mag/WMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

M3 Integration fixes

Browse Source
This commit is contained in:
Mark Gregory
2026-09-21 10:14:57 +01:00
parent 4af997c465
commit 6d60cbff84
5853 changed files with 79032 additions and 1825 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Modules/Helpdesk/Http/Controllers/GitWebhookController.php
Regular → Executable
+146 -100
View File
@@ -15,6 +15,20 @@ use Modules\Helpdesk\Services\GitWebhookIngestionService;
final class GitWebhookController
{
private const REJECTED = 'rejected';
private const SIGNATURE_FAILED = 'Git webhook signature or token validation failed.';
private const SHA256_PREFIX = 'sha256=';
private const SHA1_PREFIX = 'sha1=';
private const REQUEST_ID_HEADER = 'X-Request-Id';
private const GITHUB_DELIVERY_HEADER = 'X-GitHub-Delivery';
private const GITHUB_EVENT_HEADER = 'X-GitHub-Event';
/**
* Ingest a signed Git provider webhook for a registered Helpdesk repository.
*/
@@ -24,34 +38,31 @@ final class GitWebhookController
$event = $this->eventName($request, $provider);
$deliveryId = $this->deliveryId($request, $provider);
$rawPayload = $request->getContent();
$status = 202;
$payload = [];
if (! $repository->is_active) {
$result = ['status' => 'rejected', 'message' => 'Repository is inactive.', 'commit_count' => 0, 'linked_count' => 0, 'ignored_count' => 1];
$service->logWebhook($repository, $provider, $deliveryId, $event, $result);
return response()->json($result, 403);
$result = $this->rejectedResult('Repository is inactive.');
$status = 403;
} elseif (! $this->hasValidSignature($request, $repository, $provider, $rawPayload)) {
$result = $this->rejectedResult(self::SIGNATURE_FAILED);
$status = 403;
} else {
try {
/** @var array<string, mixed> $payload */
$payload = json_decode($rawPayload, true, 512, JSON_THROW_ON_ERROR);
$result = $service->ingest($repository, $payload, $provider, $deliveryId, $event);
} catch (JsonException) {
$result = $this->rejectedResult('Invalid JSON webhook payload.');
$status = 400;
}
}
if (! $this->hasValidSignature($request, $repository, $provider, $rawPayload)) {
$result = ['status' => 'rejected', 'message' => 'Git webhook signature or token validation failed.', 'commit_count' => 0, 'linked_count' => 0, 'ignored_count' => 1];
$service->logWebhook($repository, $provider, $deliveryId, $event, $result);
return response()->json($result, 403);
if ($status !== 202) {
$service->logWebhook($repository, $provider, $deliveryId, $event, $result, $payload);
}
try {
/** @var array<string, mixed> $payload */
$payload = json_decode($rawPayload, true, 512, JSON_THROW_ON_ERROR);
} catch (JsonException) {
$result = ['status' => 'rejected', 'message' => 'Invalid JSON webhook payload.', 'commit_count' => 0, 'linked_count' => 0, 'ignored_count' => 1];
$service->logWebhook($repository, $provider, $deliveryId, $event, $result);
return response()->json($result, 400);
}
$result = $service->ingest($repository, $payload, $provider, $deliveryId, $event);
return response()->json($result, 202);
return response()->json($result, $status);
}
/**
@@ -63,42 +74,34 @@ final class GitWebhookController
$event = $this->eventName($request, $provider);
$deliveryId = $this->deliveryId($request, $provider);
$rawPayload = $request->getContent();
$status = 202;
$repository = null;
try {
/** @var array<string, mixed> $payload */
$payload = json_decode($rawPayload, true, 512, JSON_THROW_ON_ERROR);
$repository = $this->repositoryForGiteaPayload($payload);
if (! $repository instanceof GitRepository) {
