Skip to content

Feat(webhook_listeners): adapt webhook payload format #57372

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tobiasKaminsky merged 2 commits into from
Jan 6, 2026
Merged

Feat(webhook_listeners): adapt webhook payload format #57372

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ec9cac9
feat: adapt webhook payload format
janepie Jan 6, 2026
65d44b0
docs: adapt docblock
janepie Jan 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion apps/webhook_listeners/lib/BackgroundJobs/WebhookCall.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ protected function run($argument): void {
$client = $this->clientService->newClient();

// adding Ephemeral auth tokens to the call
$data['tokens'] = $this->tokenService->getTokens($webhookListener, $data['user']['uid'] ?? null);
$data['authentication'] = $this->tokenService->getTokens($webhookListener, $data['user']['uid'] ?? null);
$options = [
'verify' => $this->certificateManager->getAbsoluteBundlePath(),
'headers' => $webhookListener->getHeaders() ?? [],
Expand Down
54 changes: 44 additions & 10 deletions apps/webhook_listeners/lib/Service/TokenService.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
use OCA\WebhookListeners\Db\WebhookListener;
use OCP\AppFramework\Utility\ITimeFactory;
use OCP\Authentication\Token\IToken;
use OCP\IURLGenerator;
use OCP\IUserManager;
use OCP\L10N\IFactory;
use OCP\Security\ISecureRandom;
Expand All @@ -22,6 +23,7 @@
class TokenService {
public function __construct(
private IProvider $tokenProvider,
private IURLGenerator $urlGenerator,
private ISecureRandom $random,
private EphemeralTokenMapper $tokenMapper,
private LoggerInterface $logger,
Expand All @@ -35,23 +37,51 @@
* creates an array which includes two arrays of tokens: 'user_ids' and 'user_roles'
* The array ['user_ids' => ['jane', 'bob'], 'user_roles' => ['owner', 'trigger']]
* as requested tokens in the registered webhook produces a result like
* ['user_ids' => [['jane' => 'abcdtokenabcd1'], ['bob','=> 'abcdtokenabcd2']], 'user_roles' => ['owner' => ['admin' => 'abcdtokenabcd3'], 'trigger' => ['user1' => 'abcdtokenabcd4']]]
* [
* ['user_ids' => [
* ['jane' => [
* 'userId' => 'jane',
* 'token' => 'abcdtokenabcd1'
* 'baseUrl' => 'https://nextcloud.example'
* ],
* ['bob'=> [
* 'userId' => 'bob',
* 'token' => 'abcdtokenabcd2'
* 'baseUrl' => 'https://nextcloud.example'
* ],
* ],
* 'owner' => [
* 'userId' => 'admin',
* 'token' => 'abcdtokenabcd3'
* 'baseUrl' => 'https://nextcloud.example'
* ],
* 'trigger' => [
* 'userId' => 'user1',
* 'token' => 'abcdtokenabcd4'
* 'baseUrl' => 'https://nextcloud.example'
* ],
* ]
* Created auth tokens are valid for 1 hour.
*
* @param WebhookListener $webhookListener
* @param ?string $triggerUserId the user that triggered the webhook call
* @return array{user_ids?:array<string,string>,user_roles?:array{owner?:array<string,string>,trigger?:array<string,string>}}

Check failure on line 68 in apps/webhook_listeners/lib/Service/TokenService.php

View workflow job for this annotation

GitHub Actions / static-code-analysis

InvalidReturnType 

apps/webhook_listeners/lib/Service/TokenService.php:68:13: InvalidReturnType: The declared return type 'array{user_ids?: array<string, string>, user_roles?: array{owner?: array<string, string>, trigger?: array<string, string>}}' for OCA\WebhookListeners\Service\TokenService::getTokens is incorrect, got 'array{owner?: array{baseUrl: string, token: string, userId: string}, trigger?: array{baseUrl: string, token: string, userId: string}, user_ids?: array<string, array{baseUrl: string, token: string, userId: mixed}>}' which is different due to additional array shape fields (trigger, owner) (see https://psalm.dev/011)
*/
public function getTokens(WebhookListener $webhookListener, ?string $triggerUserId): array {
$tokens = [
'user_ids' => [],
'user_roles' => [],
];
$tokens = [];

$tokenNeeded = $webhookListener->getTokenNeeded();
if (isset($tokenNeeded['user_ids'])) {
$tokens = [
'user_ids' => [],
];
foreach ($tokenNeeded['user_ids'] as $userId) {
try {
$tokens['user_ids'][$userId] = $this->createEphemeralToken($userId);
$tokens['user_ids'][$userId] = [
'userId' => $userId,
'token' => $this->createEphemeralToken($userId),
'baseUrl' => $this->urlGenerator->getBaseUrl()
];
} catch (\Exception $e) {
$this->logger->error('Webhook token creation for user ' . $userId . ' failed: ' . $e->getMessage(), ['exception' => $e]);
}
Expand All @@ -67,17 +97,21 @@
if (is_null($ownerId)) { // no owner uid available
break;
}
$tokens['user_roles']['owner'] = [
$ownerId => $this->createEphemeralToken($ownerId)
$tokens['owner'] = [
'userId' => $ownerId,
'token' => $this->createEphemeralToken($ownerId),
'baseUrl' => $this->urlGenerator->getBaseUrl()
];
break;
case 'trigger':
// token for the person who triggered the webhook
if (is_null($triggerUserId)) { // no trigger uid available
break;
}
$tokens['user_roles']['trigger'] = [
$triggerUserId => $this->createEphemeralToken($triggerUserId)
$tokens['trigger'] = [
'userId' => $triggerUserId,
'token' => $this->createEphemeralToken($triggerUserId),
'baseUrl' => $this->urlGenerator->getBaseUrl()
];
break;
default:
Expand All @@ -86,7 +120,7 @@
}
}
}
return $tokens;

Check failure on line 123 in apps/webhook_listeners/lib/Service/TokenService.php

View workflow job for this annotation

GitHub Actions / static-code-analysis

InvalidReturnStatement 

apps/webhook_listeners/lib/Service/TokenService.php:123:10: InvalidReturnStatement: The inferred type 'array{owner?: array{baseUrl: string, token: string, userId: string}, trigger?: array{baseUrl: string, token: string, userId: string}, user_ids?: array<string, array{baseUrl: string, token: string, userId: mixed}>}' does not match the declared return type 'array{user_ids?: array<string, string>, user_roles?: array{owner?: array<string, string>, trigger?: array<string, string>}}' for OCA\WebhookListeners\Service\TokenService::getTokens due to additional array shape fields (trigger, owner) (see https://psalm.dev/128)
}
private function createEphemeralToken(string $userId): string {
$token = $this->generateRandomDeviceToken();
Expand Down
Loading