webhooks.rs 84.5%

125 of 148 lines run, 19 of 52 functions · run #531 on main · run missed

//! Webhooks of a repository or an organisation (hub spec §12.2): the
//! settings form, deliveries and redelivery, shared by both scopes.

use super::{filters, Error, Page, RepoShell, Shell};
use crate::auth::Viewer;
use crate::db::{self, accounts};
use crate::Shared;
use askama::Template;
use serde::Deserialize;

/// Whose webhooks.
pub enum Scope {
    Repo { id: i64, slug: String },
    Org { id: i64, name: String },
}

impl Scope {
    fn owns(&self, h: &db::hooks::Hook) -> bool {
        match self {
            Scope::Repo { id, .. } => h.repo_id == Some(*id),
            Scope::Org { id, .. } => h.org_id == Some(*id),
        }
    }

    /// Where the settings page is.
    pub fn settings_url(&self) -> String {
        match self {
            Scope::Repo { slug, .. } => format!("/{slug}/settings"),
            Scope::Org { name, .. } => format!("/orgs/{name}/settings"),
        }
    }

    /// Where its webhooks are listed: a repository's own settings page
    /// (#278), an organisation's section.
    pub fn webhooks_url(&self) -> String {
        match self {
            Scope::Repo { slug, .. } => format!("/{slug}/settings/webhooks"),
            Scope::Org { name, .. } => format!("/orgs/{name}/settings#webhooks"),
        }
    }

    fn label(&self) -> &str {
        match self {
            Scope::Repo { slug, .. } => slug,
            Scope::Org { name, .. } => name,
        }
    }
}

#[derive(Deserialize)]
pub struct HookForm {
    #[serde(rename = "_csrf")]
    pub csrf_token: String,
    #[serde(default)]
    url: String,
    #[serde(default)]
    secret: String,
    #[serde(default = "star")]
    events: String,
    #[serde(default)]
    id: Option<i64>,
    #[serde(default)]
    action: String,
    /// `oxygenhub`, `discord` or `slack`; guessed from the URL when absent.
    #[serde(default)]
    format: String,
    /// For `update`: whether the hook stays active.
    #[serde(default)]
    active: Option<String>,
}

/// A hook as the settings table shows it: the URL masked, and how its
/// newest delivery went.
pub struct HookRow {
    pub hook: db::hooks::Hook,
    pub masked: String,
    pub last: Option<db::hooks::Delivery>,
}

impl HookRow {
    /// `✔ 204` or `✘ 400: why`, for the table.
    pub fn last_result(&self) -> Option<(bool, String)> {
        let d = self.last.as_ref()?;
        let ok = d.delivered_ms.is_some();
        let status = d.status.map(|s| s.to_string()).unwrap_or_else(|| "no answer".into());
        let why: String = d.response.chars().take(80).collect();
        Some((ok, if ok || why.is_empty() { status } else { format!("{status}: {why}") }))
    }
}

pub async fn rows(app: &Shared, hooks: Vec<db::hooks::Hook>) -> sqlx::Result<Vec<HookRow>> {
    let mut out = Vec::with_capacity(hooks.len());
    for hook in hooks {
        let last = db::hooks::last_attempt(&app.db, hook.id).await?;
        out.push(HookRow { masked: db::hooks::masked_url(&hook.url), last, hook });
    }
    Ok(out)
}

fn url_ok(url: &str) -> bool {
    (url.starts_with("http://") || url.starts_with("https://")) && url.len() <= 2000 && !url.contains(char::is_whitespace)
}