$result = $this->rejectedResult('No active Helpdesk Git repository matched the Gitea webhook payload.');
$status = 404;
} elseif (! $this->hasValidGiteaSecurity($request, $repository, $provider, $rawPayload)) {
$result = $this->rejectedResult(self::SIGNATURE_FAILED);
$status = 403;
} else {
$result = $service->ingest($repository, $payload, $provider, $deliveryId, $event);
}
} catch (JsonException) {
return response()->json([
'status' => 'rejected',
'message' => 'Invalid JSON webhook payload.',
'commit_count' => 0,
'linked_count' => 0,
'ignored_count' => 1,
], 400);
$payload = [];
$result = $this->rejectedResult('Invalid JSON webhook payload.');
$status = 400;
}
$repository = $this->repositoryForGiteaPayload($payload);
if (! $repository instanceof GitRepository) {
return response()->json([
'status' => 'rejected',
'message' => 'No active Helpdesk Git repository matched the Gitea webhook payload.',
'commit_count' => 0,
'linked_count' => 0,
'ignored_count' => 1,
], 404);
}
if (! $this->hasValidGiteaSecurity($request, $repository, $provider, $rawPayload)) {
$result = ['status' => 'rejected', 'message' => 'Git webhook signature or token validation failed.', 'commit_count' => 0, 'linked_count' => 0, 'ignored_count' => 1];
if ($repository instanceof GitRepository && $status !== 202) {
$service->logWebhook($repository, $provider, $deliveryId, $event, $result, $payload);
return response()->json($result, 403);
}
$result = $service->ingest($repository, $payload, $provider, $deliveryId, $event);
return response()->json($result, 202);
return response()->json($result, $status);
}
/**
@@ -143,8 +146,8 @@ final class GitWebhookController
$sha256Signature = (string) $request->header('X-Hub-Signature-256', '');
$sha1Signature = (string) $request->header('X-Hub-Signature', '');
return hash_equals('sha256=' . hash_hmac('sha256', $rawPayload, $secret), $sha256Signature)
|| hash_equals('sha1=' . hash_hmac('sha1', $rawPayload, $secret), $sha1Signature);
return hash_equals(self::SHA256_PREFIX . hash_hmac('sha256', $rawPayload, $secret), $sha256Signature)
|| hash_equals(self::SHA1_PREFIX . hash_hmac('sha1', $rawPayload, $secret), $sha1Signature);
}
/**
@@ -158,8 +161,8 @@ final class GitWebhookController
$sha1 = hash_hmac('sha1', $rawPayload, $secret);
return hash_equals($sha256, $giteaSignature)
|| hash_equals('sha256=' . $sha256, $giteaSignature)
|| hash_equals('sha1=' . $sha1, $giteaSignature)
|| hash_equals(self::SHA256_PREFIX . $sha256, $giteaSignature)
|| hash_equals(self::SHA1_PREFIX . $sha1, $giteaSignature)
|| $this->hasValidGitHubSignature($request, $secret, $rawPayload)
|| $this->hasValidGenericSignature($request, $secret, $rawPayload);
}
@@ -171,7 +174,7 @@ final class GitWebhookController
{
$signature = (string) $request->header('X-Hub-Signature', '');
return hash_equals('sha256=' . hash_hmac('sha256', $rawPayload, $secret), $signature)
return hash_equals(self::SHA256_PREFIX . hash_hmac('sha256', $rawPayload, $secret), $signature)
|| hash_equals($secret, (string) $request->header('X-Helpdesk-Token', ''));
}
@@ -184,8 +187,8 @@ final class GitWebhookController
$signature = (string) ($request->header('X-Hub-Signature-256') ?: $request->header('X-Hub-Signature'));
return hash_equals($secret, $token)
|| hash_equals('sha256=' . hash_hmac('sha256', $rawPayload, $secret), $signature)
|| hash_equals('sha1=' . hash_hmac('sha1', $rawPayload, $secret), $signature);
|| hash_equals(self::SHA256_PREFIX . hash_hmac('sha256', $rawPayload, $secret), $signature)
|| hash_equals(self::SHA1_PREFIX . hash_hmac('sha1', $rawPayload, $secret), $signature);
