Organisation webhooks under the organisation's settings, sharing the repository webhook code; an admin storage page with sizes, loose objects and packs, and maintenance (oxy gc) per repository or for all 8fb35df7d66e

//! Webhooks of a repository or an organisation (hub spec §12.2): the

//! settings form, deliveries and redelivery, shared by both scopes.

use super::{filters, Error, Page, RepoShell, Shell};

use crate::auth::Viewer;

use crate::db::{self, accounts};

use crate::Shared;

use askama::Template;

use serde::Deserialize;

/// Whose webhooks.

pub enum Scope {

    Repo { id: i64, slug: String },

    Org { id: i64, name: String },

}

impl Scope {

    fn owns(&self, h: &db::hooks::Hook) -> bool {

        match self {

            Scope::Repo { id, .. } => h.repo_id == Some(*id),

            Scope::Org { id, .. } => h.org_id == Some(*id),

        }

    }

    /// Where the settings page is.

    pub fn settings_url(&self) -> String {

        match self {

            Scope::Repo { slug, .. } => format!("/{slug}/settings"),

            Scope::Org { name, .. } => format!("/orgs/{name}/settings"),

        }

    }

    fn label(&self) -> &str {

        match self {

            Scope::Repo { slug, .. } => slug,

            Scope::Org { name, .. } => name,

        }

    }

}

#[derive(Deserialize)]

pub struct HookForm {

    #[serde(rename = "_csrf")]

    pub csrf_token: String,

    #[serde(default)]

    url: String,

    #[serde(default)]

    secret: String,

    #[serde(default = "star")]

    events: String,

    #[serde(default)]

    id: Option<i64>,

    #[serde(default)]

    action: String,

}

fn star() -> String {

    "*".into()

}

/// Apply the webhook form: `Ok(notice)` or `Err(message for the user)`.

pub async fn apply(app: &Shared, viewer: &Viewer, scope: &Scope, f: HookForm) -> sqlx::Result<Result<String, String>> {

    let owned = |h: Option<db::hooks::Hook>| h.filter(|h| scope.owns(h));

    Ok(Ok(match (f.action.as_str(), f.id) {

        ("delete", Some(id)) => {

            if owned(db::hooks::hook(&app.db, id).await?).is_some() {

                db::hooks::delete_hook(&app.db, id).await?;

                accounts::audit(&app.db, viewer.account(), "hook.deleted", scope.label(), "").await.ok();

            }

            "Webhook deleted.".to_string()

        }

        ("toggle", Some(id)) => {

            if let Some(h) = owned(db::hooks::hook(&app.db, id).await?) {

                db::hooks::set_hook_active(&app.db, id, !h.active).await?;

            }

            "Webhook updated.".to_string()

        }

        ("ping", Some(id)) => {

            if let Some(h) = owned(db::hooks::hook(&app.db, id).await?) {

                let delivery = crate::auth::random_hex(16);

                let env = hub_api::WebhookEnvelope {

                    event: "ping".into(),

                    delivery: delivery.clone(),

                    repository: None,

                    actor: viewer.account().map(|a| a.username.clone()).unwrap_or_default(),

                    at_ms: db::now_ms(),

                    data: serde_json::json!({ "zen": "changes commute" }),

                };

                db::hooks::queue_delivery(&app.db, h.id, &delivery, "ping", &serde_json::to_string(&env).unwrap_or_default()).await?;

                app.events.notify_deliveries();

            }

            "Ping queued.".to_string()

        }

        _ => {

            if !(f.url.starts_with("http://") || f.url.starts_with("https://")) {

                return Ok(Err("A webhook URL starts with http:// or https://.".into()));

            }

            let (repo_id, org_id) = match scope {

                Scope::Repo { id, .. } => (Some(*id), None),

                Scope::Org { id, .. } => (None, Some(*id)),

            };

            db::hooks::create_hook(&app.db, repo_id, org_id, f.url.trim(), f.secret.trim(), f.events.trim()).await?;

            accounts::audit(&app.db, viewer.account(), "hook.created", scope.label(), f.url.trim()).await.ok();

            "Webhook added.".to_string()

        }

    }))

}

#[derive(Template)]

#[template(path = "deliveries.html")]

pub struct DeliveriesPage {

    shell: Shell,

    /// The repository's tabs, for a repository's webhook.

    repo: Option<RepoShell>,

    hook: db::hooks::Hook,

    rows: Vec<db::hooks::Delivery>,

    settings_url: String,

}

pub async fn deliveries_page(

    app: &Shared,

    shell: Shell,

    scope: &Scope,

    repo: Option<RepoShell>,

    id: i64,

) -> Result<Page<DeliveriesPage>, Error> {

    let hook = db::hooks::hook(&app.db, id)

        .await

        .map_err(|e| Error::from_db(shell.clone(), e))?

