CI / Web-Barrierefreiheitspruefung (axe, Tastatur, Reflow, Textabstaende) (push) Canceled after 0s
CI / Web-Barrierefreiheitspruefung (axe, Tastatur, Reflow, Textabstaende) (pull_request) Canceled after 0s
Archive-Schnittstellen-Vertragstests / contract-tests (push) Canceled after 0s
CI / Core-Modul (Build/Vet/Test) (push) Canceled after 0s
CI / DMS Security-Test-Gate (AC5, Merge-Gate) (push) Canceled after 0s
CI / Connect Security-Test-Gate (QA-01 AC4, Merge-Gate) (push) Canceled after 0s
CI / DMS-Modul (Lint/Build/Test/Coverage/Artefakt) (push) Canceled after 0s
CI / DMS-Modul Supply-Chain-Scan (govulncheck) (push) Canceled after 0s
CI / Web (dms-browser) (push) Canceled after 0s
CI / Web (pdf-viewer) (push) Canceled after 0s
CI / Web (shl) (push) Canceled after 0s
AI-Pflichttest-Gate / pflichttest-gate (pull_request) Canceled after 0s
Archive-Pflichttest-Gate / pflichttest-gate (pull_request) Canceled after 0s
CI / Core-Modul (Build/Vet/Test) (pull_request) Canceled after 0s
Archive-Schnittstellen-Vertragstests / contract-tests (pull_request) Canceled after 0s
Connect-Schnittstellen-Vertragstests / contract-tests (push) Canceled after 0s
Supply-Chain-Scan (Go) / govulncheck (push) Canceled after 0s
Workflow-Schnittstellen-Vertragstests / contract-tests (push) Canceled after 0s
Connect-Schnittstellen-Vertragstests / contract-tests (pull_request) Canceled after 0s
Core-Schnittstellen-Vertragstests / contract-tests (pull_request) Canceled after 0s
Supply-Chain-Scan (Go) / govulncheck (pull_request) Canceled after 0s
Mail-Schnittstellen-Vertragstests / contract-tests (pull_request) Canceled after 0s
Mail-Pflichttest-Gate / pflichttest-gate (pull_request) Canceled after 0s
Workflow-Pflichttest-Gate / pflichttest-gate (pull_request) Canceled after 0s
CI / DMS Security-Test-Gate (AC5, Merge-Gate) (pull_request) Canceled after 0s
CI / Connect Security-Test-Gate (QA-01 AC4, Merge-Gate) (pull_request) Canceled after 0s
CI / DMS-Modul (Lint/Build/Test/Coverage/Artefakt) (pull_request) Canceled after 0s
CI / DMS-Modul Supply-Chain-Scan (govulncheck) (pull_request) Canceled after 0s
CI / Web (dms-browser) (pull_request) Canceled after 0s
CI / Web (pdf-viewer) (pull_request) Canceled after 0s
CI / Web (shl) (pull_request) Canceled after 0s
Mail-Schnittstellen-Vertragstests / contract-tests (push) Canceled after 0s
Supply-Chain-Scan (npm) / npm-audit (pull_request) Canceled after 0s
Core-Pflichttest-Gate / pflichttest-gate (pull_request) Canceled after 0s
RBAC-Rollenhierarchie-Pflichtgate / rbac-policy-invariant (pull_request) Canceled after 0s
Workflow-Schnittstellen-Vertragstests / contract-tests (pull_request) Canceled after 0s
Nur Pakete, deren Code ohne Kommentare/Importpfade byte-gleich ist: - httpclient: ai, connect (Root behaelt eigene Kopie wegen strengerem Waechtertest) - svcauth: archive, ai, workflow - auditclient: ai, connect, archive - tenantregistryclient: dms, ai, workflow (archive weicht ab, bleibt) - policyclient: mail, connect (dms weicht ab, bleibt) - httpharden: Root, archive (dms weicht ab, bleibt) - loadtest: mail, ai (archive, connect weichen ab, bleiben) go.mod (require + replace) fuer ai, connect, workflow; Pflichttest-Gates von ai/workflow und CI-Pfadfilter um common/ erweitert, damit die sicherheitskritischen Pakete (svcauth, tenantregistryclient) weiter gegated werden. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
109 lines
3.6 KiB
Go
109 lines
3.6 KiB
Go
// Package webhookclient ist ein schlanker HTTP-Client fuer Core API-07
|
|
// (internal/webhook, zentrale Webhook-Registry). Connect ist ein physisch
|
|
// getrenntes Go-Modul und kann Cores internal/webhook daher nicht direkt
|
|
// importieren -- nur ueber dessen HTTP-Schnittstelle (gleiches Muster wie
|
|
// connect/internal/auditclient fuer AUD-08 und dms/internal/retentionclient
|
|
// fuer Archive RET-05).
