Allow for email notifications with GitLab

controllers/webhook.js

@@ -0,0 +1,302 @@
+'use strict'
+
+const bufferEq = require('buffer-equal-constant-time')
+const path = require('path')
+const config = require(path.join(__dirname, '/../config'))
+const crypto = require('crypto')
+
+const gitFactory = require('../lib/GitServiceFactory')
+const Staticman = require('../lib/Staticman')
+
+/**
+ * Express handler for webhook requests/notifications generated by the backing git service.
+ */
+module.exports = async (req, res, next) => {
+  let errorsRaised = []
+
+  let service = null
+  let staticman = null
+  if (_calcIsVersion1WhenGitHubAssumed(req)) {
+    service = 'github'
+  } else {
+    /*
+     * In versions of the webhook endpoint beyond v1, we have the parameters necessary to
+     * instantiate a Staticman instance right away.
+     */
+    service = req.params.service
+    staticman = await new Staticman(req.params)
+    staticman.setConfigPath()
+  }
+
+  switch (service) {
+    case 'github':
+      await _handleWebhookGitHub(req, service, staticman).catch((errors) => {
+        errorsRaised = errorsRaised.concat(errors)
+      })
+      break
+    case 'gitlab':
+      await _handleWebhookGitLab(req, service, staticman).catch((errors) => {
+        errorsRaised = errorsRaised.concat(errors)
+      })
+      break
+    default:
+      errorsRaised.push('Unexpected service specified.')
+  }
+
+  if (errorsRaised.length > 0) {
+    res.status(400).send({
+      errors: JSON.stringify(errorsRaised)
+    })
+  } else {
+    res.status(200).send({
+      success: true
+    })
+  }
+}
+
+const _handleWebhookGitHub = async function (req, service, staticman) {
+  let errorsRaised = []
+
+  const event = req.headers['x-github-event']
+  if (!event) {
+    errorsRaised.push('No event found in the request')
+  } else {
+    if (event === 'pull_request') {
+      let webhookSecretExpected = null
+      if (staticman) {
+        // Webhook request authentication is NOT supported in v1 of the endpoint.
+        await staticman.getSiteConfig().then((siteConfig) => {
+          webhookSecretExpected = siteConfig.get('githubWebhookSecret')
+        })
+      }
+
+      let reqAuthenticated = true
+      if (webhookSecretExpected) {
+        reqAuthenticated = false
+        const webhookSecretSent = req.headers['x-hub-signature']
+        if (!webhookSecretSent) {
+          // This could be worth logging... unless the endpoint gets hammered with spam.
+          errorsRaised.push('No secret found in the webhook request')
+        } else if (_verifyGitHubSignature(webhookSecretExpected, JSON.stringify(req.body), webhookSecretSent)) {
+          reqAuthenticated = true
+        } else {
+          // This could be worth logging... unless the endpoint gets hammered with spam.
+          errorsRaised.push('Unable to verify authenticity of request')
+        }
+      }
+
+      if (reqAuthenticated) {
+        await _handleMergeRequest(req.params, service, req.body, staticman).catch((errors) => {
+          errorsRaised = errors
+        })
+      }
+    }
+  }
+
+  if (errorsRaised.length > 0) {
+    return Promise.reject(errorsRaised)
+  }
+}
+
+const _handleWebhookGitLab = async function (req, service, staticman) {
+  let errorsRaised = []
+
+  const event = req.headers['x-gitlab-event']
+  if (!event) {
+    errorsRaised.push('No event found in the request')
+  } else {
+    if (event === 'Merge Request Hook') {
+      let webhookSecretExpected = null
+      if (staticman) {
+        // Webhook request authentication is NOT supported in v1 of the endpoint.
+        await staticman.getSiteConfig().then((siteConfig) => {
+          webhookSecretExpected = siteConfig.get('gitlabWebhookSecret')
+        })
+      }
+
+      let reqAuthenticated = true
+      if (webhookSecretExpected) {
+        reqAuthenticated = false
+        const webhookSecretSent = req.headers['x-gitlab-token']
+        if (!webhookSecretSent) {
+          // This could be worth logging... unless the endpoint gets hammered with spam.
+          errorsRaised.push('No secret found in the webhook request')
+        } else if (webhookSecretExpected === webhookSecretSent) {
+          /*
+           * Whereas GitHub uses the webhook secret to sign the request body, GitLab does not.
+           * As such, just check that the received secret equals the expected value.
+           */
+          reqAuthenticated = true
+        } else {
+          // This could be worth logging... unless the endpoint gets hammered with spam.
+          errorsRaised.push('Unable to verify authenticity of request')
+        }
+      }
+
+      if (reqAuthenticated) {
+        await _handleMergeRequest(req.params, service, req.body, staticman).catch((errors) => {
+          errorsRaised = errors
+        })
+      }
+    }
+  }
+
+  if (errorsRaised.length > 0) {
+    return Promise.reject(errorsRaised)
+  }
+}
+
+const _calcIsVersion1WhenGitHubAssumed = function (req) {
+  const service = req.params.service
+  const version = req.params.version
+  return (!service && version === '1')
+}
+
+const _verifyGitHubSignature = function (secret, data, signature) {
+  const signedData = 'sha1=' + crypto.createHmac('sha1', secret).update(data).digest('hex')
+  return bufferEq(Buffer.from(signature), Buffer.from(signedData))
+}
+
+const _handleMergeRequest = async function (params, service, data, staticman) {
+  const errors = []
+
+  const ua = config.get('analytics.uaTrackingId')
