hippo-memory 1.60.0 → 1.62.0

package/dist/connectors/github/webhook.js

@@ -1,3 +1,4 @@
+import { envGithubWebhookSecret, envGithubWebhookSecretPrevious } from '../../env.js';
 import { verifyGitHubSignature } from './signature.js';
 import { isGitHubWebhookEnvelope, isGitHubIssueEvent, isGitHubIssueCommentEvent, isGitHubPullRequestEvent, isGitHubPullRequestReviewCommentEvent, } from './types.js';
 import { ingestEvent as ingestGitHubEvent } from './ingest.js';
@@ -7,7 +8,6 @@ import { resolveTenantForGitHub } from './tenant-routing.js';
 import { computeDeletionKey as computeGitHubDeletionKey } from './signature.js';
 import { resolveTenantId } from '../../tenant.js';
 import { openHippoDb, closeHippoDb } from '../../db.js';
-import { adminActor } from '../../api.js';
 import { HttpError, JSON_HEADERS, isHeaderString, readBody, sendJson, } from '../../http-util.js';
 /**
  * GitHub webhook receiver. Mirrors the Slack route shape but with
@@ -27,13 +27,13 @@ import { HttpError, JSON_HEADERS, isHeaderString, readBody, sendJson, } from '..
  */
 export async function handleGitHubEventsWebhook({ req, res, opts }) {
     const rawBody = await readBody(req);
-    const secret = process.env.GITHUB_WEBHOOK_SECRET;
+    const secret = envGithubWebhookSecret();
     if (!secret) {
         res.writeHead(404, JSON_HEADERS);
         res.end(JSON.stringify({ error: 'not found' }));
         return;
     }
-    const previousSecret = process.env.GITHUB_WEBHOOK_SECRET_PREVIOUS;
+    const previousSecret = envGithubWebhookSecretPrevious();
     const sigHdr = req.headers['x-hub-signature-256'];
     const eventHdr = req.headers['x-github-event'];
     const deliveryHdr = req.headers['x-github-delivery'];
@@ -51,158 +51,143 @@ export async function handleGitHubEventsWebhook({ req, res, opts }) {
     }
     // Signature OK from here on. Everything else is ACK-200; bad envelopes go
     // to the DLQ and a human can replay later.
-    // Cheap regex extraction of installation_id / repo for DLQ rows that fail
-    // to JSON.parse - gives operators something to triage.
-    const installationFromRaw = (() => {
-        const m = rawBody.match(/"installation"\s*:\s*\{[^}]*"id"\s*:\s*(\d+)/);
-        return m ? m[1] : null;
-    })();
-    const repoFromRaw = (() => {
-        const m = rawBody.match(/"full_name"\s*:\s*"([^"]+)"/);
-        return m ? m[1] : null;
-    })();
-    if (deliveryId === null) {
-        // Body was signed but caller omitted the audit header. Park.
-        const db = openHippoDb(opts.hippoRoot);
-        try {
-            writeToGitHubDlq(db, {
-                tenantId: resolveTenantId({}),
-                rawPayload: rawBody,
-                error: 'missing X-GitHub-Delivery header',
-                bucket: 'parse_error',
-                eventName,
-                deliveryId: null,
-                signature: sigStr,
-                installationId: installationFromRaw,
-                repoFullName: repoFromRaw,
-            });
-        }
-        finally {
-            closeHippoDb(db);
-        }
-        sendJson(res, 200, { ok: true, status: 'dlq' });
-        return;
-    }
-    // Ping fires once at hook creation. Don't ingest, don't DLQ - just pong.
