feat: add custom webhooks

Author: SergioRibera

README.md

@@ -131,8 +131,9 @@ When a `secret` is configured in the webhook:
 GRHooks currently supports webhooks from:
 
 - GitHub
+- Gitlab
+- [Custom](./crates/origin/README.md)
 
 Plans to support:
 
-- GitLab
 - Bitbucket

crates/origin/src/lib.rs

@@ -8,13 +8,15 @@ pub use crate::errors::Error;
 mod errors;
 mod github;
 mod gitlab;
+mod webhook;
 
 #[derive(Clone, Copy, Debug, Default, Deserialize)]
 #[serde(rename_all = "lowercase")]
 pub enum Origin {
     #[default]
     GitHub,
     GitLab,
+    Webhook,
 }
 
 impl<'a> TryFrom<&'a HeaderMap> for Origin {
@@ -25,6 +27,8 @@ impl<'a> TryFrom<&'a HeaderMap> for Origin {
             Ok(Origin::GitHub)
         } else if headers.contains_key("X-Gitlab-Event") {
             Ok(Origin::GitLab)
+        } else if headers.contains_key("X-Webhook-Event") {
+            Ok(Origin::Webhook)
         } else {
             Err(Self::Error::MissingHeader("X-*-Event"))
         }
@@ -47,13 +51,15 @@ impl WebhookOrigin for Origin {
         match self {
             Origin::GitHub => github::GitHubValidator.validate_headers(headers),
             Origin::GitLab => gitlab::GitLabValidator.validate_headers(headers),
+            Origin::Webhook => webhook::WebhookValidator.validate_headers(headers),
         }
     }
 
     fn extract_event_type(&self, headers: &HeaderMap) -> Result<String, Error> {
         match self {
             Origin::GitHub => github::GitHubValidator.extract_event_type(headers),
             Origin::GitLab => gitlab::GitLabValidator.extract_event_type(headers),
+            Origin::Webhook => webhook::WebhookValidator.extract_event_type(headers),
         }
     }
 
@@ -66,6 +72,7 @@ impl WebhookOrigin for Origin {
         match self {
             Origin::GitHub => github::GitHubValidator.validate_signature(headers, secret, body),
             Origin::GitLab => gitlab::GitLabValidator.validate_signature(headers, secret, body),
+            Origin::Webhook => webhook::WebhookValidator.validate_signature(headers, secret, body),
         }
     }
 }

crates/origin/src/webhook.rs

@@ -0,0 +1,67 @@
+use axum::http::HeaderMap;
+use hmac::{Hmac, Mac};
+use sha1::Sha1;
+use sha2::Sha256;
+
+use crate::{Error, WebhookOrigin};
+
+pub struct WebhookValidator;
+
+impl WebhookOrigin for WebhookValidator {
+    fn validate_headers(&self, headers: &HeaderMap) -> Result<(), Error> {
+        const REQUIRED_HEADERS: [&str; 3] = ["X-Webhook-ID", "X-Webhook-Event", "User-Agent"];
+
+        for header in REQUIRED_HEADERS {
+            if !headers.contains_key(header) {
+                return Err(Error::MissingHeader(header));
+            }
+        }
+
+        Ok(())
+    }
+
+    fn extract_event_type(&self, headers: &HeaderMap) -> Result<String, Error> {
+        headers
+            .get("X-Webhook-Event")
+            .and_then(|v| v.to_str().ok())
+            .map(ToString::to_string)
+            .ok_or(Error::MissingHeader("X-Webhook-Event"))
+    }
+
+    fn validate_signature(
+        &self,
+        headers: &HeaderMap,
+        secret: &str,
+        body: &[u8],
+    ) -> Result<(), Error> {
+        let (expected_signature, signature) = if let Some(signature) = headers
+            .get("X-Webhook-Signature-256")
+            .and_then(|v| v.to_str().ok())
+        {
+            let signature = signature.trim_start_matches("sha256=");
+            let mut mac = Hmac::<Sha256>::new_from_slice(secret.as_bytes())
+                .map_err(|_| Error::InvalidSignature)?;
+            mac.update(body);
+            let expected_signature = hex::encode(mac.finalize().into_bytes());
+            (expected_signature, signature)
+        } else {
+            let signature = headers
+                .get("X-Webhook-Signature")
+                .and_then(|v| v.to_str().ok())
+                .ok_or(Error::MissingHeader("X-Webhook-Signature"))?;
+            let signature = signature.trim_start_matches("sha1=");
+            let mut mac = Hmac::<Sha1>::new_from_slice(secret.as_bytes())
+                .map_err(|_| Error::InvalidSignature)?;
+            mac.update(body);
+            let expected_signature = hex::encode(mac.finalize().into_bytes());
+            (expected_signature, signature)
+        };
+
+        if !constant_time_eq::constant_time_eq(signature.as_bytes(), expected_signature.as_bytes())
+        {
+            return Err(Error::InvalidSignature);
+        }
+
+        Ok(())
+    }
+}