Skip to content

Commit f53ad98

Browse files
janepiejanepie
committed
feat: token deletion logic
Signed-off-by: Jana Peper <jana.peper@nextcloud.com>
1 parent ee98fb0 commit f53ad98

File tree

10 files changed

+297
-5
lines changed

10 files changed

+297
-5
lines changed

‎apps/webhook_listeners/appinfo/info.xml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ Administrators can configure webhook listeners via the app's OCS API. The app al
1818
]]>
1919
</description>
2020

21-
<version>1.4.1</version>
21+
<version>1.4.2</version>
2222
<licence>agpl</licence>
2323
<author>Côme Chilliet</author>
2424
<namespace>WebhookListeners</namespace>
@@ -49,4 +49,8 @@ Administrators can configure webhook listeners via the app's OCS API. The app al
4949
<admin-delegation>OCA\WebhookListeners\Settings\Admin</admin-delegation>
5050
<admin-delegation-section>OCA\WebhookListeners\Settings\AdminSection</admin-delegation-section>
5151
</settings>
52+
53+
<background-jobs>
54+
<job>OCA\WebhookListeners\BackgroundJobs\WebhookTokenCleanup</job>
55+
</background-jobs>
5256
</info>

‎apps/webhook_listeners/composer/composer/autoload_classmap.php‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,12 @@
99
'Composer\\InstalledVersions' => $vendorDir . '/composer/InstalledVersions.php',
1010
'OCA\\WebhookListeners\\AppInfo\\Application' => $baseDir . '/../lib/AppInfo/Application.php',
1111
'OCA\\WebhookListeners\\BackgroundJobs\\WebhookCall' => $baseDir . '/../lib/BackgroundJobs/WebhookCall.php',
12+
'OCA\\WebhookListeners\\BackgroundJobs\\WebhookTokenCleanup' => $baseDir . '/../lib/BackgroundJobs/WebhookTokenCleanup.php',
1213
'OCA\\WebhookListeners\\Command\\ListWebhooks' => $baseDir . '/../lib/Command/ListWebhooks.php',
1314
'OCA\\WebhookListeners\\Controller\\WebhooksController' => $baseDir . '/../lib/Controller/WebhooksController.php',
1415
'OCA\\WebhookListeners\\Db\\AuthMethod' => $baseDir . '/../lib/Db/AuthMethod.php',
16+
'OCA\\WebhookListeners\\Db\\TemporaryToken' => $baseDir . '/../lib/Db/TemporaryToken.php',
17+
'OCA\\WebhookListeners\\Db\\TemporaryTokenMapper' => $baseDir . '/../lib/Db/TemporaryTokenMapper.php',
1518
'OCA\\WebhookListeners\\Db\\WebhookListener' => $baseDir . '/../lib/Db/WebhookListener.php',
1619
'OCA\\WebhookListeners\\Db\\WebhookListenerMapper' => $baseDir . '/../lib/Db/WebhookListenerMapper.php',
1720
'OCA\\WebhookListeners\\Listener\\WebhooksEventListener' => $baseDir . '/../lib/Listener/WebhooksEventListener.php',