-    if (eventName === 'ping') {
-        sendJson(res, 200, { pong: true });
-        return;
-    }
-    const ALLOWED_EVENTS = new Set([
-        'issues',
-        'issue_comment',
-        'pull_request',
-        'pull_request_review_comment',
-    ]);
-    if (eventName === null || !ALLOWED_EVENTS.has(eventName)) {
-        const db = openHippoDb(opts.hippoRoot);
-        try {
-            writeToGitHubDlq(db, {
-                tenantId: resolveTenantId({}),
-                rawPayload: rawBody,
-                error: `unhandled event: ${eventName ?? '(missing X-GitHub-Event)'}`,
-                bucket: 'unhandled',
-                eventName,
-                deliveryId,
-                signature: sigStr,
-                installationId: installationFromRaw,
-                repoFullName: repoFromRaw,
-            });
-        }
-        finally {
-            closeHippoDb(db);
-        }
-        sendJson(res, 200, { ok: true, status: 'dlq' });
-        return;
-    }
-    let body;
+    routeSignedDelivery({ hippoRoot: opts.hippoRoot, res, rawBody, eventName, deliveryId, signature: sigStr });
+}
+const ALLOWED_EVENTS = new Set([
+    'issues',
+    'issue_comment',
+    'pull_request',
+    'pull_request_review_comment',
+]);
+function parkInDlq(d, park) {
+    const db = openHippoDb(d.hippoRoot);
     try {
-        body = JSON.parse(rawBody);
+        writeToGitHubDlq(db, {
+            tenantId: park.tenantId,
+            rawPayload: d.rawBody,
+            error: park.error,
+            bucket: park.bucket,
+            eventName: d.eventName,
+            deliveryId: d.deliveryId,
+            signature: d.signature,
+            installationId: park.installationId,
+            repoFullName: park.repoFullName,
+        });
     }
-    catch {
-        const db = openHippoDb(opts.hippoRoot);
-        try {
-            writeToGitHubDlq(db, {
-                tenantId: resolveTenantId({}),
-                rawPayload: rawBody,
-                error: 'invalid JSON',
-                bucket: 'parse_error',
-                eventName,
-                deliveryId,
-                signature: sigStr,
-                installationId: installationFromRaw,
-                repoFullName: repoFromRaw,
-            });
-        }
-        finally {
-            closeHippoDb(db);
-        }
-        sendJson(res, 200, { ok: true, status: 'dlq' });
-        return;
+    finally {
+        closeHippoDb(db);
     }
-    if (body === undefined || !isGitHubWebhookEnvelope(body)) {
-        const db = openHippoDb(opts.hippoRoot);
-        try {
-            writeToGitHubDlq(db, {
-                tenantId: resolveTenantId({}),
-                rawPayload: rawBody,
-                error: 'not a GitHub webhook envelope',
-                bucket: 'parse_error',
-                eventName,
-                deliveryId,
-                signature: sigStr,
-                installationId: installationFromRaw,
-                repoFullName: repoFromRaw,
-            });
-        }
-        finally {
-            closeHippoDb(db);
-        }
-        sendJson(res, 200, { ok: true, status: 'dlq' });
+    sendJson(d.res, 200, { ok: true, status: 'dlq' });
+}
+function routeSignedDelivery(d) {
+    const body = parseEnvelopeOrPark(d);
+    if (body === null || d.deliveryId === null)
         return;
-    }
-    const installationId = body.installation?.id != null ? String(body.installation.id) : null;
-    const repoFullName = body.repository?.full_name ?? null;
+    const routing = {
+        installationId: body.installation?.id != null ? String(body.installation.id) : null,
+        repoFullName: body.repository?.full_name ?? null,
+    };
     // Tenant resolution. Fail closed on multi-tenant installs with unknown
     // routing - same policy as Slack.
