126 lines
3.9 KiB
Python
126 lines
3.9 KiB
Python
"""Nexus webhook receiver — handles component/asset webhooks."""
|
|
|
|
import hashlib
|
|
import hmac
|
|
import json
|
|
import re
|
|
|
|
from fastapi import APIRouter, BackgroundTasks, Header, HTTPException, Request, status
|
|
|
|
from guarddog_nexus.config import config
|
|
from guarddog_nexus.database import get_session
|
|
from guarddog_nexus.harvester import harvest
|
|
from guarddog_nexus.logging_setup import log
|
|
|
|
router = APIRouter(prefix="/webhooks", tags=["webhooks"])
|
|
|
|
RELEVANT_ACTIONS = {"CREATED", "UPDATED"}
|
|
|
|
EXCLUDE_NAME_PATTERNS = [
|
|
re.compile(p) for p in [
|
|
r"^simple/",
|
|
r"\.html$",
|
|
r"\.json$",
|
|
r"\.xml$",
|
|
r"index\.",
|
|
r"\.rss$",
|
|
r"\.atom$",
|
|
]
|
|
]
|
|
|
|
|
|
def _should_skip_asset(filename: str) -> bool:
|
|
for pat in EXCLUDE_NAME_PATTERNS:
|
|
if pat.search(filename):
|
|
return True
|
|
return False
|
|
|
|
|
|
@router.post("/nexus")
|
|
async def nexus_webhook(
|
|
request: Request,
|
|
background_tasks: BackgroundTasks,
|
|
x_nexus_webhook_signature: str | None = Header(None, alias="X-Nexus-Webhook-Signature"),
|
|
):
|
|
payload = await request.body()
|
|
payload_str = payload.decode("utf-8")
|
|
|
|
if config.webhook_secret:
|
|
if not x_nexus_webhook_signature:
|
|
log.warning("Webhook rejected: missing signature header")
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED, detail="Missing signature"
|
|
)
|
|
expected = hmac.new(
|
|
config.webhook_secret.encode(), payload, hashlib.sha256
|
|
).hexdigest()
|
|
if not hmac.compare_digest(x_nexus_webhook_signature, expected):
|
|
log.warning("Webhook rejected: invalid signature")
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Invalid signature")
|
|
|
|
try:
|
|
data = json.loads(payload_str)
|
|
except json.JSONDecodeError:
|
|
log.warning("Webhook received invalid JSON")
|
|
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Invalid JSON")
|
|
|
|
action = data.get("action", "").upper()
|
|
if action not in RELEVANT_ACTIONS:
|
|
log.debug("Ignoring action: %s", action)
|
|
return {"status": "ignored", "action": action}
|
|
|
|
asset = data.get("asset") or data.get("component") or data.get("repositoryComponent")
|
|
if not asset:
|
|
log.warning("Webhook payload has no asset/component")
|
|
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="No asset in payload")
|
|
|
|
asset_name = asset.get("name", "")
|
|
if _should_skip_asset(asset_name):
|
|
log.debug("Skipping metadata asset: %s", asset_name)
|
|
return {"status": "ignored", "reason": "metadata_asset"}
|
|
|
|
download_url = _extract_download_url(asset, data)
|
|
if not download_url:
|
|
log.warning("Could not extract download URL from webhook")
|
|
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="No download URL")
|
|
|
|
repository_name = data.get("repositoryName", asset.get("repositoryName", ""))
|
|
format_ = asset.get("format", "pypi")
|
|
asset_path = asset.get("path", download_url)
|
|
|
|
log.info(
|
|
"Webhook: %s %s in %s (%s)",
|
|
action,
|
|
asset_name,
|
|
repository_name,
|
|
format_,
|
|
)
|
|
|
|
background_tasks.add_task(
|
|
_scan_in_background, download_url, repository_name, format_, asset_path
|
|
)
|
|
|
|
return {"status": "accepted", "package": asset_name, "action": action}
|
|
|
|
|
|
def _extract_download_url(asset: dict, full_payload: dict) -> str | None:
|
|
for key in ("downloadUrl", "download_url", "url"):
|
|
val = asset.get(key)
|
|
if val:
|
|
return val
|
|
return full_payload.get("downloadUrl") or full_payload.get("download_url")
|
|
|
|
|
|
async def _scan_in_background(
|
|
download_url: str,
|
|
repository: str,
|
|
format_: str,
|
|
asset_path: str,
|
|
):
|
|
try:
|
|
async for session in get_session():
|
|
await harvest(download_url, repository, format_, asset_path, session)
|
|
break
|
|
except Exception as e:
|
|
log.error("Background scan failed: %s", e)
|