svc-infra 0.1.597__tar.gz → 0.1.598__tar.gz

{svc_infra-0.1.597 → svc_infra-0.1.598}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: svc-infra
-Version: 0.1.597
+Version: 0.1.598
 Summary: Infrastructure for building and deploying prod-ready services
 License: MIT
 Keywords: fastapi,sqlalchemy,alembic,auth,infra,async,pydantic

{svc_infra-0.1.597 → svc_infra-0.1.598}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "svc-infra"
-version = "0.1.597"
+version = "0.1.598"
 description = "Infrastructure for building and deploying prod-ready services"
 authors = ["Ali Khatami <aliikhatami94@gmail.com>"]
 license = "MIT"
@@ -125,6 +125,7 @@ markers = [
     "ratelimit: Rate limiting and abuse protection tests",
     "concurrency: Idempotency and concurrency control tests",
     "jobs: Background jobs and scheduling tests",
+    "webhooks: Webhooks framework tests",
 ]
 filterwarnings = [
     "ignore:The `route` decorator is deprecated:DeprecationWarning:starlette.*",

{svc_infra-0.1.597 → svc_infra-0.1.598}/src/svc_infra/db/inbox.py

@@ -13,6 +13,10 @@ class InboxStore(Protocol):
         """Optional: remove expired keys, return number purged."""
         ...
 
+    def is_marked(self, key: str) -> bool:
+        """Return True if key is already marked (not expired), without modifying it."""
+        ...
+
 
 class InMemoryInboxStore:
     def __init__(self) -> None:
@@ -33,6 +37,11 @@ class InMemoryInboxStore:
             self._keys.pop(k, None)
         return len(to_del)
 
+    def is_marked(self, key: str) -> bool:
+        now = time.time()
+        exp = self._keys.get(key)
+        return bool(exp and exp > now)
+
 
 class SqlInboxStore:
     """Skeleton for a SQL-backed inbox store (dedupe table).
@@ -53,3 +62,6 @@ class SqlInboxStore:
 
     def purge_expired(self) -> int:  # pragma: no cover - skeleton
         raise NotImplementedError
+
+    def is_marked(self, key: str) -> bool:  # pragma: no cover - skeleton
+        raise NotImplementedError

svc_infra-0.1.598/src/svc_infra/jobs/builtins/webhook_delivery.py

@@ -0,0 +1,78 @@
+from __future__ import annotations
+
+import httpx
+
+from svc_infra.db.inbox import InboxStore
+from svc_infra.db.outbox import OutboxStore
+from svc_infra.jobs.queue import Job
+from svc_infra.webhooks.signing import sign
+
+
+def make_webhook_handler(
+    *,
+    outbox: OutboxStore,
+    inbox: InboxStore,
+    get_webhook_url_for_topic,
+    get_secret_for_topic,
+    header_name: str = "X-Signature",
+):
+    """Return an async job handler to deliver webhooks.
+
+    Expected job payload shape:
+    {"outbox_id": int, "topic": str, "payload": {...}}
+    """
+
+    async def _handler(job: Job) -> None:
+        data = job.payload or {}
+        outbox_id = data.get("outbox_id")
+        topic = data.get("topic")
+        payload = data.get("payload") or {}
+        if not outbox_id or not topic:
+            # Nothing we can do; ack to avoid poison loop
+            return
+        # dedupe marker key (marked after successful delivery)
+        key = f"webhook:{outbox_id}"
+        if inbox.is_marked(key):
+            # already delivered
+            outbox.mark_processed(int(outbox_id))
+            return
+        event = payload.get("event") if isinstance(payload, dict) else None
+        subscription = payload.get("subscription") if isinstance(payload, dict) else None
+        if event is not None and subscription is not None:
+            delivery_payload = event
+            url = subscription.get("url") or get_webhook_url_for_topic(topic)
+            secret = subscription.get("secret") or get_secret_for_topic(topic)
+            subscription_id = subscription.get("id")
+        else:
+            delivery_payload = payload
+            url = get_webhook_url_for_topic(topic)
+            secret = get_secret_for_topic(topic)
+            subscription_id = None
+        sig = sign(secret, delivery_payload)
+        headers = {
+            header_name: sig,
+            "X-Event-Id": str(outbox_id),
+            "X-Topic": str(topic),
+            "X-Attempt": str(job.attempts or 1),
+            "X-Signature-Alg": "hmac-sha256",
+            "X-Signature-Version": "v1",
+        }
+        if subscription_id:
+            headers["X-Webhook-Subscription"] = str(subscription_id)
+        # include event payload version if present
+        version = None
+        if isinstance(delivery_payload, dict):
+            version = delivery_payload.get("version")
+        if version is not None:
+            headers["X-Payload-Version"] = str(version)
+        async with httpx.AsyncClient(timeout=10) as client:
+            resp = await client.post(url, json=delivery_payload, headers=headers)
+            if 200 <= resp.status_code < 300:
+                # record delivery and mark processed
+                inbox.mark_if_new(key, ttl_seconds=24 * 3600)
+                outbox.mark_processed(int(outbox_id))
+                return
+            # allow retry on non-2xx: raise to trigger fail/backoff
+            raise RuntimeError(f"webhook delivery failed: {resp.status_code}")
+
+    return _handler

