Merge pull request #328 from mezuro/gitlab_hooks_verification

Refactor Webhook support to allow verification of parameters

Merge pull request #328 from mezuro/gitlab_hooks_verification
Refactor Webhook support to allow verification of parameters
Daniel
2 parents 47ad2ee2 4734ba1b
Showing 13 changed files with 361 additions and 45 deletions Show diff stats
app/controllers/repositories_controller.rb
features/repository/notify_push.feature
features/step_definitions/repository_steps.rb
features/support/env.rb
features/support/header.rb
lib/webhooks.rb
lib/webhooks/base.rb
lib/webhooks/gitlab.rb
spec/controllers/repositories_controller_spec.rb
spec/factories/repositories.rb
spec/factories/webhooks.rb
spec/lib/webhooks/base_spec.rb
spec/lib/webhooks/gitlab_spec.rb
+require 'webhooks'
+
 include OwnershipAuthentication
  
 class RepositoriesController < ApplicationController
   before_action :authenticate_user!, except: [:show, :state, :state_with_date, :index, :notify_push]
   before_action :project_owner?, only: [:new, :create], unless: Proc.new { params[:project_id].nil? }
   before_action :repository_owner?, only: [:edit, :update, :destroy, :process_repository]
-  before_action :set_repository, only: [:show, :edit, :update, :destroy, :state, :state_with_date, :process_repository]
+  before_action :set_repository, only: [:show, :edit, :update, :destroy, :state, :state_with_date, :process_repository,
+                                        :notify_push]
   before_action :set_project_id_repository_types_and_configurations, only: [:new, :edit]
  
   # Gitlab can't send a CSRF token, don't require one
@@ -100,14 +103,21 @@ class RepositoriesController &lt; ApplicationController
   end
  
   def notify_push
-    gitlab_event = request.headers['X-Gitlab-Event']
-    if gitlab_event.nil? || !gitlab_event.end_with?('Push Hook')
-      return render nothing: true, status: :unprocessable_entity
+    hook_info = Webhooks::GitLab.new(request, @repository)
+    if hook_info.valid_request?
+      if hook_info.valid_address?
+        if hook_info.valid_branch?
+          @repository.cancel_processing_of_repository unless %w(READY ERROR).include? @repository.last_processing_state
+          @repository.process
+        end
+
+        render nothing: true, status: :ok
+      else
+        render nothing: true, status: :forbidden
+      end
+    else
+      render nothing: true, status: :unprocessable_entity
     end
-    set_repository
-    @repository.cancel_processing_of_repository unless %w(READY ERROR).include? @repository.last_processing_state
-    @repository.process
-    render nothing: true, status: :ok
   end
  
   private
@@ -7,7 +7,7 @@ Feature: Notify push to repository
   Scenario: Valid repository
     Given I am a regular user
     And I have a sample configuration with hotspot metrics
-    And I have a sample repository
+    And I have a Kalibro Client GitLab repository
     And I start to process that repository
     And I wait up for a ready processing
     When I push some commits to the repository
@@ -25,7 +25,7 @@ Feature: Notify push to repository
     And I have a sample reading group
     And I have a sample configuration with the Saikuro native metric
     And I have a compound metric configuration with script "rtrnaqdfwqefwqr213r2145211234ed a = b=2" within the given mezuro configuration
-    And I have a sample repository
+    And I have a Kalibro Client GitLab repository
     And I start to process that repository
     And I wait up for an error processing
     When I push some commits to the repository
@@ -116,6 +116,10 @@ Given(/^I have a sample repository$/) do
   @independent_repository = FactoryGirl.create(:ruby_repository, kalibro_configuration_id: @kalibro_configuration.id)
 end
  
+Given(/^I have a Kalibro Client GitLab repository$/) do
+  @independent_repository = FactoryGirl.create(:kalibro_client_gitlab_repository, kalibro_configuration_id: @kalibro_configuration.id)
+end
+
 Given(/^I am at the All Repositories page$/) do
   visit repositories_path
 end
@@ -163,11 +167,15 @@ When(/^I get the Creation Date information as &quot;(.*?)&quot;$/) do |variable|
 end
  
