From f05c811bdca9605da9df2dc62ba0dd2f561cba18 Mon Sep 17 00:00:00 2001
From: Mauricio Siu <47042324+Siumauricio@users.noreply.github.com>
Date: Sun, 1 Sep 2024 14:51:03 -0600
Subject: [PATCH] fix(webhooks): update github webhook validation

---
 .../settings/git/show-git-providers.tsx       | 180 +++++++++---------
 apps/dokploy/pages/api/deploy/github.ts       |  22 ++-
 2 files changed, 106 insertions(+), 96 deletions(-)

diff --git a/apps/dokploy/components/dashboard/settings/git/show-git-providers.tsx b/apps/dokploy/components/dashboard/settings/git/show-git-providers.tsx
index a67a3682..95244d5a 100644
--- a/apps/dokploy/components/dashboard/settings/git/show-git-providers.tsx
+++ b/apps/dokploy/components/dashboard/settings/git/show-git-providers.tsx
@@ -44,100 +44,102 @@ export const ShowGitProviders = () => {
 					</div>
 				</CardContent>
 			</Card>
-			{data?.map((gitProvider, index) => {
-				const isGithub = gitProvider.providerType === "github";
-				const isGitlab = gitProvider.providerType === "gitlab";
-				const haveGithubRequirements =
-					gitProvider.providerType === "github" &&
-					gitProvider.github?.githubPrivateKey &&
-					gitProvider.github?.githubAppId &&
-					gitProvider.github?.githubInstallationId;
+			<div className="grid gap-4 sm:grid-cols-1 md:grid-cols-1">
+				{data?.map((gitProvider, index) => {
+					const isGithub = gitProvider.providerType === "github";
+					const isGitlab = gitProvider.providerType === "gitlab";
+					const haveGithubRequirements =
+						gitProvider.providerType === "github" &&
+						gitProvider.github?.githubPrivateKey &&
+						gitProvider.github?.githubAppId &&
+						gitProvider.github?.githubInstallationId;
 
-				const haveGitlabRequirements =
-					gitProvider.gitlab?.accessToken && gitProvider.gitlab?.refreshToken;
-				return (
-					<div
-						className="space-y-4"
-						key={`${gitProvider.gitProviderId}-${index}`}
-					>
-						<Card className="flex sm:flex-row max-sm:gap-2 flex-col justify-between items-center p-4">
-							<div className="flex items-center space-x-4 w-full">
-								{gitProvider.providerType === "github" && (
-									<GithubIcon className="w-6 h-6" />
-								)}
-								{gitProvider.providerType === "gitlab" && (
-									<GitlabIcon className="w-6 h-6" />
-								)}
-								{gitProvider.providerType === "bitbucket" && (
-									<BitbucketIcon className="w-6 h-6" />
-								)}
-								<div>
-									<p className="font-medium">
-										{gitProvider.providerType === "github"
-											? "GitHub"
-											: gitProvider.providerType === "gitlab"
-												? "GitLab"
-												: "Bitbucket"}
-									</p>
-									<p className="text-sm text-muted-foreground">
-										{gitProvider.name}
-									</p>
+					const haveGitlabRequirements =
+						gitProvider.gitlab?.accessToken && gitProvider.gitlab?.refreshToken;
+					return (
+						<div
+							className="space-y-4"
+							key={`${gitProvider.gitProviderId}-${index}`}
+						>
+							<Card className="flex sm:flex-row max-sm:gap-2 flex-col justify-between items-center p-4 h-full">
+								<div className="flex items-center space-x-4 w-full">
+									{gitProvider.providerType === "github" && (
+										<GithubIcon className="w-6 h-6" />
+									)}
+									{gitProvider.providerType === "gitlab" && (
+										<GitlabIcon className="w-6 h-6" />
+									)}
+									{gitProvider.providerType === "bitbucket" && (
+										<BitbucketIcon className="w-6 h-6" />
+									)}
+									<div>
+										<p className="font-medium">
+											{gitProvider.providerType === "github"
+												? "GitHub"
+												: gitProvider.providerType === "gitlab"
+													? "GitLab"
+													: "Bitbucket"}
+										</p>
+										<p className="text-sm text-muted-foreground">
+											{gitProvider.name}
+										</p>
+									</div>
 								</div>
-							</div>
-							<div className="flex  sm:gap-4 sm:flex-row flex-col">
-								{!haveGithubRequirements && isGithub && (
-									<div className="flex flex-col  gap-1">
-										<Link
-											href={`${gitProvider?.github?.githubAppName}/installations/new?state=gh_setup:${gitProvider?.github.githubId}`}
-											className={buttonVariants({ className: "w-fit" })}
-										>
-											Install Github App
-										</Link>
-									</div>
-								)}
+								<div className="flex  sm:gap-4 sm:flex-row flex-col">
+									{!haveGithubRequirements && isGithub && (
+										<div className="flex flex-col  gap-1">
+											<Link
+												href={`${gitProvider?.github?.githubAppName}/installations/new?state=gh_setup:${gitProvider?.github.githubId}`}
+												className={buttonVariants({ className: "w-fit" })}
+											>
+												Install Github App
+											</Link>
+										</div>
+									)}
 