     let resolvedTenant;
     {
-        const db = openHippoDb(opts.hippoRoot);
+        const db = openHippoDb(d.hippoRoot);
         try {
-            resolvedTenant = resolveTenantForGitHub(db, {
-                installationId,
-                repoFullName,
-            });
+            resolvedTenant = resolveTenantForGitHub(db, routing);
         }
         finally {
             closeHippoDb(db);
         }
     }
     if (resolvedTenant === null) {
-        const db = openHippoDb(opts.hippoRoot);
-        try {
-            writeToGitHubDlq(db, {
-                tenantId: null,
-                rawPayload: rawBody,
-                error: `unroutable: installation_id=${installationId ?? '(none)'} repo=${repoFullName ?? '(none)'}`,
-                bucket: 'unroutable',
-                eventName,
-                deliveryId,
-                signature: sigStr,
-                installationId,
-                repoFullName,
-            });
-        }
-        finally {
-            closeHippoDb(db);
-        }
-        sendJson(res, 200, { ok: true, status: 'dlq' });
+        parkInDlq(d, {
+            ...routing,
+            tenantId: null,
+            error: `unroutable: installation_id=${routing.installationId ?? '(none)'} repo=${routing.repoFullName ?? '(none)'}`,
+            bucket: 'unroutable',
+        });
         return;
     }
     const ctx = {
-        hippoRoot: opts.hippoRoot,
+        hippoRoot: d.hippoRoot,
+        tenantId: resolvedTenant,
+        actor: { subject: 'connector:github', role: 'admin' },
+    };
+    if (dispatchGitHubEvent(d, ctx, body, d.deliveryId, routing))
+        return;
+    // Header allow-listed but body shape didn't satisfy the matching guard.
+    parkInDlq(d, {
+        ...routing,
         tenantId: resolvedTenant,
-        actor: adminActor('connector:github'),
+        error: `body shape did not match X-GitHub-Event=${d.eventName}`,
+        bucket: 'parse_error',
+    });
+}
+/** Answers ping and parks every unusable body; returns the envelope only when ingest should go on. */
+function parseEnvelopeOrPark(d) {
+    // Cheap regex extraction of installation_id / repo for DLQ rows that fail
+    // to JSON.parse - gives operators something to triage.
+    const installationFromRaw = (() => {
+        const m = d.rawBody.match(/"installation"\s*:\s*\{[^}]*"id"\s*:\s*(\d+)/);
+        return m ? m[1] : null;
+    })();
+    const repoFromRaw = (() => {
+        const m = d.rawBody.match(/"full_name"\s*:\s*"([^"]+)"/);
+        return m ? m[1] : null;
+    })();
+    const parkRaw = (error, bucket) => {
+        parkInDlq(d, {
+            tenantId: resolveTenantId({}),
+            error,
+            bucket,
+            installationId: installationFromRaw,
+            repoFullName: repoFromRaw,
+        });
+        return null;
+    };
+    // Body was signed but caller omitted the audit header. Park.
+    if (d.deliveryId === null)
+        return parkRaw('missing X-GitHub-Delivery header', 'parse_error');
+    // Ping fires once at hook creation. Don't ingest, don't DLQ - just pong.
+    if (d.eventName === 'ping') {
+        sendJson(d.res, 200, { pong: true });
+        return null;
+    }
+    if (d.eventName === null || !ALLOWED_EVENTS.has(d.eventName)) {
+        return parkRaw(`unhandled event: ${d.eventName ?? '(missing X-GitHub-Event)'}`, 'unhandled');
+    }
+    let body;
+    try {
+        body = JSON.parse(d.rawBody);
+    }
+    catch {
+        return parkRaw('invalid JSON', 'parse_error');
+    }
+    if (body === undefined || !isGitHubWebhookEnvelope(body)) {
+        return parkRaw('not a GitHub webhook envelope', 'parse_error');
+    }
+    return body;
+}
+/** Ingests, archives or parks by event header; false when no guard matched the body. */
+function dispatchGitHubEvent(d, ctx, body, deliveryId, routing) {
+    const { res, rawBody, eventName } = d;
+    const ingest = (event) => {
+        const r = ingestGitHubEvent(ctx, { event, rawBody, deliveryId });
+        sendJson(res, 200, { ok: true, status: r.status, memoryId: r.memoryId });
+        return true;
+    };
+    const archiveComment = (event, artifactRef, updatedAt) => {
+        // The "deleted:" key namespace keeps this from colliding with the ingest key for the
+        // same artifact; a shared key would make hasSeenKey skip the archive.
