@@ -19,9 +19,11 @@ import ( |
| 19 | | 19 | |
| 20 | "github.com/tenseleyFlow/shithub/internal/auth/audit" | 20 | "github.com/tenseleyFlow/shithub/internal/auth/audit" |
| 21 | "github.com/tenseleyFlow/shithub/internal/auth/email" | 21 | "github.com/tenseleyFlow/shithub/internal/auth/email" |
| | 22 | + "github.com/tenseleyFlow/shithub/internal/auth/secretbox" |
| 22 | "github.com/tenseleyFlow/shithub/internal/infra/config" | 23 | "github.com/tenseleyFlow/shithub/internal/infra/config" |
| 23 | "github.com/tenseleyFlow/shithub/internal/infra/db" | 24 | "github.com/tenseleyFlow/shithub/internal/infra/db" |
| 24 | "github.com/tenseleyFlow/shithub/internal/infra/storage" | 25 | "github.com/tenseleyFlow/shithub/internal/infra/storage" |
| | 26 | + "github.com/tenseleyFlow/shithub/internal/webhook" |
| 25 | "github.com/tenseleyFlow/shithub/internal/worker" | 27 | "github.com/tenseleyFlow/shithub/internal/worker" |
| 26 | "github.com/tenseleyFlow/shithub/internal/worker/jobs" | 28 | "github.com/tenseleyFlow/shithub/internal/worker/jobs" |
| 27 | ) | 29 | ) |
@@ -122,6 +124,31 @@ var workerCmd = &cobra.Command{ |
| 122 | UnsubscribeKey: notifUnsubscribeKey(cfg, logger), | 124 | UnsubscribeKey: notifUnsubscribeKey(cfg, logger), |
| 123 | })) | 125 | })) |
| 124 | | 126 | |
| | 127 | + // Webhook delivery (S33). The fan-out drains domain_events |
| | 128 | + // past its own cursor; deliver runs per-row HTTP POSTs; |
| | 129 | + // purge-old prunes terminal rows past the retention window. |
| | 130 | + // We reuse the TOTP key as the at-rest secretbox key — both |
| | 131 | + // are encrypted-blob columns in the same trust domain. |
| | 132 | + hookBox, hookBoxErr := secretbox.FromBase64(cfg.Auth.TOTPKeyB64) |
| | 133 | + if hookBoxErr != nil { |
| | 134 | + logger.Warn("webhook: secretbox unavailable; webhook delivery disabled", |
| | 135 | + "hint", "set Auth.TOTPKeyB64 to a base64 32-byte key", |
| | 136 | + "error", hookBoxErr) |
| | 137 | + } else { |
| | 138 | + p.Register(webhook.KindWebhookFanout, jobs.WebhookFanout(jobs.WebhookFanoutDeps{ |
| | 139 | + Pool: pool, Logger: logger, |
| | 140 | + })) |
| | 141 | + p.Register(webhook.KindWebhookDeliver, jobs.WebhookDeliver(jobs.WebhookDeliverDeps{ |
| | 142 | + Pool: pool, |
| | 143 | + Logger: logger, |
| | 144 | + SecretBox: hookBox, |
| | 145 | + SSRF: webhook.DefaultSSRFConfig(), |
| | 146 | + })) |
| | 147 | + p.Register(webhook.KindWebhookPurgeOld, jobs.WebhookPurgeOld(jobs.WebhookPurgeOldDeps{ |
| | 148 | + Pool: pool, Logger: logger, Retention: 30 * 24 * time.Hour, |
| | 149 | + })) |
| | 150 | + } |
| | 151 | + |
| 125 | return p.Run(ctx) | 152 | return p.Run(ctx) |
| 126 | }, | 153 | }, |
| 127 | } | 154 | } |
