@shipfox/api-integration-github 4.0.0 → 6.0.0

package/src/presentation/routes/install.test.ts

@@ -15,12 +15,7 @@ import type {ConnectGithubInstallationInput} from '#core/install.js';
 import {verifyGithubInstallState} from '#core/state.js';
 import {createGithubIntegrationProvider} from '#index.js';
 
-vi.mock('@shipfox/api-workspaces', () => ({
-  requireWorkspaceMembership: vi.fn(() => Promise.resolve()),
-}));
-
-const {requireWorkspaceMembership} = await import('@shipfox/api-workspaces');
-const requireWorkspaceMembershipMock = vi.mocked(requireWorkspaceMembership);
+const requireWorkspaceMembershipMock = vi.fn(() => Promise.resolve());
 let authenticatedMemberships: UserContextMembership[] = [];
 
 const fakeUserAuth: AuthMethod = {
@@ -111,6 +106,7 @@ async function createTestApp(options: CreateTestAppOptions = {}): Promise<Fastif
     publishSourcePush: vi.fn(() => Promise.resolve({published: false})),
     recordDeliveryOnly: vi.fn(() => Promise.resolve()),
     getIntegrationConnectionById: vi.fn(() => Promise.resolve(undefined)),
+    requireActiveWorkspaceMembership: requireWorkspaceMembershipMock,
   });
   const app = await createApp({
     auth: [fakeUserAuth],

package/src/presentation/routes/install.ts

@@ -6,7 +6,6 @@ import {
   githubCallbackQuerySchema,
   githubCallbackResponseSchema,
 } from '@shipfox/api-integration-github-dto';
-import {requireWorkspaceMembership} from '@shipfox/api-workspaces';
 import {defineRoute, type RouteGroup} from '@shipfox/node-fastify';
 import type {GithubApiClient} from '#api/client.js';
 import {config} from '#config.js';
@@ -23,12 +22,18 @@ export interface CreateGithubIntegrationRoutesOptions {
   connectGithubInstallation: (
     input: ConnectGithubInstallationInput,
   ) => Promise<IntegrationConnection<'github'>>;
+  requireActiveWorkspaceMembership?: (input: {
+    workspaceId: string;
+    userId: string;
+    memberships: ReadonlyArray<import('@shipfox/api-auth-context').UserContextMembership>;
+  }) => Promise<unknown>;
 }
 
 export function createGithubIntegrationRoutes({
   github,
   getExistingGithubConnection,
   connectGithubInstallation,
+  requireActiveWorkspaceMembership,
 }: CreateGithubIntegrationRoutesOptions): RouteGroup {
   const createInstallRoute = defineRoute({
     method: 'POST',
@@ -77,7 +82,8 @@ export function createGithubIntegrationRoutes({
         state: request.query.state,
         sessionUserId: actor.userId,
         sessionMemberships: actor.memberships,
-        requireWorkspaceMembership,
+        requireWorkspaceMembership:
+          requireActiveWorkspaceMembership ?? unavailableWorkspaceMembershipCheck,
         getExistingGithubConnection,
         connectGithubInstallation,
       });
@@ -91,3 +97,11 @@ export function createGithubIntegrationRoutes({
     routes: [createInstallRoute, callbackApiRoute],
   };
 }
+
+function unavailableWorkspaceMembershipCheck(_input: {
+  workspaceId: string;
+  userId: string;
+  memberships: ReadonlyArray<import('@shipfox/api-auth-context').UserContextMembership>;
+}): Promise<never> {
+  return Promise.reject(new Error('Workspaces inter-module client is not configured'));
+}

package/src/presentation/routes/webhooks.ts

@@ -1,21 +1,28 @@
-import {Buffer} from 'node:buffer';
-import {Webhooks} from '@octokit/webhooks';
+import {randomUUID} from 'node:crypto';
 import type {
   GetIntegrationConnectionByIdFn,
   PublishIntegrationEventReceivedFn,
   PublishSourcePushFn,
   RecordDeliveryOnlyFn,
+  StoredWebhookRequest,
+  WebhookProcessingResult,
 } from '@shipfox/api-integration-core-dto';
 import {
+  createStoredWebhookRequest,
+  WEBHOOK_MAX_RAW_BODY_BYTES,
+} from '@shipfox/api-integration-core-dto';
+import {
+  ClientError,
   defineRoute,
   type RouteGroup,
   rawBodyPlugin,
   WEBHOOK_BODY_LIMIT,
 } from '@shipfox/node-fastify';
-import {logger} from '@shipfox/node-opentelemetry';
 import type {NodePgDatabase} from 'drizzle-orm/node-postgres';
-import {config} from '#config.js';
-import {handleGithubEvent} from '#core/webhook.js';
+import {
+  createGithubWebhookProcessor,
+  type GithubWebhookProcessor,
+} from '#core/webhook-processor.js';
 