 When(/^I push some commits to the repository$/) do
-  post repository_notify_push_path(id: @repository.id), {}, {'HTTP_X_GITLAB_EVENT' => 'Push Hook'}
+  request = FactoryGirl.build(:gitlab_webhook_request)
+  set_headers(request.headers)
+  page.driver.post(repository_notify_push_path(id: @repository.id), request.params)
 end
  
 When(/^I push some commits to an invalid repository$/) do
-  @response = post repository_notify_push_path(id: 0), {}, {'HTTP_X_GITLAB_EVENT' => 'Push Hook'}
+  request = FactoryGirl.build(:gitlab_webhook_request)
+  set_headers(request.headers)
+  page.driver.post(repository_notify_push_path(id: 0), request.params)
 end
  
 Then(/^I should see the sample metric's name$/) do
@@ -271,5 +279,5 @@ Then(/^Mezuro should process the repository again$/) do
 end
  
 Then(/^I should get a not found error$/) do
-  expect(@response.status).to eq(404)
+  expect(page.driver.status_code).to eq(404)
 end
@@ -20,8 +20,11 @@ end
 # instead of editing this one. Cucumber will automatically load all features/**/*.rb
 # files.
  
+require 'warden'
 require 'cucumber/rails'
 require 'capybara/poltergeist'
+require_relative 'header'
+
 #Capybara.default_driver = :poltergeist
 Capybara.javascript_driver = :poltergeist
 Capybara.default_max_wait_time = 20 # default is 2 seconds
@@ -81,5 +84,6 @@ Cucumber::Rails::Database.javascript_strategy = :truncation
 # KalibroClient hooks
 require 'kalibro_client/kalibro_cucumber_helpers/hooks.rb'
  
-# Warden test helpers so the user authentication can be as fast as possible
-include Warden::Test::Helpers
+Warden.test_mode!
+World(Warden::Test::Helpers, HeaderUtils)
+
@@ -0,0 +1,15 @@
+module HeaderUtils
+  def set_header(key, value)
+    header_method = nil
+    if defined?(page) && ! page.driver.nil?
+      header_method = [:add_header, :header].find(&page.driver.method(:respond_to?))
+    end
+
+    raise StandardError.new("No header setting method available in current driver: #{page.driver}") unless header_method
+    page.driver.send(header_method, key, value)
+  end
+
+  def set_headers(headers)
+    headers.each(&method(:set_header))
+  end
+end
@@ -0,0 +1,5 @@
+require 'webhooks/base'
+require 'webhooks/gitlab'
+
+module Webhooks
+end
@@ -0,0 +1,44 @@
+module Webhooks
+  class Base
+    attr_reader :request, :repository
+
+    def initialize(request, repository)
+      @request = request
+      @repository = repository
+    end
+
+    # Returns true if and only if the remote addresses in the request and repository match.
+    def valid_address?
+      repository.address == webhook_address
+    end
+
+    # Returns true if and only if the branch in the request and repository match.
+    def valid_branch?
+      repository.branch == webhook_branch
+    end
+
+    # Returns true if the request parameters, as determined by the particular hook service, are valid
+    # It will usually check headers, IP ranges, signatures, or any other relevant information.
+    def valid_request?; raise NotImplementedError; end
+
+    # Extracts the remote address from the webhook request.
+    def webhook_address; raise NotImplementedError; end
+
+    # Extracts the branch from the webhook request.
+    def webhook_branch; raise NotImplementedError; end
+
+    protected
+
+    # Converts a git ref name to a branch. This is an utility function for webhook formats that only provide the ref
+    # updated in their information. Returns nil if the passed parameter is not a valid ref.
+    # The expected format is 'refs/heads/#{branch_name}'. Anything else will be rejected.
+    def branch_from_ref(ref)
+      return nil if !ref
+
+      ref = ref.split('/')
+      return nil if ref.size != 3 || ref[0..1] != ['refs', 'heads']
+
+      ref.last
+    end
+  end
+end
@@ -0,0 +1,19 @@
+module Webhooks
+  class GitLab < Base
+    def valid_request?
+      request.headers['X-Gitlab-Event'] == 'Push Hook'
+    end
+
+    def webhook_address
+      begin
+        request.params.fetch(:project).fetch(:git_http_url)
+      rescue KeyError
+        return nil
+      end
+    end
+
+    def webhook_branch
+      branch_from_ref(request.params[:ref])
+    end
+  end
+end
@@ -471,11 +471,12 @@ describe RepositoriesController, :type =&gt; :controller do
   end
  