+        const idempotencyKey = computeGitHubDeletionKey(artifactRef, updatedAt);
+        const r = handleGitHubCommentDeleted(ctx, {
+            artifactRef,
+            idempotencyKey,
+            deliveryId,
+            eventName: event,
+        });
+        sendJson(res, 200, { ok: true, status: r.status, archivedCount: r.archivedCount });
+        return true;
     };
     // Dispatch by event header. Type guards cross-check the body shape against
     // the header so a payload of one event type cannot satisfy another's guard.
@@ -211,57 +196,26 @@ export async function handleGitHubEventsWebhook({ req, res, opts }) {
             // GitHub does fire issues.deleted (admin-initiated). Don't archive - V1
             // policy is to log and let an operator decide. Archive could lose the
             // memory if the issue is being moved between accounts.
-            const db = openHippoDb(opts.hippoRoot);
-            try {
-                writeToGitHubDlq(db, {
-                    tenantId: resolvedTenant,
-                    rawPayload: rawBody,
-                    error: 'issues.deleted requires manual review',
-                    bucket: 'unhandled',
-                    eventName,
-                    deliveryId,
-                    signature: sigStr,
-                    installationId,
-                    repoFullName,
-                });
-            }
-            finally {
-                closeHippoDb(db);
-            }
-            sendJson(res, 200, { ok: true, status: 'dlq' });
-            return;
+            parkInDlq(d, {
+                ...routing,
+                tenantId: ctx.tenantId,
+                error: 'issues.deleted requires manual review',
+                bucket: 'unhandled',
+            });
+            return true;
         }
-        const ingestInput = { eventName: 'issues', payload: body };
-        const r = ingestGitHubEvent(ctx, { event: ingestInput, rawBody, deliveryId });
-        sendJson(res, 200, { ok: true, status: r.status, memoryId: r.memoryId });
-        return;
+        return ingest({ eventName: 'issues', payload: body });
     }
     if (eventName === 'issue_comment' && isGitHubIssueCommentEvent(body, 'issue_comment')) {
         if (body.action === 'deleted') {
             const repo = body.repository?.full_name ?? '';
             const artifactRef = `github://${repo}/issue/${body.issue.number}/comment/${body.comment.id}`;
-            // The "deleted:" key namespace keeps this from colliding with the ingest key for the
-            // same artifact; a shared key would make hasSeenKey skip the archive.
-            const idempotencyKey = computeGitHubDeletionKey(artifactRef, body.comment.updated_at ?? null);
-            const r = handleGitHubCommentDeleted(ctx, {
-                artifactRef,
-                idempotencyKey,
-                deliveryId,
-                eventName,
-            });
-            sendJson(res, 200, { ok: true, status: r.status, archivedCount: r.archivedCount });
-            return;
+            return archiveComment(eventName, artifactRef, body.comment.updated_at ?? null);
         }
-        const ingestInput = { eventName: 'issue_comment', payload: body };
-        const r = ingestGitHubEvent(ctx, { event: ingestInput, rawBody, deliveryId });
-        sendJson(res, 200, { ok: true, status: r.status, memoryId: r.memoryId });
-        return;
+        return ingest({ eventName: 'issue_comment', payload: body });
     }
     if (eventName === 'pull_request' && isGitHubPullRequestEvent(body, 'pull_request')) {
-        const ingestInput = { eventName: 'pull_request', payload: body };
-        const r = ingestGitHubEvent(ctx, { event: ingestInput, rawBody, deliveryId });
-        sendJson(res, 200, { ok: true, status: r.status, memoryId: r.memoryId });
-        return;
+        return ingest({ eventName: 'pull_request', payload: body });
     }
     if (eventName === 'pull_request_review_comment' &&
         isGitHubPullRequestReviewCommentEvent(body, 'pull_request_review_comment')) {
@@ -269,45 +223,10 @@ export async function handleGitHubEventsWebhook({ req, res, opts }) {
             const repo = body.repository?.full_name ?? '';
             const artifactRef = `github://${repo}/pull/${body.pull_request.number}/review_comment/${body.comment.id}`;
             // Same "deleted:" key namespace as the issue_comment branch above.