fn star() -> String {
    "*".into()
}

/// Apply the webhook form: `Ok(notice)` or `Err(message for the user)`.
pub async fn apply(app: &Shared, viewer: &Viewer, scope: &Scope, f: HookForm) -> sqlx::Result<Result<String, String>> {
    let owned = |h: Option<db::hooks::Hook>| h.filter(|h| scope.owns(h));
    Ok(Ok(match (f.action.as_str(), f.id) {
        ("delete", Some(id)) => {
            if owned(db::hooks::hook(&app.db, id).await?).is_some() {
                db::hooks::delete_hook(&app.db, id).await?;
                accounts::audit(&app.db, viewer.account(), "hook.deleted", scope.label(), "").await.ok();
            }
            "Webhook deleted.".to_string()
        }
        ("toggle", Some(id)) => {
            if let Some(h) = owned(db::hooks::hook(&app.db, id).await?) {
                db::hooks::set_hook_active(&app.db, id, !h.active).await?;
            }
            "Webhook updated.".to_string()
        }
        ("ping", Some(id)) => {
            if let Some(h) = owned(db::hooks::hook(&app.db, id).await?) {
                let delivery = crate::auth::random_hex(16);
                let env = hub_api::WebhookEnvelope {
                    event: "ping".into(),
                    delivery: delivery.clone(),
                    repository: None,
                    actor: viewer.account().map(|a| a.username.clone()).unwrap_or_default(),
                    at_ms: db::now_ms(),
                    data: serde_json::json!({ "zen": "changes commute" }),
                };
                db::hooks::queue_delivery(&app.db, h.id, &delivery, "ping", &serde_json::to_string(&env).unwrap_or_default()).await?;
                app.bus.delivery_waiting();
            }
            "Ping queued.".to_string()
        }
        ("update", Some(id)) => {
            let Some(h) = owned(db::hooks::hook(&app.db, id).await?) else { return Ok(Err("No such webhook.".into())) };
            let url = f.url.trim();
            if !url.is_empty() && !url_ok(url) {
                return Ok(Err("A webhook URL starts with http:// or https://.".into()));
            }
            let format = if db::hooks::FORMATS.contains(&f.format.as_str()) { f.format.as_str() } else { h.format.as_str() };
            let events = if f.events.trim().is_empty() { "*" } else { f.events.trim() };
            let secret = f.secret.trim();
            db::hooks::update_hook(
                &app.db,
                id,
                (!url.is_empty()).then_some(url),
                (!secret.is_empty()).then_some(secret),
                events,
                format,
                f.active.is_some(),
            )
            .await?;
            accounts::audit(
                &app.db,
                viewer.account(),
                "hook.updated",
                scope.label(),
                &db::hooks::masked_url(if url.is_empty() { &h.url } else { url }),
            )
            .await
            .ok();
            "Webhook saved.".to_string()
        }
        _ => {
            let url = f.url.trim();
            if !url_ok(url) {
                return Ok(Err("A webhook URL starts with http:// or https://.".into()));
            }
            let (repo_id, org_id) = match scope {
                Scope::Repo { id, .. } => (Some(*id), None),
                Scope::Org { id, .. } => (None, Some(*id)),
            };
            let h = db::hooks::create_hook(&app.db, repo_id, org_id, url, f.secret.trim(), f.events.trim()).await?;
            if db::hooks::FORMATS.contains(&f.format.as_str()) && f.format != h.format {
                db::hooks::set_hook_format(&app.db, h.id, &f.format).await?;
            }
            // Never the full URL in the log: it can hold a token.
            accounts::audit(&app.db, viewer.account(), "hook.created", scope.label(), &db::hooks::masked_url(url)).await.ok();
            "Webhook added.".to_string()
        }
    }))
}