   describe 'notify_push' do
-    let(:repository) { FactoryGirl.build(:repository) }
+    let(:repository) { FactoryGirl.build(:kalibro_client_gitlab_repository) }
+    let(:webhook_request) { FactoryGirl.build(:gitlab_webhook_request) }
  
     def post_push
-      @request.env['HTTP_X_GITLAB_EVENT'] = ['Push Hook', 'Tag Push Hook'].sample
-      post :notify_push, id: repository.id, format: :json
+      @request.headers.merge!(webhook_request.headers)
+      post :notify_push, {id: repository.id, format: :json}.merge(webhook_request.params)
     end
  
     context 'with a valid repository' do
@@ -483,35 +484,67 @@ describe RepositoriesController, :type =&gt; :controller do
         Repository.expects(:find).with(repository.id).returns(repository)
       end
  
-      context 'when the repository is being processed' do
-        before do
-          repository.expects(:last_processing_state).returns('INTERPRETING')
-          repository.expects(:cancel_processing_of_repository).once
-          repository.expects(:process).once
+      context 'without a valid address' do
+        before :each do
+          Webhooks::Base.any_instance.expects(:valid_address?).returns(false)
           post_push
         end
  
-        it { is_expected.to respond_with(:ok) }
+        it { is_expected.to respond_with(:forbidden) }
       end
  
-      context "when the repository's processing resulted in an error" do
-        before do
-          repository.expects(:last_processing_state).returns('ERROR')
-          repository.expects(:process).once
-          post_push
+      context 'with a valid address' do
+        before :each do
+          Webhooks::Base.any_instance.expects(:valid_address?).returns(true)
         end
  
-        it { is_expected.to respond_with(:ok) }
-      end
+        context 'without a matching branch' do
+          before :each do
+            Webhooks::Base.any_instance.expects(:valid_branch?).returns(false)
+            repository.expects(:cancel_processing_of_repository).never
+            repository.expects(:process).never
+            post_push
+          end
  
-      context 'when the repository is not being processed' do
-        before do
-          repository.expects(:last_processing_state).returns('READY')
-          repository.expects(:process).once
-          post_push
+          it { is_expected.to respond_with(:ok) }
         end
  
-        it { is_expected.to respond_with(:ok) }
+        context 'with a matching branch' do
+          before :each do
+            Webhooks::Base.any_instance.expects(:valid_branch?).returns(true)
+          end
+
+          context 'when the repository is being processed' do
+            before do
+              repository.expects(:last_processing_state).returns('INTERPRETING')
+              repository.expects(:cancel_processing_of_repository).once
+              repository.expects(:process).once
+              post_push
+            end
+
+            it { is_expected.to respond_with(:ok) }
+          end
+
+          context "when the repository's processing resulted in an error" do
+            before do
+              repository.expects(:last_processing_state).returns('ERROR')
+              repository.expects(:process).once
+              post_push
+            end
+
+            it { is_expected.to respond_with(:ok) }
+          end
+
+          context 'when the repository is not being processed' do
+            before do
+              repository.expects(:last_processing_state).returns('READY')
+              repository.expects(:process).once
+              post_push
+            end
+
+            it { is_expected.to respond_with(:ok) }
+          end
+        end
       end
     end
  
@@ -523,13 +556,5 @@ describe RepositoriesController, :type =&gt; :controller do
  
       it { is_expected.to respond_with(:not_found) }
     end
-
-    context 'with an invalid header' do
-      before :each do
-        post :notify_push, id: repository.id, format: :json
-      end
-
-      it { is_expected.to respond_with(:unprocessable_entity) }
-    end
   end
 end
@@ -36,6 +36,18 @@ FactoryGirl.define do
     kalibro_configuration_id 1
   end
  
