webgate 0.3.1__tar.gz → 0.3.2__tar.gz

{webgate-0.3.1 → webgate-0.3.2}/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## v0.3.2 (2026-04-15)
+
+### Features
+
+- **Webhook notifications** -- admin can register HTTPS endpoints that receive a JSON POST when significant events fire. Supported events: `user_login`, `user_login_failed`, `ssh_connect`, `sftp_upload`, `sftp_delete`, `server_added`, `server_deleted`. Each webhook can subscribe to all events (`*`) or a specific subset.
+- **HMAC-SHA256 signing** -- optional shared secret per webhook; the dispatcher signs the body and sends it as `X-Webgate-Signature: sha256=<hex>` so the receiver can verify authenticity.
+- **Test button + delivery telemetry** -- one-click test fire from the admin UI; each webhook row shows the last HTTP status and timestamp.
+
+### Details
+
+- New `Webhook` model + REST CRUD at `/api/webhooks` (admin-only)
+- New `webgate.webhooks.dispatcher.fire(event, data)` -- fire-and-forget, schedules HTTP delivery via `httpx`, never blocks the caller
+- Frontend: "Webhooks" button in the top toolbar (admin only) with full management modal
+- New base dependency: `httpx>=0.28.0` (used by the dispatcher)
+
+Verified end-to-end against a real HTTP echo receiver: `user_login`, `server_added` and a manual test all delivered with HTTP 200 and signature header.
+
+---
+
 ## v0.3.1 (2026-04-15)
 
 ### Fixed

{webgate-0.3.1 → webgate-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: webgate
-Version: 0.3.1
+Version: 0.3.2
 Summary: Self-hosted web application for remote server management via SSH terminal and SFTP file browser
 Project-URL: Homepage, https://github.com/kalexnolasco/webgate
 Project-URL: Documentation, https://kalexnolasco.github.io/webgate/
@@ -32,6 +32,7 @@ Requires-Dist: asyncssh>=2.18.0
 Requires-Dist: bcrypt>=4.2.0
 Requires-Dist: cryptography>=44.0.0
 Requires-Dist: fastapi>=0.115.0
+Requires-Dist: httpx>=0.28.0
 Requires-Dist: passlib[bcrypt]>=1.7.4
 Requires-Dist: pydantic-settings>=2.7.0
 Requires-Dist: pydantic>=2.10.0
@@ -471,6 +472,21 @@ When adding a server, pick another server from the **Jump Via** dropdown to tunn
 ### SSH command snippets
 
 Each user has a personal library of named commands. They appear as buttons in the terminal toolbar -- click to send `command + Enter`. Right-click to delete, `+` to create. Stored in the `snippets` table.
+
+### Webhooks
+
+Admins can register HTTPS endpoints that receive a JSON POST when events fire (`user_login`, `ssh_connect`, `server_added`, etc). Each webhook can subscribe to all events (`*`) or a specific subset.
+
+```json
+POST https://your-receiver.example.com/wh
+Content-Type: application/json
+X-Webgate-Signature: sha256=<hmac of body using your webhook's secret>
+
+{"event": "ssh_connect", "timestamp": "2026-04-15T18:03:18Z",
+ "data": {"user": "alice", "server": "prod-web-01", "host": "10.0.1.50:22"}}
+```
+
+Manage from the **Webhooks** button in the top toolbar (admin only). Last delivery status is shown next to each row.
 | `WEBGATE_LOG_LEVEL` | `info` | Log level |
 | `WEBGATE_SESSION_TIMEOUT` | `3600` | SSH session timeout (seconds) |
 | `WEBGATE_MAX_UPLOAD_SIZE` | `104857600` | Max upload size (100 MB) |

{webgate-0.3.1 → webgate-0.3.2}/README.md

@@ -424,6 +424,21 @@ When adding a server, pick another server from the **Jump Via** dropdown to tunn
 ### SSH command snippets
 
