mosaic/stack
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases 2 Wiki Activity

[COORD-001] Set up webhook receiver endpoint #157

New Issue
Closed
opened 2026-01-31 21:27:44 +00:00 by jason.woltje · 0 comments
jason.woltje commented 2026-01-31 21:27:44 +00:00
Owner
Copy Link

Objective

Implement FastAPI webhook receiver that handles Gitea issue assignment events.

Implementation Details

  1. Create FastAPI application with /webhook/gitea endpoint
  2. Implement signature verification (HMAC SHA256)
  3. Route events: assigned, unassigned, closed
  4. Add logging for all webhook events
  5. Return 401 for invalid signatures
  6. Return 200 for valid events

Context Estimate

  • Files to modify: 4 (main.py, webhook.py, security.py, config.py)
  • Implementation complexity: medium (20000 tokens)
  • Test requirements: medium (10000 tokens)
  • Documentation: medium (3000 tokens)
  • Total estimated: 52000 tokens
  • Recommended agent: glm

Difficulty

medium

Dependencies

  • Blocked by: #156 (COORD-000 - needs bot user created)
  • Blocks: COORD-002 (parser needs webhook to fire)

Acceptance Criteria

  • FastAPI endpoint /webhook/gitea responds to POST
  • Signature verification rejects invalid requests
  • Event routing works for assigned/unassigned/closed
  • All events logged with timestamp, issue number, action
  • 85% test coverage (unit tests for each event type)
  • Docker container runs webhook receiver
  • Health check endpoint /health returns 200

Testing Requirements

  • Unit tests for signature verification
  • Unit tests for each event handler
  • Integration test with mock Gitea webhook
  • Security test: Invalid signature → 401
  • Manual test: Send test webhook from Gitea
## Objective Implement FastAPI webhook receiver that handles Gitea issue assignment events. ## Implementation Details 1. Create FastAPI application with /webhook/gitea endpoint 2. Implement signature verification (HMAC SHA256) 3. Route events: assigned, unassigned, closed 4. Add logging for all webhook events 5. Return 401 for invalid signatures 6. Return 200 for valid events ## Context Estimate - Files to modify: 4 (main.py, webhook.py, security.py, config.py) - Implementation complexity: medium (20000 tokens) - Test requirements: medium (10000 tokens) - Documentation: medium (3000 tokens) - **Total estimated: 52000 tokens** - **Recommended agent: glm** ## Difficulty medium ## Dependencies - Blocked by: #156 (COORD-000 - needs bot user created) - Blocks: COORD-002 (parser needs webhook to fire) ## Acceptance Criteria - [ ] FastAPI endpoint /webhook/gitea responds to POST - [ ] Signature verification rejects invalid requests - [ ] Event routing works for assigned/unassigned/closed - [ ] All events logged with timestamp, issue number, action - [ ] 85% test coverage (unit tests for each event type) - [ ] Docker container runs webhook receiver - [ ] Health check endpoint /health returns 200 ## Testing Requirements - Unit tests for signature verification - Unit tests for each event handler - Integration test with mock Gitea webhook - Security test: Invalid signature → 401 - Manual test: Send test webhook from Gitea
jason.woltje added the p0apiapi labels 2026-01-31 21:27:44 +00:00
jason.woltje added this to the M4.1-Coordinator (0.0.4) milestone 2026-01-31 21:28:42 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
ai
AI/LLM integration
 api
Backend/API work
 api
auth
Authentication
 database
database
Database/schema work
 devops
Docker/deployment
 docs
Documentation
 frontend
graph
knowledge-module
migration
Data migration
 orchestrator
Orchestrator service (apps/orchestrator/)
 p0
Critical priority
 p1
High priority
 p2
Medium priority
 p3
Low priority
 performance
Performance work
 phase-1
phase-2
phase-3
phase-4
phase-5
plugin
MoltBot plugin work
 search
security
Security-related
 setup
Initial setup
 testing
Testing/QA
 web
Frontend work
No Label api api p0
Milestone
No items
No Milestone M4.1-Coordinator (0.0.4)
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaic/stack#157
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?