+  factory :kalibro_client_gitlab_repository, class: Repository do
+    id 3
+    name "KalibroClient"
+    description "KalibroClient"
+    license "GPLv3"
+    period 1
+    scm_type "GIT"
+    address "https://gitlab.com/mezuro/kalibro_client.git"
+    branch 'master'
+    kalibro_configuration_id 1
+  end
+
   factory :another_repository, parent: :repository do
     id 2
   end
@@ -0,0 +1,40 @@
+require 'action_controller/test_case'
+
+class RequestInfo
+  attr_accessor :headers, :params
+
+  def request
+    req = ActionController::TestRequest.new
+    headers.each { |k, v| req.headers[k] = v }
+    params.each { |k, v| req.update_param(k, v) }
+    req
+  end
+end
+
+FactoryGirl.define do
+  factory :request, class: RequestInfo do
+    headers {}
+    params {}
+  end
+
+  factory :gitlab_webhook_request, parent: :request do
+    headers { { 'X-Gitlab-Event' => 'Push Hook' } }
+
+    # Excerpt From http://doc.gitlab.com/ee/web_hooks/web_hooks.html
+    params { {
+      "object_kind" =>  "push",
+      "ref" =>  "refs/heads/master",
+      "project" => {
+        "name" => "Kalibro Client",
+        "description" => "",
+        "git_ssh_url" => "git@example.com:mezuro/kalibro_client.git",
+        "git_http_url" => "https://gitlab.com/mezuro/kalibro_client.git",
+        "path_with_namespace" => "mezuro/kalibro_client",
+        "default_branch" => "master",
+        "url" => "git@example.com:mezuro/kalibro_client.git",
+        "ssh_url" => "git@example.com:mezuro/kalibro_client.git",
+        "http_url" => "https://gitlab.com/mezuro/kalibro_client.git"
+      }
+    } }
+  end
+end
@@ -0,0 +1,74 @@
+require 'rails_helper'
+require 'webhooks'
+
+RSpec.describe Webhooks::Base do
+  let(:request) { ActionController::TestRequest.new }
+  let(:repository) { FactoryGirl.build(:repository) }
+
+  subject { described_class.new(request, repository) }
+
+  describe 'initialize' do
+    it 'is expected to initialize request and repository' do
+      expect(subject.request).to eq(request)
+      expect(subject.repository).to eq(repository)
+    end
+  end
+
+  describe 'valid_request?' do
+    it 'is expected to not be implemented' do
+      expect { subject.valid_request? }.to raise_error(NotImplementedError)
+    end
+  end
+
+  describe 'webhook_address' do
+    it 'is expected to not be implemented' do
+      expect { subject.webhook_address }.to raise_error(NotImplementedError)
+    end
+  end
+
+  describe 'webhook_branch' do
+    it 'is expected to not be implemented' do
+      expect { subject.webhook_branch }.to raise_error(NotImplementedError)
+    end
+  end
+
+  describe 'valid_address?' do
+    it 'is expected to return true if the repository and webhook addresses match' do
+      subject.expects(:webhook_address).returns(repository.address)
+      expect(subject.valid_address?).to eq(true)
+    end
+
+    it "is expected to return false if the repository and webhook addresses don't match" do
+      subject.expects(:webhook_address).returns('test')
+      expect(subject.valid_address?).to eq(false)
+    end
+  end
+
+  describe 'valid_branch?' do
+    it 'is expected to return true if the repository and webhook branches match' do
+      subject.expects(:webhook_branch).returns(repository.branch)
+      expect(subject.valid_branch?).to eq(true)
+    end
+
+    it "is expected to return false if the repository and webhook addresses don't match" do
+      subject.expects(:webhook_branch).returns('test')
+      expect(subject.valid_branch?).to eq(false)
+    end
+  end
+
+  describe 'branch_from_ref' do
+    cases = {
+        nil => nil,
+        'refs/heads/master' => 'master',
+        'refs/tags/test' => nil,
+        'test' => nil,
