code>settings.php</code> / <code>civicrm.settings.php</code> / environment-specific <code>settings.development.php</code>.</p>
  
  <p>If the secret keys aren't suitable, you could look for test-specific properties of the submitted contact data.</p>
  
  <p>That might look like,</p>
  
  <pre><code>// Lives in settings.php so it's not in your committed code.
  $mandrill_secrets = [
    'development' =&gt; 'devkey',
    'production' =&gt; 'livekey'
  ];
  </code></pre>
  
  <p>Boot time: obtain current environment, put in <code>$environment</code>:</p>
  
  <ul>
  <li><a href="https://www.drupal.org/project/environment" rel="nofollow noreferrer">Drupal environment module</a></li>
  <li><code>strpos($_SERVER['SERVER_NAME'], '.demo.example')</code></li>
  <li>Whatever you want to use ...</li>
  </ul>
  
  <p>Before CiviCRM has a chance to respond to <code>civicrm/ajax/mte/callback</code>: If the supplied secret doesn't match the current environment, unset it or make it invalid.</p>
  
  <pre><code>if (isset($_GET['mandrillSecret']) &amp;&amp; $_GET['mandrillSecret'] != $mandrill_secrets[$environment]) {
    $_GET['mandrillSecret'] = 'invalid';
  }
  </code></pre>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-11-12T04:40:55.580Z
Answers.Text: Hey Chris, glad to see you and thankyou for the answer :-). Word limit here, so i've updated the question.
Answers.UserDisplayName: jitendra - fuzion
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-11-12T04:53:28.170Z
Answers.Text: Are the "secret codes" on live and dev the same or different? Your question has `livekey` / `devkey` so I figured they weren't the same. EDIT: ah, I see your updated question says they are the same.
Answers.UserDisplayName: Chris Burgess
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-11-12T05:04:42.500Z
Answers.Text: Yeah, I think you need to separate this Mandrill side then. Will using a test key help? https://mandrill.zendesk.com/hc/en-us/articles/205582447-Does-Mandrill-Have-a-Test-Mode-or-Sandbox-
Answers.UserDisplayName: Chris Burgess
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-11-12T05:28:36.587Z
Answers.Text: No, the secret key is different for both the URL as mentioned in the post(devkey/livekey). 
  
  The `same` word the updated question is dev url `secret key` and the `option group value` stored on the dev site.
Answers.UserDisplayName: jitendra - fuzion
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-11-11T21:58:54.597Z
Answers.LastActivityDate: 2017-11-12T22:15:43.583Z
Answers.LastEditDate: 2017-11-12T22:15:43.583Z
Answers.UserDisplayName: Chris Burgess
Answers.Body: <p>It sounds like what you want is to switch your dev environment to use <a href="https://mandrill.zendesk.com/hc/en-us/articles/205582447-Does-Mandrill-Have-a-Test-Mode-or-Sandbox-" rel="nofollow noreferrer">Mandrill's Test Mode</a>?</p>
  
  <p>You can then make your site <a href="http://www.pixelite.co.nz/article/environment-aware-drupal-sites/" rel="nofollow noreferrer">environment aware</a> to switch the Mandrill account details each time you refresh data on your dev environment, preventing live webhooks from affecting dev environment and vice versa.</p>
  
  <p>Mandrill's test mode is API key specific; on your dev site you'll need to switch the API key used, and then send emails to certain addresses to test bounce, rejection etc.</p>
  
  <ul>
  <li><a href="https://mandrill.zendesk.com/hc/en-us/articles/205582447-Does-Mandrill-Have-a-Test-Mode-or-Sandbox-" rel="nofollow noreferrer">Mandrill Zendesk: Test mode / sandbox</a></li>
  <li><code>reject@test.mandrillapp.com</code> => Rejected email</li>
  <li><code>hard_bounce@test.mandrillapp.com</code> => Hard-bounced email</li>
  <li><code>soft_bounce@test.mandrillapp.com</code> => Soft-bounced email</li>
  <li><code>spam@test.mandrillapp.com</code> => Spam complaint</li>
  </ul>
  
