Compare commits
7 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
9ed8905a5c | ||
|
|
8cb28459a0 | ||
|
|
753ad6dd05 | ||
|
|
dd4c20f0a7 | ||
|
|
c04b4e8da5 | ||
|
|
69dd1ba156 | ||
|
|
65c964b329 |
@@ -38,7 +38,7 @@ default = ["local_trigger"]
|
|||||||
local_trigger = []
|
local_trigger = []
|
||||||
|
|
||||||
[dependencies]
|
[dependencies]
|
||||||
axum = { version = "0.7.5", default-features = false, features = ["tokio", "http1", "http2", "json"] }
|
axum = { version = "0.7.5", default-features = false, features = ["tokio", "http1", "json"] }
|
||||||
base64 = "0.22.1"
|
base64 = "0.22.1"
|
||||||
hmac = "0.12.1"
|
hmac = "0.12.1"
|
||||||
http-body-util = "0.1.2"
|
http-body-util = "0.1.2"
|
||||||
|
|||||||
@@ -63,7 +63,6 @@ pub async fn launch_server() -> Result<(), Box<dyn std::error::Error>> {
|
|||||||
.collect();
|
.collect();
|
||||||
tracing::debug!("Using repo whitelist: {:?}", allowed_repos);
|
tracing::debug!("Using repo whitelist: {:?}", allowed_repos);
|
||||||
|
|
||||||
let allowed_repos = HashSet::new();
|
|
||||||
let app = Router::new()
|
let app = Router::new()
|
||||||
.route("/hook", post(hook))
|
.route("/hook", post(hook))
|
||||||
.layer(middleware::from_fn(verify_signature))
|
.layer(middleware::from_fn(verify_signature))
|
||||||
@@ -98,7 +97,7 @@ pub async fn local_trigger(payload: &str) -> Result<(), Box<dyn std::error::Erro
|
|||||||
|
|
||||||
let allowed_repos = std::env::var("WEBHOOK_BRIDGE_REPO_WHITELIST")
|
let allowed_repos = std::env::var("WEBHOOK_BRIDGE_REPO_WHITELIST")
|
||||||
.ok()
|
.ok()
|
||||||
.unwrap_or_else(String::new);
|
.unwrap_or_default();
|
||||||
let allowed_repos: HashSet<_> = allowed_repos
|
let allowed_repos: HashSet<_> = allowed_repos
|
||||||
.split(",")
|
.split(",")
|
||||||
.filter(|s| !s.is_empty())
|
.filter(|s| !s.is_empty())
|
||||||
|
|||||||
@@ -42,24 +42,34 @@ pub(crate) async fn hook(
|
|||||||
debug!("REQ: {:?}", payload);
|
debug!("REQ: {:?}", payload);
|
||||||
match payload {
|
match payload {
|
||||||
HookRequest::Push(webhook_payload) => {
|
HookRequest::Push(webhook_payload) => {
|
||||||
handle_push(
|
let push_result = handle_push(
|
||||||
state.gitea,
|
state.gitea,
|
||||||
state.kubernetes_client,
|
state.kubernetes_client,
|
||||||
state.allowed_repos.borrow(),
|
state.allowed_repos.borrow(),
|
||||||
webhook_payload,
|
webhook_payload,
|
||||||
)
|
)
|
||||||
.await
|
.await;
|
||||||
.expect("Failed to handle push event.");
|
match push_result {
|
||||||
(
|
Ok(_) => (
|
||||||
StatusCode::OK,
|
StatusCode::OK,
|
||||||
Json(HookResponse {
|
Json(HookResponse {
|
||||||
ok: true,
|
ok: true,
|
||||||
message: None,
|
message: None,
|
||||||
}),
|
}),
|
||||||
)
|
),
|
||||||
|
Err(_) => (
|
||||||
|
// StatusCode::INTERNAL_SERVER_ERROR,
|
||||||
|
StatusCode::OK,
|
||||||
|
Json(HookResponse {
|
||||||
|
ok: false,
|
||||||
|
message: Some("Failed to handle push event.".to_string()),
|
||||||
|
}),
|
||||||
|
),
|
||||||
|
}
|
||||||
}
|
}
|
||||||
HookRequest::Unrecognized(payload) => (
|
HookRequest::Unrecognized(payload) => (
|
||||||
StatusCode::BAD_REQUEST,
|
// StatusCode::BAD_REQUEST,
|
||||||
|
StatusCode::OK,
|
||||||
Json(HookResponse {
|
Json(HookResponse {
|
||||||
ok: false,
|
ok: false,
|
||||||
message: Some(format!("unrecognized event type: {payload}")),
|
message: Some(format!("unrecognized event type: {payload}")),
|
||||||
@@ -146,9 +156,9 @@ where
|
|||||||
}
|
}
|
||||||
|
|
||||||
async fn check_hash(body: Bytes, secret: String, signature: Vec<u8>) -> Result<Bytes, Response> {
|
async fn check_hash(body: Bytes, secret: String, signature: Vec<u8>) -> Result<Bytes, Response> {
|
||||||
tracing::info!("Checking signature {:02x?}", signature.as_slice());
|
tracing::debug!("Checking signature {:02x?}", signature.as_slice());
|
||||||
tracing::info!("Using secret {:?}", secret);
|
// tracing::info!("Using secret {:?}", secret);
|
||||||
tracing::info!("and body {}", general_purpose::STANDARD.encode(&body));
|
tracing::debug!("and body {}", general_purpose::STANDARD.encode(&body));
|
||||||
let mut mac = HmacSha256::new_from_slice(secret.as_bytes())
|
let mut mac = HmacSha256::new_from_slice(secret.as_bytes())
|
||||||
.map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()).into_response())?;
|
.map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()).into_response())?;
|
||||||
mac.update(&body);
|
mac.update(&body);
|
||||||
|
|||||||
Reference in New Issue
Block a user