#[derive(Template)]
#[template(path = "deliveries.html")]
pub struct DeliveriesPage {
    shell: Shell,
    /// The repository's tabs, for a repository's webhook.
    repo: Option<RepoShell>,
    hook: db::hooks::Hook,
    rows: Vec<db::hooks::Delivery>,
    settings_url: String,
    /// The page listing the webhooks, to go back to.
    back_url: String,
}

pub async fn deliveries_page(
    app: &Shared,
    shell: Shell,
    scope: &Scope,
    repo: Option<RepoShell>,
    id: i64,
) -> Result<Page<DeliveriesPage>, Error> {
    let hook = db::hooks::hook(&app.db, id)
        .await
        .map_err(|e| Error::from_db(shell.clone(), e))?
        .filter(|h| scope.owns(h))
        .ok_or_else(|| Error::not_found(shell.clone()))?;
    let rows = db::hooks::deliveries_for_hook(&app.db, id, 100).await.map_err(|e| Error::from_db(shell.clone(), e))?;
    Ok(Page(DeliveriesPage { shell, repo, hook, rows, settings_url: scope.settings_url(), back_url: scope.webhooks_url() }))
}

pub async fn redeliver(app: &Shared, scope: &Scope, id: i64, delivery: i64) -> sqlx::Result<()> {
    let mine = db::hooks::hook(&app.db, id).await?.is_some_and(|h| scope.owns(&h));
    if mine && db::hooks::delivery(&app.db, delivery).await?.is_some_and(|d| d.hook_id == id) {
        db::hooks::redeliver(&app.db, delivery).await?;
        app.bus.delivery_waiting();
    }
    Ok(())
}

