feat: Add webhook event system with HMAC-SHA256 signing and retry logic#346
Open
i010542 wants to merge 2 commits intorohitdash08:mainfrom
Open
feat: Add webhook event system with HMAC-SHA256 signing and retry logic#346i010542 wants to merge 2 commits intorohitdash08:mainfrom
i010542 wants to merge 2 commits intorohitdash08:mainfrom
Conversation
- Add Webhook and WebhookDelivery ORM models - Implement HMAC-SHA256 signature verification - Add 3-attempt retry logic with exponential backoff (0s, 5s, 30s) - Create REST API endpoints for webhook CRUD operations - Add test-ping endpoint for webhook testing - Emit events: expense.*, bill.*, reminder.*, user.registered, user.deleted - Add 20 unit tests for all acceptance criteria - Fix: WebhookDelivery model, test file, code duplication, event filtering - Improve: type annotations, logging, error handling Features: - Event filtering - specify which events to receive - Request tracing - unique trace_id for debugging - Code deduplication - extracted _emit_expense common method - Type safety - complete type annotations - Error handling - distinguish timeout, connection errors, etc. - Test coverage - 20 comprehensive test cases Acceptance Criteria: - Signed delivery via HMAC-SHA256 - Retry & failure handling with 3-attempt schedule - Event types documented in code and route validation Resolves rohitdash08#77
修复了PR审查发现的关键问题： P0严重问题修复： - 修复乐观锁实现：添加版本冲突检查，防止并发更新导致的数据丢失 - 当客户端版本与数据库版本不匹配时返回409错误 P1重要问题修复： - 集成Flask-Limiter速率限制：为create_webhook端点添加每分钟10次限制 - 启用WebhookAuditLog审计日志：在创建、更新、删除webhook时记录操作历史 - 添加审计日志辅助函数_log_webhook_audit()，记录IP地址和User-Agent P2改进问题修复： - 完善配置文档：在.env.example中添加webhook、速率限制、Celery配置示例 其他修复和增强： - 创建Celery任务文件tasks.py，实现异步webhook重试机制 - 移除test_webhooks.py中的重复测试函数 - 添加依赖项：flask-babel, flask-limiter, celery - 在_webhook_to_dict()中返回version字段以支持乐观锁 - 修复handle_delivery_error中的会话管理问题 - 优化代码注释和文档 影响范围： - packages/backend/app/models.py - 添加索引、version字段、WebhookAuditLog模型 - packages/backend/app/routes/webhooks.py - 乐观锁、速率限制、审计日志 - packages/backend/app/services/webhooks.py - URL验证、配置验证、错误处理 - packages/backend/app/tasks.py - 新增Celery异步任务 - packages/backend/tests/test_webhooks.py - 移除重复测试 - packages/backend/requirements.txt - 添加新依赖 - .env.example - 添加配置示例
Author
✅ PR审核优化完成已应用所有审查发现的修复： 🔴 P0 - 严重问题修复
🟡 P1 - 重要问题修复
🟢 P2 - 改进问题修复
📊 审查结果
📝 提交信息
所有修复已推送到 webhook-system 分支。 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implemented a complete webhook event system for FinMind satisfying all acceptance criteria from Issue #77.
Changes
API Endpoints
```
GET /webhooks List endpoints
POST /webhooks Create (returns secret once)
GET /webhooks/:id Get endpoint (no secret)
PATCH /webhooks/:id Update url/events/active
DELETE /webhooks/:id Delete
GET /webhooks/:id/deliveries Last 50 delivery logs
POST /webhooks/:id/test Send test ping
```
Features
Acceptance Criteria
Testing
Resolves
#77