`bf76678`

S33: register webhook worker jobs

Authored by

espadonne 4 days ago

SHA: bf76678a177af1e1a75bd6b6bc9e2ae8d5ddb876
Parents: ff0e41e
Tree: c4a13ed

1 changed file

Status	File	+	-
M	`cmd/shithubd/worker.go`	27	0

cmd/shithubd/worker.gomodified

  	"github.com/tenseleyFlow/shithub/internal/auth/audit"
  	"github.com/tenseleyFlow/shithub/internal/auth/email"
 +	"github.com/tenseleyFlow/shithub/internal/auth/secretbox"
  	"github.com/tenseleyFlow/shithub/internal/infra/config"
  	"github.com/tenseleyFlow/shithub/internal/infra/db"
  	"github.com/tenseleyFlow/shithub/internal/infra/storage"
 +	"github.com/tenseleyFlow/shithub/internal/webhook"
  	"github.com/tenseleyFlow/shithub/internal/worker"
  	"github.com/tenseleyFlow/shithub/internal/worker/jobs"
+ )
  			UnsubscribeKey: notifUnsubscribeKey(cfg, logger),
  		}))
 +		// Webhook delivery (S33). The fan-out drains domain_events
 +		// past its own cursor; deliver runs per-row HTTP POSTs;
 +		// purge-old prunes terminal rows past the retention window.
 +		// We reuse the TOTP key as the at-rest secretbox key — both
 +		// are encrypted-blob columns in the same trust domain.
 +		hookBox, hookBoxErr := secretbox.FromBase64(cfg.Auth.TOTPKeyB64)
 +		if hookBoxErr != nil {
 +			logger.Warn("webhook: secretbox unavailable; webhook delivery disabled",
 +				"hint", "set Auth.TOTPKeyB64 to a base64 32-byte key",
 +				"error", hookBoxErr)
 +		} else {
 +			p.Register(webhook.KindWebhookFanout, jobs.WebhookFanout(jobs.WebhookFanoutDeps{
 +				Pool: pool, Logger: logger,
 +			}))
 +			p.Register(webhook.KindWebhookDeliver, jobs.WebhookDeliver(jobs.WebhookDeliverDeps{
 +				Pool:      pool,
 +				Logger:    logger,
 +				SecretBox: hookBox,
 +				SSRF:      webhook.DefaultSSRFConfig(),
 +			}))
 +			p.Register(webhook.KindWebhookPurgeOld, jobs.WebhookPurgeOld(jobs.WebhookPurgeOldDeps{
 +				Pool: pool, Logger: logger, Retention: 30 * 24 * time.Hour,
 +			}))
 +		}
++
  		return p.Run(ctx)
  	},
+ }