[Enhancement] Support CloudEvents Webhook Specification

[jinrongluo]

Search before asking

• I had searched in the issues and found no similar issues.

Enhancement Request

Eventmesh supports CloudEvents Specification. But there is a missing piece of work about Http Webhook for CloudEvents.

https://github.com/cloudevents/spec/blob/v1.0.1/http-webhook.md

To completely meet the CloudEvents Spec, I suggest implement Http Webhook for CloudEvents in EventMesh.

Describe the solution you'd like

Implement HTTP Webhook for CloudEvents Spec - https://github.com/cloudevents/spec/blob/v1.0.1/http-webhook.md

In HTTP Push -> AsyncHTTPPushRequest class

Are you willing to submit PR?

• Yes I am willing to submit a PR!

[vongosling]

There are many constraints in this pr. IMO, the most important must-be item is WebHook-Request-Origin, we should care about this part.

[jinrongluo]

Thanks I will contribute PR for this CloudEvents webhook spec

[jinrongluo]

For implementing CloudEvents WebHook Spec, the following items required:

Delivery Notification Request

1. use HTTPS when invoking the webhook
2. HTTP Header uses Content-Type
3. HTTP Header includes WebHook-Request-Origin

Delivery Notification Response

1. If delivery is accepted and processed, there is payload in response, Http return Code 200 OK / 201 Created, Response HTTP Header uses Content-Type
2. If delivery is accepted and processed and no payload, HTTP return code 201 Created / 204 No Content
3. If delivery is accepted and process status is unknown, HTTP return code 202 Accepted
4. If the delivery is retired and the target returns 410 Gone, Eventmesh should not send further requests
5. If the delivery target not able to process the request due to exceeding request rate limit, it should return 429 Too Many Requests. and include Retry-After header. Eventmesh should use this value for next retry
6. If the delivery is not accepted due to the notification format is not understood. it should return 415 Unsupported Media Type

Authorization

1. Adding Authorization header

Abuse Protection: Validation Request

1. include WebHook-Request-Origin Http Header

Abuse Protection: Validation Response

1. include WebHook-Allowed-Origin