        .filter(|h| scope.owns(h))

        .ok_or_else(|| Error::not_found(shell.clone()))?;

    let rows = db::hooks::deliveries_for_hook(&app.db, id, 100).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    Ok(Page(DeliveriesPage { shell, repo, hook, rows, settings_url: scope.settings_url() }))

}

pub async fn redeliver(app: &Shared, scope: &Scope, id: i64, delivery: i64) -> sqlx::Result<()> {

    let mine = db::hooks::hook(&app.db, id).await?.is_some_and(|h| scope.owns(&h));

    if mine && db::hooks::delivery(&app.db, delivery).await?.is_some_and(|d| d.hook_id == id) {

        db::hooks::redeliver(&app.db, delivery).await?;

        app.events.notify_deliveries();

    }

    Ok(())

}

{% extends "base.html" %}

{% block title %}Storage · Administration{% endblock %}

{% block content %}

<div class="head"><h1>Storage <small>{{ rows.len() }} repositories · {{ total|bytes }}</small></h1></div>

<p><a href="/admin">← administration</a></p>

{% if let Some(n) = notice %}<p class="note">{{ n }}</p>{% endif %}

{% if let Some(e) = error %}<p class="error">{{ e }}</p>{% endif %}

<p class="small mute">Maintenance runs <code>oxy gc</code> on the hub's copy: loose objects go into a pack, and unreachable objects older than the grace period are pruned. Each repository is locked for writing while it runs.</p>

<form class="tiny" method="post" action="/admin/storage"><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><input type="hidden" name="repo" value="*"><button type="submit">MAINTAIN EVERY REPOSITORY</button></form>

<table class="list">

  <thead><tr><th>Repository</th><th>On disk</th><th>Loose objects</th><th>Packs</th><th></th></tr></thead>

  <tbody>

  {% for r in rows %}

  <tr><td><a href="/{{ r.slug }}">{{ r.slug }}</a></td><td>{{ r.bytes|bytes }}</td><td>{{ r.loose }}{% if r.loose > 1000 %} <span class="tag warn">pack me</span>{% endif %}</td><td>{{ r.packs }}</td>

  <td><form class="tiny" method="post" action="/admin/storage"><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><input type="hidden" name="repo" value="{{ r.slug }}"><button type="submit">maintain</button></form></td></tr>

  {% endfor %}

  </tbody>

</table>

{% endblock %}

{% macro panel(base, hooks, csrf, what) %}

<section class="panel" id="webhooks">

  <h2>Webhooks</h2>

  <p class="small mute">{{ what }}</p>

  {% if hooks.is_empty() %}<p class="mute small">None.</p>{% else %}

  <table class="small"><tr><th>URL</th><th>Events</th><th>Active</th><th></th></tr>

  {% for h in hooks %}<tr><td>{{ h.url }}</td><td>{{ h.events }}</td><td>{% if h.active %}yes{% else %}no{% endif %}</td>

  <td><a class="small" href="{{ base }}/hooks/{{ h.id }}/deliveries">deliveries</a>

  <form class="tiny" method="post" action="{{ base }}/hooks"><input type="hidden" name="_csrf" value="{{ csrf }}"><input type="hidden" name="id" value="{{ h.id }}"><button name="action" value="ping">ping</button> <button name="action" value="toggle">{% if h.active %}disable{% else %}enable{% endif %}</button> <button name="action" value="delete">delete</button></form></td></tr>{% endfor %}

  </table>{% endif %}

  <form class="card" method="post" action="{{ base }}/hooks">

    <input type="hidden" name="_csrf" value="{{ csrf }}">

    <label for="hurl">URL</label><input type="text" id="hurl" name="url" placeholder="https://…" required>