 Each user has a personal library of named commands. They appear as buttons in the terminal toolbar -- click to send `command + Enter`. Right-click to delete, `+` to create. Stored in the `snippets` table.
+
+### Webhooks
+
+Admins can register HTTPS endpoints that receive a JSON POST when events fire (`user_login`, `ssh_connect`, `server_added`, etc). Each webhook can subscribe to all events (`*`) or a specific subset.
+
+```json
+POST https://your-receiver.example.com/wh
+Content-Type: application/json
+X-Webgate-Signature: sha256=<hmac of body using your webhook's secret>
+
+{"event": "ssh_connect", "timestamp": "2026-04-15T18:03:18Z",
+ "data": {"user": "alice", "server": "prod-web-01", "host": "10.0.1.50:22"}}
+```
+
+Manage from the **Webhooks** button in the top toolbar (admin only). Last delivery status is shown next to each row.
 | `WEBGATE_LOG_LEVEL` | `info` | Log level |
 | `WEBGATE_SESSION_TIMEOUT` | `3600` | SSH session timeout (seconds) |
 | `WEBGATE_MAX_UPLOAD_SIZE` | `104857600` | Max upload size (100 MB) |

{webgate-0.3.1 → webgate-0.3.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "webgate"
-version = "0.3.1"
+version = "0.3.2"
 description = "Self-hosted web application for remote server management via SSH terminal and SFTP file browser"
 readme = "README.md"
 license = "MIT"
@@ -41,6 +41,7 @@ dependencies = [
     "pyotp>=2.9.0",
     "qrcode[pil]>=8.2",
     "asyncpg>=0.30.0",
+    "httpx>=0.28.0",
 ]
 
 [project.urls]

{webgate-0.3.1 → webgate-0.3.2}/src/webgate/app.py

@@ -20,6 +20,7 @@ from webgate.servers.monitor import server_monitor
 from webgate.servers.routes import router as servers_router
 from webgate.snippets.routes import router as snippets_router
 from webgate.terminal.routes import router as terminal_router
+from webgate.webhooks.routes import router as webhooks_router
 
 
 @asynccontextmanager
@@ -91,6 +92,7 @@ def create_app() -> FastAPI:
     app.include_router(terminal_router)
     app.include_router(files_router)
     app.include_router(snippets_router)
+    app.include_router(webhooks_router)
 
     app.mount("/", StaticFiles(directory=str(settings.static_dir), html=True), name="static")
 

{webgate-0.3.1 → webgate-0.3.2}/src/webgate/auth/routes.py

@@ -10,6 +10,7 @@ limiter = Limiter(key_func=get_remote_address)
 
 from webgate.audit.models import AuditOut
 from webgate.audit.service import get_audit_log, log_action
+from webgate.webhooks.dispatcher import fire as fire_webhook
 from webgate.auth.models import (
     ApiKeyCreate,
     ApiKeyCreated,
@@ -88,6 +89,10 @@ def _require_admin(user: UserOut) -> None:
 async def login(request: Request, body: UserLogin, session: SessionDep) -> LoginOut:
     user = await get_user_by_username(session, body.username)
     if not user or not verify_password(body.password, user.hashed_password):
+        await fire_webhook("user_login_failed", {
+            "username": body.username,
+            "ip": request.client.host if request.client else "",
+        })
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid credentials"
         )
@@ -111,6 +116,11 @@ async def login(request: Request, body: UserLogin, session: SessionDep) -> Login
         "login",
         ip_address=request.client.host if request.client else "",
     )
+    await fire_webhook("user_login", {
+        "username": user.username,
+        "user_id": user.id,
+        "ip": request.client.host if request.client else "",
+    })
     return LoginOut(access_token=token)
 
 

{webgate-0.3.1 → webgate-0.3.2}/src/webgate/files/routes.py

@@ -26,6 +26,7 @@ from webgate.files.pool import sftp_pool
 from webgate.files.sftp_service import SFTPClient, validate_path
 from webgate.servers.models import Server
 from webgate.servers.service import get_server, get_server_credentials, resolve_jump_creds
+from webgate.webhooks.dispatcher import fire as fire_webhook
 
 router = APIRouter(prefix="/api/files", tags=["files"])
 
@@ -199,6 +200,10 @@ async def upload_files(
                 data = await f.read()
                 await client.upload(dest, data)
                 uploaded.append(dest)
+            await fire_webhook("sftp_upload", {
+                "user": current_user.username, "server_id": server_id,
+                "paths": uploaded, "count": len(uploaded),
+            })
             return {"uploaded": uploaded, "count": len(uploaded)}
         except ValueError as e:
             raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e)) from e
@@ -256,6 +261,9 @@ async def delete_item(
             check_read_only(read_only)
             check_path_allowed(path, allowed_paths)
             await client.delete(path)
+            await fire_webhook("sftp_delete", {
+                "user": current_user.username, "server_id": server_id, "path": path,
+            })
             return {"path": validate_path(path), "status": "deleted"}
         except ValueError as e:
             raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e)) from e