+        '' => nil
+    }
+
+    cases.each do |input, output|
+      it "is expected to return #{output.inspect} for #{input.inspect}" do
+        expect(subject.send(:branch_from_ref, input)).to eq(output)
+      end
+    end
+  end
+end
@@ -0,0 +1,60 @@
+require 'rails_helper'
+require 'webhooks'
+
+RSpec.describe Webhooks::GitLab do
+  let(:request) { FactoryGirl.build(:gitlab_webhook_request).request }
+  let(:repository) { FactoryGirl.build(:repository) }
+  subject { described_class.new(request, repository) }
+
+  describe 'valid_request?' do
+    context 'with the correct Gitlab header value' do
+      it 'is expected to return true' do
+        expect(subject.valid_request?).to be(true)
+      end
+    end
+
+    context 'with an incorrect Gitlab header value' do
+      let(:request) { FactoryGirl.build(:gitlab_webhook_request, headers: { 'X-Gitlab-Event' => 'Merge Hook' }).request }
+      it 'is expected to return false' do
+        expect(subject.valid_request?).to be(false)
+      end
+    end
+
+    context 'without a GitLab header' do
+      let(:request) { FactoryGirl.build(:gitlab_webhook_request, headers: {}).request }
+      it 'is expected to return false' do
+        expect(subject.valid_request?).to be(false)
+      end
+    end
+  end
+
+  describe 'webhook_address' do
+    context 'the git URL is present' do
+      it 'is expected to return the  URL' do
+        expect(subject.webhook_address).to eq(request.params[:project][:git_http_url])
+      end
+    end
+
+    context'the git URL is not present' do
+      it 'is expected to return nil' do
+        request.expects(:params).returns({})
+        expect(subject.webhook_address).to be_nil
+      end
+    end
+  end
+
+  describe 'webhook_branch' do
+    context 'the git ref is present' do
+      it 'is expected to return the branch from the ref' do
+        expect(subject.webhook_branch).to eq('master')
+      end
+    end
+
+    context 'the git ref is not present' do
+      it 'is expected to return nil' do
+        request.expects(:params).returns({})
+        expect(subject.webhook_branch).to be_nil
+      end
+    end
+  end
+end
	1	+require 'webhooks'
	2	+
1	3	include OwnershipAuthentication
2	4
3	5	class RepositoriesController < ApplicationController
4	6	before_action :authenticate_user!, except: [:show, :state, :state_with_date, :index, :notify_push]
5	7	before_action :project_owner?, only: [:new, :create], unless: Proc.new { params[:project_id].nil? }
6	8	before_action :repository_owner?, only: [:edit, :update, :destroy, :process_repository]
7		- before_action :set_repository, only: [:show, :edit, :update, :destroy, :state, :state_with_date, :process_repository]
	9	+ before_action :set_repository, only: [:show, :edit, :update, :destroy, :state, :state_with_date, :process_repository,
	10	+ :notify_push]
8	11	before_action :set_project_id_repository_types_and_configurations, only: [:new, :edit]
9	12
10	13	# Gitlab can't send a CSRF token, don't require one
...	...	@@ -100,14 +103,21 @@ class RepositoriesController < ApplicationController
100	103	end
101	104
102	105	def notify_push
103		- gitlab_event = request.headers['X-Gitlab-Event']
104		- if gitlab_event.nil? \|\| !gitlab_event.end_with?('Push Hook')
105		- return render nothing: true, status: :unprocessable_entity
	106	+ hook_info = Webhooks::GitLab.new(request, @repository)
	107	+ if hook_info.valid_request?
	108	+ if hook_info.valid_address?
	109	+ if hook_info.valid_branch?
	110	+ @repository.cancel_processing_of_repository unless %w(READY ERROR).include? @repository.last_processing_state
	111	+ @repository.process
	112	+ end
	113	+
	114	+ render nothing: true, status: :ok
	115	+ else