    <label for="hsecret">Secret (signs each delivery)</label><input type="text" id="hsecret" name="secret">

    <label for="hevents">Events (<code>*</code>, or a list such as <code>push,proposal,issue</code>)</label><input type="text" id="hevents" name="events" value="*">

    <button type="submit">ADD WEBHOOK</button>

  </form>

</section>

{% endmacro %}

// ------------------------------------------------------------------ storage

/// One repository's footprint on disk.

pub struct StorageRow {

    pub slug: String,

    pub bytes: u64,

    /// Objects not yet in a pack.

    pub loose: usize,

    pub packs: usize,

}

#[derive(Template)]

#[template(path = "admin_storage.html")]

pub struct StoragePage {

    shell: Shell,

    rows: Vec<StorageRow>,

    total: u64,

    notice: Option<String>,

    error: Option<String>,

}

/// Size, loose objects and packs under a repository directory.

fn footprint(dir: &std::path::Path) -> (u64, usize, usize) {

    let (mut bytes, mut loose, mut packs) = (0u64, 0usize, 0usize);

    let mut stack = vec![dir.to_path_buf()];

    while let Some(d) = stack.pop() {

        let Ok(rd) = std::fs::read_dir(&d) else { continue };

        for e in rd.flatten() {

            let Ok(ft) = e.file_type() else { continue };

            if ft.is_dir() {

                stack.push(e.path());

            } else if ft.is_file() {

                bytes += e.metadata().map(|m| m.len()).unwrap_or(0);

                let p = e.path();

                if p.components().any(|c| c.as_os_str() == "loose") {

                    loose += 1;

                } else if p.extension().is_some_and(|x| x == "pack") {

                    packs += 1;

                }

            }

        }

    }

    (bytes, loose, packs)

}

async fn storage_page(app: &Shared, shell: Shell, notice: Option<String>, error: Option<String>) -> Result<Page<StoragePage>, Error> {

    let repos = crate::db::repos::list(&app.db).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    let dirs: Vec<(String, std::path::PathBuf)> =

        repos.iter().filter_map(|r| crate::repos::RepoName::new(&r.owner, &r.name).map(|n| (n.to_string(), app.repos.dir(&n)))).collect();

    let mut rows = tokio::task::spawn_blocking(move || {

        dirs.into_iter()

            .map(|(slug, dir)| {

                let (bytes, loose, packs) = footprint(&dir);

                StorageRow { slug, bytes, loose, packs }

            })

            .collect::<Vec<_>>()

    })

    .await

    .unwrap_or_default();

    rows.sort_by_key(|r| std::cmp::Reverse(r.bytes));

    let total = rows.iter().map(|r| r.bytes).sum();

    Ok(Page(StoragePage { shell, rows, total, notice, error }))

}

pub async fn storage(State(app): State<Shared>, viewer: Viewer) -> Result<Page<StoragePage>, Error> {

    let shell = Shell::new(&app, "/admin/storage", &viewer);

    require_admin(&viewer, &shell)?;

    storage_page(&app, shell, None, None).await

}

#[derive(Deserialize)]

pub struct MaintainForm {

    #[serde(rename = "_csrf")]

    csrf_token: String,

    /// `owner/name`, or `*` for every repository.

    repo: String,

}

/// `POST /admin/storage`: `oxy gc` on one repository or all of them, under

/// each repository's write lock, with the grace period kept.

pub async fn maintain(State(app): State<Shared>, viewer: Viewer, Form(f): Form<MaintainForm>) -> Result<Page<StoragePage>, Error> {

    let shell = Shell::new(&app, "/admin/storage", &viewer);

    let me = require_admin(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let names: Vec<crate::repos::RepoName> = if f.repo == "*" {

        crate::db::repos::list(&app.db)

            .await

            .map_err(|e| Error::from_db(shell.clone(), e))?

