mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-10-27 23:28:03 +09:00
Juan DenisandClaude Fable 5
5417c39100
An audit found 102 FK columns with no index — every join, per-parent listing, and the delete cascades from _delete_cascade_policy scanned whole tables on them (deployments.app_id, audit_logs.user_id, dns_records.zone_id, webhook_logs.webhook_id, ...). All FK columns now declare index=True; migration 096 creates the same indexes on existing installs, deriving the list from the live schema at upgrade time (so it is idempotent and cannot drift from what an install actually has). Ratchet: test_every_fk_column_is_indexed pins the rule with no allowlist — a new FK column is born indexed or the build fails. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
98 lines
4.3 KiB
Python
98 lines
4.3 KiB
Python
import hmac
|
|
import hashlib
|
|
import base64
|
|
from datetime import datetime
|
|
from app import db
|
|
from app.models.mixins import TimestampMixin
|
|
from app.models.json_column_mixin import JsonColumnMixin
|
|
|
|
|
|
class WebhookEndpoint(TimestampMixin, JsonColumnMixin, db.Model):
|
|
"""Inbound webhook endpoint configuration."""
|
|
__tablename__ = 'webhook_endpoints'
|
|
|
|
id = db.Column(db.Integer, primary_key=True)
|
|
name = db.Column(db.String(200), nullable=False, unique=True)
|
|
slug = db.Column(db.String(220), nullable=False, unique=True, index=True)
|
|
secret = db.Column(db.String(500), nullable=False) # HMAC secret
|
|
is_active = db.Column(db.Boolean, default=True)
|
|
filter_paths = db.Column(db.Text, nullable=True) # JSON list of dotted-path filters
|
|
forward_url = db.Column(db.String(500), nullable=True)
|
|
retry_count = db.Column(db.Integer, default=3)
|
|
created_by = db.Column(db.Integer, db.ForeignKey('users.id'), nullable=True, index=True)
|
|
# Workspace scoping (#33): backfilled to the Default workspace by migration 021.
|
|
workspace_id = db.Column(db.Integer, db.ForeignKey('workspaces.id'), nullable=True, index=True)
|
|
|
|
deliveries = db.relationship('WebhookDelivery', backref='endpoint', lazy='dynamic', cascade='all, delete-orphan')
|
|
|
|
def get_filter_paths(self):
|
|
return self._json_read('filter_paths', [])
|
|
|
|
def set_filter_paths(self, paths):
|
|
self._json_write('filter_paths', list(paths) if paths else None)
|
|
|
|
def verify_signature(self, payload: bytes, signature_header: str, algorithm: str = 'sha256') -> bool:
|
|
"""Verify HMAC-SHA1/SHA256 signature from header."""
|
|
if not signature_header:
|
|
return False
|
|
if algorithm == 'sha256':
|
|
expected = 'sha256=' + hmac.new(self.secret.encode(), payload, hashlib.sha256).hexdigest()
|
|
return hmac.compare_digest(expected, signature_header)
|
|
if algorithm == 'sha1':
|
|
expected = 'sha1=' + hmac.new(self.secret.encode(), payload, hashlib.sha1).hexdigest()
|
|
return hmac.compare_digest(expected, signature_header)
|
|
return False
|
|
|
|
def to_dict(self):
|
|
return {
|
|
'id': self.id,
|
|
'name': self.name,
|
|
'slug': self.slug,
|
|
'is_active': self.is_active,
|
|
'filter_paths': self.get_filter_paths(),
|
|
'forward_url': self.forward_url,
|
|
'retry_count': self.retry_count,
|
|
'workspace_id': self.workspace_id,
|
|
'delivery_count': self.deliveries.count(),
|
|
'created_at': self.created_at.isoformat() if self.created_at else None,
|
|
'updated_at': self.updated_at.isoformat() if self.updated_at else None,
|
|
}
|
|
|
|
|
|
class WebhookDelivery(JsonColumnMixin, db.Model):
|
|
"""Log of an inbound webhook delivery."""
|
|
__tablename__ = 'webhook_deliveries'
|
|
|
|
id = db.Column(db.Integer, primary_key=True)
|
|
endpoint_id = db.Column(db.Integer, db.ForeignKey('webhook_endpoints.id', ondelete='CASCADE'), nullable=False, index=True)
|
|
event_id = db.Column(db.String(300), nullable=False, unique=True, index=True)
|
|
payload = db.Column(db.Text, nullable=True)
|
|
headers = db.Column(db.Text, nullable=True)
|
|
signature_valid = db.Column(db.Boolean, nullable=True)
|
|
status = db.Column(db.String(50), default='received') # received, filtered, forwarded, failed
|
|
response_status = db.Column(db.Integer, nullable=True)
|
|
response_body = db.Column(db.Text, nullable=True)
|
|
error_message = db.Column(db.Text, nullable=True)
|
|
received_at = db.Column(db.DateTime, default=datetime.utcnow)
|
|
completed_at = db.Column(db.DateTime, nullable=True)
|
|
|
|
def get_headers(self):
|
|
return self._json_read('headers')
|
|
|
|
def set_headers(self, headers):
|
|
self._json_write('headers', dict(headers) if headers else None)
|
|
|
|
def to_dict(self):
|
|
return {
|
|
'id': self.id,
|
|
'endpoint_id': self.endpoint_id,
|
|
'event_id': self.event_id,
|
|
'payload': self._json_read('payload', None),
|
|
'signature_valid': self.signature_valid,
|
|
'status': self.status,
|
|
'response_status': self.response_status,
|
|
'error_message': self.error_message,
|
|
'received_at': self.received_at.isoformat() if self.received_at else None,
|
|
'completed_at': self.completed_at.isoformat() if self.completed_at else None,
|
|
}
|