{webgate-0.3.1 → webgate-0.3.2}/src/webgate/servers/routes.py

@@ -7,6 +7,7 @@ from webgate.auth.models import UserOut
 from webgate.auth.routes import get_current_user
 from webgate.db.engine import get_session
 from webgate.servers.models import ServerCreate, ServerImport, ServerOut, ServerUpdate
+from webgate.webhooks.dispatcher import fire as fire_webhook
 from webgate.servers.service import (
     create_server,
     delete_server,
@@ -57,6 +58,10 @@ async def create(
 ) -> ServerOut:
     _require_admin(current_user)
     server = await create_server(session, body, current_user.id)
+    await fire_webhook("server_added", {
+        "id": server.id, "name": server.name, "hostname": server.hostname,
+        "by": current_user.username,
+    })
     return server_to_out(server)
 
 
@@ -144,7 +149,9 @@ async def delete(
     server = await get_server(session, server_id, current_user.id, is_admin=True)
     if not server:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Server not found")
+    server_info = {"id": server.id, "name": server.name, "hostname": server.hostname}
     await delete_server(session, server)
+    await fire_webhook("server_deleted", {**server_info, "by": current_user.username})
 
 
 @router.post("/{server_id}/test")

{webgate-0.3.1 → webgate-0.3.2}/src/webgate/static/index.html

@@ -232,6 +232,7 @@ window._showToastImpl = function(message, type) {
             <button x-show="currentUser?.is_admin" @click="showServerModal=true;resetServerForm()" class="fz-btn" style="font-size:11px" title="New Server (Ctrl+N)">New Server</button>
             <button x-show="currentUser?.is_admin" @click="openUsersModal()" class="fz-btn" style="font-size:11px">Users</button>
             <button x-show="currentUser?.is_admin" @click="openAuditLog()" class="fz-btn" style="font-size:11px">Audit</button>
+            <button x-show="currentUser?.is_admin" @click="openWebhooksModal()" class="fz-btn" style="font-size:11px">Webhooks</button>
             <button @click="openApiKeysModal()" class="fz-btn" style="font-size:11px">Keys</button>
         </div>
         <div style="display:flex;align-items:center;gap:8px">
@@ -741,6 +742,59 @@ window._showToastImpl = function(message, type) {
     </div>
 </div>
 
