lex-webhook 0.1.2 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 32d491d3d84f39bda974bdc455326fb692bec59e0b15a5e8ce443c47a9feecce
-  data.tar.gz: e13c80478240c638a59898676dcf30f1a583f3a72f7b01087b548cb21876a988
+  metadata.gz: cda9060d79734016ce64972bcb8e38010910f9fa8d34848345434b750229cb6d
+  data.tar.gz: 0cf3860479b77cc49f66c36d2a6dc64277812cdb95d93d71299e0cd7a7018651
 SHA512:
-  metadata.gz: 93d7b656d82d45d56af2824f52e9d7f0959d93e081daac2277374ca41f1e5b9ef499df1ceda80907792a42250a8de05793e2cd006dbf6b3dc3ab5b7a51ea862e
-  data.tar.gz: ccc666a2d46aedd88832db901c8a82aaf969898415a88569b98ccc1ca1b5527d0daffb1f7d46b71d391534135b1cd7faab5921e7e9e2e9dbdcb1a99833a9a5e0
+  metadata.gz: 8c636a22741a8c2a0f9f09393663067bf992c194cec178c5b0af807b1648209312fff5230fd34e924527a29de6bc1df6737d407314c748c0bea9db96f27d21eb
+  data.tar.gz: 644f88dc384ceab5fd87fbdf524462049f72aa43a554eb152ef6ee87d64552931413f3fe61fe5dbec558f52699b18c8389ab143bb0a5aa670124e3d2c6c3953d

data/.github/CODEOWNERS

@@ -0,0 +1,7 @@
+# Auto-generated from team-config.yml
+# Team: extensions
+#
+# To apply: scripts/apply-codeowners.sh lex-webhook
+
+* @LegionIO/maintainers
+* @LegionIO/extensions

data/.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: bundler
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - "type:dependencies"
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - "type:dependencies"

data/.github/workflows/ci.yml

@@ -3,13 +3,31 @@ on:
   push:
     branches: [main]
   pull_request:
+  schedule:
+    - cron: '0 9 * * 1'
 
 jobs:
   ci:
     uses: LegionIO/.github/.github/workflows/ci.yml@main
 
+  excluded-files:
+    uses: LegionIO/.github/.github/workflows/excluded-files.yml@main
+
+  security:
+    uses: LegionIO/.github/.github/workflows/security-scan.yml@main
+
+  version-changelog:
+    uses: LegionIO/.github/.github/workflows/version-changelog.yml@main
+
+  dependency-review:
+    uses: LegionIO/.github/.github/workflows/dependency-review.yml@main
+
+  stale:
+    if: github.event_name == 'schedule'
+    uses: LegionIO/.github/.github/workflows/stale.yml@main
+
   release:
-    needs: ci
+    needs: [ci, excluded-files]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     uses: LegionIO/.github/.github/workflows/release.yml@main
     secrets:

data/.rubocop.yml

@@ -1,53 +1,18 @@
-AllCops:
-  TargetRubyVersion: 3.4
-  NewCops: enable
-  SuggestExtensions: false
+inherit_gem:
+  rubocop-legion: config/lex.yml
 
-Layout/LineLength:
-  Max: 160
-
-Layout/SpaceAroundEqualsInParameterDefault:
-  EnforcedStyle: space
-
-Layout/HashAlignment:
-  EnforcedHashRocketStyle: table
-  EnforcedColonStyle: table
-
-Metrics/MethodLength:
-  Max: 50
-
-Metrics/ClassLength:
-  Max: 1500
-
-Metrics/ModuleLength:
-  Max: 1500
-
-Metrics/BlockLength:
-  Max: 40
-  Exclude:
-    - 'spec/**/*'
-
-Metrics/AbcSize:
-  Max: 60
-
-Metrics/CyclomaticComplexity:
-  Max: 15
-
-Metrics/PerceivedComplexity:
-  Max: 17
-
-Style/Documentation:
+# Runner modules are designed for include into Client; not standalone
+Legion/Extension/RunnerIncludeHelpers:
   Enabled: false
 
-Style/SymbolArray:
-  Enabled: true
-
-Style/FrozenStringLiteralComment:
-  Enabled: true
-  EnforcedStyle: always
+# Private helpers and early-return methods return non-Hash values by design
+Legion/Extension/RunnerReturnHash:
+  Enabled: false
 
