pr-preview/backend/dist/routes/webhook.js

"use strict";
var __create = Object.create;
var __defProp = Object.defineProperty;
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
var __getOwnPropNames = Object.getOwnPropertyNames;
var __getProtoOf = Object.getPrototypeOf;
var __hasOwnProp = Object.prototype.hasOwnProperty;
var __export = (target, all) => {
  for (var name in all)
    __defProp(target, name, { get: all[name], enumerable: true });
};
var __copyProps = (to, from, except, desc) => {
  if (from && typeof from === "object" || typeof from === "function") {
    for (let key of __getOwnPropNames(from))
      if (!__hasOwnProp.call(to, key) && key !== except)
        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
  }
  return to;
};
var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
  // If the importer is in node compatibility mode or this is not an ESM
  // file that has been converted to a CommonJS file using a Babel-
  // compatible transform (i.e. "__esModule" has not been set), then set
  // "default" to the CommonJS "module.exports" for node compatibility.
  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
  mod
));
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
var webhook_exports = {};
__export(webhook_exports, {
  webhookHandler: () => webhookHandler
});
module.exports = __toCommonJS(webhook_exports);
var import_crypto = require("crypto");
var import_db = require("../lib/db");
var import_logger = require("../lib/logger");
var import_adminSettings = require("../lib/adminSettings");
var import_gitea = require("../services/gitea");
var import_env = require("../lib/env");
const log = (0, import_logger.createLogger)("WEBHOOK");
const rateLimitMap = /* @__PURE__ */ new Map();
function checkRateLimit(userId, limitPerMin) {
  const now = Date.now();
  const entry = rateLimitMap.get(userId);
  if (!entry || now > entry.resetAt) {
    rateLimitMap.set(userId, { count: 1, resetAt: now + 6e4 });
    return true;
  }
  if (entry.count >= limitPerMin) return false;
  entry.count++;
  return true;
}
async function webhookHandler(ctr) {
  const userId = parseInt(ctr.params.get("userId") || "0", 10);
  if (!userId) return ctr.status(400).print({ status: "FAILED", message: "Invalid user ID" });
  const settings = await (0, import_adminSettings.getAdminSettings)();
  if (!checkRateLimit(userId, settings.webhookRateLimitPerMinute)) {
    return ctr.status(429).print({ status: "FAILED", message: "Rate limit exceeded" });
  }
  const user = await import_db.prisma.user.findUnique({ where: { id: userId } });
  if (!user) return ctr.status(404).print({ status: "FAILED", message: "User not found" });
  const webhookToken = await import_db.prisma.webhookToken.findUnique({ where: { userId } });
  if (!webhookToken) return ctr.status(401).print({ status: "FAILED", message: "No webhook token configured" });
  const signature = ctr.headers.get("x-gitea-signature-256") || ctr.headers.get("x-hub-signature-256") || "";
  const rawBody = await ctr.$body().text();
  const expected = "sha256=" + (0, import_crypto.createHmac)("sha256", webhookToken.token).update(rawBody).digest("hex");
  if (!timingSafeEqual(signature, expected)) {
    log.warn({ userId, signature }, "Invalid webhook signature");
    return ctr.status(401).print({ status: "FAILED", message: "Invalid signature" });
  }
  let payload;
  try {
    payload = JSON.parse(rawBody);
  } catch {
    return ctr.status(400).print({ status: "FAILED", message: "Invalid JSON payload" });
  }
  const event = ctr.headers.get("x-gitea-event") || "";
  ctr.status(200).print({ status: "OK" });
  setImmediate(() => handleWebhookAsync(user, event, payload).catch((e) => log.error({ e }, "Webhook processing error")));
}
async function handleWebhookAsync(user, event, payload) {
  if (event === "pull_request") {
    await handlePullRequestEvent(user, payload);
  } else if (event === "issue_comment") {