+    ? require('universal-analytics')(config.get('analytics.uaTrackingId'))
+    : null
+
+  const version = params.version
+  const username = params.username
+  const repository = params.repository
+  const branch = params.branch
+
+  let gitService = null
+  let mergeReqNbr = null
+  if (service === 'github') {
+    gitService = await _buildGitHubService(version, service, username, repository, branch, data)
+    mergeReqNbr = data.number
+  } else if (service === 'gitlab') {
+    gitService = await gitFactory.create('gitlab', {
+      version: version,
+      username: username,
+      repository: repository,
+      branch: branch
+    })
+    mergeReqNbr = data.object_attributes.iid
+  } else {
+    errors.push('Unable to determine service.')
+    return Promise.reject(errors)
+  }
+
+  if (mergeReqNbr === null || typeof mergeReqNbr === 'undefined') {
+    errors.push('No pull/merge request number found.')
+    return Promise.reject(errors)
+  }
+
+  let review = await gitService.getReview(mergeReqNbr).catch((error) => {
+    const msg = `Failed to retrieve merge request ${mergeReqNbr} - ${error}`
+    console.error(msg)
+    errors.push(msg)
+    return Promise.reject(errors)
+  })
+
+  if (_calcIsMergeRequestStaticmanGenerated(review)) {
+    if (_calcIsMergeRequestAccepted(review)) {
+      await _createNotifyMailingList(review, staticman, ua).catch((error) => {
+        errors.push(error.message)
+      })
+
+      if (_calcIsMergeRequestBranchRequiresManualDelete(service)) {
+        await _deleteMergeRequestBranch(gitService, review, ua).catch((error) => {
+          errors.push(error)
+        })
+      }
+    }
+  }
+
+  if (errors.length > 0) {
+    return Promise.reject(errors)
+  }
+}
+
+const _buildGitHubService = function (version, service, username, repository, branch, data) {
+  /*
+   * In v1 of the endpoint, the service, username, repository, and branch parameters were
+   * ommitted. As such, if not provided in the webhook request URL, pull them from the webhook
+   * payload.
+   */
+  if (username === null || typeof username === 'undefined') {
+    username = data.repository.owner.login
+  }
+  if (repository === null || typeof repository === 'undefined') {
+    repository = data.repository.name
+  }
+  if (branch === null || typeof branch === 'undefined') {
+    branch = data.pull_request.base.ref
+  }
+
+  return gitFactory.create(service, {
+    version: version,
+    username: username,
+    repository: repository,
+    branch: branch
+  })
+}
+
+const _calcIsMergeRequestAccepted = function (review) {
+  return (review.state === 'merged' || review.state === 'closed')
+}
+
+const _calcIsMergeRequestStaticmanGenerated = function (review) {
+  return (review.sourceBranch.indexOf('staticman_') > -1)
+}
+
+const _calcIsMergeRequestBranchRequiresManualDelete = function (service) {
+  return (service === 'github')
+}
+
+const _createNotifyMailingList = async function (review, staticman, ua) {
+  const bodyMatch = review.body.match(/(?:.*?)<!--staticman_notification:(.+?)-->(?:.*?)/i)
+  if (_calcIsNotificationsEnabledWhenMergeRequestCreated(bodyMatch)) {
+    try {
+      const parsedBody = JSON.parse(bodyMatch[1])
+      if (staticman === null) {
+        staticman = await new Staticman(parsedBody.parameters)
+        staticman.setConfigPath(parsedBody.configPath)
+      }
+
+      await staticman.processMerge(parsedBody.fields, parsedBody.extendedFields, parsedBody.options).then(msg => {
+        if (ua) {
+          ua.event('Hooks', 'Create/notify mailing list').send()
+        }
+      })
+    } catch (err) {
+      if (ua) {
+        ua.event('Hooks', 'Create/notify mailing list error').send()
+      }
+
+      return Promise.reject(err)
+    }
+  }
+}
+
+const _calcIsNotificationsEnabledWhenMergeRequestCreated = function (bodyMatch) {
+  return (bodyMatch && (bodyMatch.length === 2))
+}
+
+const _deleteMergeRequestBranch = async function (gitService, review, ua) {
+  try {
+    // This will throw the error 'Reference does not exist' if the branch has already been deleted.
+    await gitService.deleteBranch(review.sourceBranch)
+    if (ua) {
+      ua.event('Hooks', 'Delete branch').send()
+    }
+  } catch (err) {
+    if (ua) {
+      ua.event('Hooks', 'Delete branch error').send()
+    }
+
+    const msg = `Failed to delete merge branch ${review.sourceBranch} - ${err}`
+    console.error(msg)
+    return Promise.reject(msg)
+  }
+}

lib/GitHub.js

@@ -19,7 +19,8 @@ class GitHub extends GitService {
       const isAppAuth = config.get('githubAppID') &&
         config.get('githubPrivateKey')
       const isLegacyAuth = config.get('githubToken') &&
-        ['1', '2'].includes(options.version)
+        // Staticman version may not always be available to the caller. As such, allow for blank.
+        ['1', '2', ''].includes(options.version)
 
       let authToken
 

lib/Staticman.js

@@ -573,18 +573,12 @@ class Staticman {
   }
 
   processMerge (fields, options) {
-    this.fields = Object.assign({}, fields)
-    this.options = Object.assign({}, options)
-
     return this.getSiteConfig().then(config => {
       const subscriptions = this._initialiseSubscriptions()
 
       return subscriptions.send(options.parent, fields, options, this.siteConfig)
     }).catch(err => {
-      return Promise.reject(errorHandler('ERROR_PROCESSING_MERGE', {
-        err,
-        instance: this
-      }))
+      return Promise.reject(err)
     })
   }