feat: protect github route with secret too

2025-08-27 19:04:06 -07:00
parent d5c0abe4d8
commit 994f50c174
3 changed files with 30 additions and 14 deletions
@@ -25,13 +25,23 @@ const isPull = (body: GithubPayload): body is PullRequestCreated => {
 * @param request - The Fastify request payload.
 * @param response - The Fastify reply class.
 */
-// eslint-disable-next-line max-statements -- STFU.
+// eslint-disable-next-line max-statements, max-lines-per-function -- STFU.
 export const processGithubEvent = async(
  amari: Amari,
-  // eslint-disable-next-line @typescript-eslint/naming-convention -- Fastify standard.
-  request: FastifyRequest<{ Body: GithubPayload }>,
+  request: FastifyRequest<{
+    // eslint-disable-next-line @typescript-eslint/naming-convention -- Fastify standard.
+    Body:        GithubPayload;
+    // eslint-disable-next-line @typescript-eslint/naming-convention -- Fastify standard.
+    Querystring: { secret: string };
+  }>,
  response: FastifyReply,
 ): Promise<void> => {
+  const { secret } = request.query;
+  if (secret !== process.env.GH_WEBHOOK_SECRET) {
+    await response.status(403).send({
+      message: "Invalid secret provided!",
+    });
+  }
  const event = request.headers["x-github-event"];
  if (typeof event !== "string") {
    await response.status(400).
@@ -57,6 +57,7 @@ const html = `<!DOCTYPE html>
 * Starts up a web server for health monitoring.
 * @param amari - Amari's instance.
 */
+// eslint-disable-next-line max-lines-per-function -- STFU.
 export const instantiateServer = (amari: Amari): void => {
  try {
    const server = fastify({
@@ -68,18 +69,21 @@ export const instantiateServer = (amari: Amari): void => {
      response.send(html);
    });

-    server.
+    server.post<{
+    // eslint-disable-next-line @typescript-eslint/naming-convention -- Fastify standard.
+      Body:        GithubPayload;
      // eslint-disable-next-line @typescript-eslint/naming-convention -- Fastify standard.
-      post<{ Body: GithubPayload }>("/github", async(request, response) => {
-        try {
-          await processGithubEvent(amari, request, response);
-        } catch (error) {
-          if (!(error instanceof Error)) {
-            return;
-          }
-          await logger.error("/github route", error);
+      Querystring: { secret: string };
+    }>("/github", async(request, response) => {
+      try {
+        await processGithubEvent(amari, request, response);
+      } catch (error) {
+        if (!(error instanceof Error)) {
+          return;
        }
-      });
+        await logger.error("/github route", error);
+      }
+    });

    server.
      // eslint-disable-next-line @typescript-eslint/naming-convention -- Fastify standard.