}
/**
@@ -230,63 +233,94 @@ final class GitWebhookController
->where('is_active', true)
->whereRaw('LOWER(provider) IN (?, ?)', ['gitea', 'git'])
->get();
$matchedRepository = null;
if ($repositories->isEmpty()) {
Log::warning('Helpdesk Gitea webhook received but no active Gitea/git repository is configured.');
} else {
$normalisedPayloadValues = $this->normalisedPayloadRepositoryValues($payload);
$matchedRepository = $repositories->first(
fn (GitRepository $repository): bool => $this->repositoryMatchesPayload($repository, $normalisedPayloadValues),
);
return null;
if (! $matchedRepository instanceof GitRepository && $repositories->count() === 1) {
$matchedRepository = $repositories->first();
} elseif (! $matchedRepository instanceof GitRepository) {
Log::warning('Helpdesk Gitea webhook did not match any configured repository.', [
'payload_repository' => Arr::get($payload, 'repository.full_name') ?: Arr::get($payload, 'repository.clone_url') ?: Arr::get($payload, 'repository.html_url'),
'configured_repository_count' => $repositories->count(),
]);
}
}
$payloadValues = array_values(array_filter([
return $matchedRepository instanceof GitRepository ? $matchedRepository : null;
}
/** @param array<string, mixed> $payload
* @return list<string>
*/
private function normalisedPayloadRepositoryValues(array $payload): array
{
$name = Arr::get($payload, 'repository.name');
$owner = Arr::get($payload, 'repository.owner.username');
return $this->normaliseRepositoryValues([
Arr::get($payload, 'repository.full_name'),
Arr::get($payload, 'repository.name'),
$name,
Arr::get($payload, 'repository.html_url'),
Arr::get($payload, 'repository.clone_url'),
Arr::get($payload, 'repository.ssh_url'),
Arr::get($payload, 'repository.url'),
Arr::get($payload, 'repository.owner.username') && Arr::get($payload, 'repository.name')
? Arr::get($payload, 'repository.owner.username') . '/' . Arr::get($payload, 'repository.name')
: null,
], static fn (mixed $value): bool => is_scalar($value) && trim((string) $value) !== ''));
$owner && $name ? $owner . '/' . $name : null,
]);
}
$normalisedPayloadValues = array_values(array_filter(array_map(
fn (mixed $value): ?string => $this->normaliseRepositoryIdentity((string) $value),
$payloadValues,
)));
/** @param list<string> $payloadValues */
private function repositoryMatchesPayload(GitRepository $repository, array $payloadValues): bool
{
$repositoryValues = $this->normaliseRepositoryValues([
$repository->remote_url,
$repository->name,
Str::of((string) $repository->remote_url)->afterLast(':')->beforeLast('.git')->value(),
]);
foreach ($repositories as $repository) {
$repositoryValues = array_filter([
$repository->remote_url,
$repository->name,
Str::of((string) $repository->remote_url)->afterLast(':')->beforeLast('.git')->value(),
], static fn (mixed $value): bool => is_scalar($value) && trim((string) $value) !== '');
$normalisedRepositoryValues = array_values(array_filter(array_map(
fn (mixed $value): ?string => $this->normaliseRepositoryIdentity((string) $value),
$repositoryValues,
)));
foreach ($normalisedPayloadValues as $payloadValue) {
foreach ($normalisedRepositoryValues as $repositoryValue) {
if ($payloadValue === $repositoryValue
|| str_ends_with($repositoryValue, '/' . $payloadValue)
|| str_ends_with($payloadValue, '/' . $repositoryValue)) {
return $repository;
}
foreach ($payloadValues as $payloadValue) {
foreach ($repositoryValues as $repositoryValue) {
if ($this->repositoryIdentitiesMatch($payloadValue, $repositoryValue)) {
return true;
}
}
}