-Naming/FileName:
+# Runner modules use Legion::JSON directly; helper mixin not included
+Legion/HelperMigration/DirectJson:
   Enabled: false
 
-Gemspec/DevelopmentDependencies:
+# Class instance variables are used for lazy initialization patterns by design
+ThreadSafety/ClassInstanceVariable:
   Enabled: false

data/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## [0.1.3] - 2026-03-30
+
+### Changed
+- update to rubocop-legion 0.1.7, resolve all offenses
+
 ## [0.1.2] - 2026-03-22
 
 ### Changed

data/CLAUDE.md

@@ -0,0 +1,114 @@
+# lex-webhook: Generic Webhook Receiver for LegionIO
+
+**Repository Level 3 Documentation**
+- **Parent**: `/Users/miverso2/rubymine/legion/extensions-core/CLAUDE.md`
+- **Grandparent**: `/Users/miverso2/rubymine/legion/CLAUDE.md`
+
+## Purpose
+
+Legion Extension that receives incoming webhooks, verifies HMAC signatures, and dispatches parsed payloads. Provides an endpoint registry for managing webhook paths and secrets, and a standalone client for use without the full framework.
+
+**GitHub**: https://github.com/LegionIO/lex-webhook
+**License**: MIT
+**Version**: 0.1.2
+
+## Architecture
+
+```
+Legion::Extensions::Webhook
+├── Runners/
+│   ├── Receive      # receive: parse body, verify HMAC signature, return payload
+│   ├── Verify       # verify: HMAC signature check; compute_signature: generate HMAC
+│   └── Endpoints    # register_endpoint, list_endpoints, remove_endpoint (in-memory registry)
+├── Helpers/
+│   └── Signature    # HMAC-SHA256 compute and verify (supports sha256/sha1 algorithms)
+└── Client           # Standalone client including all three runners
+```
+
+No explicit actors directory and no AMQP transport — this extension exposes its runners for framework subscription actors via auto-generation.
+
+## Gem Info
+
+| Field | Value |
+|-------|-------|
+| Gem name | `lex-webhook` |
+| Module | `Legion::Extensions::Webhook` |
+| Version | `0.1.2` |
+| Ruby | `>= 3.4` |
+| Runtime deps | legion sub-gems (cache, crypt, data, json, logging, settings, transport) |
+| License | MIT |
+
+## Runner Details
+
+### Receive (`Runners::Receive`)
+
+**`receive(path:, headers: {}, body: '', method: 'POST', secret: nil, **)`**
+- Finds the HMAC signature from headers (`x-hub-signature-256`, `x-hub-signature`, `x-signature`, `x-webhook-signature`)
+- If `secret:` present and signature header found, calls `Helpers::Signature.verify`
+- Parses body as JSON (symbolized keys) when Content-Type includes `json`, otherwise returns raw body
+- Returns `{ received: true, path:, method:, payload:, verified: }`
+
+### Verify (`Runners::Verify`)
+
+**`verify(secret:, signature:, payload:, algorithm: 'sha256', **)`**
+- Delegates to `Helpers::Signature.verify`
+- Returns `{ valid:, algorithm: }`
+
+**`compute_signature(secret:, payload:, algorithm: 'sha256', **)`**
+- Delegates to `Helpers::Signature.compute`
+- Returns `{ signature: }`
+
+### Endpoints (`Runners::Endpoints`)
+
+In-memory registry (per-process). Not persisted to DB.
+
+**`register_endpoint(path:, secret: nil, description: nil, **)`** — registers or updates an endpoint. Returns `{ registered:, updated:, path: }`.
+
+**`list_endpoints(**)`** — returns `{ endpoints: [...] }`.
+
+**`remove_endpoint(path:, **)`** — removes endpoint. Returns `{ removed:, path: }`.
+
+## Signature Helper
+
+`Helpers::Signature.compute(secret:, payload:, algorithm: 'sha256')` — returns `OpenSSL::HMAC.hexdigest` of `payload` using `secret`.
+
+`Helpers::Signature.verify(secret:, signature:, payload:, algorithm: 'sha256')` — compares computed HMAC with the provided signature using `OpenSSL.fixed_length_secure_compare` for timing-safe comparison. Strips algorithm prefix (`sha256=`) if present before comparing.
+
+## File Structure
+
+```
+lex-webhook/
+├── lex-webhook.gemspec
+├── Gemfile
+├── lib/
+│   └── legion/
+│       └── extensions/
+│           ├── webhook.rb                         # Entry point; requires all helpers/runners/client
+│           └── webhook/
+│               ├── version.rb
+│               ├── client.rb                      # Client class; includes all three runners
+│               ├── helpers/
+│               │   └── signature.rb              # HMAC compute + verify
+│               └── runners/
+│                   ├── receive.rb                 # Webhook reception + body parsing
+│                   ├── verify.rb                  # Signature verification + computation
+│                   └── endpoints.rb              # In-memory endpoint registry
+└── spec/
+    ├── spec_helper.rb
+    ├── client_spec.rb
+    └── legion/extensions/webhook/
+        ├── helpers/signature_spec.rb
+        └── runners/{receive,verify,endpoints}_spec.rb
+```
+
+## Testing
+
+```bash
+bundle install
+bundle exec rspec
+bundle exec rubocop
+```
+
+---
+
+**Maintained By**: Matthew Iverson (@Esity)