-								{haveGithubRequirements && isGithub && (
-									<div className="flex flex-col  gap-1">
-										<Link
-											href={`${gitProvider?.github?.githubAppName}`}
-											target="_blank"
-											className={buttonVariants({
-												className: "w-fit",
-												variant: "secondary",
-											})}
-										>
-											<span className="text-sm">Manage Github App</span>
-										</Link>
-									</div>
-								)}
+									{haveGithubRequirements && isGithub && (
+										<div className="flex flex-col  gap-1">
+											<Link
+												href={`${gitProvider?.github?.githubAppName}`}
+												target="_blank"
+												className={buttonVariants({
+													className: "w-fit",
+													variant: "secondary",
+												})}
+											>
+												<span className="text-sm">Manage Github App</span>
+											</Link>
+										</div>
+									)}
 
-								{!haveGitlabRequirements && isGitlab && (
-									<div className="flex flex-col  gap-1">
-										<Link
-											href={getGitlabUrl(
-												gitProvider.gitlab?.applicationId || "",
-												gitProvider.gitlab?.gitlabId || "",
-											)}
-											target="_blank"
-											className={buttonVariants({
-												className: "w-fit",
-												variant: "secondary",
-											})}
-										>
-											<span className="text-sm">Install Gitlab App</span>
-										</Link>
-									</div>
-								)}
+									{!haveGitlabRequirements && isGitlab && (
+										<div className="flex flex-col  gap-1">
+											<Link
+												href={getGitlabUrl(
+													gitProvider.gitlab?.applicationId || "",
+													gitProvider.gitlab?.gitlabId || "",
+												)}
+												target="_blank"
+												className={buttonVariants({
+													className: "w-fit",
+													variant: "secondary",
+												})}
+											>
+												<span className="text-sm">Install Gitlab App</span>
+											</Link>
+										</div>
+									)}
 
-								<RemoveGitProvider
-									gitProviderId={gitProvider.gitProviderId}
-									gitProviderType={gitProvider.providerType}
-								/>
-							</div>
-						</Card>
-					</div>
-				);
-			})}
+									<RemoveGitProvider
+										gitProviderId={gitProvider.gitProviderId}
+										gitProviderType={gitProvider.providerType}
+									/>
+								</div>
+							</Card>
+						</div>
+					);
+				})}
+			</div>
 		</div>
 	);
 };
diff --git a/apps/dokploy/pages/api/deploy/github.ts b/apps/dokploy/pages/api/deploy/github.ts
index 832e34cc..1c22b9c0 100644
--- a/apps/dokploy/pages/api/deploy/github.ts
+++ b/apps/dokploy/pages/api/deploy/github.ts
@@ -1,6 +1,6 @@
 import { findAdmin } from "@/server/api/services/admin";
 import { db } from "@/server/db";
-import { applications, compose } from "@/server/db/schema";
+import { applications, compose, githubProvider } from "@/server/db/schema";
 import type { DeploymentJob } from "@/server/queues/deployments-queue";
 import { myQueue } from "@/server/queues/queueSetup";
 import { Webhooks } from "@octokit/webhooks";
@@ -19,18 +19,26 @@ export default async function handler(
 		return;
 	}
 
-	if (!admin.githubWebhookSecret) {
-		res.status(200).json({ message: "Github Webhook Secret not set" });
+	const signature = req.headers["x-hub-signature-256"];
+	const github = req.body;
+
+	const githubResult = await db.query.githubProvider.findFirst({
+		where: eq(githubProvider.githubInstallationId, github.installation.id),
+	});
+
+	if (!githubResult) {
+		res.status(400).json({ message: "Github Installation not found" });
 		return;
 	}
 
+	if (!githubResult.githubWebhookSecret) {
+		res.status(400).json({ message: "Github Webhook Secret not set" });
+		return;
+	}
 	const webhooks = new Webhooks({
-		secret: admin.githubWebhookSecret,
+		secret: githubResult.githubWebhookSecret,
 	});
 
-	const signature = req.headers["x-hub-signature-256"];
-	const github = req.body;
-
 	const verified = await webhooks.verify(
 		JSON.stringify(github),
 		signature as string,