Fabian Gasper
139 lines
3.1 KiB
Go
139 lines
3.1 KiB
Go
package webhook
|
|
|
|
import (
|
|
"context"
|
|
"crypto/hmac"
|
|
"crypto/sha256"
|
|
"encoding/hex"
|
|
"io"
|
|
"log"
|
|
"net/http"
|
|
"os"
|
|
"time"
|
|
|
|
"github.com/go-git/go-git/v5"
|
|
githttp "github.com/go-git/go-git/v5/plumbing/transport/http"
|
|
"github.com/gorilla/mux"
|
|
"golang.org/x/time/rate"
|
|
|
|
"varde/internal/middleware"
|
|
"varde/internal/ntfy"
|
|
)
|
|
|
|
type Config struct {
|
|
Enabled bool
|
|
ContentDir string
|
|
RepoURL string
|
|
RepoToken string
|
|
WebhookSecret string
|
|
}
|
|
|
|
type Module struct {
|
|
cfg Config
|
|
ntfyCfg ntfy.Config
|
|
repo *git.Repository
|
|
limiter *rate.Limiter
|
|
}
|
|
|
|
func New(cfg Config, ntfyCfg ntfy.Config) *Module {
|
|
return &Module{
|
|
cfg: cfg,
|
|
ntfyCfg: ntfyCfg,
|
|
limiter: rate.NewLimiter(rate.Every(10*time.Second), 1),
|
|
}
|
|
}
|
|
|
|
func (m *Module) Name() string { return "webhook" }
|
|
|
|
func (m *Module) RegisterRoutes(r *mux.Router) {
|
|
r.Handle("/webhook", middleware.RateLimit(m.limiter)(http.HandlerFunc(m.handleWebhook))).Methods("POST")
|
|
}
|
|
|
|
// Start clones or opens the content repo. Returns an error instead of
|
|
// calling log.Fatalf directly — a failing webhook module should not
|
|
// necessarily bring down other, unrelated modules in the same process.
|
|
func (m *Module) Start(ctx context.Context) error {
|
|
return m.cloneOrOpen()
|
|
}
|
|
|
|
func (m *Module) Stop(ctx context.Context) error { return nil }
|
|
|
|
func (m *Module) cloneOrOpen() error {
|
|
auth := &githttp.BasicAuth{
|
|
Username: "x-token",
|
|
Password: m.cfg.RepoToken,
|
|
}
|
|
|
|
if _, err := os.Stat(m.cfg.ContentDir + "/.git"); os.IsNotExist(err) {
|
|
log.Println("webhook: cloning repo...")
|
|
r, err := git.PlainClone(m.cfg.ContentDir, false, &git.CloneOptions{
|
|
URL: m.cfg.RepoURL,
|
|
Auth: auth,
|
|
})
|
|
if err != nil {
|
|
ntfy.Notify(m.ntfyCfg, "webhook clone failed", err)
|
|
return err
|
|
}
|
|
m.repo = r
|
|
return nil
|
|
}
|
|
|
|
log.Println("webhook: opening existing repo...")
|
|
r, err := git.PlainOpen(m.cfg.ContentDir)
|
|
if err != nil {
|
|
ntfy.Notify(m.ntfyCfg, "webhook open failed", err)
|
|
return err
|
|
}
|
|
m.repo = r
|
|
return nil
|
|
}
|
|
|
|
func (m *Module) pull() error {
|
|
w, err := m.repo.Worktree()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
err = w.Pull(&git.PullOptions{
|
|
Auth: &githttp.BasicAuth{
|
|
Username: "x-token",
|
|
Password: m.cfg.RepoToken,
|
|
},
|
|
})
|
|
if err == git.NoErrAlreadyUpToDate {
|
|
return nil
|
|
}
|
|
return err
|
|
}
|
|
|
|
func validateSignature(secret, signature string, body []byte) bool {
|
|
mac := hmac.New(sha256.New, []byte(secret))
|
|
mac.Write(body)
|
|
expected := hex.EncodeToString(mac.Sum(nil))
|
|
return hmac.Equal([]byte(expected), []byte(signature))
|
|
}
|
|
|
|
func (m *Module) handleWebhook(w http.ResponseWriter, r *http.Request) {
|
|
body, err := io.ReadAll(r.Body)
|
|
if err != nil {
|
|
w.WriteHeader(http.StatusBadRequest)
|
|
return
|
|
}
|
|
|
|
sig := r.Header.Get("X-Gitea-Signature")
|
|
if !validateSignature(m.cfg.WebhookSecret, sig, body) {
|
|
log.Println("webhook: invalid signature")
|
|
w.WriteHeader(http.StatusUnauthorized)
|
|
return
|
|
}
|
|
|
|
if err := m.pull(); err != nil {
|
|
ntfy.Notify(m.ntfyCfg, "webhook pull failed", err)
|
|
log.Printf("webhook: pull failed: %v", err)
|
|
w.WriteHeader(http.StatusInternalServerError)
|
|
return
|
|
}
|
|
|
|
log.Println("webhook: pulled new content")
|
|
w.WriteHeader(http.StatusOK)
|
|
}
|