            .iter()

            .filter_map(|r| crate::repos::RepoName::new(&r.owner, &r.name))

            .collect()

    } else {

        match crate::repos::RepoName::parse(&f.repo) {

            Some(n) if app.repos.exists(&n) => vec![n],

            _ => return storage_page(&app, shell, None, Some(format!("No repository {}.", f.repo))).await,

        }

    };

    let (mut packed, mut pruned, mut freed, mut failed) = (0usize, 0usize, 0u64, Vec::new());

    for name in &names {

        match app.repos.write(name, |r, _| r.gc(false).map_err(crate::repos::RepoError::Oxy)).await {

            Ok(rep) => {

                packed += rep.packed.objects;

                pruned += rep.pruned.objects;

                freed += rep.pruned.bytes + rep.packed.raw_bytes.saturating_sub(rep.packed.packed_bytes);

            }

            Err(e) => failed.push(format!("{name}: {e}")),

        }

    }

    let summary = format!(

        "Maintained {} repositor{}: {packed} loose objects packed, {pruned} unreachable objects pruned, about {} saved.",

        names.len(),

        if names.len() == 1 { "y" } else { "ies" },

        crate::render::bytes(freed)

    );

    accounts::audit(&app.db, Some(&me), "admin.gc", &f.repo, &summary).await.ok();

    let error = (!failed.is_empty()).then(|| failed.join("; "));

    storage_page(&app, shell, Some(summary), error).await

}

mod webhooks;

        .route("/orgs/{name}/settings/hooks", post(orgs::hooks))

        .route("/orgs/{name}/settings/hooks/{id}/deliveries", get(orgs::deliveries))

        .route("/orgs/{name}/settings/hooks/{id}/redeliver/{delivery}", post(orgs::redeliver))

        .route("/admin/storage", get(admin::storage).post(admin::maintain))

    hooks: Vec<crate::db::hooks::Hook>,

    let hooks = crate::db::hooks::hooks_for_org(&app.db, org.id).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    Ok(Page(OrgSettingsPage { shell, org, members, teams, hooks, notice, error }))

}

/// `POST /orgs/{name}/settings/hooks`: webhooks that hear every repository of the organisation.

pub async fn hooks(

    State(app): State<Shared>,

    viewer: Viewer,

    Path(name): Path<String>,

    Form(f): Form<super::webhooks::HookForm>,

) -> Result<Page<OrgSettingsPage>, Error> {

    let shell = Shell::new(&app, &format!("/orgs/{name}/settings"), &viewer);

    let (_, org) = owned_org(&app, &shell, &viewer, &name).await?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let scope = super::webhooks::Scope::Org { id: org.id, name: org.name.clone() };

    match super::webhooks::apply(&app, &viewer, &scope, f).await.map_err(|e| Error::from_db(shell.clone(), e))? {

        Ok(notice) => org_page(&app, shell, org, Some(notice), None).await,

        Err(error) => org_page(&app, shell, org, None, Some(error)).await,

    }

}

pub async fn deliveries(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((name, id)): Path<(String, i64)>,

) -> Result<Page<super::webhooks::DeliveriesPage>, Error> {

    let shell = Shell::new(&app, &format!("/orgs/{name}/settings/hooks/{id}/deliveries"), &viewer);

    let (_, org) = owned_org(&app, &shell, &viewer, &name).await?;

    let scope = super::webhooks::Scope::Org { id: org.id, name: org.name };

    super::webhooks::deliveries_page(&app, shell, &scope, None, id).await

}

pub async fn redeliver(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((name, id, delivery)): Path<(String, i64, i64)>,

    Form(f): Form<super::session::CsrfForm>,

) -> Result<Page<super::webhooks::DeliveriesPage>, Error> {

    let shell = Shell::new(&app, &format!("/orgs/{name}/settings/hooks/{id}/deliveries"), &viewer);

    let (_, org) = owned_org(&app, &shell, &viewer, &name).await?;

    csrf(&viewer, &f.csrf, &shell)?;

    let scope = super::webhooks::Scope::Org { id: org.id, name: org.name };

    super::webhooks::redeliver(&app, &scope, id, delivery).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    super::webhooks::deliveries_page(&app, shell, &scope, None, id).await

    Form(f): Form<super::webhooks::HookForm>,

    let scope = super::webhooks::Scope::Repo { id: row.id, slug: format!("{owner}/{name}") };

    match super::webhooks::apply(&app, &viewer, &scope, f).await.map_err(|e| Error::from_db(shell.clone(), e))? {