‎apps/webhook_listeners/composer/composer/autoload_static.php‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,12 @@ class ComposerStaticInitWebhookListeners
2424
'Composer\\InstalledVersions' => __DIR__ . '/..' . '/composer/InstalledVersions.php',
2525
'OCA\\WebhookListeners\\AppInfo\\Application' => __DIR__ . '/..' . '/../lib/AppInfo/Application.php',
2626
'OCA\\WebhookListeners\\BackgroundJobs\\WebhookCall' => __DIR__ . '/..' . '/../lib/BackgroundJobs/WebhookCall.php',
27+
'OCA\\WebhookListeners\\BackgroundJobs\\WebhookTokenCleanup' => __DIR__ . '/..' . '/../lib/BackgroundJobs/WebhookTokenCleanup.php',
2728
'OCA\\WebhookListeners\\Command\\ListWebhooks' => __DIR__ . '/..' . '/../lib/Command/ListWebhooks.php',
2829
'OCA\\WebhookListeners\\Controller\\WebhooksController' => __DIR__ . '/..' . '/../lib/Controller/WebhooksController.php',
2930
'OCA\\WebhookListeners\\Db\\AuthMethod' => __DIR__ . '/..' . '/../lib/Db/AuthMethod.php',
31+
'OCA\\WebhookListeners\\Db\\TemporaryToken' => __DIR__ . '/..' . '/../lib/Db/TemporaryToken.php',
32+
'OCA\\WebhookListeners\\Db\\TemporaryTokenMapper' => __DIR__ . '/..' . '/../lib/Db/TemporaryTokenMapper.php',
3033
'OCA\\WebhookListeners\\Db\\WebhookListener' => __DIR__ . '/..' . '/../lib/Db/WebhookListener.php',
3134
'OCA\\WebhookListeners\\Db\\WebhookListenerMapper' => __DIR__ . '/..' . '/../lib/Db/WebhookListenerMapper.php',
3235
'OCA\\WebhookListeners\\Listener\\WebhooksEventListener' => __DIR__ . '/..' . '/../lib/Listener/WebhooksEventListener.php',

‎apps/webhook_listeners/lib/BackgroundJobs/WebhookCall.php‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,6 @@ protected function run($argument): void {
4747

4848
// adding temporary auth tokens to the call
4949
$data['tokens'] = $this->tokenService->getTokens($webhookListener, $data['user']['uid']);
50-
error_log(json_encode($data['tokens']));
5150
$options = [
5251
'verify' => $this->certificateManager->getAbsoluteBundlePath(),
5352
'headers' => $webhookListener->getHeaders() ?? [],

‎apps/webhook_listeners/lib/BackgroundJobs/WebhookTokenCleanup.php‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
<?php
2+
3+
declare(strict_types=1);
4+
5+
/**
6+
* SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
7+
* SPDX-License-Identifier: AGPL-3.0-or-later
8+
*/
9+
10+
namespace OCA\WebhookListeners\BackgroundJobs;
11+
12+
use OCA\WebhookListeners\Db\TemporaryTokenMapper;
13+
use OCP\AppFramework\Utility\ITimeFactory;
14+
use OCP\BackgroundJob\TimedJob;
15+
16+
class WebhookTokenCleanup extends TimedJob {
17+
18+
public function __construct(
19+
private TemporaryTokenMapper $tokenMapper,
20+
ITimeFactory $timeFactory,
21+
) {
22+
parent::__construct($timeFactory);
23+
// every 5 min
24+
$this->setInterval(1 * 5 * 60);
25+
}
26+
27+
/**
28+
* @param array $argument
29+
*/
30+
protected function run($argument): void {
31+
32+
$this->tokenMapper->invalidateOldTokens();
33+
34+
35+
}
36+
37+
38+
}

‎apps/webhook_listeners/lib/Db/TemporaryToken.php‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
<?php
2+
3+
declare(strict_types=1);
4+
5+
/**
6+
* SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
7+
* SPDX-License-Identifier: AGPL-3.0-or-later
8+
*/
9+
10+
namespace OCA\WebhookListeners\Db;
11+
12+
use OCP\AppFramework\Db\Entity;
13+
14+
/**
15+
* @method int getTokenId()
16+
* @method string getToken()
17+
* @method ?string getUserId()
18+
* @method int getCreationDatetime()
19+
* @psalm-suppress PropertyNotSetInConstructor
20+
*/
21+
class TemporaryToken extends Entity implements \JsonSerializable {
22+
/**
23+
* @var int id of the token that was created for a webhook
24+
*/
25+
protected $tokenId;
26+
27+
/**
28+
* @var string the token
29+
*/
30+
protected $token;
31+
32+
/**
33+
* @var ?string id of the user wich the token belongs to
34+
* @psalm-suppress PropertyNotSetInConstructor
35+
*/
36+
protected $userId = null;
37+
38+
/**
39+
* @var int
40+
* @psalm-suppress PropertyNotSetInConstructor
41+
*/
42+
protected $creationDatetime;
43+
44+
45+
46+
47+
public function __construct() {
48+
$this->addType('tokenId', 'integer');
49+
$this->addType('token', 'string');
50+
$this->addType('userId', 'string');
51+
$this->addType('creationDatetime', 'integer');
52+
}
53+
54+
public function jsonSerialize(): array {
55+
$fields = array_keys($this->getFieldTypes());
56+
return array_combine(
57+
$fields,
58+
array_map(
59+
fn ($field) => $this->getter($field),
60+
$fields
61+
)
62+
);
63+
}
64+
65+
}

