280 lines
10 KiB
PHP
280 lines
10 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Deploymentcenter\Modules\Notify;
|
|
|
|
use Deploymentcenter\Core\Config;
|
|
use Deploymentcenter\Core\Logger;
|
|
use PDO;
|
|
|
|
/**
|
|
* Ausgehende Webhooks.
|
|
*
|
|
* Ereignisgesteuerte Benachrichtigung statt Polling: Agenten und Chat-Kanaele
|
|
* (Telegram, Matrix, n8n, ...) koennen sich registrieren und werden bei neuen
|
|
* oder kritischen Items sowie bei Watchdog-Zustandswechseln informiert.
|
|
*
|
|
* Jede Zustellung traegt eine HMAC-SHA256-Signatur im Header X-DC-Signature,
|
|
* damit der Empfaenger die Echtheit pruefen kann:
|
|
* signature = hex(hmac_sha256(secret, timestamp . '.' . body))
|
|
* Der Header X-DC-Timestamp enthaelt den zugehoerigen Unix-Zeitstempel.
|
|
*/
|
|
final class WebhookDispatcher
|
|
{
|
|
/** Bekannte Ereignisnamen. */
|
|
public const EVENTS = [
|
|
'bug.created',
|
|
'bug.critical',
|
|
'bug.resolved',
|
|
'feature.created',
|
|
'monitor.down',
|
|
'monitor.recovered',
|
|
'release.published',
|
|
'security.lockout',
|
|
'security.attack',
|
|
];
|
|
|
|
private const TIMEOUT_SECONDS = 4;
|
|
private const MAX_TARGETS = 10;
|
|
|
|
/** Verhindert, dass eine Kette von Ereignissen einen Request blockiert. */
|
|
private static int $dispatchedThisRequest = 0;
|
|
|
|
public static function dispatch(PDO $db, string $event, array $payload): void
|
|
{
|
|
// Kritische Ereignisse direkt an Rocket.Chat spiegeln
|
|
if ($event === 'bug.critical') {
|
|
RocketChatNotifier::sendAlert(
|
|
$db,
|
|
'Kritischer Bug gemeldet',
|
|
(string)($payload['title'] ?? $payload['error_message'] ?? 'Neuer kritischer Fehler'),
|
|
'alarm',
|
|
[
|
|
'Projekt' => $payload['project_slug'] ?? 'Unbekannt',
|
|
'Umgebung' => $payload['environment'] ?? 'production',
|
|
'Item-ID' => $payload['item_id'] ?? 'neu',
|
|
]
|
|
);
|
|
} elseif ($event === 'monitor.down') {
|
|
RocketChatNotifier::sendAlert(
|
|
$db,
|
|
'System-Ausfall erkannt (Watchdog)',
|
|
(string)($payload['source'] ?? 'Monitor') . ' (' . ($payload['instance'] ?? 'default') . '): ' . ($payload['reason'] ?? 'Heartbeat ausgeblieben'),
|
|
'alarm',
|
|
[
|
|
'Quelle' => $payload['source'] ?? 'unbekannt',
|
|
'Instanz' => $payload['instance'] ?? 'default',
|
|
'Von Zustand' => $payload['from_state'] ?? 'up',
|
|
'Nach Zustand' => $payload['to_state'] ?? 'down',
|
|
]
|
|
);
|
|
} elseif ($event === 'security.lockout') {
|
|
RocketChatNotifier::sendAlert(
|
|
$db,
