* docs(autoscan): add arr webhook intake spec and implementation plan Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(autoscan): add webhook intake schema migration Adds delivery_mode to autoscan_sources, the autoscan_webhook_endpoints table, and delivery_mode/provider_event_type on autoscan_events. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(autoscan): add built-in arr-webhook source identity Host-discovered scan-source entry so webhook-mode sources need no plugin installation; composite lister appends it to plugin discovery. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(autoscan): persist delivery mode, webhook endpoints, event metadata Sources carry delivery_mode; autoscan_webhook_endpoints CRUD with SHA-256 token lookup and AAD-bound encrypted redisplay; events record delivery_mode/provider_event_type; CreateEvent gains SkipRunningCheck so webhook deliveries are never dropped by the poll exclusion. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(autoscan): share the consume path and add webhook IngestChanges Extracts consumeSourceChanges from PollOnce (marker semantics preserved, existing poll tests unchanged); PollOnce skips webhook sources; IngestChanges feeds deliveries through the shared pipeline without markers and without the running-event exclusion. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(autoscan): add Sonarr/Radarr webhook payload parser Host-side arrwebhook package: provider inference, import/rename/delete path extraction with vanished-path-friendly previous paths, subtree fallback, exact-path dedupe, and no-op unknown events. Fixture-backed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(autoscan): add public webhook delivery route and admin endpoint management Public POST /api/v1/autoscan/webhooks/{token} with per-IP rate limiting, 256KiB body cap, 202-for-noop semantics, and token/body kept out of logs; admin create/rotate/delete endpoint routes; source responses carry delivery mode + webhook status/URL; create/update validate delivery mode against source identity. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(web): add webhook delivery mode to Autoscan admin UI Webhook sources get a generate/copy/rotate webhook URL section, provider selector, delivery status, and a connection-free Add-source flow; activity rows badge webhook deliveries with the arr event type. Path rewrites stay editable in both modes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(api): redact secret path params from request and activity logs The request logger and activity-log middleware recorded raw URLs, so bearer credentials in secret path segments (autoscan webhook {token}, webhook-sync {secret}) were persisted to app logs and activity_log. Redact the secret segment via the chi route params in both sinks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(autoscan): make webhook delivery reliable --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
111 lines
3.9 KiB
Go
111 lines
3.9 KiB
Go
package autoscan
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
)
|
|
|
|
// Built-in source identities are host-discovered scan-source entries that need
|
|
// no plugin installation. The ARR webhook identity backs webhook-mode sources:
|
|
// Sonarr/Radarr POST directly to Silo, the host parses the payload, and the
|
|
// plugin provider is never invoked for it.
|
|
const (
|
|
BuiltinArrWebhookPluginID = "silo.autoscan.arr-webhook"
|
|
BuiltinArrWebhookCapabilityID = "arr-webhook"
|
|
builtinArrWebhookDisplayName = "Sonarr/Radarr Webhook"
|
|
)
|
|
|
|
// BuiltinArrWebhookSource returns the host-built-in ARR webhook source
|
|
// identity offered by the Add-source picker alongside installed plugin
|
|
// capabilities.
|
|
func BuiltinArrWebhookSource() DiscoveredSource {
|
|
return DiscoveredSource{
|
|
PluginID: BuiltinArrWebhookPluginID,
|
|
CapabilityID: BuiltinArrWebhookCapabilityID,
|
|
DisplayName: builtinArrWebhookDisplayName,
|
|
}
|
|
}
|
|
|
|
// IsBuiltinArrWebhookIdentity reports whether (pluginID, capabilityID) is the
|
|
// built-in ARR webhook source identity.
|
|
func IsBuiltinArrWebhookIdentity(pluginID, capabilityID string) bool {
|
|
return pluginID == BuiltinArrWebhookPluginID && capabilityID == BuiltinArrWebhookCapabilityID
|
|
}
|
|
|
|
// DiscoveredSource identifies one installed scan_source.v1 capability instance,
|
|
// enriched with the metadata the Add-source picker needs (plugin id + a
|
|
// human-friendly display name).
|
|
type DiscoveredSource struct {
|
|
// PluginID is the installation's plugin id (e.g. "sonarr"); empty when the
|
|
// lister cannot supply it.
|
|
PluginID string
|
|
CapabilityID string
|
|
// DisplayName is a human-friendly label for the capability (from the
|
|
// capability's manifest display_name, falling back to plugin/capability ids).
|
|
DisplayName string
|
|
}
|
|
|
|
// ScanSourceLister enumerates every installed scan_source.v1 capability so the
|
|
// engine can offer them in the Add-source picker.
|
|
type ScanSourceLister interface {
|
|
// ListScanSources returns one entry per installed scan_source.v1 capability,
|
|
// enriched with plugin id + display name.
|
|
ListScanSources(ctx context.Context) ([]DiscoveredSource, error)
|
|
}
|
|
|
|
// WithBuiltinSources wraps a ScanSourceLister so host-built-in source
|
|
// identities appear beside installed plugin capabilities. inner may be nil
|
|
// (only the builtins are returned), matching the Service's nil-lister
|
|
// tolerance.
|
|
func WithBuiltinSources(inner ScanSourceLister, builtins ...DiscoveredSource) ScanSourceLister {
|
|
return builtinSourceLister{inner: inner, builtins: builtins}
|
|
}
|
|
|
|
type builtinSourceLister struct {
|
|
inner ScanSourceLister
|
|
builtins []DiscoveredSource
|
|
}
|
|
|
|
func (l builtinSourceLister) ListScanSources(ctx context.Context) ([]DiscoveredSource, error) {
|
|
var out []DiscoveredSource
|
|
if l.inner != nil {
|
|
discovered, err := l.inner.ListScanSources(ctx)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
out = discovered
|
|
}
|
|
return append(out, l.builtins...), nil
|
|
}
|
|
|
|
// AvailableScanSource is one installed scan_source capability an operator can
|
|
// create a source against (the Add-source picker list).
|
|
type AvailableScanSource struct {
|
|
PluginID string `json:"plugin_id"`
|
|
CapabilityID string `json:"capability_id"`
|
|
DisplayName string `json:"display_name"`
|
|
}
|
|
|
|
// ListAvailableScanSources enumerates every installed scan_source capability so
|
|
// an operator can pick one when creating a source. When no lister is configured
|
|
// it returns an empty list. The handler also uses this to validate that a
|
|
// create request targets a currently-installed capability.
|
|
func (s *Service) ListAvailableScanSources(ctx context.Context) ([]AvailableScanSource, error) {
|
|
if s.lister == nil {
|
|
return []AvailableScanSource{}, nil
|
|
}
|
|
discovered, err := s.lister.ListScanSources(ctx)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("list scan sources: %w", err)
|
|
}
|
|
out := make([]AvailableScanSource, 0, len(discovered))
|
|
for _, d := range discovered {
|
|
out = append(out, AvailableScanSource{
|
|
PluginID: d.PluginID,
|
|
CapabilityID: d.CapabilityID,
|
|
DisplayName: d.DisplayName,
|
|
})
|
|
}
|
|
return out, nil
|
|
}
|