+<!-- ======== WEBHOOKS MODAL ======== -->
+<div x-show="showWebhooksModal" class="fz-modal-bg" @click.self="showWebhooksModal=false">
+    <div class="fz-modal" style="width:720px" @click.stop>
+        <div class="fz-modal-title">Webhooks</div>
+        <div class="fz-modal-body" style="padding:0;max-height:50vh;overflow-y:auto">
+            <table style="width:100%;font-size:12px;border-collapse:collapse">
+                <thead style="position:sticky;top:0;background:var(--btn-bg)">
+                    <tr>
+                        <th style="padding:8px 12px;border-bottom:1px solid var(--border);color:var(--text-secondary);font-size:10px;text-transform:uppercase;text-align:left">Name</th>
+                        <th style="padding:8px 12px;border-bottom:1px solid var(--border);color:var(--text-secondary);font-size:10px;text-transform:uppercase;text-align:left">URL</th>
+                        <th style="padding:8px 12px;border-bottom:1px solid var(--border);color:var(--text-secondary);font-size:10px;text-transform:uppercase;text-align:left">Events</th>
+                        <th style="padding:8px 12px;border-bottom:1px solid var(--border);color:var(--text-secondary);font-size:10px;text-transform:uppercase;text-align:left">Last</th>
+                        <th style="padding:8px 12px;border-bottom:1px solid var(--border);color:var(--text-secondary);font-size:10px;text-transform:uppercase;width:120px"></th>
+                    </tr>
+                </thead>
+                <tbody>
+                    <template x-for="w in webhooks" :key="w.id">
+                        <tr style="border-bottom:1px solid var(--btn-bg)">
+                            <td style="padding:6px 12px;color:var(--text-primary);font-weight:500" x-text="w.name"></td>
+                            <td style="padding:6px 12px;font-family:'JetBrains Mono',monospace;color:var(--text-secondary);font-size:11px;max-width:200px;overflow:hidden;text-overflow:ellipsis" :title="w.url" x-text="w.url"></td>
+                            <td style="padding:6px 12px;color:var(--text-secondary);font-size:11px" x-text="w.events.join(', ')"></td>
+                            <td style="padding:6px 12px;color:var(--text-secondary);font-size:11px">
+                                <span x-show="w.last_status" :style="(w.last_status >= 200 && w.last_status < 300) ? 'color:var(--success)' : 'color:var(--danger)'" x-text="w.last_status + ' · ' + (w.last_fired_at ? new Date(w.last_fired_at).toLocaleString() : '')"></span>
+                                <span x-show="!w.last_status" style="color:var(--text-muted)">never fired</span>
+                            </td>
+                            <td style="padding:6px 12px;display:flex;gap:4px">
+                                <button @click="testWebhook(w)" class="fz-btn" style="font-size:10px;padding:1px 6px">Test</button>
+                                <button @click="confirmDeleteWebhook(w)" class="fz-btn fz-btn-danger" style="font-size:10px;padding:1px 6px">Del</button>
+                            </td>
+                        </tr>
+                    </template>
+                    <template x-if="webhooks.length === 0">
+                        <tr><td colspan="5" style="padding:16px;text-align:center;color:var(--text-muted);font-size:12px">No webhooks. Add one below.</td></tr>
+                    </template>
+                </tbody>
+            </table>
+        </div>
+        <div style="border-top:1px solid var(--border);padding:12px 16px;background:var(--bg-tertiary)">
+            <div style="font-size:12px;font-weight:600;margin-bottom:8px;color:var(--text-primary)">Add Webhook</div>
+            <form @submit.prevent="createWebhook()" style="display:grid;grid-template-columns:1fr 2fr 1fr;gap:6px;align-items:end">
+                <div><label style="font-size:10px;color:var(--text-secondary);font-weight:500">Name</label><input type="text" x-model="newWebhook.name" required placeholder="Slack" style="width:100%;font-size:12px;padding:5px 8px;border:1px solid var(--border);border-radius:6px;background:var(--bg-secondary);color:var(--text-primary)"></div>