  <p>(Your tests will also need to ensure that they are idempotent, ie reset the DB to a known state that ensures the <code>hard_bounce</code> contact is newly created or has not been marked undeliverable in CiviCRM.)</p>
  
  <p>You can then use Mandrill's Rules Engine to send webhook requests to the appropriate site based on the API key in use for the generated email.</p>
  
  <ul>
  <li><a href="https://mandrill.zendesk.com/hc/en-us/articles/205583117" rel="nofollow noreferrer">Mandrill Zendesk: Rules Engine</a></li>
  </ul>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-11-13T14:29:11.113Z
Answers.Text: Great info. Tested this by removing all the default triggers from dev webhook and replaced it with rules. This seems to be working when the mail are sent from live site(they don't create any new contacts or activity on dev now). But sending mails from dev site also don't create any activity on dev. Pretty sure the rules are configured correctly to react on dev api key match.
Answers.UserDisplayName: jitendra - fuzion
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-11-13T14:32:09.997Z
Answers.Text: Also, as live webhook is meant to trigger on default open/click event, mails sent from dev site created a new activity on live... yikes.
Answers.UserDisplayName: jitendra - fuzion
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-11-12T19:57:07.123Z
Answers.LastActivityDate: 2017-11-12T22:17:43.220Z
Answers.LastEditDate: 2017-11-12T22:17:43.220Z
Answers.UserDisplayName: Chris Burgess
Body: <p>We have a client who has two webhooks defined in Mandrillapp - both of them reacting to the same events (click, open, etc). These webhooks have a post url of two different sites(dev and live). Eg.</p>
  
  <blockquote>
    <p>Post url of dev = <a href="http://devsite.com/civicrm/ajax/mte/callback?mandrillSecret=_devkey_" rel="nofollow noreferrer">http://devsite.com/civicrm/ajax/mte/callback?mandrillSecret=<em>devkey</em></a></p>
    
    <p>Post URL of live - <a href="http://livesite.com/civicrm/ajax/mte/callback?mandrillSecret=_livekey_" rel="nofollow noreferrer">http://livesite.com/civicrm/ajax/mte/callback?mandrillSecret=<em>livekey</em></a></p>
  </blockquote>
  
  <p>My guess is that - when an email is sent from the live site, these both urls are triggered(on open or click event) and dev site also gets the response which creates a mandrill activity on dev site.</p>
  
  <p>This is what is happening for us - when a bulk email is sent from the live site, dev also creates a mandrill activity.</p>
  
  <p>Can we conclude that we need to use two different mandrill accounts for two different sites OR there is a way to avoid this (rules, etc)?</p>
  
  <hr>
  
  <p>UPDATE after Chris Answer -</p>
  
  <p>The posted answer seems to be something which is <a href="https://github.com/JMAConsulting/biz.jmaconsulting.mte/blob/master/CRM/Mte/Page/callback.php#L40-L44" rel="nofollow noreferrer">already present</a> in Mandrill extension?</p>
  
  <p><a href="https://github.com/JMAConsulting/biz.jmaconsulting.mte/blame/master/README.md#L67-L71" rel="nofollow noreferrer">Readme file</a> asks user to save the secret key as a value of an option group which we've done for dev and live sites.</p>
  
  <p>Problem arises when <strong>DEV</strong> webhook is triggered by an event(open/click) of LIVE mails(note both above URLs react on the same event). As dev secret key <strike>is same(url param and option grp value)</strike> <strong>matches</strong> the option value stored on the dev site, this checking of key match doesn't help us. </p>
  
  <p>In short, a dev Post URL need to be avoided to be triggered after an event has occurred for emails sent from live site. Maybe this could to be done on the MandrillApp side?</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-11-12T19:58:34.053Z
Comments.Text: I've split my two answers and expanded the one about Mandrill's Test Mode
Comments.UserDisplayName: Chris Burgess
Tags: <email><mandrill>
Title: Mandrill - webhooks for two different sites?
ThreadText: # Mandrill - webhooks for two different sites?
  
