133 lines
4.1 KiB
Elixir
133 lines
4.1 KiB
Elixir
defmodule ToweropsWeb.Api.V1.GaiiaWebhookController do
|
|
@moduledoc """
|
|
Webhook endpoint for receiving real-time updates from Gaiia.
|
|
|
|
Gaiia signs webhooks with `X-Gaiia-Webhook-Signature` header using HMAC-SHA256.
|
|
Format: `t=<unix_timestamp>,v1=<hex_signature>`
|
|
Signed payload: `<timestamp>.<raw_body>`
|
|
|
|
If a webhook_secret is configured AND the signature header is present,
|
|
we verify it. Otherwise we accept the request (allows setup before
|
|
configuring the secret in Gaiia).
|
|
|
|
Route: POST /api/v1/webhooks/gaiia/:organization_id
|
|
"""
|
|
use ToweropsWeb, :controller
|
|
|
|
alias Towerops.Gaiia.Webhooks
|
|
alias Towerops.Integrations
|
|
|
|
require Logger
|
|
|
|
@max_age_seconds 300
|
|
|
|
def create(conn, %{"organization_id" => organization_id}) do
|
|
with {:ok, integration} <- get_gaiia_integration(organization_id),
|
|
:ok <- maybe_verify_signature(conn, integration),
|
|
{:ok, event} <- get_event(conn.body_params) do
|
|
data = Map.get(conn.body_params, "payload", Map.get(conn.body_params, "data", %{}))
|
|
entity_id = Map.get(conn.body_params, "objectId", Map.get(data, "id"))
|
|
payload = %{"entity_id" => entity_id, "data" => data}
|
|
|
|
Webhooks.process_event(organization_id, event, payload)
|
|
|
|
json(conn, %{status: "ok"})
|
|
end
|
|
end
|
|
|
|
defp get_gaiia_integration(organization_id) do
|
|
case Integrations.get_integration(organization_id, "gaiia") do
|
|
{:ok, integration} -> {:ok, integration}
|
|
{:error, :not_found} -> {:error, :not_found}
|
|
end
|
|
end
|
|
|
|
defp maybe_verify_signature(conn, integration) do
|
|
secret = get_in(integration.credentials, ["webhook_secret"])
|
|
sig_header = get_req_header(conn, "x-gaiia-webhook-signature")
|
|
|
|
case {secret, sig_header} do
|
|
# No secret configured — accept without verification
|
|
{nil, _} ->
|
|
:ok
|
|
|
|
{"", _} ->
|
|
:ok
|
|
|
|
# Secret configured but no signature header — accept (Gaiia may not have secret set yet)
|
|
{_secret, []} ->
|
|
Logger.warning("Gaiia webhook received without signature header, skipping verification")
|
|
:ok
|
|
|
|
# Both present — verify
|
|
{secret, [header]} ->
|
|
raw_body = conn.private[:raw_body] || ""
|
|
verify_signature(header, raw_body, secret)
|
|
end
|
|
end
|
|
|
|
defp verify_signature(header, raw_body, secret) do
|
|
with {:ok, timestamp, signature} <- parse_signature_header(header),
|
|
:ok <- check_timestamp(timestamp) do
|
|
signed_payload = timestamp <> "." <> raw_body
|
|
|
|
computed =
|
|
:hmac
|
|
|> :crypto.mac(:sha256, secret, signed_payload)
|
|
|> Base.encode16(case: :lower)
|
|
|
|
if Plug.Crypto.secure_compare(computed, signature) do
|
|
:ok
|
|
else
|
|
Logger.warning("Gaiia webhook signature mismatch")
|
|
{:error, :invalid_signature}
|
|
end
|
|
end
|
|
end
|
|
|
|
defp parse_signature_header(header) do
|
|
parts =
|
|
header
|
|
|> String.split(",")
|
|
|> Enum.map(&String.split(&1, "=", parts: 2))
|
|
|> Map.new(fn [k, v] -> {String.trim(k), v} end)
|
|
|
|
case {Map.get(parts, "t"), Map.get(parts, "v1")} do
|
|
{t, v1} when is_binary(t) and is_binary(v1) -> {:ok, t, v1}
|
|
_ -> {:error, :invalid_signature}
|
|
end
|
|
rescue
|
|
_ -> {:error, :invalid_signature}
|
|
end
|
|
|
|
defp check_timestamp(timestamp) do
|
|
case Integer.parse(timestamp) do
|
|
{ts, ""} ->
|
|
now = System.system_time(:second)
|
|
if abs(now - ts) <= @max_age_seconds, do: :ok, else: {:error, :invalid_signature}
|
|
|
|
_ ->
|
|
{:error, :invalid_signature}
|
|
end
|
|
end
|
|
|
|
defp get_event(%{"eventName" => event}) when is_binary(event), do: {:ok, event}
|
|
defp get_event(%{"event" => event}) when is_binary(event), do: {:ok, event}
|
|
defp get_event(_), do: {:error, :missing_event}
|
|
|
|
def action(conn, _opts) do
|
|
case apply(__MODULE__, action_name(conn), [conn, conn.params]) do
|
|
{:error, :not_found} ->
|
|
conn |> put_status(:not_found) |> json(%{error: "Gaiia integration not found"})
|
|
|
|
{:error, :invalid_signature} ->
|
|
conn |> put_status(:unauthorized) |> json(%{error: "Invalid webhook signature"})
|
|
|
|
{:error, :missing_event} ->
|
|
conn |> put_status(:bad_request) |> json(%{error: "Missing event field"})
|
|
|
|
other ->
|
|
other
|
|
end
|
|
end
|
|
end
|