Kris
9e503becd3
新增了插件相关的完整领域模型、应用服务、基础设施实现，包括： 1. 插件状态、注册模式、来源等基础枚举和数据结构 2. 插件清单解析、发现、加载工具类 3. 插件注册表领域服务和内存存储实现 4. 插件相关的命令、查询、事件定义 5. 插件REST API接口和DTO映射 6. 集成了原有通道适配器到插件系统 7. 新增内置插件注册和自动发现能力
52 lines
2.0 KiB
Python
52 lines
2.0 KiB
Python
from __future__ import annotations
|
|
|
|
import hashlib
|
|
import hmac
|
|
import logging
|
|
|
|
from yuxi.channel.channels.hooks.config import HookMapping
|
|
from yuxi.channel.domain.port.channel_request_verifier_port import VerifyResult
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
|
|
class HooksRequestVerifier:
|
|
def __init__(self, *, mappings: dict[tuple[str, str], HookMapping]) -> None:
|
|
self._mappings = mappings
|
|
|
|
@property
|
|
def channel_type(self) -> str:
|
|
return "hooks"
|
|
|
|
@property
|
|
def enabled(self) -> bool:
|
|
return any(m.secret for m in self._mappings.values())
|
|
|
|
async def verify(self, body: bytes, headers: dict[str, str]) -> VerifyResult:
|
|
path = headers.get("x-hook-path", "")
|
|
source = headers.get("x-hook-source", "*")
|
|
mapping = self._mappings.get((path, source)) or self._mappings.get((path, "*"))
|
|
if not mapping:
|
|
return VerifyResult(passed=False, method="hooks_path", reason="no_hook_mapping")
|
|
|
|
if not mapping.secret:
|
|
return VerifyResult(passed=True, method="hooks_none", reason="no_secret_configured")
|
|
|
|
auth_header = headers.get("authorization", "")
|
|
if auth_header.startswith("Bearer "):
|
|
token = auth_header[7:]
|
|
if hmac.compare_digest(token, mapping.secret):
|
|
return VerifyResult(passed=True, method="hooks_bearer")
|
|
return VerifyResult(passed=False, method="hooks_bearer", reason="invalid_bearer_token")
|
|
|
|
signature = headers.get("x-signature-256") or headers.get("x-hub-signature-256")
|
|
if signature:
|
|
if signature.startswith("sha256="):
|
|
signature = signature[7:]
|
|
expected = hmac.new(mapping.secret.encode(), body, hashlib.sha256).hexdigest()
|
|
if hmac.compare_digest(signature, expected):
|
|
return VerifyResult(passed=True, method="hooks_hmac")
|
|
return VerifyResult(passed=False, method="hooks_hmac", reason="invalid_signature")
|
|
|
|
return VerifyResult(passed=False, method="hooks_auth", reason="authentication_required")
|