|
|
'Benutzerkonto vorübergehend gesperrt',
|
|
sprintf(
|
|
'Das Konto "%s" wurde nach wiederholten Fehlversuchen von IP %s für %d Minute(n) gesperrt.',
|
|
$payload['username'] ?? 'unbekannt',
|
|
$payload['ip'] ?? 'unbekannt',
|
|
(int)($payload['duration_minutes'] ?? 15)
|
|
),
|
|
'alarm',
|
|
[
|
|
'Benutzer' => $payload['username'] ?? 'unbekannt',
|
|
'IP-Adresse' => $payload['ip'] ?? 'unbekannt',
|
|
'Sperrdauer' => ($payload['duration_minutes'] ?? 15) . ' Min',
|
|
'Zeitpunkt' => gmdate('Y-m-d H:i:s') . ' UTC',
|
|
]
|
|
);
|
|
} elseif ($event === 'security.attack') {
|
|
RocketChatNotifier::sendAlert(
|
|
$db,
|
|
'Sicherheitsalarm: Brute-Force-Angriff erkannt',
|
|
sprintf(
|
|
'Verdächtige Aktivität von IP %s: %s',
|
|
$payload['ip'] ?? 'unbekannt',
|
|
$payload['details'] ?? 'Wiederholte Fehlversuche'
|
|
),
|
|
'alarm',
|
|
[
|
|
'IP-Adresse' => $payload['ip'] ?? 'unbekannt',
|
|
'Ziel / Pfad' => $payload['target'] ?? 'Login / API',
|
|
'Typ' => $payload['type'] ?? 'Brute-Force',
|
|
'Zeitpunkt' => gmdate('Y-m-d H:i:s') . ' UTC',
|
|
]
|
|
);
|
|
}
|
|
|
|
if (self::$dispatchedThisRequest >= self::MAX_TARGETS) {
|
|
return;
|
|
}
|
|
|
|
$targets = self::targetsFor($db, $event, $payload['project_slug'] ?? null);
|
|
if ($targets === []) {
|
|
return;
|
|
}
|
|
|
|
$body = [
|
|
'event' => $event,
|
|
'timestamp' => gmdate('c'),
|
|
'source' => (string)Config::get('app.url', ''),
|
|
'data' => $payload,
|
|
];
|
|
|
|
$json = json_encode($body, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
|
|
if ($json === false) {
|
|
Logger::warning('Webhook-Payload nicht kodierbar', ['event' => $event]);
|
|
return;
|
|
}
|
|
|
|
foreach ($targets as $target) {
|
|
if (self::$dispatchedThisRequest >= self::MAX_TARGETS) {
|
|
break;
|
|
}
|
|
self::$dispatchedThisRequest++;
|
|
self::deliver($db, $target, $json);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* @return list<array<string,mixed>>
|
|
*/
|
|
private static function targetsFor(PDO $db, string $event, $projectSlug): array
|
|
{
|
|
try {
|
|
$stmt = $db->prepare('
|
|
SELECT id, name, url, secret, events, project_slug
|
|
FROM dc_webhooks
|
|
WHERE enabled = 1
|
|
AND (project_slug IS NULL OR project_slug = :slug)
|
|
LIMIT 25
|
|
');
|
|
$stmt->execute([':slug' => is_string($projectSlug) ? $projectSlug : '']);
|
|
$rows = $stmt->fetchAll() ?: [];
|
|
} catch (\Throwable $e) {
|
|
// Tabelle fehlt (Migration noch nicht gelaufen) - kein Grund zu scheitern.