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

1		//! Webhooks of a repository or an organisation (hub spec §12.2): the
2		//! settings form, deliveries and redelivery, shared by both scopes.
3
4		use super::{filters, Error, Page, RepoShell, Shell};
5		use crate::auth::Viewer;
6		use crate::db::{self, accounts};
7		use crate::Shared;
8		use askama::Template;
9		use serde::Deserialize;
10
11		/// Whose webhooks.
12		pub enum Scope {
13		Repo { id: i64, slug: String },
14		Org { id: i64, name: String },
15		}
16
17		impl Scope {
18	8×	fn owns(&self, h: &db::hooks::Hook) -> bool {
19	8×	match self {
20	4×	Scope::Repo { id, .. } => h.repo_id == Some(*id),
21	4×	Scope::Org { id, .. } => h.org_id == Some(*id),
22		}
23	8×	}
24
25		/// Where the settings page is.
26	1×	pub fn settings_url(&self) -> String {
27	1×	match self {
28	0×	Scope::Repo { slug, .. } => format!("/{slug}/settings"),
29	1×	Scope::Org { name, .. } => format!("/orgs/{name}/settings"),
30		}
31	1×	}
32
33		/// Where its webhooks are listed: a repository's own settings page
34		/// (#278), an organisation's section.
35	1×	pub fn webhooks_url(&self) -> String {
36	1×	match self {
37	0×	Scope::Repo { slug, .. } => format!("/{slug}/settings/webhooks"),
38	1×	Scope::Org { name, .. } => format!("/orgs/{name}/settings#webhooks"),
39		}
40	1×	}
41
42	4×	fn label(&self) -> &str {
43	4×	match self {
44	3×	Scope::Repo { slug, .. } => slug,
45	1×	Scope::Org { name, .. } => name,
46		}
47	4×	}
48		}
49
50		#[derive(Deserialize)]
51		pub struct HookForm {
52		#[serde(rename = "_csrf")]
53		pub csrf_token: String,
54		#[serde(default)]
55		url: String,
56		#[serde(default)]
57		secret: String,
58		#[serde(default = "star")]
59		events: String,
60		#[serde(default)]
61		id: Option<i64>,
62		#[serde(default)]
63		action: String,
64		/// `oxygenhub`, `discord` or `slack`; guessed from the URL when absent.
65		#[serde(default)]
66		format: String,
67		/// For `update`: whether the hook stays active.
68		#[serde(default)]
69		active: Option<String>,
70		}
71
72		/// A hook as the settings table shows it: the URL masked, and how its
73		/// newest delivery went.
74		pub struct HookRow {
75		pub hook: db::hooks::Hook,
76		pub masked: String,
77		pub last: Option<db::hooks::Delivery>,
78		}
79
80		impl HookRow {
81		/// `✔ 204` or `✘ 400: why`, for the table.
82	10×	pub fn last_result(&self) -> Option<(bool, String)> {
83	10×	let d = self.last.as_ref()?;
84	5×	let ok = d.delivered_ms.is_some();
85	5×	let status = d.status.map(\|s\| s.to_string()).unwrap_or_else(\|\| "no answer".into());
86	5×	let why: String = d.response.chars().take(80).collect();
87	5×	Some((ok, if ok \|\| why.is_empty() { status } else { format!("{status}: {why}") }))
88	10×	}
89		}
90
91	164×	pub async fn rows(app: &Shared, hooks: Vec<db::hooks::Hook>) -> sqlx::Result<Vec<HookRow>> {
92	164×	let mut out = Vec::with_capacity(hooks.len());
93	164×	for hook in hooks {
94	12×	let last = db::hooks::last_attempt(&app.db, hook.id).await?;
95	12×	out.push(HookRow { masked: db::hooks::masked_url(&hook.url), last, hook });
96		}
97	164×	Ok(out)
98	164×	}
99
100	4×	fn url_ok(url: &str) -> bool {
101	4×	(url.starts_with("http://") \|\| url.starts_with("https://")) && url.len() <= 2000 && !url.contains(char::is_whitespace)
102	4×	}
103
104	4×	fn star() -> String {
105	4×	"*".into()
106	4×	}
107
108		/// Apply the webhook form: `Ok(notice)` or `Err(message for the user)`.
109	10×	pub async fn apply(app: &Shared, viewer: &Viewer, scope: &Scope, f: HookForm) -> sqlx::Result<Result<String, String>> {
110	10×	let owned = \|h: Option<db::hooks::Hook>\| h.filter(\|h\| scope.owns(h));
111	10×	Ok(Ok(match (f.action.as_str(), f.id) {
112	10×	("delete", Some(id)) => {
113	2×	if owned(db::hooks::hook(&app.db, id).await?).is_some() {
114	0×	db::hooks::delete_hook(&app.db, id).await?;
115	0×	accounts::audit(&app.db, viewer.account(), "hook.deleted", scope.label(), "").await.ok();
116	2×	}
117	2×	"Webhook deleted.".to_string()
118		}
119	8×	("toggle", Some(id)) => {
120	0×	if let Some(h) = owned(db::hooks::hook(&app.db, id).await?) {
121	0×	db::hooks::set_hook_active(&app.db, id, !h.active).await?;
