close
Skip to content

feat(api): implement HandleVCSWebhook ingress HTTP handler - #2740

Draft
jcscottiii wants to merge 11 commits into
feature/code-subs-10d-api-delete-code-subscriptionfrom
feature/code-subs-10-api-handlers
Draft

feat(api): implement HandleVCSWebhook ingress HTTP handler#2740
jcscottiii wants to merge 11 commits into
feature/code-subs-10d-api-delete-code-subscriptionfrom
feature/code-subs-10-api-handlers

Conversation

@jcscottiii

@jcscottiii jcscottiii commented Aug 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Refs #2712, #2722

Adds HTTP route handlers for code subscriptions and webhook ingestion.

  • backend/pkg/httpserver/code_subscriptions_handlers.go: REST handlers for listing installations, querying subscriptions, and deleting subscriptions with BOLA authorization checks.
  • backend/pkg/httpserver/handle_vcs_webhook.go: Ingress webhook handler verifying HMAC signatures, recording deduplication, and publishing scan tasks to Pub/Sub.
  • HTTP handler unit tests using standard test server helpers.

@jcscottiii jcscottiii mentioned this pull request Aug 14, 2026
Open
@jcscottiii
jcscottiii force-pushed the feature/code-subs-09-openapi branch from 691fc02 to f8da097 Compare August 14, 2026 20:26
@jcscottiii
jcscottiii force-pushed the feature/code-subs-10-api-handlers branch 2 times, most recently from 05c5e80 to 814bdf1 Compare August 16, 2026 15:29
@jcscottiii
jcscottiii force-pushed the feature/code-subs-09-openapi branch 2 times, most recently from 82a5273 to 06806d9 Compare August 17, 2026 02:28
@jcscottiii
jcscottiii force-pushed the feature/code-subs-10-api-handlers branch 2 times, most recently from e3d9561 to afe850d Compare August 17, 2026 20:56
@jcscottiii
jcscottiii force-pushed the feature/code-subs-09-openapi branch 2 times, most recently from 0cd59d0 to d231d25 Compare August 18, 2026 13:57
@jcscottiii
jcscottiii force-pushed the feature/code-subs-10-api-handlers branch from afe850d to bdd03a8 Compare August 18, 2026 13:57
@jcscottiii
jcscottiii force-pushed the feature/code-subs-09-openapi branch from d231d25 to ffdc523 Compare August 18, 2026 16:27
@jcscottiii
jcscottiii force-pushed the feature/code-subs-10-api-handlers branch 2 times, most recently from 3b27805 to ae9eecc Compare August 18, 2026 17:42
@jcscottiii
jcscottiii force-pushed the feature/code-subs-09-openapi branch from ffdc523 to 0798ce6 Compare August 18, 2026 17:42
@jcscottiii
jcscottiii force-pushed the feature/code-subs-10-api-handlers branch from ae9eecc to 929b975 Compare August 18, 2026 19:34
@jcscottiii
jcscottiii force-pushed the feature/code-subs-09-openapi branch 2 times, most recently from 927f683 to fef2f11 Compare August 18, 2026 19:45
@jcscottiii
jcscottiii force-pushed the feature/code-subs-10-api-handlers branch from 929b975 to c798bdb Compare August 18, 2026 19:45
@jcscottiii
jcscottiii force-pushed the feature/code-subs-09-openapi branch from fef2f11 to ededf1b Compare August 18, 2026 19:45
@jcscottiii
jcscottiii force-pushed the feature/code-subs-10-api-handlers branch from c798bdb to 791deff Compare August 18, 2026 19:45
@jcscottiii
jcscottiii force-pushed the feature/code-subs-09-openapi branch from ededf1b to 9539bd2 Compare August 18, 2026 20:28
@jcscottiii
jcscottiii force-pushed the feature/code-subs-10-api-handlers branch from 791deff to f8f46ed Compare August 18, 2026 20:28
@jcscottiii
