summaryrefslogtreecommitdiffstats
path: root/modules
diff options
context:
space:
mode:
authoroliverpool <3864879+oliverpool@users.noreply.github.com>2022-11-03 19:23:20 +0100
committerGitHub <noreply@github.com>2022-11-03 20:23:20 +0200
commitb6e81357bd6fb80f8ba94c513f89a210beb05313 (patch)
treeb495f05c492c4876a5f8ded3a85d9985e0ec22a8 /modules
parent085f717529008c31b147f76ea7eeaf06ca8801bd (diff)
downloadgitea-b6e81357bd6fb80f8ba94c513f89a210beb05313.tar.gz
gitea-b6e81357bd6fb80f8ba94c513f89a210beb05313.zip
Add Webhook authorization header (#20926)
_This is a different approach to #20267, I took the liberty of adapting some parts, see below_ ## Context In some cases, a weebhook endpoint requires some kind of authentication. The usual way is by sending a static `Authorization` header, with a given token. For instance: - Matrix expects a `Bearer <token>` (already implemented, by storing the header cleartext in the metadata - which is buggy on retry #19872) - TeamCity #18667 - Gitea instances #20267 - SourceHut https://man.sr.ht/graphql.md#authentication-strategies (this is my actual personal need :) ## Proposed solution Add a dedicated encrypt column to the webhook table (instead of storing it as meta as proposed in #20267), so that it gets available for all present and future hook types (especially the custom ones #19307). This would also solve the buggy matrix retry #19872. As a first step, I would recommend focusing on the backend logic and improve the frontend at a later stage. For now the UI is a simple `Authorization` field (which could be later customized with `Bearer` and `Basic` switches): ![2022-08-23-142911](https://user-images.githubusercontent.com/3864879/186162483-5b721504-eef5-4932-812e-eb96a68494cc.png) The header name is hard-coded, since I couldn't fine any usecase justifying otherwise. ## Questions - What do you think of this approach? @justusbunsi @Gusted @silverwind - ~~How are the migrations generated? Do I have to manually create a new file, or is there a command for that?~~ - ~~I started adding it to the API: should I complete it or should I drop it? (I don't know how much the API is actually used)~~ ## Done as well: - add a migration for the existing matrix webhooks and remove the `Authorization` logic there _Closes #19872_ Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: Gusted <williamzijl7@hotmail.com> Co-authored-by: delvh <dev.lh@web.de>
Diffstat (limited to 'modules')
-rw-r--r--modules/convert/convert.go26
-rw-r--r--modules/structs/hook.go29
2 files changed, 32 insertions, 23 deletions
diff --git a/modules/convert/convert.go b/modules/convert/convert.go
index 8c92bbb371..78eb62d42d 100644
--- a/modules/convert/convert.go
+++ b/modules/convert/convert.go
@@ -243,7 +243,7 @@ func ToGPGKeyEmail(email *user_model.EmailAddress) *api.GPGKeyEmail {
}
// ToHook convert models.Webhook to api.Hook
-func ToHook(repoLink string, w *webhook.Webhook) *api.Hook {
+func ToHook(repoLink string, w *webhook.Webhook) (*api.Hook, error) {
config := map[string]string{
"url": w.URL,
"content_type": w.ContentType.Name(),
@@ -256,16 +256,22 @@ func ToHook(repoLink string, w *webhook.Webhook) *api.Hook {
config["color"] = s.Color
}
- return &api.Hook{
- ID: w.ID,
- Type: w.Type,
- URL: fmt.Sprintf("%s/settings/hooks/%d", repoLink, w.ID),
- Active: w.IsActive,
- Config: config,
- Events: w.EventsArray(),
- Updated: w.UpdatedUnix.AsTime(),
- Created: w.CreatedUnix.AsTime(),
+ authorizationHeader, err := w.HeaderAuthorization()
+ if err != nil {
+ return nil, err
}
+
+ return &api.Hook{
+ ID: w.ID,
+ Type: w.Type,
+ URL: fmt.Sprintf("%s/settings/hooks/%d", repoLink, w.ID),
+ Active: w.IsActive,
+ Config: config,
+ Events: w.EventsArray(),
+ AuthorizationHeader: authorizationHeader,
+ Updated: w.UpdatedUnix.AsTime(),
+ Created: w.CreatedUnix.AsTime(),
+ }, nil
}
// ToGitHook convert git.Hook to api.GitHook
diff --git a/modules/structs/hook.go b/modules/structs/hook.go
index 8321a15a8f..f0600a192d 100644
--- a/modules/structs/hook.go
+++ b/modules/structs/hook.go
@@ -18,12 +18,13 @@ var ErrInvalidReceiveHook = errors.New("Invalid JSON payload received over webho
// Hook a hook is a web hook when one repository changed
type Hook struct {
- ID int64 `json:"id"`
- Type string `json:"type"`
- URL string `json:"-"`
- Config map[string]string `json:"config"`
- Events []string `json:"events"`
- Active bool `json:"active"`
+ ID int64 `json:"id"`
+ Type string `json:"type"`
+ URL string `json:"-"`
+ Config map[string]string `json:"config"`
+ Events []string `json:"events"`
+ AuthorizationHeader string `json:"authorization_header"`
+ Active bool `json:"active"`
// swagger:strfmt date-time
Updated time.Time `json:"updated_at"`
// swagger:strfmt date-time
@@ -43,19 +44,21 @@ type CreateHookOption struct {
// enum: dingtalk,discord,gitea,gogs,msteams,slack,telegram,feishu,wechatwork,packagist
Type string `json:"type" binding:"Required"`
// required: true
- Config CreateHookOptionConfig `json:"config" binding:"Required"`
- Events []string `json:"events"`
- BranchFilter string `json:"branch_filter" binding:"GlobPattern"`
+ Config CreateHookOptionConfig `json:"config" binding:"Required"`
+ Events []string `json:"events"`
+ BranchFilter string `json:"branch_filter" binding:"GlobPattern"`
+ AuthorizationHeader string `json:"authorization_header"`
// default: false
Active bool `json:"active"`
}
// EditHookOption options when modify one hook
type EditHookOption struct {
- Config map[string]string `json:"config"`
- Events []string `json:"events"`
- BranchFilter string `json:"branch_filter" binding:"GlobPattern"`
- Active *bool `json:"active"`
+ Config map[string]string `json:"config"`
+ Events []string `json:"events"`
+ BranchFilter string `json:"branch_filter" binding:"GlobPattern"`
+ AuthorizationHeader string `json:"authorization_header"`
+ Active *bool `json:"active"`
}
// Payloader payload is some part of one hook