‎apps/webhook_listeners/lib/Db/TemporaryTokenMapper.php‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
<?php
2+
3+
declare(strict_types=1);
4+
5+
/**
6+
* SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
7+
* SPDX-License-Identifier: AGPL-3.0-or-later
8+
*/
9+
10+
namespace OCA\WebhookListeners\Db;
11+
12+
use OC\Authentication\Token\PublicKeyTokenMapper;
13+
use OCP\AppFramework\Db\DoesNotExistException;
14+
use OCP\AppFramework\Db\MultipleObjectsReturnedException;
15+
use OCP\AppFramework\Db\QBMapper;
16+
use OCP\AppFramework\Utility\ITimeFactory;
17+
use OCP\DB\Exception;
18+
use OCP\DB\QueryBuilder\IQueryBuilder;
19+
use OCP\IDBConnection;
20+
use Psr\Log\LoggerInterface;
21+
22+
/**
23+
* @template-extends QBMapper<TemporaryToken>
24+
*/
25+
26+
class TemporaryTokenMapper extends QBMapper {
27+
public const TABLE_NAME = 'webhook_tokens';
28+
public const TOKEN_LIFETIME = 1 * 1 * 60; // one hour in seconds
29+
30+
31+
public function __construct(
32+
IDBConnection $db,
33+
private LoggerInterface $logger,
34+
private ITimeFactory $time,
35+
private PublicKeyTokenMapper $tokenMapper,
36+
) {
37+
parent::__construct($db, self::TABLE_NAME, TemporaryToken::class);
38+
}
39+
40+
/**
41+
* @throws DoesNotExistException
42+
* @throws MultipleObjectsReturnedException
43+
* @throws Exception
44+
*/
45+
public function getById(int $id): TemporaryToken {
46+
$qb = $this->db->getQueryBuilder();
47+
48+
$qb->select('*')
49+
->from($this->getTableName())
50+
->where($qb->expr()->eq('id', $qb->createNamedParameter($id, IQueryBuilder::PARAM_INT)));
51+
52+
return $this->findEntity($qb);
53+
}
54+
55+
/**
56+
* @throws Exception
57+
* @return WebhookListener[]
58+
*/
59+
public function getAll(): array {
60+
$qb = $this->db->getQueryBuilder();
61+
62+
$qb->select('*')
63+
->from($this->getTableName());
64+
65+
return $this->findEntities($qb);
66+
}
67+
68+
public function getOlderThan($olderThan): array {
69+
$qb = $this->db->getQueryBuilder();
70+
71+
$qb->select('*')
72+
->from($this->getTableName())
73+
->where($qb->expr()->lt('creation_datetime', $qb->createNamedParameter($olderThan, IQueryBuilder::PARAM_INT)));
74+
75+
return $this->findEntities($qb);
76+
}
77+
78+
79+
/**
80+
* @throws Exception
81+
*/
82+
public function addTemporaryToken(
83+
int $tokenId,
84+
string $token,
85+
?string $userId,
86+
int $creationDatetime,
87+
): TemporaryToken {
88+
$tempToken = TemporaryToken::fromParams(
89+
[
90+
'tokenId' => $tokenId,
91+
'token' => $token,
92+
'userId' => $userId,
93+
'creationDatetime' => $creationDatetime,
94+
]
95+
);
96+
return $this->insert($tempToken);
97+
}
98+
99+
/**
100+
* @throws Exception
101+
*/
102+
public function deleteByTokenId(int $tokenId): bool {
103+
$qb = $this->db->getQueryBuilder();
104+
105+
$qb->delete($this->getTableName())
106+
->where($qb->expr()->eq('token_id', $qb->createNamedParameter($tokenId, IQueryBuilder::PARAM_INT)));
107+
108+
return $qb->executeStatement() > 0;
109+
}
110+
111+
public function invalidateOldTokens(int $token_lifetime = self::TOKEN_LIFETIME) {
112+
$olderThan = $this->time->getTime() - $token_lifetime;
113+
$tokensToDelete = $this->getOlderThan($olderThan);
114+
115+
$this->logger->debug('Invalidating temporary webhook tokens older than ' . date('c', $olderThan), ['app' => 'cron']);
116+
foreach ($tokensToDelete as $token) {
117+
$this->tokenMapper->invalidate($token->getToken()); // delete token itself
118+
$this->deleteByTokenId($token->getTokenId()); // delete db row in webhook_temporary_tokens
119+
}
120+
121+
}
122+
}