        Ok(notice) => settings_page(&app, shell, row, role, Some(notice), None).await,

        Err(error) => settings_page(&app, shell, row, role, None, Some(error)).await,

    }

) -> Result<Page<super::webhooks::DeliveriesPage>, Error> {

    let scope = super::webhooks::Scope::Repo { id: row.id, slug: format!("{owner}/{name}") };

    super::webhooks::deliveries_page(&app, shell, &scope, Some(RepoShell::new(&app, &row, "settings").with_role(role)), id).await

) -> Result<Page<super::webhooks::DeliveriesPage>, Error> {

    let (_, row, role) = lookup_role(&app, &shell, &viewer, &owner, &name, Access::Admin).await?;

    let scope = super::webhooks::Scope::Repo { id: row.id, slug: format!("{owner}/{name}") };

    super::webhooks::redeliver(&app, &scope, id, delivery).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    super::webhooks::deliveries_page(&app, shell, &scope, Some(RepoShell::new(&app, &row, "settings").with_role(role)), id).await

#[tokio::test(flavor = "multi_thread")]

async fn organisation_webhooks_and_storage() {

    let h = hub().await;

    let app = &h.app;

    let andy = register(app, "andy", "").await;

    let me = db::accounts::account_by_name(&app.db, "andy").await.unwrap().unwrap();

    let org = db::accounts::create_org(&app.db, "acme", "Acme", me.id).await.unwrap();

    // Organisation webhooks: add, ping, deliveries; only for this organisation.

    let page = get(app, "/orgs/acme/settings", Some(&andy)).await;

    assert!(page.body.contains("id=\"webhooks\"") && page.body.contains("href=\"#webhooks\""));

    let csrf = csrf_of(&page.body);

    let r = post(app, "/orgs/acme/settings/hooks", Some(&andy), &format!("_csrf={csrf}&url=ftp%3A%2F%2Fx&events=*")).await;

    assert!(r.body.contains("starts with http"), "{}", r.body);

    let r = post(

        app,

        "/orgs/acme/settings/hooks",

        Some(&andy),

        &format!("_csrf={csrf}&url=https%3A%2F%2Fhooks.invalid%2Facme&secret=s&events=push"),

    )

    .await;

    assert!(r.body.contains("Webhook added"));

    let hooks = db::hooks::hooks_for_org(&app.db, org.id).await.unwrap();

    assert_eq!(hooks.len(), 1);

    let id = hooks[0].id;

    assert!(post(app, "/orgs/acme/settings/hooks", Some(&andy), &format!("_csrf={csrf}&id={id}&action=ping"))

        .await

        .body

        .contains("Ping queued"));

    let deliveries = get(app, &format!("/orgs/acme/settings/hooks/{id}/deliveries"), Some(&andy)).await;

    assert_eq!(deliveries.status, StatusCode::OK);

    assert!(deliveries.body.contains(">ping<") && deliveries.body.contains("/orgs/acme/settings#webhooks"));

    // A repository's hook cannot be touched through the organisation's form.

    let repo = oxygenhub::repos::RepoName::parse("andy/demo").unwrap();

    app.repos.create(&repo, None).unwrap();

    let row = db::repos::create(&app.db, "andy", "demo", "", hub_api::Visibility::Public).await.unwrap();

    let repo_hook = db::hooks::create_hook(&app.db, Some(row.id), None, "https://hooks.invalid/repo", "", "*").await.unwrap().id;

    post(app, "/orgs/acme/settings/hooks", Some(&andy), &format!("_csrf={csrf}&id={repo_hook}&action=delete")).await;

    assert!(db::hooks::hook(&app.db, repo_hook).await.unwrap().is_some(), "not the organisation's");

    assert_eq!(get(app, &format!("/orgs/acme/settings/hooks/{repo_hook}/deliveries"), Some(&andy)).await.status, StatusCode::NOT_FOUND);

    // The repository's own settings still manage its hooks (shared code).

    let rs = get(app, "/andy/demo/settings", Some(&andy)).await;

    assert!(rs.body.contains("https://hooks.invalid/repo") && rs.body.contains("action=\"/andy/demo/settings/hooks\""));