	116	+ render nothing: true, status: :forbidden
	117	+ end
	118	+ else
	119	+ render nothing: true, status: :unprocessable_entity
106	120	end
107		- set_repository
108		- @repository.cancel_processing_of_repository unless %w(READY ERROR).include? @repository.last_processing_state
109		- @repository.process
110		- render nothing: true, status: :ok
111	121	end
112	122
113	123	private
...	...
...	...	@@ -7,7 +7,7 @@ Feature: Notify push to repository
7	7	Scenario: Valid repository
8	8	Given I am a regular user
9	9	And I have a sample configuration with hotspot metrics
10		- And I have a sample repository
	10	+ And I have a Kalibro Client GitLab repository
11	11	And I start to process that repository
12	12	And I wait up for a ready processing
13	13	When I push some commits to the repository
...	...	@@ -25,7 +25,7 @@ Feature: Notify push to repository
25	25	And I have a sample reading group
26	26	And I have a sample configuration with the Saikuro native metric
27	27	And I have a compound metric configuration with script "rtrnaqdfwqefwqr213r2145211234ed a = b=2" within the given mezuro configuration
28		- And I have a sample repository
	28	+ And I have a Kalibro Client GitLab repository
29	29	And I start to process that repository
30	30	And I wait up for an error processing
31	31	When I push some commits to the repository
...	...
...	...	@@ -116,6 +116,10 @@ Given(/^I have a sample repository$/) do
116	116	@independent_repository = FactoryGirl.create(:ruby_repository, kalibro_configuration_id: @kalibro_configuration.id)
117	117	end
118	118
	119	+Given(/^I have a Kalibro Client GitLab repository$/) do
	120	+ @independent_repository = FactoryGirl.create(:kalibro_client_gitlab_repository, kalibro_configuration_id: @kalibro_configuration.id)
	121	+end
	122	+
119	123	Given(/^I am at the All Repositories page$/) do
120	124	visit repositories_path
121	125	end
...	...	@@ -163,11 +167,15 @@ When(/^I get the Creation Date information as "(.*?)"$/) do \|variable\|
163	167	end
164	168
165	169	When(/^I push some commits to the repository$/) do
166		- post repository_notify_push_path(id: @repository.id), {}, {'HTTP_X_GITLAB_EVENT' => 'Push Hook'}
	170	+ request = FactoryGirl.build(:gitlab_webhook_request)
	171	+ set_headers(request.headers)
	172	+ page.driver.post(repository_notify_push_path(id: @repository.id), request.params)
167	173	end
168	174
169	175	When(/^I push some commits to an invalid repository$/) do
170		- @response = post repository_notify_push_path(id: 0), {}, {'HTTP_X_GITLAB_EVENT' => 'Push Hook'}
	176	+ request = FactoryGirl.build(:gitlab_webhook_request)
	177	+ set_headers(request.headers)
	178	+ page.driver.post(repository_notify_push_path(id: 0), request.params)
171	179	end
172	180
173	181	Then(/^I should see the sample metric's name$/) do
...	...	@@ -271,5 +279,5 @@ Then(/^Mezuro should process the repository again$/) do
271	279	end
272	280
273	281	Then(/^I should get a not found error$/) do
274		- expect(@response.status).to eq(404)
	282	+ expect(page.driver.status_code).to eq(404)
275	283	end
...	...
...	...	@@ -20,8 +20,11 @@ end
20	20	# instead of editing this one. Cucumber will automatically load all features/*/.rb
21	21	# files.
22	22
	23	+require 'warden'
23	24	require 'cucumber/rails'
24	25	require 'capybara/poltergeist'
	26	+require_relative 'header'
	27	+
25	28	#Capybara.default_driver = :poltergeist
26	29	Capybara.javascript_driver = :poltergeist
27	30	Capybara.default_max_wait_time = 20 # default is 2 seconds
...	...	@@ -81,5 +84,6 @@ Cucumber::Rails::Database.javascript_strategy = :truncation
81	84	# KalibroClient hooks
82	85	require 'kalibro_client/kalibro_cucumber_helpers/hooks.rb'
83	86
84		-# Warden test helpers so the user authentication can be as fast as possible