jcscottiii force-pushed the feature/code-subs-09-openapi branch from 9539bd2 to 4c70fe8 Compare August 18, 2026 20:29
@jcscottiii
jcscottiii force-pushed the feature/code-subs-10-api-handlers branch from f8f46ed to 580a006 Compare August 18, 2026 20:29
@jcscottiii
jcscottiii force-pushed the feature/code-subs-09-openapi branch from 4c70fe8 to a733999 Compare August 18, 2026 20:31
@jcscottiii
jcscottiii force-pushed the feature/code-subs-10-api-handlers branch from 580a006 to 38388dc Compare August 18, 2026 20:31
@jcscottiii
jcscottiii force-pushed the feature/code-subs-09-openapi branch from a733999 to 6728ccc Compare August 18, 2026 20:32
@jcscottiii
jcscottiii force-pushed the feature/code-subs-10-api-handlers branch from 38388dc to ba26d96 Compare August 18, 2026 20:32
@jcscottiii
jcscottiii force-pushed the feature/code-subs-09-openapi branch from 6728ccc to c4c6614 Compare August 18, 2026 20:34
@jcscottiii
jcscottiii force-pushed the feature/code-subs-09-openapi branch from a631c4c to 2545163 Compare August 19, 2026 00:32
@jcscottiii
jcscottiii force-pushed the feature/code-subs-10-api-handlers branch from 1a02536 to f6d5cfe Compare August 19, 2026 00:32
@jcscottiii
jcscottiii force-pushed the feature/code-subs-09-openapi branch from 2545163 to 659586b Compare August 19, 2026 00:36
@jcscottiii
jcscottiii force-pushed the feature/code-subs-10-api-handlers branch from f6d5cfe to 2df09b8 Compare August 19, 2026 00:36
@jcscottiii
jcscottiii force-pushed the feature/code-subs-09-openapi branch from 659586b to 8a0df7c Compare August 19, 2026 01:04
@jcscottiii
jcscottiii force-pushed the feature/code-subs-10-api-handlers branch from 2df09b8 to c63a75e Compare August 19, 2026 01:04
@jcscottiii
jcscottiii force-pushed the feature/code-subs-09-openapi branch from 8a0df7c to 2a98ea3 Compare August 19, 2026 02:02
@jcscottiii
jcscottiii force-pushed the feature/code-subs-10-api-handlers branch from c63a75e to 2788ce4 Compare August 19, 2026 02:02
@jcscottiii
jcscottiii force-pushed the feature/code-subs-09-openapi branch from 2a98ea3 to 01bde95 Compare August 19, 2026 02:12
@jcscottiii
jcscottiii force-pushed the feature/code-subs-10-api-handlers branch from 2788ce4 to a0c4cd0 Compare August 19, 2026 02:12
@jcscottiii
jcscottiii force-pushed the feature/code-subs-09-openapi branch from 01bde95 to b63f0cd Compare August 19, 2026 13:08
@jcscottiii
jcscottiii force-pushed the feature/code-subs-10-api-handlers branch from a0c4cd0 to 5122aec Compare August 19, 2026 13:08
@jcscottiii
jcscottiii force-pushed the feature/code-subs-09-openapi branch from b63f0cd to fd7da3b Compare August 19, 2026 15:28
@jcscottiii
jcscottiii force-pushed the feature/code-subs-10-api-handlers branch from 5122aec to d62748f Compare August 19, 2026 15:28
@jcscottiii
[Spanner Schema] Add Migration 000034.sql and VCSInstallation Entity …
1aed15d 
…Models

- Create VCSInstallations table in Spanner migration 000034.sql
- Implement VCSInstallation Go model and Spanner serialization mappers
- Add UpsertVCSInstallation client method with roundtrip unit tests
- Add pure domain types in lib/backendtypes/code_subscriptions.go

TAG=agy
@jcscottiii
[Spanner Schema] Add Migration 000035.sql for CodeSubscriptions
e48cd80 
- Create CodeSubscriptions table in migration 000035.sql
- Implement CodeSubscription model and Spanner mappers
- Add struct conversion, mapper, and Spanner emulator unit tests