-            const idempotencyKey = computeGitHubDeletionKey(artifactRef, body.comment.updated_at ?? null);
-            const r = handleGitHubCommentDeleted(ctx, {
-                artifactRef,
-                idempotencyKey,
-                deliveryId,
-                eventName,
-            });
-            sendJson(res, 200, { ok: true, status: r.status, archivedCount: r.archivedCount });
-            return;
+            return archiveComment(eventName, artifactRef, body.comment.updated_at ?? null);
         }
-        const ingestInput = {
-            eventName: 'pull_request_review_comment',
-            payload: body,
-        };
-        const r = ingestGitHubEvent(ctx, { event: ingestInput, rawBody, deliveryId });
-        sendJson(res, 200, { ok: true, status: r.status, memoryId: r.memoryId });
-        return;
-    }
-    // Header allow-listed but body shape didn't satisfy the matching guard.
-    {
-        const db = openHippoDb(opts.hippoRoot);
-        try {
-            writeToGitHubDlq(db, {
-                tenantId: resolvedTenant,
-                rawPayload: rawBody,
-                error: `body shape did not match X-GitHub-Event=${eventName}`,
-                bucket: 'parse_error',
-                eventName,
-                deliveryId,
-                signature: sigStr,
-                installationId,
-                repoFullName,
-            });
-        }
-        finally {
-            closeHippoDb(db);
-        }
-        sendJson(res, 200, { ok: true, status: 'dlq' });
-        return;
+        return ingest({ eventName: 'pull_request_review_comment', payload: body });
     }
+    return false;
 }
 //# sourceMappingURL=webhook.js.map

package/dist/connectors/slack/dlq.js

@@ -93,35 +93,9 @@ export function replayDlqEntry(ctx, id, opts = {}) {
     }
     // Signature verification (current secret, not previous).
     if (!opts.force) {
-        if (!row.signature || !row.slackTimestamp) {
-            return {
-                ok: false,
-                status: 'sig_missing',
-                memoryId: null,
-                retryCount: row.retryCount,
-                reason: 'row has no signature/timestamp (legacy, or redacted before storing); pass --force to replay',
-            };
-        }
-        if (opts.signingSecret) {
-            const ok = verifySlackSignature({
-                rawBody: row.rawPayload,
-                signature: row.signature,
-                timestamp: row.slackTimestamp,
-                signingSecret: opts.signingSecret,
-                now: opts.now,
-                // Replays happen long after the fact — give them a wider skew unless overridden.
-                skewSeconds: opts.skewSeconds ?? 60 * 60 * 24 * 365,
-            });
-            if (!ok) {
-                return {
-                    ok: false,
-                    status: 'sig_fail',
-                    memoryId: null,
-                    retryCount: row.retryCount,
-                    reason: 'signature did not verify against current SLACK_SIGNING_SECRET; pass --force to replay anyway',
-                };
-            }
-        }
+        const sigFailure = checkReplaySignature(row, opts);
+        if (sigFailure)
+            return sigFailure;
     }
     // Parse + dispatch.
     let parsed;
@@ -129,24 +103,10 @@ export function replayDlqEntry(ctx, id, opts = {}) {
         parsed = JSON.parse(row.rawPayload);
     }
     catch (e) {
-        bumpRetryCount(ctx.hippoRoot, id);
-        return {
-            ok: false,
-            status: 'parse_error',
-            memoryId: null,
-            retryCount: row.retryCount + 1,
-            reason: `still unparseable: ${e instanceof Error ? e.message : String(e)}`,
-        };
+        return failAndBump(ctx.hippoRoot, row, 'parse_error', `still unparseable: ${e instanceof Error ? e.message : String(e)}`);
     }
     if (!isSlackEventEnvelope(parsed)) {
-        bumpRetryCount(ctx.hippoRoot, id);
-        return {
-            ok: false,
-            status: 'unhandled',
-            memoryId: null,
-            retryCount: row.retryCount + 1,
-            reason: 'not an event_callback envelope',
-        };
+        return failAndBump(ctx.hippoRoot, row, 'unhandled', 'not an event_callback envelope');
     }
     // Resolve tenant against current state. If still unroutable, bail.