85		-include Warden::Test::Helpers
	87	+Warden.test_mode!
	88	+World(Warden::Test::Helpers, HeaderUtils)
	89	+
...	...
...	...	@@ -0,0 +1,15 @@
	1	+module HeaderUtils
	2	+ def set_header(key, value)
	3	+ header_method = nil
	4	+ if defined?(page) && ! page.driver.nil?
	5	+ header_method = [:add_header, :header].find(&page.driver.method(:respond_to?))
	6	+ end
	7	+
	8	+ raise StandardError.new("No header setting method available in current driver: #{page.driver}") unless header_method
	9	+ page.driver.send(header_method, key, value)
	10	+ end
	11	+
	12	+ def set_headers(headers)
	13	+ headers.each(&method(:set_header))
	14	+ end
	15	+end
...	...
...	...	@@ -0,0 +1,5 @@
	1	+require 'webhooks/base'
	2	+require 'webhooks/gitlab'
	3	+
	4	+module Webhooks
	5	+end
...	...
...	...	@@ -0,0 +1,44 @@
	1	+module Webhooks
	2	+ class Base
	3	+ attr_reader :request, :repository
	4	+
	5	+ def initialize(request, repository)
	6	+ @request = request
	7	+ @repository = repository
	8	+ end
	9	+
	10	+ # Returns true if and only if the remote addresses in the request and repository match.
	11	+ def valid_address?
	12	+ repository.address == webhook_address
	13	+ end
	14	+
	15	+ # Returns true if and only if the branch in the request and repository match.
	16	+ def valid_branch?
	17	+ repository.branch == webhook_branch
	18	+ end
	19	+
	20	+ # Returns true if the request parameters, as determined by the particular hook service, are valid
	21	+ # It will usually check headers, IP ranges, signatures, or any other relevant information.
	22	+ def valid_request?; raise NotImplementedError; end
	23	+
	24	+ # Extracts the remote address from the webhook request.
	25	+ def webhook_address; raise NotImplementedError; end
	26	+
	27	+ # Extracts the branch from the webhook request.
	28	+ def webhook_branch; raise NotImplementedError; end
	29	+
	30	+ protected
	31	+
	32	+ # Converts a git ref name to a branch. This is an utility function for webhook formats that only provide the ref
	33	+ # updated in their information. Returns nil if the passed parameter is not a valid ref.
	34	+ # The expected format is 'refs/heads/#{branch_name}'. Anything else will be rejected.
	35	+ def branch_from_ref(ref)
	36	+ return nil if !ref
	37	+
	38	+ ref = ref.split('/')
	39	+ return nil if ref.size != 3 \|\| ref[0..1] != ['refs', 'heads']
	40	+
	41	+ ref.last
	42	+ end
	43	+ end
	44	+end
...	...
...	...	@@ -0,0 +1,19 @@
	1	+module Webhooks
	2	+ class GitLab < Base
	3	+ def valid_request?
	4	+ request.headers['X-Gitlab-Event'] == 'Push Hook'
	5	+ end
	6	+
	7	+ def webhook_address
	8	+ begin
	9	+ request.params.fetch(:project).fetch(:git_http_url)
	10	+ rescue KeyError
	11	+ return nil
	12	+ end
	13	+ end
	14	+
	15	+ def webhook_branch
	16	+ branch_from_ref(request.params[:ref])
	17	+ end
	18	+ end
	19	+end
...	...
...	...	@@ -471,11 +471,12 @@ describe RepositoriesController, :type => :controller do
471	471	end
472	472
473	473	describe 'notify_push' do
474		- let(:repository) { FactoryGirl.build(:repository) }
	474	+ let(:repository) { FactoryGirl.build(:kalibro_client_gitlab_repository) }
	475	+ let(:webhook_request) { FactoryGirl.build(:gitlab_webhook_request) }
475	476
476	477	def post_push
477		- @request.env['HTTP_X_GITLAB_EVENT'] = ['Push Hook', 'Tag Push Hook'].sample
478		- post :notify_push, id: repository.id, format: :json
	478	+ @request.headers.merge!(webhook_request.headers)
	479	+ post :notify_push, {id: repository.id, format: :json}.merge(webhook_request.params)
479	480	end
480	481
481	482	context 'with a valid repository' do
...	...	@@ -483,35 +484,67 @@ describe RepositoriesController, :type => :controller do
483	484	Repository.expects(:find).with(repository.id).returns(repository)
