feat: verify hooks signature

webbertakken / reviewer

PR Code Reviewer

MIT License

22 stars 2 forks source link

Changes

This verifies the signature of an event hook call (using the secret).
Take the installationId from the request headers and owner and repo from the event payload.
Update code signature to better align with the information that's available at each level, to reduce the pollution of the code with config and init stuff.
Fix tests
Correctly authenticate using pkcs8 (recognisable by BEGIN PRIVATE KEY signature) over pkcs1 (recognisable by BEGIN RSA PRIVATE KEY signature)

Signature signature signature, yes I know :D

Checklist

[x] Read the contribution guide and accept the code of conduct
[x] Readme (updated or not needed)
[x] Tests (added, updated or not needed)

Codecov Report

Merging #31 (6c05eb9) into main (75d018d) will not change coverage. The diff coverage is 100.00%.

@@ Coverage Diff @@ ## main #31 +/- ## ========================================= Coverage 100.00% 100.00% ========================================= Files 1 2 +1 Lines 39 87 +48 Branches 4 7 +3 ========================================= + Hits 39 87 +48