‎apps/webhook_listeners/lib/Migration/Version1500Date20251007130000.php‎

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
namespace OCA\WebhookListeners\Migration;
1111

1212
use Closure;
13+
use OCA\WebhookListeners\Db\TemporaryTokenMapper;
1314
use OCA\WebhookListeners\Db\WebhookListenerMapper;
1415
use OCP\DB\ISchemaWrapper;
1516
use OCP\DB\Types;
@@ -34,9 +35,38 @@ public function changeSchema(IOutput $output, Closure $schemaClosure, array $opt
3435
'notnull' => false,
3536
]);
3637
}
38+
}
39+
40+
if (!$schema->hasTable(TemporaryTokenMapper::TABLE_NAME)) {
41+
$table = $schema->createTable(TemporaryTokenMapper::TABLE_NAME);
42+
$table->addColumn('id', 'integer', [
43+
'autoincrement' => true,
44+
'notnull' => true,
45+
]);
46+
47+
$table->addColumn('token_id', 'integer', [
48+
'notnull' => true,
49+
'length' => 4,
50+
'unsigned' => true,
51+
]);
52+
$table->addColumn('token', 'string', [
53+
'notnull' => false,
54+
'length' => 200,
55+
]);
56+
$table->addColumn('user_id', 'string', [
57+
'notnull' => false,
58+
'length' => 64,
59+
]);
60+
$table->addColumn('creation_datetime', 'integer', [
61+
'notnull' => true,
62+
'length' => 4,
63+
'unsigned' => true,
64+
]);
65+
66+
$table->setPrimaryKey(['id']);
3767

38-
return $schema;
3968
}
40-
return null;
69+
return $schema;
70+
4171
}
4272
}

‎apps/webhook_listeners/lib/Service/TokenService.php‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,18 @@
88
namespace OCA\WebhookListeners\Service;
99

1010
use OC\Authentication\Token\IProvider;
11+
use OCA\WebhookListeners\Db\TemporaryTokenMapper;
1112
use OCA\WebhookListeners\Db\WebhookListener;
13+
use OCP\AppFramework\Utility\ITimeFactory;
1214
use OCP\Authentication\Token\IToken;
1315
use OCP\Security\ISecureRandom;
1416

1517
class TokenService {
1618
public function __construct(
1719
private IProvider $tokenProvider,
1820
private ISecureRandom $random,
21+
private TemporaryTokenMapper $tokenMapper,
22+
private ITimeFactory $time,
1923
) {
2024
}
2125

@@ -42,7 +46,6 @@ public function getTokens(WebhookListener $webhookListener, ?string $triggerUser
4246
}
4347
}
4448
if (isset($tokenNeeded['users'])) {
45-
error_log(json_encode($tokenNeeded));
4649
foreach ($tokenNeeded['functions'] as $function) {
4750
switch ($function) {
4851
case 'owner':
@@ -77,6 +80,7 @@ private function createTemporaryToken(string $userId): string {
7780
$name = 'Ephemeral webhook authentication';
7881
$password = null;
7982
$deviceToken = $this->tokenProvider->generateToken($token, $userId, $userId, $password, $name, IToken::PERMANENT_TOKEN);
83+
$this->tokenMapper->addTemporaryToken($deviceToken->getId(), $deviceToken->getToken(), $userId, $this->time->getTime());
8084
return $token;
8185
}
8286

0 commit comments

Comments
 (0)