484	485	end
485	486
486		- context 'when the repository is being processed' do
487		- before do
488		- repository.expects(:last_processing_state).returns('INTERPRETING')
489		- repository.expects(:cancel_processing_of_repository).once
490		- repository.expects(:process).once
	487	+ context 'without a valid address' do
	488	+ before :each do
	489	+ Webhooks::Base.any_instance.expects(:valid_address?).returns(false)
491	490	post_push
492	491	end
493	492
494		- it { is_expected.to respond_with(:ok) }
	493	+ it { is_expected.to respond_with(:forbidden) }
495	494	end
496	495
497		- context "when the repository's processing resulted in an error" do
498		- before do
499		- repository.expects(:last_processing_state).returns('ERROR')
500		- repository.expects(:process).once
501		- post_push
	496	+ context 'with a valid address' do
	497	+ before :each do
	498	+ Webhooks::Base.any_instance.expects(:valid_address?).returns(true)
502	499	end
503	500
504		- it { is_expected.to respond_with(:ok) }
505		- end
	501	+ context 'without a matching branch' do
	502	+ before :each do
	503	+ Webhooks::Base.any_instance.expects(:valid_branch?).returns(false)
	504	+ repository.expects(:cancel_processing_of_repository).never
	505	+ repository.expects(:process).never
	506	+ post_push
	507	+ end
506	508
507		- context 'when the repository is not being processed' do
508		- before do
509		- repository.expects(:last_processing_state).returns('READY')
510		- repository.expects(:process).once
511		- post_push
	509	+ it { is_expected.to respond_with(:ok) }
512	510	end
513	511
514		- it { is_expected.to respond_with(:ok) }
	512	+ context 'with a matching branch' do
	513	+ before :each do
	514	+ Webhooks::Base.any_instance.expects(:valid_branch?).returns(true)
	515	+ end
	516	+
	517	+ context 'when the repository is being processed' do
	518	+ before do
	519	+ repository.expects(:last_processing_state).returns('INTERPRETING')
	520	+ repository.expects(:cancel_processing_of_repository).once
	521	+ repository.expects(:process).once
	522	+ post_push
	523	+ end
	524	+
	525	+ it { is_expected.to respond_with(:ok) }
	526	+ end
	527	+
	528	+ context "when the repository's processing resulted in an error" do
	529	+ before do
	530	+ repository.expects(:last_processing_state).returns('ERROR')
	531	+ repository.expects(:process).once
	532	+ post_push
	533	+ end
	534	+
	535	+ it { is_expected.to respond_with(:ok) }
	536	+ end
	537	+
	538	+ context 'when the repository is not being processed' do
	539	+ before do
	540	+ repository.expects(:last_processing_state).returns('READY')
	541	+ repository.expects(:process).once
	542	+ post_push
	543	+ end
	544	+
	545	+ it { is_expected.to respond_with(:ok) }
	546	+ end
	547	+ end
515	548	end
516	549	end
517	550
...	...	@@ -523,13 +556,5 @@ describe RepositoriesController, :type => :controller do
523	556
524	557	it { is_expected.to respond_with(:not_found) }
525	558	end
526		-
527		- context 'with an invalid header' do
528		- before :each do
529		- post :notify_push, id: repository.id, format: :json
530		- end
531		-
532		- it { is_expected.to respond_with(:unprocessable_entity) }
533		- end
534	559	end
535	560	end
...	...
...	...	@@ -36,6 +36,18 @@ FactoryGirl.define do
36	36	kalibro_configuration_id 1
37	37	end
38	38
	39	+ factory :kalibro_client_gitlab_repository, class: Repository do
	40	+ id 3
	41	+ name "KalibroClient"
	42	+ description "KalibroClient"
	43	+ license "GPLv3"
	44	+ period 1
	45	+ scm_type "GIT"
	46	+ address "https://gitlab.com/mezuro/kalibro_client.git"
	47	+ branch 'master'
	48	+ kalibro_configuration_id 1
	49	+ end
	50	+
39	51	factory :another_repository, parent: :repository do
40	52	id 2
41	53	end
...	...