  (Asked by: username_0 on 2017-11-11)
  
  We have a client who has two webhooks defined in Mandrillapp - both of them reacting to the same events (click, open, etc). These webhooks have a post url of two different sites(dev and live). Eg.
  
  > Post url of dev = [http://devsite.com/civicrm/ajax/mte/callback?mandrillSecret=*devkey*](http://devsite.com/civicrm/ajax/mte/callback?mandrillSecret=_devkey_)
  >
  > Post URL of live - [http://livesite.com/civicrm/ajax/mte/callback?mandrillSecret=*livekey*](http://livesite.com/civicrm/ajax/mte/callback?mandrillSecret=_livekey_)
  
  My guess is that - when an email is sent from the live site, these both urls are triggered(on open or click event) and dev site also gets the response which creates a mandrill activity on dev site.
  
  This is what is happening for us - when a bulk email is sent from the live site, dev also creates a mandrill activity.
  
  Can we conclude that we need to use two different mandrill accounts for two different sites OR there is a way to avoid this (rules, etc)?
  
  ---
  
  UPDATE after username_1 Answer -
  
  The posted answer seems to be something which is [already present](https://github.com/JMAConsulting/biz.jmaconsulting.mte/blob/master/CRM/Mte/Page/callback.php#L40-L44) in Mandrill extension?
  
  [Readme file](https://github.com/JMAConsulting/biz.jmaconsulting.mte/blame/master/README.md#L67-L71) asks user to save the secret key as a value of an option group which we've done for dev and live sites.
  
  Problem arises when **DEV** webhook is triggered by an event(open/click) of LIVE mails(note both above URLs react on the same event). As dev secret key is same(url param and option grp value) **matches** the option value stored on the dev site, this checking of key match doesn't help us.
  
  In short, a dev Post URL need to be avoided to be triggered after an event has occurred for emails sent from live site. Maybe this could to be done on the MandrillApp side?
  
  **Tags:** email, mandrill
  
  > **Comments:**
  > **username_1**: I've split my two answers and expanded the one about Mandrill's Test Mode  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_2 on 2017-11-14. Score: 1
  
  The Mandrill extension was not designed to support multiple sites.
  
  It is a reasonable use case to enhance it to support dev and prod instances of the same site.
  
  @username_1 workarounds are likely best approach in absence of funding to do this.
  
  Without reviewing Mandrill docs etc I think the approach needed is to figure out somehow whether the instance receiving a callback is the one that sent out the mailing. One way might be to add another field containing the baseurl of the sending instance to each email, then check that value which you can get on the webhook callback.
  
  Note: code contributions are welcome!
  
  > **Comments:**
  > **username_0**: _One way might be to add another field containing the baseurl of the sending instance to each email_ - I did this as a first trial before posting this question by adding CIVICRM_SITE_KEY to the headers created in [altermailparam() hook](https://github.com/JMAConsulting/biz.jmaconsulting.mte/blob/master/mte.php#L308), but most of the click or open event wasn't containing this headers information(not even civicrm mandrill id) in response :(  
  
  ---
  
  ### Answer by username_1 on 2017-11-11. Score: 1
  
  If you must use the same account on both environments, Drupal/CiviCRM hooks could potentially support this? *(All of this answer is likely more work than just using the provider's supported test mode, though!)*
  
  You can pick any hook that fires before `Mte.callback` gets fired, and trigger rejection / invalidation based on any of the incoming data including the secret key or contact details in the request.
  
  CMS boot hooks (eg Drupal [`hook_init`](https://api.drupal.org/api/drupal/modules%21system%21system.api.php/function/hook_init/7.x)) or CRM config hook ([`hook_civicrm_config`](https://docs.civicrm.org/dev/en/latest/hooks/hook_civicrm_config/)) happen early but on many requests so will add overhead; if possible I'd do this as late and specifically as possible - [`hook_civicrm_apiWrappers`](https://docs.civicrm.org/dev/en/latest/hooks/hook_civicrm_apiWrappers/) could be just the ticket if it works for this usage? Alternatively you could just throw some interception in `settings.php` / `civicrm.settings.php` / environment-specific `settings.development.php`.
  
