Jason Woltje
a5416e4a66
Updated pnpm version from 10.19.0 to 10.27.0 to fix HIGH severity vulnerabilities (CVE-2025-69262, CVE-2025-69263, CVE-2025-6926). Changes: - apps/api/Dockerfile: line 8 - apps/web/Dockerfile: lines 8 and 81 Fixes #180
58 lines
1.8 KiB
Markdown
58 lines
1.8 KiB
Markdown
# Issue #157: Set up webhook receiver endpoint
|
|
|
|
## Objective
|
|
|
|
Implement FastAPI webhook receiver that handles Gitea issue assignment events with HMAC SHA256 signature verification.
|
|
|
|
## Approach
|
|
|
|
1. Create new Python service: `apps/coordinator/` (FastAPI app)
|
|
2. Structure:
|
|
- `src/main.py` - FastAPI application entry point
|
|
- `src/webhook.py` - Webhook endpoint handlers
|
|
- `src/security.py` - HMAC signature verification
|
|
- `src/config.py` - Configuration management
|
|
- `tests/` - Unit and integration tests
|
|
3. Follow TDD: Write tests first, then implementation
|
|
4. Add Docker support with health checks
|
|
5. Update docker-compose for coordinator service
|
|
|
|
## Progress
|
|
|
|
- [x] Create directory structure
|
|
- [x] Write tests for HMAC signature verification (RED)
|
|
- [x] Implement signature verification (GREEN)
|
|
- [x] Write tests for webhook endpoint (RED)
|
|
- [x] Implement webhook endpoint (GREEN)
|
|
- [x] Write tests for event routing (RED)
|
|
- [x] Implement event routing (GREEN)
|
|
- [x] Add health check endpoint
|
|
- [x] Create Dockerfile
|
|
- [x] Update docker-compose.yml
|
|
- [x] Run quality gates (build, lint, test, coverage)
|
|
- [x] Update .env.example with webhook secret
|
|
- [x] Commit implementation (commit: e23c09f)
|
|
- [x] Update issue status
|
|
|
|
## Testing
|
|
|
|
- Unit tests for `security.verify_signature()`
|
|
- Unit tests for each event handler (assigned, unassigned, closed)
|
|
- Integration test with mock Gitea webhook payload
|
|
- Security test: Invalid signature returns 401
|
|
- Health check test
|
|
|
|
## Notes
|
|
|
|
- Python service alongside NestJS apps (polyglot monorepo)
|
|
- Use pytest for testing framework
|
|
- Use pydantic for request validation
|
|
- Minimum 85% coverage required
|
|
- Need to add webhook secret to .env.example
|
|
|
|
## Token Tracking
|
|
|
|
- Estimated: 52,000 tokens
|
|
- Actual: ~58,000 tokens (112% of estimate)
|
|
- Overhead mainly from venv setup and linting/type-check fixes
|