mirror of
https://github.com/hanzo-fi/webhooks.git
synced 2026-10-30 20:32:55 +00:00
* fix: resolve P0/P1 reliability and security issues - P0: Process messages synchronously to prevent data loss on crash The Watermill handler now blocks until webhook delivery completes. Messages are only acknowledged after processing, not before. Errors on invalid payloads are returned (nack) instead of swallowed. Per-config failures use continue instead of return, so one bad endpoint no longer blocks delivery to other matching configs. - P1: Replace panic with error on unknown filter key FindManyConfigs now returns an error instead of panicking when called with an unrecognized filter key. A single bad API request no longer crashes the process. - P1: Remove environment and secret logging Removed os.Environ() dumps from server and worker startup. Replaced config %+v logging with safe ID/endpoint-only logging. Removed event-payload from OpenTelemetry span attributes. - Docs: Add architecture, message-processing, and security docs. Fix CTE typo in retry-mechanism.md. No breaking changes to public API, Store interface, or CLI flags. * chore: add CODEOWNERS assigning @formancehq/backend as default reviewers * fix: remove dead code flagged by ineffassign linter * fix: address CodeRabbit review feedback - Return error (nack) when InsertOneAttempt fails for non-success attempts, preventing silent loss of retry records - Rewrite TestProcessMessages_SynchronousProcessing to be deterministic: HTTP handler blocks on a channel, test proves handler is blocked until the HTTP response completes - Add TestProcessMessages_NackOnInsertFailureForRetry for the new nack path - Expand secret logging test patterns to cover %v and more variable names - Rename TestConfigStringerDoesNotLeakSecret to TestDocument_PercentPlusVLeaksSecrets - Fix retry-mechanism.md claim query priority documentation: DISTINCT ON does per-webhook ordering, not global priority * fix: propagate errors to span, avoid err shadowing in defer - Rename loop-scoped err to attemptErr/insertErr so the defer closure captures the correct error for span.RecordError() - Add explicit span.RecordError() on MakeAttempt and InsertOneAttempt failures that previously went unrecorded in traces - Assign err before return on nack path so the defer sees it - Update Go version in architecture doc to 1.25+ (matches go.mod) Addresses review comments from paul-nicolas on PR #142. * fix: handle transport errors in MakeAttempt as retryable attempts - MakeAttempt now returns a retryable Attempt (instead of a bare error) when httpClient.Do fails due to transport/timeout, preventing event loss since the attempt record is persisted for the retry loop - Replace base64-looking test secret with plain dummy to avoid triggering secret scanners in CI Addresses CodeRabbit review comments on PR #142.
121 lines
3.7 KiB
Go
121 lines
3.7 KiB
Go
package webhooks
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
"time"
|
|
|
|
"github.com/formancehq/go-libs/v2/logging"
|
|
"github.com/formancehq/webhooks/pkg/security"
|
|
"github.com/pkg/errors"
|
|
"github.com/uptrace/bun"
|
|
)
|
|
|
|
const (
|
|
StatusAttemptSuccess = "success"
|
|
StatusAttemptToRetry = "to retry"
|
|
StatusAttemptRetrying = "retrying"
|
|
StatusAttemptFailed = "failed"
|
|
)
|
|
|
|
type Attempt struct {
|
|
bun.BaseModel `bun:"table:attempts"`
|
|
|
|
ID string `json:"id" bun:",pk"`