     const db2 = openHippoDb(ctx.hippoRoot);
@@ -158,31 +118,59 @@ export function replayDlqEntry(ctx, id, opts = {}) {
         closeHippoDb(db2);
     }
     if (!tenant) {
-        bumpRetryCount(ctx.hippoRoot, id);
-        return {
-            ok: false,
-            status: 'unroutable',
-            memoryId: null,
-            retryCount: row.retryCount + 1,
-            reason: `team_id ${parsed.team_id} still unroutable`,
-        };
+        return failAndBump(ctx.hippoRoot, row, 'unroutable', `team_id ${parsed.team_id} still unroutable`);
     }
     const replayCtx = {
         hippoRoot: ctx.hippoRoot,
         tenantId: tenant,
         actor: adminActor('connector:slack:replay'),
     };
-    const inner = parsed.event;
-    if (!isSlackMessageEvent(inner)) {
-        bumpRetryCount(ctx.hippoRoot, id);
+    return dispatchReplay(replayCtx, row, parsed);
+}
+/** The failure result when the row cannot pass the signature gate, else null; never bumps the count. */
+function checkReplaySignature(row, opts) {
+    if (!row.signature || !row.slackTimestamp) {
         return {
             ok: false,
-            status: 'unhandled',
+            status: 'sig_missing',
             memoryId: null,
-            retryCount: row.retryCount + 1,
-            reason: `unhandled inner event type`,
+            retryCount: row.retryCount,
+            reason: 'row has no signature/timestamp (legacy, or redacted before storing); pass --force to replay',
         };
     }
+    if (opts.signingSecret) {
+        const ok = verifySlackSignature({
+            rawBody: row.rawPayload,
+            signature: row.signature,
+            timestamp: row.slackTimestamp,
+            signingSecret: opts.signingSecret,
+            now: opts.now,
+            // Replays happen long after the fact — give them a wider skew unless overridden.
+            skewSeconds: opts.skewSeconds ?? 60 * 60 * 24 * 365,
+        });
+        if (!ok) {
+            return {
+                ok: false,
+                status: 'sig_fail',
+                memoryId: null,
+                retryCount: row.retryCount,
+                reason: 'signature did not verify against current SLACK_SIGNING_SECRET; pass --force to replay anyway',
+            };
+        }
+    }
+    return null;
+}
+function failAndBump(hippoRoot, row, status, reason) {
+    bumpRetryCount(hippoRoot, row.id);
+    return { ok: false, status, memoryId: null, retryCount: row.retryCount + 1, reason };
+}
+function dispatchReplay(replayCtx, row, parsed) {
+    const { hippoRoot } = replayCtx;
+    const id = row.id;
+    const inner = parsed.event;
+    if (!isSlackMessageEvent(inner)) {
+        return failAndBump(hippoRoot, row, 'unhandled', `unhandled inner event type`);
+    }
     if (inner.subtype === 'message_deleted' && inner.deleted_ts) {
         const r = handleMessageDeleted(replayCtx, {
             teamId: parsed.team_id,
@@ -190,7 +178,7 @@ export function replayDlqEntry(ctx, id, opts = {}) {
             deletedTs: inner.deleted_ts,
             eventId: parsed.event_id,
         });
-        markRetried(ctx.hippoRoot, id);
+        markRetried(hippoRoot, id);
         return { ok: true, status: r.status, memoryId: r.memoryId, retryCount: row.retryCount + 1 };
     }
     const result = ingestMessage(replayCtx, {
@@ -204,7 +192,7 @@ export function replayDlqEntry(ctx, id, opts = {}) {
         message: inner,
         eventId: parsed.event_id,
     });
-    markRetried(ctx.hippoRoot, id);
+    markRetried(hippoRoot, id);
     return { ok: true, status: result.status, memoryId: result.memoryId, retryCount: row.retryCount + 1 };
 }
 function markRetried(hippoRoot, id) {