  If the secret keys aren't suitable, you could look for test-specific properties of the submitted contact data.
  
  That might look like,
  
  ```
  // Lives in settings.php so it's not in your committed code.
  $mandrill_secrets = [
    'development' => 'devkey',
    'production' => 'livekey'
  ];
  
  ```
  
  Boot time: obtain current environment, put in `$environment`:
  
  * [Drupal environment module](https://www.drupal.org/project/environment)
  * `strpos($_SERVER['SERVER_NAME'], '.demo.example')`
  * Whatever you want to use ...
  
  Before CiviCRM has a chance to respond to `civicrm/ajax/mte/callback`: If the supplied secret doesn't match the current environment, unset it or make it invalid.
  
  ```
  if (isset($_GET['mandrillSecret']) && $_GET['mandrillSecret'] != $mandrill_secrets[$environment]) {
    $_GET['mandrillSecret'] = 'invalid';
  }
  
  ```
  
  > **Comments:**
  > **username_0**: Hey username_1, glad to see you and thankyou for the answer :-). Word limit here, so i've updated the question.  
  > **username_1**: Are the "secret codes" on live and dev the same or different? Your question has `livekey` / `devkey` so I figured they weren't the same. EDIT: ah, I see your updated question says they are the same.  
  > **username_1**: Yeah, I think you need to separate this Mandrill side then. Will using a test key help? https://mandrill.zendesk.com/hc/en-us/articles/205582447-Does-Mandrill-Have-a-Test-Mode-or-Sandbox-  
  > **username_0**: No, the secret key is different for both the URL as mentioned in the post(devkey/livekey).   The `same` word the updated question is dev url `secret key` and the `option group value` stored on the dev site.  
  
  ---
  
  ### Answer by username_1 on 2017-11-12. Score: 1
  
  It sounds like what you want is to switch your dev environment to use [Mandrill's Test Mode](https://mandrill.zendesk.com/hc/en-us/articles/205582447-Does-Mandrill-Have-a-Test-Mode-or-Sandbox-)?
  
  You can then make your site [environment aware](http://www.pixelite.co.nz/article/environment-aware-drupal-sites/) to switch the Mandrill account details each time you refresh data on your dev environment, preventing live webhooks from affecting dev environment and vice versa.
  
  Mandrill's test mode is API key specific; on your dev site you'll need to switch the API key used, and then send emails to certain addresses to test bounce, rejection etc.
  
  * [Mandrill Zendesk: Test mode / sandbox](https://mandrill.zendesk.com/hc/en-us/articles/205582447-Does-Mandrill-Have-a-Test-Mode-or-Sandbox-)
  * `reject@test.mandrillapp.com` => Rejected email
  * `hard_bounce@test.mandrillapp.com` => Hard-bounced email
  * `soft_bounce@test.mandrillapp.com` => Soft-bounced email
  * `spam@test.mandrillapp.com` => Spam complaint
  
  (Your tests will also need to ensure that they are idempotent, ie reset the DB to a known state that ensures the `hard_bounce` contact is newly created or has not been marked undeliverable in CiviCRM.)
  
  You can then use Mandrill's Rules Engine to send webhook requests to the appropriate site based on the API key in use for the generated email.
  
  * [Mandrill Zendesk: Rules Engine](https://mandrill.zendesk.com/hc/en-us/articles/205583117)
  
  > **Comments:**
  > **username_0**: Great info. Tested this by removing all the default triggers from dev webhook and replaced it with rules. This seems to be working when the mail are sent from live site(they don't create any new contacts or activity on dev now). But sending mails from dev site also don't create any activity on dev. Pretty sure the rules are configured correctly to react on dev api key match.  
  > **username_0**: Also, as live webhook is meant to trigger on default open/click event, mails sent from dev site created a new activity on live... yikes.  
  
  ---
  
  