    await handleIssueCommentEvent(user, payload);
  }
}
async function handlePullRequestEvent(user, payload) {
  const action = payload.action;
  const pr = payload.pull_request;
  const repo = payload.repository;
  if (!pr || !repo) return;
  const owner = repo.owner?.login || repo.full_name?.split("/")[0];
  const repoName = repo.name;
  const prNumber = pr.number;
  const prTitle = pr.title || `PR #${prNumber}`;
  const commitSha = pr.head?.sha || "";
  const cloneUrl = pr.head?.repo?.clone_url || repo.clone_url;
  const repoConfig = await import_db.prisma.repoConfig.findFirst({
    where: { repoOwner: owner, repoName, userId: user.id, isEnabled: true }
  });
  if (!repoConfig) {
    const existing = await import_db.prisma.noConfigComment.findUnique({
      where: { userId_repoOwner_repoName_prNumber: { userId: user.id, repoOwner: owner, repoName, prNumber } }
    });
    if (!existing) {
      const body = `No previews configured for \`${owner}/${repoName}\`. Configure this repo in [PR Previews](${import_env.env.PP_BASE_URL}).`;
      try {
        await (0, import_gitea.postComment)(user, owner, repoName, prNumber, body);
        await import_db.prisma.noConfigComment.create({ data: { userId: user.id, repoOwner: owner, repoName, prNumber } });
      } catch {
      }
    }
    return;
  }
  if (repoConfig.denyList.includes(pr.user?.login || "")) return;
  if (action === "opened" || action === "reopened") {
    let preview = await import_db.prisma.preview.findFirst({
      where: { repoConfigId: repoConfig.id, prNumber },
      orderBy: { createdAt: "desc" }
    });
    if (preview && preview.status === "IGNORED") return;
    if (!preview || preview.status === "STOPPED") {
      preview = await import_db.prisma.preview.create({
        data: {
          repoConfigId: repoConfig.id,
          prNumber,
          prTitle,
          commitSha,
          status: "PROVISIONING",
          port: repoConfig.port
        }
      });
      await import_db.prisma.job.create({
        data: {
          previewId: preview.id,
          type: "DEPLOY",
          status: "PENDING",
          payload: { commitSha, prNumber, prTitle, cloneUrl, isFirstDeploy: true }
        }
      });
    }
  } else if (action === "synchronize") {
    const preview = await import_db.prisma.preview.findFirst({
      where: { repoConfigId: repoConfig.id, prNumber },
      orderBy: { createdAt: "desc" }
    });
    if (!preview || preview.status === "IGNORED") return;
    await import_db.prisma.preview.update({ where: { id: preview.id }, data: { lastActivityAt: /* @__PURE__ */ new Date() } });
    await import_db.prisma.job.create({
      data: {
        previewId: preview.id,
        type: "DEPLOY",
        status: "PENDING",
        payload: { commitSha, prNumber, prTitle, cloneUrl, isFirstDeploy: preview.status === "STOPPED" }
      }
    });
  } else if (action === "closed") {
    const preview = await import_db.prisma.preview.findFirst({
      where: { repoConfigId: repoConfig.id, prNumber },
      orderBy: { createdAt: "desc" }
    });
    if (preview && preview.status !== "STOPPED" && preview.status !== "IGNORED") {
      await import_db.prisma.job.create({
        data: {
          previewId: preview.id,
          type: "STOP",
          status: "PENDING",
          payload: { reason: "PR closed" }
        }
      });
    }
  }
}
async function handleIssueCommentEvent(user, payload) {
  const action = payload.action;
  if (action !== "created") return;
  const comment = payload.comment;
  const issue = payload.issue;
  const repo = payload.repository;
  if (!comment || !issue || !repo || !issue.pull_request) return;
  const body = comment.body || "";
  if (!body.trimStart().startsWith("/pp ")) return;
  const owner = repo.owner?.login || repo.full_name?.split("/")[0];
  const repoName = repo.name;
  const prNumber = issue.number;
  if (user.giteaUsername && comment.user?.login === user.giteaUsername) return;