|
|
package webhookclient
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"encoding/json"
|
|
"fmt"
|
|
"net/http"
|
|
"net/url"
|
|
"time"
|
|
|
|
"gitea.perlbach24.de/scripte/nexarch/common/httpclient"
|
|
)
|
|
|
|
type Client struct {
|
|
BaseURL string
|
|
ServiceToken string
|
|
HTTPClient *http.Client
|
|
}
|
|
|
|
func New(baseURL, serviceToken string) *Client {
|
|
return &Client{BaseURL: baseURL, ServiceToken: serviceToken, HTTPClient: httpclient.Default()}
|
|
}
|
|
|
|
// Subscription spiegelt Core API-07s Antwort auf eine Registrierung.
|
|
type Subscription struct {
|
|
ID string `json:"id"`
|
|
EventType string `json:"event_type"`
|
|
TargetURL string `json:"target_url"`
|
|
CreatedAt time.Time `json:"created_at"`
|
|
}
|
|
|
|
type subscribeRequest struct {
|
|
TenantSlug string `json:"tenant_slug"`
|
|
EventType string `json:"event_type"`
|
|
TargetURL string `json:"target_url"`
|
|
Secret string `json:"secret"`
|
|
}
|
|
|
|
// Subscribe registriert targetURL bei Core API-07 fuer eventType. Jeder
|
|
// Fehler (Transport, Timeout, Nicht-2xx) wird als Fehler zurueckgegeben --
|
|
// der Aufrufer entscheidet, ob/wie er das nachbehandelt (Akzeptanzkriterium
|
|
// 1).
|
|
func (c *Client) Subscribe(ctx context.Context, tenantSlug, eventType, targetURL, secret string) (Subscription, error) {
|
|
body, err := json.Marshal(subscribeRequest{
|
|
TenantSlug: tenantSlug, EventType: eventType, TargetURL: targetURL, Secret: secret,
|
|
})
|
|
if err != nil {
|
|
return Subscription{}, fmt.Errorf("webhookclient: request kodieren: %w", err)
|
|
}
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.BaseURL+"/webhooks/subscriptions", bytes.NewReader(body))
|
|
if err != nil {
|
|
return Subscription{}, fmt.Errorf("webhookclient: request bauen: %w", err)
|
|
}
|
|
req.Header.Set("Content-Type", "application/json")
|
|
req.Header.Set("X-Service-Token", c.ServiceToken)
|
|
|
|
resp, err := c.httpClient().Do(req)
|
|
if err != nil {
|
|
return Subscription{}, fmt.Errorf("webhookclient: aufruf fehlgeschlagen: %w", err)
|
|
}
|
|
defer func() { _ = resp.Body.Close() }()
|
|
|
|
if resp.StatusCode != http.StatusCreated {
|
|
return Subscription{}, fmt.Errorf("webhookclient: unerwarteter status %d", resp.StatusCode)
|
|
}
|
|
var out Subscription
|
|
if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
|
|
return Subscription{}, fmt.Errorf("webhookclient: antwort dekodieren: %w", err)
|
|
}
|
|
return out, nil
|
|
}
|
|
|
|
// Unsubscribe entfernt subscriptionID vollstaendig aus Core API-07
|
|
// (Akzeptanzkriterium 3).
|
|
func (c *Client) Unsubscribe(ctx context.Context, tenantSlug, subscriptionID string) error {
|
|
target := c.BaseURL + "/webhooks/subscriptions/" + url.PathEscape(subscriptionID) +
|
|
"?tenant_slug=" + url.QueryEscape(tenantSlug)
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodDelete, target, nil)
|
|
if err != nil {
|
|
return fmt.Errorf("webhookclient: request bauen: %w", err)
|
|
}
|
|
req.Header.Set("X-Service-Token", c.ServiceToken)
|
|
|
|
resp, err := c.httpClient().Do(req)
|
|
if err != nil {
|
|
return fmt.Errorf("webhookclient: aufruf fehlgeschlagen: %w", err)
|
|
}
|
|
defer func() { _ = resp.Body.Close() }()
|
|
|
|
if resp.StatusCode != http.StatusNoContent {
|
|
return fmt.Errorf("webhookclient: unerwarteter status %d", resp.StatusCode)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (c *Client) httpClient() *http.Client {
|
|
if c.HTTPClient != nil {
|
|
return c.HTTPClient
|
|
}
|
|
return httpclient.Default()
|
|
}
|