122	0×	}
123	0×	"Webhook updated.".to_string()
124		}
125	8×	("ping", Some(id)) => {
126	2×	if let Some(h) = owned(db::hooks::hook(&app.db, id).await?) {
127	2×	let delivery = crate::auth::random_hex(16);
128	2×	let env = hub_api::WebhookEnvelope {
129	2×	event: "ping".into(),
130	2×	delivery: delivery.clone(),
131	2×	repository: None,
132	2×	actor: viewer.account().map(\|a\| a.username.clone()).unwrap_or_default(),
133	2×	at_ms: db::now_ms(),
134	2×	data: serde_json::json!({ "zen": "changes commute" }),
135		};
136	2×	db::hooks::queue_delivery(&app.db, h.id, &delivery, "ping", &serde_json::to_string(&env).unwrap_or_default()).await?;
137	2×	app.bus.delivery_waiting();
138	0×	}
139	2×	"Ping queued.".to_string()
140		}
141	6×	("update", Some(id)) => {
142	3×	let Some(h) = owned(db::hooks::hook(&app.db, id).await?) else { return Ok(Err("No such webhook.".into())) };
143	3×	let url = f.url.trim();
144	3×	if !url.is_empty() && !url_ok(url) {
145	1×	return Ok(Err("A webhook URL starts with http:// or https://.".into()));
146	2×	}
147	2×	let format = if db::hooks::FORMATS.contains(&f.format.as_str()) { f.format.as_str() } else { h.format.as_str() };
148	2×	let events = if f.events.trim().is_empty() { "*" } else { f.events.trim() };
149	2×	let secret = f.secret.trim();
150	2×	db::hooks::update_hook(
151	2×	&app.db,
152	2×	id,
153	2×	(!url.is_empty()).then_some(url),
154	2×	(!secret.is_empty()).then_some(secret),
155	2×	events,
156	2×	format,
157	2×	f.active.is_some(),
158	2×	)
159	2×	.await?;
160	2×	accounts::audit(
161	2×	&app.db,
162	2×	viewer.account(),
163	2×	"hook.updated",
164	2×	scope.label(),
165	2×	&db::hooks::masked_url(if url.is_empty() { &h.url } else { url }),
166		)
167	2×	.await
168	2×	.ok();
169	2×	"Webhook saved.".to_string()
170		}
171		_ => {
172	3×	let url = f.url.trim();
173	3×	if !url_ok(url) {
174	1×	return Ok(Err("A webhook URL starts with http:// or https://.".into()));
175	2×	}
176	2×	let (repo_id, org_id) = match scope {
177	1×	Scope::Repo { id, .. } => (Some(*id), None),
178	1×	Scope::Org { id, .. } => (None, Some(*id)),
179		};
180	2×	let h = db::hooks::create_hook(&app.db, repo_id, org_id, url, f.secret.trim(), f.events.trim()).await?;
181	2×	if db::hooks::FORMATS.contains(&f.format.as_str()) && f.format != h.format {
182	1×	db::hooks::set_hook_format(&app.db, h.id, &f.format).await?;
183	1×	}
184		// Never the full URL in the log: it can hold a token.
185	2×	accounts::audit(&app.db, viewer.account(), "hook.created", scope.label(), &db::hooks::masked_url(url)).await.ok();
186	2×	"Webhook added.".to_string()
187		}
188		}))
189	10×	}
190
191		#[derive(Template)]
192		#[template(path = "deliveries.html")]
193		pub struct DeliveriesPage {
194		shell: Shell,
195		/// The repository's tabs, for a repository's webhook.
196		repo: Option<RepoShell>,
197		hook: db::hooks::Hook,
198		rows: Vec<db::hooks::Delivery>,
199		settings_url: String,
200		/// The page listing the webhooks, to go back to.
201		back_url: String,
202		}
203
204	2×	pub async fn deliveries_page(
205	2×	app: &Shared,
206	2×	shell: Shell,
207	2×	scope: &Scope,
208	2×	repo: Option<RepoShell>,
209	2×	id: i64,
210	2×	) -> Result<Page<DeliveriesPage>, Error> {
211	2×	let hook = db::hooks::hook(&app.db, id)
212	2×	.await
213	2×	.map_err(\|e\| Error::from_db(shell.clone(), e))?
214	2×	.filter(\|h\| scope.owns(h))
215	2×	.ok_or_else(\|\| Error::not_found(shell.clone()))?;
216	1×	let rows = db::hooks::deliveries_for_hook(&app.db, id, 100).await.map_err(\|e\| Error::from_db(shell.clone(), e))?;
217	1×	Ok(Page(DeliveriesPage { shell, repo, hook, rows, settings_url: scope.settings_url(), back_url: scope.webhooks_url() }))
218	2×	}
219
220	0×	pub async fn redeliver(app: &Shared, scope: &Scope, id: i64, delivery: i64) -> sqlx::Result<()> {
221	0×	let mine = db::hooks::hook(&app.db, id).await?.is_some_and(\|h\| scope.owns(&h));
222	0×	if mine && db::hooks::delivery(&app.db, delivery).await?.is_some_and(\|d\| d.hook_id == id) {
223	0×	db::hooks::redeliver(&app.db, delivery).await?;
224	0×	app.bus.delivery_waiting();
225	0×	}
226	0×	Ok(())
227	0×	}

Coverage / crates/hub/src/web/webhooks.rs 84.5%

Keyboard