data/Gemfile

@@ -3,3 +3,5 @@
 source 'https://rubygems.org'
 
 gemspec
+
+gem 'rubocop-legion', '~> 0.1'

data/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2021 Esity
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

data/README.md

@@ -42,6 +42,24 @@ client.list_endpoints
 client.remove_endpoint(path: '/hooks/github')
 ```
 
+## Runners
+
+- **Receive** - Parse incoming webhook body, detect HMAC signature from headers, return `{ received:, path:, method:, payload:, verified: }`
+- **Verify** - Verify an HMAC signature against a secret and payload; compute a signature for outgoing use
+- **Endpoints** - In-memory endpoint registry: register, list, and remove webhook paths with associated secrets
+
+Signature headers checked (in order): `x-hub-signature-256`, `x-hub-signature`, `x-signature`, `x-webhook-signature`.
+
+## Requirements
+
+- Ruby >= 3.4
+- [LegionIO](https://github.com/LegionIO/LegionIO) framework
+
+## Related
+
+- [LegionIO](https://github.com/LegionIO/LegionIO) - Framework
+- [lex-github](https://github.com/LegionIO/lex-github) - GitHub integration that uses webhook-style event delivery
+
 ## License
 
 MIT

data/lib/legion/extensions/webhook/helpers/signature.rb

@@ -9,7 +9,7 @@ module Legion
         module Signature
           module_function
 
-          def verify(secret:, signature:, payload:, algorithm: 'sha256') # rubocop:disable Naming/PredicateMethod
+          def verify(secret:, signature:, payload:, algorithm: 'sha256')
             computed = compute(secret: secret, payload: payload, algorithm: algorithm)
             bytes_match?(computed, signature)
           end

data/lib/legion/extensions/webhook/runners/receive.rb

@@ -46,7 +46,7 @@ module Legion
             return Legion::JSON.load(body) if content_type.include?('json')
 
             body
-          rescue StandardError
+          rescue StandardError => _e
             body
           end
         end

data/lib/legion/extensions/webhook/version.rb

@@ -3,7 +3,7 @@
 module Legion
   module Extensions
     module Webhook
-      VERSION = '0.1.2'
+      VERSION = '0.1.3'
     end
   end
 end

data/lib/legion/extensions/webhook.rb

@@ -11,7 +11,7 @@ require 'legion/extensions/webhook/client'
 module Legion
   module Extensions
     module Webhook
-      extend Legion::Extensions::Core if Legion::Extensions.const_defined?(:Core)
+      extend Legion::Extensions::Core if Legion::Extensions.const_defined?(:Core, false)
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lex-webhook
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.1.3
 platform: ruby
 authors:
 - Esity
@@ -170,12 +170,16 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".github/CODEOWNERS"
+- ".github/dependabot.yml"
 - ".github/workflows/ci.yml"
 - ".gitignore"
 - ".rspec"
 - ".rubocop.yml"
 - CHANGELOG.md
+- CLAUDE.md
 - Gemfile
+- LICENSE
 - README.md
 - lex-webhook.gemspec
 - lib/legion/extensions/webhook.rb