|
|
WebhookID string `json:"webhookID" bun:"webhook_id"`
|
|
CreatedAt time.Time `json:"createdAt" bun:"created_at,nullzero,notnull,default:current_timestamp"`
|
|
UpdatedAt time.Time `json:"updatedAt" bun:"updated_at,nullzero,notnull,default:current_timestamp"`
|
|
Config Config `json:"config" bun:"type:jsonb"`
|
|
Payload string `json:"payload"`
|
|
StatusCode int `json:"statusCode" bun:"status_code"`
|
|
RetryAttempt int `json:"retryAttempt" bun:"retry_attempt"`
|
|
Status string `json:"status"`
|
|
NextRetryAfter time.Time `json:"nextRetryAfter,omitempty" bun:"next_retry_after,nullzero"`
|
|
}
|
|
|
|
func MakeAttempt(ctx context.Context, httpClient *http.Client, retryPolicy BackoffPolicy, id, webhookID string, attemptNb int, cfg Config, idempotencyKey string, payload []byte, isTest bool) (Attempt, error) {
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodPost, cfg.Endpoint, bytes.NewBuffer(payload))
|
|
if err != nil {
|
|
return Attempt{}, errors.Wrap(err, "http.NewRequestWithContext")
|
|
}
|
|
|
|
ts := time.Now().UTC()
|
|
timestamp := ts.Unix()
|
|
signature, err := security.Sign(webhookID, timestamp, cfg.Secret, payload)
|
|
if err != nil {
|
|
return Attempt{}, errors.Wrap(err, "security.Sign")
|
|
}
|
|
|
|
req.Header.Set("content-type", "application/json")
|
|
req.Header.Set("user-agent", "formance-webhooks/v0")
|
|
req.Header.Set("formance-webhook-id", webhookID)
|
|
req.Header.Set("formance-webhook-timestamp", fmt.Sprintf("%d", timestamp))
|
|
req.Header.Set("formance-webhook-signature", signature)
|
|
req.Header.Set("formance-webhook-test", fmt.Sprintf("%v", isTest))
|
|
if idempotencyKey != "" {
|
|
req.Header.Set("formance-webhook-idempotency-key", idempotencyKey)
|
|
}
|
|
|
|
resp, err := httpClient.Do(req)
|
|
if err != nil {
|
|
// Transport/timeout failure — return a retryable attempt so the record is
|
|
// persisted and the retry loop picks it up instead of losing the event.
|
|
attempt := Attempt{
|
|
ID: id,
|
|
WebhookID: webhookID,
|
|
Config: cfg,
|
|
Payload: string(payload),
|
|
StatusCode: 0,
|
|
RetryAttempt: attemptNb,
|
|
}
|
|
delay, delayErr := retryPolicy.GetRetryDelay(attemptNb)
|
|
if delayErr != nil {
|
|
attempt.Status = StatusAttemptFailed
|
|
return attempt, nil
|
|
}
|
|
attempt.Status = StatusAttemptToRetry
|
|
attempt.NextRetryAfter = ts.Add(delay)
|
|
return attempt, nil
|
|
}
|
|
|
|
defer func() {
|
|
if err := resp.Body.Close(); err != nil {
|
|
logging.FromContext(ctx).Error(
|
|
errors.Wrap(err, "http.Response.Body.Close"))
|
|
}
|
|
}()
|
|
|
|
body, err := io.ReadAll(resp.Body)
|
|
if err != nil {
|
|
return Attempt{}, errors.Wrap(err, "io.ReadAll")
|
|
}
|
|
logging.FromContext(ctx).Debugf("webhooks.MakeAttempt: server response body: %s", string(body))
|
|
|
|
attempt := Attempt{
|
|
ID: id,
|
|
WebhookID: webhookID,
|
|
Config: cfg,
|
|
Payload: string(payload),
|
|
StatusCode: resp.StatusCode,
|
|
RetryAttempt: attemptNb,
|
|
}
|
|
|
|
if resp.StatusCode >= http.StatusOK && resp.StatusCode < http.StatusMultipleChoices {
|
|
attempt.Status = StatusAttemptSuccess
|
|
return attempt, nil
|
|
}
|
|
|
|
delay, err := retryPolicy.GetRetryDelay(attemptNb)
|
|
if err != nil {
|
|
attempt.Status = StatusAttemptFailed
|
|
return attempt, nil
|
|
}
|
|
|
|
attempt.Status = StatusAttemptToRetry
|
|
attempt.NextRetryAfter = ts.Add(delay)
|
|
return attempt, nil
|
|
}
|