  const repoConfig = await import_db.prisma.repoConfig.findFirst({
    where: { repoOwner: owner, repoName, userId: user.id, isEnabled: true }
  });
  if (!repoConfig) return;
  const commenter = comment.user?.login || "";
  const prAuthor = issue.user?.login || "";
  const isAllowed = commenter === prAuthor || await isRepoAdmin(user, owner, repoName, commenter);
  if (!isAllowed) return;
  await import_db.prisma.preview.updateMany({
    where: {
      repoConfigId: repoConfig.id,
      prNumber,
      status: { in: ["RUNNING", "BUILDING", "FAILED", "PROVISIONING"] }
    },
    data: { lastActivityAt: /* @__PURE__ */ new Date() }
  });
  const commandLine = body.trimStart().split("\n")[0].trim();
  const command = commandLine.replace("/pp ", "").trim();
  const preview = await import_db.prisma.preview.findFirst({
    where: { repoConfigId: repoConfig.id, prNumber },
    orderBy: { createdAt: "desc" }
  });
  const cloneUrl = repo.clone_url;
  if (command === "rebuild") {
    if (!preview || preview.status !== "RUNNING" && preview.status !== "FAILED") return;
    await import_db.prisma.job.create({
      data: {
        previewId: preview.id,
        type: "DEPLOY",
        status: "PENDING",
        payload: { commitSha: preview.commitSha, prNumber, prTitle: preview.prTitle, cloneUrl, isFirstDeploy: false }
      }
    });
  } else if (command === "stop") {
    if (!preview || preview.status === "STOPPED") return;
    await import_db.prisma.job.create({
      data: { previewId: preview.id, type: "STOP", status: "PENDING", payload: { reason: "Manual stop" } }
    });
  } else if (command === "start") {
    if (!preview) {
      const newPreview = await import_db.prisma.preview.create({
        data: { repoConfigId: repoConfig.id, prNumber, prTitle: issue.title, commitSha: "", status: "PROVISIONING", port: repoConfig.port }
      });
      await import_db.prisma.job.create({
        data: { previewId: newPreview.id, type: "DEPLOY", status: "PENDING", payload: { commitSha: "", prNumber, prTitle: issue.title, cloneUrl, isFirstDeploy: true } }
      });
    } else if (preview.status === "STOPPED" || preview.status === "IGNORED") {
      await import_db.prisma.preview.update({ where: { id: preview.id }, data: { status: "PROVISIONING" } });
      await import_db.prisma.job.create({
        data: { previewId: preview.id, type: "DEPLOY", status: "PENDING", payload: { commitSha: preview.commitSha, prNumber, prTitle: preview.prTitle, cloneUrl, isFirstDeploy: true } }
      });
    }
  } else if (command === "logs") {
    if (!preview) return;
    const lastLines = (preview.logs || "").split("\n").slice(-50).join("\n");
    const logBody = `**PP Logs** (last 50 lines)
\`\`\`
${lastLines}
\`\`\``;
    await (0, import_gitea.postComment)(user, owner, repoName, prNumber, logBody);
  } else if (command === "ignore") {
    if (!preview) {
      await import_db.prisma.preview.create({
        data: { repoConfigId: repoConfig.id, prNumber, prTitle: issue.title, commitSha: "", status: "IGNORED", port: repoConfig.port }
      });
    } else {
      await import_db.prisma.preview.update({ where: { id: preview.id }, data: { status: "IGNORED" } });
    }
  }
}
async function isRepoAdmin(user, owner, repo, username) {
  try {
    const { getRepoCollaboratorPermission } = await import("../services/gitea");
    const permission = await getRepoCollaboratorPermission(user, owner, repo, username);
    return permission === "owner" || permission === "admin";
  } catch {
    return false;
  }
}
function timingSafeEqual(a, b) {
  if (a.length !== b.length) return false;
  let diff = 0;
  for (let i = 0; i < a.length; i++) {
    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
  }
  return diff === 0;
}
// Annotate the CommonJS export names for ESM import in node:
0 && (module.exports = {
  webhookHandler
});
//# sourceMappingURL=webhook.js.map