|
| 1 | +"""GitHub webhook endpoint dispatching push events to the sync queue.""" |
| 2 | + |
| 3 | +from __future__ import annotations |
| 4 | + |
| 5 | +from typing import Annotated |
| 6 | + |
| 7 | +import gidgethub |
| 8 | +from fastapi import APIRouter, Depends, HTTPException, Request, status |
| 9 | +from gidgethub import sansio |
| 10 | +from gidgethub.routing import Router as GidgethubRouter |
| 11 | + |
| 12 | +from docverse.dependencies.context import RequestContext, context_dependency |
| 13 | +from docverse.services.dashboard_templates import PushEventProcessor |
| 14 | +from docverse.storage.github import GitHubAppNotConfiguredError |
| 15 | + |
| 16 | +__all__ = ["router"] |
| 17 | + |
| 18 | +router = APIRouter(include_in_schema=False) |
| 19 | +"""FastAPI router for GitHub webhook endpoints. |
| 20 | +
|
| 21 | +Mounted under ``config.path_prefix`` from ``main.py`` so the public |
| 22 | +URL is ``POST {path_prefix}/webhooks/github``. Excluded from the |
| 23 | +OpenAPI schema because the API surface is GitHub's webhook contract, |
| 24 | +not the Docverse REST API. |
| 25 | +""" |
| 26 | + |
| 27 | + |
| 28 | +_event_router = GidgethubRouter() |
| 29 | +"""Module-level gidgethub router for event-type dispatch. |
| 30 | +
|
| 31 | +Using a fresh router per request would defeat gidgethub's intended |
| 32 | +registration model and force every callback to re-bind on every |
| 33 | +delivery. Holding it at module scope mirrors the pattern in |
| 34 | +``safir.github`` and Times Square / Semaphore: register handlers |
| 35 | +once, dispatch many. |
| 36 | +""" |
| 37 | + |
| 38 | + |
| 39 | +@_event_router.register("push") |
| 40 | +async def _handle_push( |
| 41 | + event: sansio.Event, |
| 42 | + *, |
| 43 | + processor: PushEventProcessor, |
| 44 | + context: RequestContext, |
| 45 | +) -> None: |
| 46 | + """Translate a push event into ``dashboard_sync`` enqueues. |
| 47 | +
|
| 48 | + The processor owns transaction-free DB writes through the |
| 49 | + enqueuer; the handler wraps both the binding lookup and the |
| 50 | + enqueue in a single ``session.begin()`` so a failure aborts the |
| 51 | + whole webhook delivery cleanly. |
| 52 | + """ |
| 53 | + async with context.session.begin(): |
| 54 | + jobs = await processor.process(event.data) |
| 55 | + await context.session.commit() |
| 56 | + context.logger.info( |
| 57 | + "Processed push webhook", |
| 58 | + delivery_id=event.delivery_id, |
| 59 | + enqueued=len(jobs), |
| 60 | + ) |
| 61 | + |
| 62 | + |
| 63 | +@router.post( |
| 64 | + "/webhooks/github", |
| 65 | + status_code=status.HTTP_200_OK, |
| 66 | + summary="GitHub App webhook receiver", |
| 67 | + name="github_webhook", |
| 68 | +) |
| 69 | +async def post_github_webhook( |
| 70 | + request: Request, |
| 71 | + context: Annotated[RequestContext, Depends(context_dependency)], |
| 72 | +) -> dict[str, str]: |
| 73 | + """Receive a GitHub webhook delivery and dispatch by event type. |
| 74 | +
|
| 75 | + Returns ``404`` when the GitHub App feature is not configured |
| 76 | + (any of ``github_app_id`` / ``github_app_private_key`` / |
| 77 | + ``github_webhook_secret`` unset). This keeps the URL effectively |
| 78 | + invisible to a misconfigured deployment without surfacing a 5xx |
| 79 | + that would page operators on every GitHub redelivery attempt. |
| 80 | +
|
| 81 | + Returns ``401`` when the request is unsigned or the HMAC does |
| 82 | + not match the configured webhook secret. ``415`` is returned by |
| 83 | + ``gidgethub`` directly when the content-type is wrong. |
| 84 | +
|
| 85 | + Returns ``200`` for all signed deliveries — including event |
| 86 | + types this app does not subscribe to — so GitHub's redelivery |
| 87 | + machinery does not retry deliveries we have intentionally |
| 88 | + chosen not to act on. |
| 89 | + """ |
| 90 | + try: |
| 91 | + secret = context.factory.get_github_webhook_secret() |
| 92 | + processor = context.factory.create_push_event_processor() |
| 93 | + except GitHubAppNotConfiguredError as exc: |
| 94 | + raise HTTPException( |
| 95 | + status_code=status.HTTP_404_NOT_FOUND, |
| 96 | + detail="GitHub App is not configured", |
| 97 | + ) from exc |
| 98 | + |
| 99 | + body = await request.body() |
| 100 | + try: |
| 101 | + event = sansio.Event.from_http( |
| 102 | + _lowercase_headers(request.headers), body, secret=secret |
| 103 | + ) |
| 104 | + except gidgethub.ValidationFailure as exc: |
| 105 | + raise HTTPException( |
| 106 | + status_code=status.HTTP_401_UNAUTHORIZED, |
| 107 | + detail="Invalid webhook signature", |
| 108 | + ) from exc |
| 109 | + |
| 110 | + context.rebind_logger( |
| 111 | + github_event=event.event, github_delivery_id=event.delivery_id |
| 112 | + ) |
| 113 | + |
| 114 | + await _event_router.dispatch(event, processor=processor, context=context) |
| 115 | + |
| 116 | + return {"status": "ok"} |
| 117 | + |
| 118 | + |
| 119 | +def _lowercase_headers(headers: object) -> dict[str, str]: |
| 120 | + """Return a dict of request headers with lower-cased keys. |
| 121 | +
|
| 122 | + ``gidgethub.sansio.Event.from_http`` expects a mapping that |
| 123 | + supports lower-cased keys; FastAPI's ``Request.headers`` already |
| 124 | + is case-insensitive but ``Event.from_http`` indexes via |
| 125 | + ``headers["x-github-event"]`` directly, so a plain dict with |
| 126 | + pre-lower-cased keys is the safest contract. |
| 127 | + """ |
| 128 | + items = headers.items() if hasattr(headers, "items") else [] |
| 129 | + return {str(k).lower(): str(v) for k, v in items} |
0 commit comments