+                <div><label style="font-size:10px;color:var(--text-secondary);font-weight:500">URL</label><input type="url" x-model="newWebhook.url" required placeholder="https://hooks.slack.com/..." style="width:100%;font-size:12px;padding:5px 8px;border:1px solid var(--border);border-radius:6px;background:var(--bg-secondary);color:var(--text-primary)"></div>
+                <div><label style="font-size:10px;color:var(--text-secondary);font-weight:500">Events</label><input type="text" x-model="newWebhook.events" placeholder="* (or ssh_connect,user_login)" style="width:100%;font-size:12px;padding:5px 8px;border:1px solid var(--border);border-radius:6px;background:var(--bg-secondary);color:var(--text-primary)"></div>
+                <div style="grid-column:span 2"><label style="font-size:10px;color:var(--text-secondary);font-weight:500">Secret (optional, for HMAC signing)</label><input type="text" x-model="newWebhook.secret" placeholder="leave empty to skip" style="width:100%;font-size:12px;padding:5px 8px;border:1px solid var(--border);border-radius:6px;background:var(--bg-secondary);color:var(--text-primary)"></div>
+                <button type="submit" class="fz-btn fz-btn-primary" style="font-size:12px">Add</button>
+            </form>
+        </div>
+        <div class="fz-modal-footer">
+            <button @click="showWebhooksModal=false" class="fz-btn">Close</button>
+        </div>
+    </div>
+</div>
+
 <!-- ======== EDIT GROUPS MODAL ======== -->
 <div x-show="showGroupsModal" class="fz-modal-bg" @click.self="showGroupsModal=false">
     <div class="fz-modal" style="width:400px" @click.stop>
@@ -846,6 +900,7 @@ function app() {
         editingUserObj: null, editingGroupsStr: '',
         showAuditModal: false, auditEntries: [],
         showApiKeysModal: false, apiKeys: [], newApiKeyName: '', createdApiKey: null,
+        showWebhooksModal: false, webhooks: [], newWebhook: { name: '', url: '', events: '*', secret: '' },
         view: 'dashboard',
         ssh: { host: '', port: 22, username: '', password: '' },
         servers: [], groups: [], selectedGroup: '', searchQuery: '',
@@ -1429,6 +1484,29 @@ function app() {
             if (!confirm(`Revoke API key "${k.name}"?`)) return;
             try { await this.apiCall(`/api/auth/api-keys/${k.id}`, { method: 'DELETE' }); this.showToast('API key revoked'); this.apiKeys = await this.apiCall('/api/auth/api-keys'); } catch (e) { this.showToast(e.message, 'error'); }
         },
+
+        // Webhooks
+        async openWebhooksModal() {
+            try { this.webhooks = await this.apiCall('/api/webhooks'); } catch (e) { this.showToast(e.message, 'error'); return; }
+            this.showWebhooksModal = true;
+        },
+        async createWebhook() {
+            const events = (this.newWebhook.events || '*').split(',').map(e => e.trim()).filter(Boolean);
+            const body = { name: this.newWebhook.name.trim(), url: this.newWebhook.url.trim(), events, secret: this.newWebhook.secret || '' };
+            try {
+                await this.apiCall('/api/webhooks', { method: 'POST', body: JSON.stringify(body) });
+                this.newWebhook = { name: '', url: '', events: '*', secret: '' };
+                this.webhooks = await this.apiCall('/api/webhooks');
+                this.showToast('Webhook added');
+            } catch (e) { this.showToast(e.message, 'error'); }
+        },
+        async confirmDeleteWebhook(w) {
+            if (!confirm(`Delete webhook "${w.name}"?`)) return;
+            try { await this.apiCall(`/api/webhooks/${w.id}`, { method: 'DELETE' }); this.webhooks = await this.apiCall('/api/webhooks'); this.showToast('Webhook deleted'); } catch (e) { this.showToast(e.message, 'error'); }
+        },
+        async testWebhook(w) {
+            try { await this.apiCall(`/api/webhooks/${w.id}/test`, { method: 'POST' }); this.showToast(`Test queued for "${w.name}"`); setTimeout(async () => { this.webhooks = await this.apiCall('/api/webhooks'); }, 1500); } catch (e) { this.showToast(e.message, 'error'); }
+        },
     };
 }
 </script>