if ($repositories->count() === 1) {
return $repositories->first();
return false;
}
/** @param array<int, mixed> $values
* @return list<string>
*/
private function normaliseRepositoryValues(array $values): array
{
$normalised = [];
foreach ($values as $value) {
if (! is_scalar($value) || trim((string) $value) === '') {
continue;
}
$identity = $this->normaliseRepositoryIdentity((string) $value);
if ($identity !== null) {
$normalised[] = $identity;
}
}
Log::warning('Helpdesk Gitea webhook did not match any configured repository.', [
'payload_repository' => Arr::get($payload, 'repository.full_name') ?: Arr::get($payload, 'repository.clone_url') ?: Arr::get($payload, 'repository.html_url'),
'configured_repository_count' => $repositories->count(),
]);
return $normalised;
}
return null;
private function repositoryIdentitiesMatch(string $payloadValue, string $repositoryValue): bool
{
return $payloadValue === $repositoryValue
|| str_ends_with($repositoryValue, '/' . $payloadValue)
|| str_ends_with($payloadValue, '/' . $repositoryValue);
}
/**
@@ -325,17 +359,29 @@ final class GitWebhookController
return implode('/', array_slice($segments, -2));
}
/** @return array{status: string, message: string, commit_count: int, linked_count: int, ignored_count: int} */
private function rejectedResult(string $message): array
{
return [
'status' => self::REJECTED,
'message' => $message,
'commit_count' => 0,
'linked_count' => 0,
'ignored_count' => 1,
];
}
/**
* Read the event name from provider-specific headers.
*/
private function eventName(Request $request, string $provider): ?string
{
return match ($provider) {
'github' => $request->header('X-GitHub-Event'),
'github' => $request->header(self::GITHUB_EVENT_HEADER),
'gitlab' => $request->header('X-Gitlab-Event'),
'gitea' => $request->header('X-Gitea-Event') ?: $request->header('X-Gitea-Event-Type') ?: $request->header('X-GitHub-Event'),
'gitea' => $request->header('X-Gitea-Event') ?: $request->header('X-Gitea-Event-Type') ?: $request->header(self::GITHUB_EVENT_HEADER),
'bitbucket' => $request->header('X-Event-Key'),
default => $request->header('X-Helpdesk-Event') ?: $request->header('X-GitHub-Event') ?: $request->header('X-Gitlab-Event') ?: 'push',
default => $request->header('X-Helpdesk-Event') ?: $request->header(self::GITHUB_EVENT_HEADER) ?: $request->header('X-Gitlab-Event') ?: 'push',
};
}
@@ -345,11 +391,11 @@ final class GitWebhookController
private function deliveryId(Request $request, string $provider): ?string
{
return match ($provider) {
'github' => $request->header('X-GitHub-Delivery'),
'gitlab' => $request->header('X-Gitlab-Event-UUID') ?: $request->header('X-Request-Id'),
'gitea' => $request->header('X-Gitea-Delivery') ?: $request->header('X-GitHub-Delivery') ?: $request->header('X-Request-Id'),
'bitbucket' => $request->header('X-Request-UUID') ?: $request->header('X-Request-Id'),
default => $request->header('X-Helpdesk-Delivery') ?: $request->header('X-GitHub-Delivery') ?: $request->header('X-Request-Id'),
'github' => $request->header(self::GITHUB_DELIVERY_HEADER),
'gitlab' => $request->header('X-Gitlab-Event-UUID') ?: $request->header(self::REQUEST_ID_HEADER),
'gitea' => $request->header('X-Gitea-Delivery') ?: $request->header(self::GITHUB_DELIVERY_HEADER) ?: $request->header(self::REQUEST_ID_HEADER),
'bitbucket' => $request->header('X-Request-UUID') ?: $request->header(self::REQUEST_ID_HEADER),
default => $request->header('X-Helpdesk-Delivery') ?: $request->header(self::GITHUB_DELIVERY_HEADER) ?: $request->header(self::REQUEST_ID_HEADER),
};
}
}