svc_infra-0.1.598/src/svc_infra/webhooks/__init__.py

@@ -0,0 +1 @@
+from __future__ import annotations

svc_infra-0.1.598/src/svc_infra/webhooks/fastapi.py

@@ -0,0 +1,37 @@
+from __future__ import annotations
+
+from typing import Callable, Sequence
+
+from fastapi import HTTPException, Request, status
+
+from .signing import verify, verify_any
+
+
+def require_signature(
+    secrets_provider: Callable[[], str | Sequence[str]],
+    *,
+    header_name: str = "X-Signature",
+):
+    async def _dep(request: Request):
+        sig = request.headers.get(header_name)
+        if not sig:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED, detail="missing signature"
+            )
+        try:
+            body = await request.json()
+        except Exception:
+            raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="invalid JSON body")
+        secrets = secrets_provider()
+        ok = False
+        if isinstance(secrets, str):
+            ok = verify(secrets, body, sig)
+        else:
+            ok = verify_any(secrets, body, sig)
+        if not ok:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED, detail="invalid signature"
+            )
+        return body
+
+    return _dep

svc_infra-0.1.598/src/svc_infra/webhooks/router.py

@@ -0,0 +1,55 @@
+from __future__ import annotations
+
+from typing import Any, Dict
+
+from fastapi import APIRouter, Depends, HTTPException
+
+from svc_infra.db.outbox import InMemoryOutboxStore, OutboxStore
+
+from .service import InMemoryWebhookSubscriptions, WebhookService
+
+router = APIRouter(prefix="/_webhooks", tags=["webhooks"])
+
+
+def get_outbox() -> OutboxStore:
+    # For now expose an in-memory default. Apps can override via DI.
+    # In production, provide a proper store through dependency override.
+    return InMemoryOutboxStore()
+
+
+def get_subs() -> InMemoryWebhookSubscriptions:
+    return InMemoryWebhookSubscriptions()
+
+
+def get_service(
+    outbox: OutboxStore = Depends(get_outbox),
+    subs: InMemoryWebhookSubscriptions = Depends(get_subs),
+) -> WebhookService:
+    return WebhookService(outbox=outbox, subs=subs)
+
+
+@router.post("/subscriptions")
+def add_subscription(
+    body: Dict[str, Any],
+    subs: InMemoryWebhookSubscriptions = Depends(get_subs),
+):
+    topic = body.get("topic")
+    url = body.get("url")
+    secret = body.get("secret")
+    if not topic or not url or not secret:
+        raise HTTPException(status_code=400, detail="Missing topic/url/secret")
+    subs.add(topic, url, secret)
+    return {"ok": True}
+
+
+@router.post("/test-fire")
+def test_fire(
+    body: Dict[str, Any],
+    svc: WebhookService = Depends(get_service),
+):
+    topic = body.get("topic")
+    payload = body.get("payload") or {}
+    if not topic:
+        raise HTTPException(status_code=400, detail="Missing topic")
+    outbox_id = svc.publish(topic, payload)
+    return {"ok": True, "outbox_id": outbox_id}