{webgate-0.3.1 → webgate-0.3.2}/src/webgate/terminal/routes.py

@@ -13,6 +13,7 @@ from webgate.servers.service import (
     update_last_connected,
 )
 from webgate.terminal.ws_handler import authenticate_websocket, handle_terminal_ws
+from webgate.webhooks.dispatcher import fire as fire_webhook
 
 router = APIRouter(tags=["terminal"])
 
@@ -107,6 +108,10 @@ async def ws_terminal_server(ws: WebSocket, server_id: int) -> None:
 
         await update_last_connected(session, server)
         await log_action(user_out.id, user_out.username, "ssh_connect", f"{server.hostname}:{server.port}")
+        await fire_webhook("ssh_connect", {
+            "user": user_out.username, "server_id": server.id, "server": server.name,
+            "host": f"{server.hostname}:{server.port}", "via_jump": server.jump_via_id is not None,
+        })
 
     await handle_terminal_ws(
         ws,

webgate-0.3.2/src/webgate/webhooks/dispatcher.py

@@ -0,0 +1,74 @@
+"""Fire-and-forget webhook dispatcher.
+
+Webhooks are sent asynchronously without blocking the request that triggered
+them. Failures are logged and stored on the webhook row (last_status) but
+never propagate back to the caller.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import hashlib
+import hmac
+import json
+import logging
+from datetime import UTC, datetime
+from typing import Any
+
+import httpx
+from sqlalchemy import select
+
+from webgate.db.engine import async_session_factory
+from webgate.webhooks.models import Webhook
+
+logger = logging.getLogger(__name__)
+
+_TIMEOUT = 5.0  # seconds
+
+
+def _sign(secret: str, body: bytes) -> str:
+    return hmac.new(secret.encode(), body, hashlib.sha256).hexdigest()
+
+
+async def _deliver(webhook_id: int, url: str, secret: str, payload: dict[str, Any]) -> None:
+    body = json.dumps(payload).encode()
+    headers = {"Content-Type": "application/json", "User-Agent": "webgate-webhook/1.0"}
+    if secret:
+        headers["X-Webgate-Signature"] = "sha256=" + _sign(secret, body)
+    status: int | None = None
+    try:
+        async with httpx.AsyncClient(timeout=_TIMEOUT) as client:
+            resp = await client.post(url, content=body, headers=headers)
+            status = resp.status_code
+    except Exception as e:
+        logger.warning("Webhook %s -> %s failed: %s", webhook_id, url, e)
+    finally:
+        async with async_session_factory() as session:
+            wh = (
+                await session.execute(select(Webhook).where(Webhook.id == webhook_id))
+            ).scalar_one_or_none()
+            if wh is not None:
+                wh.last_fired_at = datetime.now(UTC)
+                wh.last_status = status
+                await session.commit()
+
+
+async def fire(event: str, data: dict[str, Any]) -> None:
+    """Fire-and-forget: schedule webhook deliveries for this event."""
+    payload = {
+        "event": event,
+        "timestamp": datetime.now(UTC).isoformat(),
+        "data": data,
+    }
+    async with async_session_factory() as session:
+        result = await session.execute(select(Webhook).where(Webhook.enabled.is_(True)))
+        hooks = list(result.scalars().all())
+    for wh in hooks:
+        try:
+            events = json.loads(wh.events)
+        except json.JSONDecodeError:
+            events = ["*"]
+        if "*" not in events and event not in events:
+            continue
+        # Detached background task; never block caller.
+        asyncio.create_task(_deliver(wh.id, wh.url, wh.secret, payload))

webgate-0.3.2/src/webgate/webhooks/models.py

@@ -0,0 +1,61 @@
+from datetime import datetime
+
+from pydantic import BaseModel, Field
+from sqlalchemy import Boolean, DateTime, ForeignKey, Integer, String, Text, func
+from sqlalchemy.orm import Mapped, mapped_column
+
+from webgate.db.engine import Base
+
+# Known event names. Stored in `events` as a JSON array of strings; "*" means all.
+EVENT_NAMES = [
+    "user_login",
+    "user_login_failed",
+    "ssh_connect",
+    "sftp_upload",
+    "sftp_delete",
+    "server_added",
+    "server_deleted",
+]
+
+
+class Webhook(Base):
+    __tablename__ = "webhooks"
+
+    id: Mapped[int] = mapped_column(primary_key=True, autoincrement=True)
+    name: Mapped[str] = mapped_column(String(255))
+    url: Mapped[str] = mapped_column(Text)
+    events: Mapped[str] = mapped_column(Text, default='["*"]')  # JSON array
+    enabled: Mapped[bool] = mapped_column(Boolean, default=True)
+    secret: Mapped[str] = mapped_column(String(255), default="")  # HMAC signing key
+    last_fired_at: Mapped[datetime | None] = mapped_column(DateTime, nullable=True)
+    last_status: Mapped[int | None] = mapped_column(Integer, nullable=True)
+    user_id: Mapped[int] = mapped_column(Integer, ForeignKey("users.id"))
+    created_at: Mapped[datetime] = mapped_column(DateTime, server_default=func.now())
+
+
+class WebhookCreate(BaseModel):
+    name: str
+    url: str
+    events: list[str] = Field(default_factory=lambda: ["*"])
+    enabled: bool = True
+    secret: str = ""
+
+
+class WebhookUpdate(BaseModel):
+    name: str | None = None
+    url: str | None = None
+    events: list[str] | None = None
+    enabled: bool | None = None
+    secret: str | None = None
+
+
+class WebhookOut(BaseModel):
+    id: int
+    name: str
+    url: str
+    events: list[str]
+    enabled: bool
+    has_secret: bool
+    last_fired_at: datetime | None
+    last_status: int | None
+    created_at: datetime