    // Storage: sizes and loose objects, and maintenance packs them.

    let work = tempfile::tempdir().unwrap();

    let mut client = Repo::init(work.path()).unwrap();

    client.config.set("remote.origin.url", &format!("{}/andy/demo", h.base)).unwrap();

    let (token, hash) = oxygenhub::auth::new_token();

    db::accounts::create_token(&app.db, me.id, "push", &hash, "repo:write", "", None).await.unwrap();

    client.config.set("remote.origin.token", &token).unwrap();

    client.save_config().unwrap();

    write(work.path(), "a.txt", b"a\n");

    client.snapshot("t").unwrap();

    client.commit("one", &[]).unwrap();

    assert!(client.push("origin", false).unwrap().iter().all(|r| r.ok));

    let storage = get(app, "/admin/storage", Some(&andy)).await;

    assert_eq!(storage.status, StatusCode::OK);

    assert!(storage.body.contains("href=\"/andy/demo\""));

    let loose_before = std::fs::read_dir(app.repos.dir(&repo).join(".oxy/objects/loose")).map(|d| d.count()).unwrap_or(0);

    assert!(loose_before > 0, "the push left loose objects");

    let r = post(app, "/admin/storage", Some(&andy), &format!("_csrf={}&repo=andy%2Fdemo", csrf_of(&storage.body))).await;

    assert!(r.body.contains("Maintained 1 repository") && r.body.contains("loose objects packed"), "{}", r.body);

    let loose_after: usize = walk_files(&app.repos.dir(&repo).join(".oxy/objects/loose"));

    assert_eq!(loose_after, 0, "packed");

    let audit = db::accounts::audit_rows(&app.db, 20).await.unwrap();

    assert!(audit.iter().any(|a| a.action == "admin.gc" && a.target == "andy/demo"));

    let r = post(app, "/admin/storage", Some(&andy), &format!("_csrf={}&repo=nobody%2Fnone", csrf_of(&storage.body))).await;

    assert!(r.body.contains("No repository nobody/none"));

}

fn walk_files(dir: &Path) -> usize {

    let Ok(rd) = std::fs::read_dir(dir) else { return 0 };

    rd.flatten().map(|e| if e.path().is_dir() { walk_files(&e.path()) } else { 1 }).sum()

}

| `/admin/*` | Site: accounts, registration mode, invitations, audit log; `/admin/storage` lists every repository's size on disk, loose objects and packs, and runs maintenance (`oxy gc` with the grace period kept, under the repository's write lock) on one repository or all, audited |

Per repository and per organisation: a URL, a secret, an event selection, active flag, and delivery log with redelivery. Repository admins manage a repository's webhooks under its settings; organisation owners manage the organisation's under its settings, and those hear every repository the organisation owns. Payloads are JSON with `X-Oxyhub-Event`, `X-Oxyhub-Delivery`, and `X-Oxyhub-Signature: blake3-keyed=<hex>` computed as keyed BLAKE3 over the body. Events: `push` (reference updated: old and new state, heads, changes), `proposal` (opened, edited, review requested, landed, closed, conflicted), `review`, `comment`, `issue`, `release`, `check`, `policy`. Deliveries retry with backoff up to 24 hours.

<p><a class="go small" href="/admin/storage">Storage and maintenance</a></p>

{% block title %}Deliveries{% endblock %}

{% block tabs %}{% if let Some(r) = repo %}{% call m::tabs(r, "settings") %}{% endif %}{% endblock %}

<p><a href="{{ settings_url }}#webhooks">← settings</a></p>

<td><form class="tiny" method="post" action="{{ settings_url }}/hooks/{{ hook.id }}/redeliver/{{ d.id }}"><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><button>redeliver</button></form></td></tr>

{% import "webhooks_panel.html" as w %}

  <a href="#webhooks">Webhooks</a>

{% call w::panel("/orgs/" ~ org.name ~ "/settings", hooks, shell.csrf, "These hear every repository of the organisation, as well as each repository's own webhooks.") %}

{% import "webhooks_panel.html" as w %}

{% call w::panel(repo.url ~ "/settings", hooks, shell.csrf, "Each delivery is signed with the secret (X-Oxyhub-Signature) and retried with backoff for a day.") %}