TAG=agy
@jcscottiii
[Spanner Schema] Add Migration 000036.sql for CodeSubscriptionDeliveries
5de4484 
- Create CodeSubscriptionDeliveries table in migration 000036.sql
- Implement CodeSubscriptionDelivery model and Spanner mappers
- Add struct conversion, mapper, and Spanner emulator unit tests

TAG=agy
@jcscottiii
[Spanner Schema] Add Migration 000037.sql for ScanLogs and WebhookDel…
56800a6 
…iveries

- Create CodeSubscriptionScanLogs and VCSWebhookDeliveries tables in migration 000037.sql
- Configure native Spanner TTL row deletion policies (30-day and 7-day)
- Implement entity models, Spanner mappers, and unit tests

TAG=agy
@jcscottiii
[Security] Implement SafeDialer SSRF Defense and HMAC Verifier
bcd981c 
- Implement SafeDialer with socket-level Control verification and DNS rebinding defense
- Block RFC1918, CGNAT, link-local, GCP metadata, and IPv4-mapped IPv6 ranges
- Implement constant-time HMAC SHA-256 webhook signature verification
- Add table-driven unit tests and Go fuzz test

TAG=agy
@jcscottiii
[Auth] Implement RS256 JWT Minting and Singleflight TokenProvider
cdca781 
- Implement RS256 JWT minting for GitHub App authentication
- Implement TokenProvider with singleflight coalescing and in-memory caching
- Add detached context protection for background execution
- Add comprehensive concurrency and error recovery unit tests

TAG=agy
@jcscottiii
[AST Scanner] Implement Linear-Time Comment Directive Parser
10d67e7 
- Parse canonical TODO(baseline/<id>) and TODO(baseline/<id>, newly) directives
- Support legacy @WebStatus: annotations and multi-language comment syntax
- Parse project-level baseline defaults from .baseline.json and AGENTS.md
- Add comprehensive unit test suite

TAG=agy
@jcscottiii
[AST Scanner] Implement Git Tree Scanner with Blob Retrieval
8246dc1 
- Implement ScanGitTree walking git tree entries with 1MB blob limits
- Decouple VCS provider and blob retrieval via BlobReader interface
- Aggregate occurrences across multiple files and directories
- Add unit tests for multi-file directive aggregation and project defaults

TAG=agy
@jcscottiii
[Spanner Repo] Implement Scoped Synchronization and Delivery Locking
02a2915 
- Implement SynchronizeRepositoryCodeSubscriptions with non-deleted status checks
- Implement atomic AcquireDeliveryLock, RecordDeliverySuccess, and ReleaseDeliveryLock
- Implement RecordVCSWebhookDelivery for replay deduplication
- Add comprehensive Spanner emulator integration test

TAG=agy
@jcscottiii
[OpenAPI] Add Code Subscriptions REST Schemas and Generated Bindings
1511359 
- Add OpenAPI 3.0 schemas for VCS installations, subscriptions, and webhooks
- Regenerate Go and TypeScript type definitions
- Implement Spanner and PubSub adapters for OpenAPI types

TAG=agy
@jcscottiii
[API] Implement Code Subscriptions and Webhook HTTP Handlers
160e31c 
- Implement ListCodeSubscriptions, DeleteCodeSubscription, and VCS installation handlers
- Implement HandleVCSWebhook for ingress with HMAC verification and replay deduplication
- Enforce BOLA authorization checks using repository permissions
- Add table-driven unit tests for all REST and webhook endpoints

TAG=agy
@jcscottiii
jcscottiii force-pushed the feature/code-subs-10-api-handlers branch from d62748f to 160e31c Compare August 19, 2026 17:16
@jcscottiii
jcscottiii force-pushed the feature/code-subs-09-openapi branch 2 times, most recently from 1511359 to 88ce8c5 Compare August 19, 2026 21:33
@jcscottiii jcscottiii changed the title feat(api): add code subscriptions and webhook HTTP route handlers feat(api): implement HandleVCSWebhook ingress HTTP handler Aug 19, 2026
@jcscottiii
jcscottiii changed the base branch from feature/code-subs-09-openapi to feature/code-subs-10d-api-delete-code-subscription August 19, 2026 21:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jcscottiii