mirror of
https://github.com/Sea-Haven-Industries/open-swe.git
synced 2026-09-30 08:03:15 +00:00
Adam Moussa
b3fc62da80
Plan step C4 (docs/upstream-sync/domain-reorg/reorg-build-plan.md, approved
decisions 1-2): split the 2,590-line agent/webapp.py monolith into
agent/webhooks/common.py (shared verify/dispatch helpers), agent/api/app.py
(composition), agent/api/health.py (/health + /webhooks/run-complete), and
per-source {github,linear,slack,jira,confluence}_routes.py. Atlassian
Connect lifecycle + descriptor routes (/connect/*) fold into
confluence_routes.py; webapp.py becomes the upstream-shaped compatibility
shim (from .api.app import app). langgraph.json http.app stays
agent.webapp:app via the shim.
Fork content, upstream layout: linear/slack route files verified
content-identical to upstream 8356eb34 and taken verbatim; github_routes is
upstream + the fork's CI auto-fix trigger wiring; jira/confluence routes are
fork-only, transformed to the same common.X / service.X module-attribute
style. All signature verification (GitHub HMAC, Slack, Linear
timestamp-freshness, verify_jira_secret + opt-in HMAC/timestamp/IP
allowlist, Connect JWT/qsh), token-attribution gating, TID-COLLIDE-01 repo
binding, _is_repo_auto_review_enabled gates, and public-repo org gate move
unchanged.
Handlers rewired from webapp.X to common.X; test monkeypatch sites across
26 files + conftest.py + e2e/harness.py retargeted to
webhook_common/handler/route modules per upstream's pattern. Residual
agent.webapp importers: only the shim, langgraph.json http.app, Makefile
uvicorn target, and docs (doc-path updates land in C7).
Gates: ruff check + format, pytest --co, full unit (1637 passed), full
Playwright E2E vs real langgraph dev (9/9), residual-importer sweep.
53 lines
1.9 KiB
Python
53 lines
1.9 KiB
Python
"""Replay-window enforcement for Linear webhook signature verification (AUTHZ-001)."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import hashlib
|
|
import hmac
|
|
import json
|
|
from datetime import UTC, datetime
|
|
|
|
from agent.webhooks import common as webhook_common
|
|
|
|
_SECRET = "linear-signing-secret"
|
|
|
|
|
|
def _sign(body: bytes) -> str:
|
|
return hmac.new(_SECRET.encode("utf-8"), body, hashlib.sha256).hexdigest()
|
|
|
|
|
|
def _now_ms() -> int:
|
|
return int(datetime.now(UTC).timestamp() * 1000)
|
|
|
|
|
|
def test_fresh_timestamp_accepted() -> None:
|
|
body = json.dumps({"type": "Comment", "webhookTimestamp": _now_ms()}).encode()
|
|
assert webhook_common.verify_linear_signature(body, _sign(body), _SECRET) is True
|
|
|
|
|
|
def test_stale_timestamp_rejected() -> None:
|
|
stale = _now_ms() - 10 * 60 * 1000 # 10 minutes old
|
|
body = json.dumps({"type": "Comment", "webhookTimestamp": stale}).encode()
|
|
# Signature is valid, but the timestamp is outside the freshness window.
|
|
assert webhook_common.verify_linear_signature(body, _sign(body), _SECRET) is False
|
|
|
|
|
|
def test_future_timestamp_rejected() -> None:
|
|
future = _now_ms() + 10 * 60 * 1000
|
|
body = json.dumps({"type": "Comment", "webhookTimestamp": future}).encode()
|
|
assert webhook_common.verify_linear_signature(body, _sign(body), _SECRET) is False
|
|
|
|
|
|
def test_missing_timestamp_rejected() -> None:
|
|
body = json.dumps({"type": "Comment"}).encode()
|
|
assert webhook_common.verify_linear_signature(body, _sign(body), _SECRET) is False
|
|
|
|
|
|
def test_non_numeric_timestamp_rejected() -> None:
|
|
body = json.dumps({"type": "Comment", "webhookTimestamp": "not-a-number"}).encode()
|
|
assert webhook_common.verify_linear_signature(body, _sign(body), _SECRET) is False
|
|
|
|
|
|
def test_bad_signature_rejected_even_when_fresh() -> None:
|
|
body = json.dumps({"type": "Comment", "webhookTimestamp": _now_ms()}).encode()
|
|
assert webhook_common.verify_linear_signature(body, "deadbeef", _SECRET) is False
|