 const SIGNATURE_HEADER = 'x-hub-signature-256';
 const EVENT_HEADER = 'x-github-event';
@@ -30,10 +37,11 @@ export interface CreateGithubWebhookRoutesOptions {
   deleteInstallationTokenSecret?:
     | ((params: {workspaceId: string; installationId: number}) => Promise<unknown>)
     | undefined;
+  processor?: GithubWebhookProcessor | undefined;
 }
 
 export function createGithubWebhookRoutes(options: CreateGithubWebhookRoutesOptions): RouteGroup {
-  const webhooks = new Webhooks({secret: config.GITHUB_APP_WEBHOOK_SECRET});
+  const processor = options.processor ?? createGithubWebhookProcessor(options);
 
   const pushRoute = defineRoute({
     method: 'POST',
@@ -59,50 +67,18 @@ export function createGithubWebhookRoutes(options: CreateGithubWebhookRoutesOpti
         return {error: 'missing X-GitHub-Event header'};
       }
 
-      const body = request.body;
-      if (!Buffer.isBuffer(body)) {
+      if (!(request.body instanceof Uint8Array)) {
         reply.code(400);
         return {error: 'expected raw JSON body'};
       }
-      const rawBody = body.toString('utf8');
-
-      let verified: boolean;
-      try {
-        verified = await webhooks.verify(rawBody, signature);
-      } catch (error) {
-        logger().warn({deliveryId, err: error}, 'github webhook signature verification threw');
-        verified = false;
-      }
-      if (!verified) {
-        reply.code(401);
-        return {error: 'invalid signature'};
-      }
-
-      let parsedJson: unknown;
-      try {
-        parsedJson = JSON.parse(rawBody);
-      } catch (error) {
-        logger().warn({deliveryId, err: error}, 'github webhook payload JSON parse failed');
-        reply.code(400);
-        return {error: 'malformed JSON'};
-      }
-
-      await options.coreDb().transaction(async (tx) => {
-        await handleGithubEvent({
-          tx,
-          deliveryId,
-          event,
-          payload: parsedJson,
-          publishIntegrationEventReceived: options.publishIntegrationEventReceived,
-          publishSourcePush: options.publishSourcePush,
-          recordDeliveryOnly: options.recordDeliveryOnly,
-          getIntegrationConnectionById: options.getIntegrationConnectionById,
-          deleteInstallationTokenSecret: options.deleteInstallationTokenSecret,
-        });
-      });
-
-      reply.code(204);
-      return null;
+      const result = await processor.process(
+        createGithubStoredWebhookRequest({
+          body: request.body,
+          headers: request.headers,
+          rawQueryString: request.raw.url?.split('?')[1] ?? '',
+        }),
+      );
+      return sendGithubWebhookResponse(reply, result);
     },
   });
 
@@ -113,3 +89,61 @@ export function createGithubWebhookRoutes(options: CreateGithubWebhookRoutesOpti
     routes: [pushRoute],
   };
 }
+
+function createGithubStoredWebhookRequest(input: {
+  body: Uint8Array;
+  headers: Record<string, string | string[] | undefined>;
+  rawQueryString: string;
+}): StoredWebhookRequest {
+  if (input.body.byteLength > WEBHOOK_MAX_RAW_BODY_BYTES) {
+    throw new ClientError('Webhook request body is too large', 'body-too-large', {status: 413});
+  }
+  try {
+    return createStoredWebhookRequest({
+      requestId: randomUUID(),
+      routeId: 'github',
+      receivedAt: new Date().toISOString(),
+      rawQueryString: input.rawQueryString,
+      headers: githubWebhookHeaders(input.headers),
+      body: input.body,
+    });
+  } catch (error) {
+    throw new ClientError('Webhook request metadata is invalid', 'invalid-webhook-request', {
+      cause: error,
+    });
+  }
+}
+
+function githubWebhookHeaders(headers: Record<string, string | string[] | undefined>) {
+  return Object.fromEntries(
+    ['content-type', DELIVERY_HEADER, EVENT_HEADER, SIGNATURE_HEADER].flatMap((name) => {
+      const value = headers[name];
+      return typeof value === 'string' ? [[name, value]] : [];
+    }),
+  );
+}
+
+function sendGithubWebhookResponse(
+  reply: {code(statusCode: number): void},
+  result: WebhookProcessingResult,
+) {
+  if (result.outcome !== 'discarded') {
+    reply.code(204);
+    return null;
+  }
+
+  switch (result.reason) {
+    case 'invalid_signature':
+      reply.code(401);
+      return {error: 'invalid signature'};
+    case 'malformed_payload':
+      reply.code(400);
+      return {error: 'malformed JSON'};
+    case 'connection_unavailable':
+    case 'missing_required_input':
+    case 'stale_at_receipt':
+    case 'unsupported_event':
+      reply.code(204);
+      return null;
+  }
+}