|
|
return [];
|
|
}
|
|
|
|
$matching = [];
|
|
foreach ($rows as $row) {
|
|
$subscribed = array_map('trim', explode(',', (string)$row['events']));
|
|
if (in_array($event, $subscribed, true) || in_array('*', $subscribed, true)) {
|
|
$matching[] = $row;
|
|
}
|
|
}
|
|
|
|
return $matching;
|
|
}
|
|
|
|
private static function deliver(PDO $db, array $target, string $json): void
|
|
{
|
|
$secret = (string)($target['secret'] ?? '');
|
|
if ($secret === '') {
|
|
$secret = (string)Config::get('security.webhook_key', '');
|
|
}
|
|
|
|
$timestamp = (string)time();
|
|
$signature = $secret !== ''
|
|
? hash_hmac('sha256', $timestamp . '.' . $json, $secret)
|
|
: '';
|
|
|
|
$headers = [
|
|
'Content-Type: application/json',
|
|
'User-Agent: Deploymentcenter-Webhook/1.0',
|
|
'X-DC-Timestamp: ' . $timestamp,
|
|
];
|
|
if ($signature !== '') {
|
|
$headers[] = 'X-DC-Signature: sha256=' . $signature;
|
|
}
|
|
|
|
[$ok, $status, $error] = self::post((string)$target['url'], $json, $headers);
|
|
|
|
self::recordResult($db, (int)$target['id'], $ok, $status, $error);
|
|
}
|
|
|
|
/**
|
|
* @param list<string> $headers
|
|
* @return array{0:bool,1:int,2:?string}
|
|
*/
|
|
private static function post(string $url, string $json, array $headers): array
|
|
{
|
|
if (!preg_match('#^https?://#i', $url)) {
|
|
return [false, 0, 'Ungueltige URL'];
|
|
}
|
|
|
|
if (function_exists('curl_init')) {
|
|
$ch = curl_init($url);
|
|
if ($ch === false) {
|
|
return [false, 0, 'curl_init fehlgeschlagen'];
|
|
}
|
|
|
|
curl_setopt_array($ch, [
|
|
CURLOPT_POST => true,
|
|
CURLOPT_POSTFIELDS => $json,
|
|
CURLOPT_HTTPHEADER => $headers,
|
|
CURLOPT_RETURNTRANSFER => true,
|
|
CURLOPT_TIMEOUT => self::TIMEOUT_SECONDS,
|
|
CURLOPT_CONNECTTIMEOUT => 2,
|
|
CURLOPT_FOLLOWLOCATION => false,
|
|
CURLOPT_SSL_VERIFYPEER => true,
|
|
CURLOPT_SSL_VERIFYHOST => 2,
|
|
]);
|
|
|
|
$response = curl_exec($ch);
|
|
$status = (int)curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
|
|
$error = $response === false ? curl_error($ch) : null;
|
|
curl_close($ch);
|
|
|
|
return [$status >= 200 && $status < 300, $status, $error];
|
|
}
|
|
|
|
$context = stream_context_create([
|
|
'http' => [
|
|
'method' => 'POST',
|
|
'header' => implode("\r\n", $headers),
|
|
'content' => $json,
|
|
'timeout' => self::TIMEOUT_SECONDS,
|
|
'ignore_errors' => true,
|
|
],
|
|
]);
|
|
|
|
$result = @file_get_contents($url, false, $context);
|
|
$status = 0;
|
|
if (isset($http_response_header[0]) && preg_match('#\s(\d{3})\s#', $http_response_header[0], $m) === 1) {
|
|
$status = (int)$m[1];
|
|
}
|
|
|
|
return [
|
|
$result !== false && $status >= 200 && $status < 300,
|
|
$status,
|
|
$result === false ? 'Anfrage fehlgeschlagen' : null,
|
|
];
|
|
}
|
|
|
|
private static function recordResult(PDO $db, int $webhookId, bool $ok, int $status, ?string $error): void
|
|
{
|
|
try {
|
|
$stmt = $db->prepare('
|
|
UPDATE dc_webhooks
|
|
SET last_status = :status,
|
|
last_error = :error,
|
|
last_fired_at = UTC_TIMESTAMP(),
|
|
failure_count = IF(:ok = 1, 0, failure_count + 1),
|
|
enabled = IF(:ok2 = 1, enabled, IF(failure_count + 1 >= 20, 0, enabled))
|
|
WHERE id = :id
|
|
');
|
|
$stmt->execute([
|
|
':status' => $ok ? 'ok (' . $status . ')' : 'failed (' . $status . ')',
|
|
':error' => $error !== null ? mb_substr($error, 0, 500) : null,
|
|
':ok' => $ok ? 1 : 0,
|
|
':ok2' => $ok ? 1 : 0,
|
|
':id' => $webhookId,
|
|
]);
|
|
} catch (\Throwable $e) {
|
|
Logger::warning('Webhook-Ergebnis nicht gespeichert', ['id' => $webhookId]);
|
|
}
|
|
}
|
|
}
|