Merge branch 'main' of github.com:l3montree-dev/devguard

Author: timbastin

controllers/system_controller.go

@@ -152,7 +152,7 @@ func (s *SystemController) Info(c shared.Context) error {
 		poolInfo.AcquiredConns = int(stats.AcquiredConns())
 		poolInfo.MaxConns = int(stats.MaxConns())
 
-		if ver, dirty, err := database.GetMigrationVersionWithDB(); err == nil {
+		if ver, dirty, err := database.GetMigrationVersionFromDB(s.db); err == nil {
 			v := ver
 			dbInfo.MigrationVersion = &v
 			dbInfo.MigrationDirty = &dirty

database/migrations.go

@@ -187,12 +187,21 @@ func pendingVersions(src migsource.Driver, currentVersion int) ([]uint, error) {
 	return versions, nil
 }
 
-// GetMigrationVersionWithDB returns the current migration version using an existing GORM database instance
-func GetMigrationVersionWithDB() (uint, bool, error) {
-	if migrationVersion != 0 || migratorErr != nil {
-		db := NewGormDB(NewPgxConnPool(GetPoolConfigFromEnv()))
+// GetMigrationVersionFromDB returns the current migration version using an existing GORM database instance
+func GetMigrationVersionFromDB(db shared.DB) (uint, bool, error) {
+	if migrationVersion == 0 || migratorErr != nil {
+		if db == nil {
+			// create a new connection if none got passed
+			db = NewGormDB(NewPgxConnPool(GetPoolConfigFromEnv()))
+		}
+
 		migrator, _ = getMigrator(db)
-		defer migrator.Close()
+
+		if db == nil {
+			// only close if we own the connection
+			defer migrator.Close()
+		}
+
 		migrationVersion, migrationDirty, migratorErr = migrator.Version()
 	}
 

services/webhook_service.go

@@ -6,6 +6,9 @@ package services
 import (
 	"bytes"
 	"context"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -70,6 +73,14 @@ func (c *webhookClient) CreateRequest(ctx context.Context, method, url string, b
 		return nil, fmt.Errorf("failed to read request body: %w", err)
 	}
 
+	hasSecret := c.Secret != nil && *c.Secret != ""
+	var signature string
+	if hasSecret {
+		mac := hmac.New(sha256.New, []byte(*c.Secret))
+		_, _ = mac.Write(bodyBytes)
+		signature = "sha256=" + hex.EncodeToString(mac.Sum(nil))
+	}
+
 	ctx, cancel := context.WithTimeout(ctx, 120*time.Second)
 	defer cancel()
 
@@ -90,9 +101,12 @@ func (c *webhookClient) CreateRequest(ctx context.Context, method, url string, b
 		if err != nil {
 			return nil, err
 		}
-		if c.Secret != nil {
+		if hasSecret {
 			req.Header.Set("X-Webhook-Secret", *c.Secret)
 		}
+		if signature != "" {
+			req.Header.Set("X-Hub-Signature-256", signature)
+		}
 		req.Header.Set("Content-Type", "application/json")
 
 		resp, lastErr = utils.EgressClient.Do(req)

services/webhook_service_test.go

@@ -5,6 +5,10 @@ package services
 
 import (
 	"context"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -21,6 +25,89 @@ func newTestWebhookService(url string) *webhookClient {
 	return webhookClient
 }
 
+func TestWebhookClient_CreateRequest_HMACSignature(t *testing.T) {
+	const secret = "test-webhook-secret"
+	body := `{"event":"dependencyVulnerabilities","severity":"high"}`
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		receivedBody, err := io.ReadAll(r.Body)
+		require.NoError(t, err)
+
+		mac := hmac.New(sha256.New, []byte(secret))
+		_, _ = mac.Write(receivedBody)
+		expectedSignature := "sha256=" + hex.EncodeToString(mac.Sum(nil))
+
+		assert.Equal(t, body, string(receivedBody))
+		assert.Equal(t, expectedSignature, r.Header.Get("X-Hub-Signature-256"))
+		assert.Equal(t, secret, r.Header.Get("X-Webhook-Secret"))
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer server.Close()
+
+	secretValue := secret
+	client := NewWebhookService(server.URL, &secretValue)
+	client.retryDelays = []time.Duration{0, 0, 0}
+
+	resp, err := client.CreateRequest(context.Background(), http.MethodPost, server.URL, strings.NewReader(body))
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	defer resp.Body.Close()
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+}
+
+func TestWebhookClient_CreateRequest_DoesNotSignWithoutSecret(t *testing.T) {
+	emptySecret := ""
+	cases := []struct {
+		name   string
+		secret *string
+	}{
+		{name: "nil secret", secret: nil},
+		{name: "empty secret", secret: &emptySecret},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				assert.Empty(t, r.Header.Get("X-Hub-Signature-256"))
+				assert.Empty(t, r.Header.Get("X-Webhook-Secret"))
+				w.WriteHeader(http.StatusOK)
+			}))
+			defer server.Close()
+
+			client := NewWebhookService(server.URL, tc.secret)
+			client.retryDelays = []time.Duration{0, 0, 0}
+			resp, err := client.CreateRequest(context.Background(), http.MethodPost, server.URL, strings.NewReader(`{"test":"data"}`))
+			require.NoError(t, err)
+			require.NotNil(t, resp)
+			defer resp.Body.Close()
+		})
+	}
+}
+
+func TestWebhookClient_CreateRequest_ReusesSignatureAcrossRetries(t *testing.T) {
+	const secret = "test-webhook-secret"
+	body := `{"event":"test"}`
+	var signatures []string
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		signatures = append(signatures, r.Header.Get("X-Hub-Signature-256"))
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer server.Close()
+
+	secretValue := secret
+	client := NewWebhookService(server.URL, &secretValue)
+	client.retryDelays = []time.Duration{0, 0, 0}
+	resp, err := client.CreateRequest(context.Background(), http.MethodPost, server.URL, strings.NewReader(body))
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	defer resp.Body.Close()
+
+	require.Len(t, signatures, 3)
+	assert.Equal(t, signatures[0], signatures[1])
+	assert.Equal(t, signatures[1], signatures[2])
+}
+
 func TestWebhookClient_CreateRequest_RetryLogic(t *testing.T) {
 	t.Run("should succeed on first attempt when request is successful", func(t *testing.T) {
 		attemptCount := 0