svc_infra-0.1.598/src/svc_infra/webhooks/service.py

@@ -0,0 +1,59 @@
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from typing import Dict, List
+
+from uuid import uuid4
+
+from svc_infra.db.outbox import OutboxStore
+
+
+@dataclass
+class WebhookSubscription:
+    topic: str
+    url: str
+    secret: str
+    id: str = field(default_factory=lambda: uuid4().hex)
+
+
+class InMemoryWebhookSubscriptions:
+    def __init__(self):
+        self._subs: Dict[str, List[WebhookSubscription]] = {}
+
+    def add(self, topic: str, url: str, secret: str) -> None:
+        self._subs.setdefault(topic, []).append(WebhookSubscription(topic, url, secret))
+
+    def get_for_topic(self, topic: str) -> List[WebhookSubscription]:
+        return list(self._subs.get(topic, []))
+
+
+class WebhookService:
+    def __init__(self, outbox: OutboxStore, subs: InMemoryWebhookSubscriptions):
+        self._outbox = outbox
+        self._subs = subs
+
+    def publish(self, topic: str, payload: Dict, *, version: int = 1) -> int:
+        created_at = datetime.now(timezone.utc).isoformat()
+        base_event = {
+            "topic": topic,
+            "payload": payload,
+            "version": version,
+            "created_at": created_at,
+        }
+        # For each subscription, enqueue an outbox message with subscriber identity
+        last_id = 0
+        for sub in self._subs.get_for_topic(topic):
+            event = dict(base_event)
+            msg_payload = {
+                "event": event,
+                "subscription": {
+                    "id": sub.id,
+                    "topic": sub.topic,
+                    "url": sub.url,
+                    "secret": sub.secret,
+                },
+            }
+            msg = self._outbox.enqueue(topic, msg_payload)
+            last_id = msg.id
+        return last_id

svc_infra-0.1.598/src/svc_infra/webhooks/signing.py

@@ -0,0 +1,30 @@
+from __future__ import annotations
+
+import hashlib
+import hmac
+import json
+from typing import Dict, Iterable
+
+
+def canonical_body(payload: Dict) -> bytes:
+    return json.dumps(payload, separators=(",", ":"), sort_keys=True).encode()
+
+
+def sign(secret: str, payload: Dict) -> str:
+    body = canonical_body(payload)
+    return hmac.new(secret.encode(), body, hashlib.sha256).hexdigest()
+
+
+def verify(secret: str, payload: Dict, signature: str) -> bool:
+    expected = sign(secret, payload)
+    try:
+        return hmac.compare_digest(expected, signature)
+    except Exception:
+        return False
+
+
+def verify_any(secrets: Iterable[str], payload: Dict, signature: str) -> bool:
+    for s in secrets:
+        if verify(s, payload, signature):
+            return True
+    return False

svc_infra-0.1.597/src/svc_infra/jobs/builtins/webhook_delivery.py

@@ -1,59 +0,0 @@
-from __future__ import annotations
-
-import hashlib
-import hmac
-import json
-from typing import Dict
-
-import httpx
-
-from svc_infra.db.inbox import InboxStore
-from svc_infra.db.outbox import OutboxStore
-from svc_infra.jobs.queue import Job
-
-
-def _compute_signature(secret: str, payload: Dict) -> str:
-    body = json.dumps(payload, separators=(",", ":")).encode()
-    return hmac.new(secret.encode(), body, hashlib.sha256).hexdigest()
-
-
-def make_webhook_handler(
-    *,
-    outbox: OutboxStore,
-    inbox: InboxStore,
-    get_webhook_url_for_topic,
-    get_secret_for_topic,
-    header_name: str = "X-Signature",
-):
-    """Return an async job handler to deliver webhooks.
-
-    Expected job payload shape:
-    {"outbox_id": int, "topic": str, "payload": {...}}
-    """
-
-    async def _handler(job: Job) -> None:
-        data = job.payload or {}
-        outbox_id = data.get("outbox_id")
-        topic = data.get("topic")
-        payload = data.get("payload") or {}
-        if not outbox_id or not topic:
-            # Nothing we can do; ack to avoid poison loop
-            return
-        # dedupe by outbox_id via inbox
-        key = f"webhook:{outbox_id}"
-        if not inbox.mark_if_new(key, ttl_seconds=24 * 3600):
-            # already delivered
-            outbox.mark_processed(int(outbox_id))
-            return
-        url = get_webhook_url_for_topic(topic)
-        secret = get_secret_for_topic(topic)
-        sig = _compute_signature(secret, payload)
-        async with httpx.AsyncClient(timeout=10) as client:
-            resp = await client.post(url, json=payload, headers={header_name: sig})
-            if 200 <= resp.status_code < 300:
-                outbox.mark_processed(int(outbox_id))
-                return
-            # allow retry on non-2xx: raise to trigger fail/backoff
-            raise RuntimeError(f"webhook delivery failed: {resp.status_code}")
-
-    return _handler