webgate-0.3.2/src/webgate/webhooks/routes.py

@@ -0,0 +1,129 @@
+import json
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from webgate.auth.models import UserOut
+from webgate.auth.routes import get_current_user
+from webgate.db.engine import get_session
+from webgate.webhooks.dispatcher import fire
+from webgate.webhooks.models import (
+    EVENT_NAMES,
+    Webhook,
+    WebhookCreate,
+    WebhookOut,
+    WebhookUpdate,
+)
+
+router = APIRouter(prefix="/api/webhooks", tags=["webhooks"])
+
+SessionDep = Annotated[AsyncSession, Depends(get_session)]
+CurrentUserDep = Annotated[UserOut, Depends(get_current_user)]
+
+
+def _to_out(wh: Webhook) -> WebhookOut:
+    try:
+        events = json.loads(wh.events)
+    except json.JSONDecodeError:
+        events = ["*"]
+    return WebhookOut(
+        id=wh.id,
+        name=wh.name,
+        url=wh.url,
+        events=events,
+        enabled=wh.enabled,
+        has_secret=bool(wh.secret),
+        last_fired_at=wh.last_fired_at,
+        last_status=wh.last_status,
+        created_at=wh.created_at,
+    )
+
+
+def _require_admin(user: UserOut) -> None:
+    if not user.is_admin:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Admin only")
+
+
+@router.get("", response_model=list[WebhookOut])
+async def list_webhooks(session: SessionDep, user: CurrentUserDep) -> list[WebhookOut]:
+    _require_admin(user)
+    result = await session.execute(select(Webhook).order_by(Webhook.name))
+    return [_to_out(w) for w in result.scalars().all()]
+
+
+@router.get("/events", response_model=list[str])
+async def list_events(user: CurrentUserDep) -> list[str]:
+    _require_admin(user)
+    return EVENT_NAMES
+
+
+@router.post("", response_model=WebhookOut, status_code=status.HTTP_201_CREATED)
+async def create_webhook(
+    body: WebhookCreate, session: SessionDep, user: CurrentUserDep
+) -> WebhookOut:
+    _require_admin(user)
+    wh = Webhook(
+        name=body.name,
+        url=body.url,
+        events=json.dumps(body.events or ["*"]),
+        enabled=body.enabled,
+        secret=body.secret,
+        user_id=user.id,
+    )
+    session.add(wh)
+    await session.commit()
+    await session.refresh(wh)
+    return _to_out(wh)
+
+
+@router.put("/{webhook_id}", response_model=WebhookOut)
+async def update_webhook(
+    webhook_id: int, body: WebhookUpdate, session: SessionDep, user: CurrentUserDep
+) -> WebhookOut:
+    _require_admin(user)
+    wh = (
+        await session.execute(select(Webhook).where(Webhook.id == webhook_id))
+    ).scalar_one_or_none()
+    if wh is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Webhook not found")
+    if body.name is not None:
+        wh.name = body.name
+    if body.url is not None:
+        wh.url = body.url
+    if body.events is not None:
+        wh.events = json.dumps(body.events)
+    if body.enabled is not None:
+        wh.enabled = body.enabled
+    if body.secret is not None:
+        wh.secret = body.secret
+    await session.commit()
+    await session.refresh(wh)
+    return _to_out(wh)
+
+
+@router.delete("/{webhook_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_webhook(webhook_id: int, session: SessionDep, user: CurrentUserDep) -> None:
+    _require_admin(user)
+    wh = (
+        await session.execute(select(Webhook).where(Webhook.id == webhook_id))
+    ).scalar_one_or_none()
+    if wh is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Webhook not found")
+    await session.delete(wh)
+    await session.commit()
+
+
+@router.post("/{webhook_id}/test")
+async def test_webhook(
+    webhook_id: int, session: SessionDep, user: CurrentUserDep
+) -> dict[str, object]:
+    _require_admin(user)
+    wh = (
+        await session.execute(select(Webhook).where(Webhook.id == webhook_id))
+    ).scalar_one_or_none()
+    if wh is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Webhook not found")
+    await fire("test", {"webhook_id": wh.id, "name": wh.name, "triggered_by": user.username})
+    return {"queued": True}

{webgate-0.3.1 → webgate-0.3.2}/uv.lock

@@ -1845,6 +1845,7 @@ dependencies = [
     { name = "bcrypt" },
     { name = "cryptography" },
     { name = "fastapi" },
+    { name = "httpx" },
     { name = "passlib", extra = ["bcrypt"] },
     { name = "pydantic" },
     { name = "pydantic-settings" },
@@ -1880,6 +1881,7 @@ requires-dist = [
     { name = "bcrypt", specifier = ">=4.2.0" },
     { name = "cryptography", specifier = ">=44.0.0" },
     { name = "fastapi", specifier = ">=0.115.0" },
+    { name = "httpx", specifier = ">=0.28.0" },
     { name = "passlib", extras = ["bcrypt"], specifier = ">=1.7.4" },
     { name = "pydantic", specifier = ">=2.10.0" },
     { name = "pydantic-settings", specifier = ">=2.7.0" },