gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-27 18:57:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: harden deploy enforcement paths (#1030)

Browse Source 
* fix: harden deploy enforcement paths

* fix: update Docker toolchain to Go 1.26.3

* fix: repair Dockerfile tr argument split across lines

* fix: bump protobufjs to clear npm audit high-severity advisories

* fix(test): add execFile to child_process mock in compose-images test

* fix: resolve merge conflicts with main

* fix: resolve merge conflicts with main

* fix: resolve merge conflicts with main
This commit is contained in:
Anso
2026-05-12 19:30:49 -04:00
committed by GitHub
parent 74ae2ce0c6
commit b1c5fe8391
19 changed files with 1179 additions and 922 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/WebhookService.ts
+11
View File
@@ -4,6 +4,7 @@ import { ComposeService } from './ComposeService';
import { FileSystemService } from './FileSystemService';
import { GitSourceService } from './GitSourceService';
import { NodeRegistry } from './NodeRegistry';
import { assertPolicyGateAllows, buildSystemPolicyGateOptions } from '../helpers/policyGate';
export class WebhookService {
private static instance: WebhookService;
@@ -63,6 +64,11 @@ export class WebhookService {
const compose = ComposeService.getInstance(defaultNodeId);
switch (action) {
case 'deploy':
await assertPolicyGateAllows(
webhook.stack_name,
defaultNodeId,
buildSystemPolicyGateOptions('webhook', { auditPath: `/api/webhooks/${webhookId}/execute` }),
);
await compose.deployStack(webhook.stack_name, undefined, atomic);
break;
case 'restart':
@@ -75,6 +81,11 @@ export class WebhookService {
await compose.runCommand(webhook.stack_name, 'start');
break;
case 'pull':
await assertPolicyGateAllows(
webhook.stack_name,
defaultNodeId,
buildSystemPolicyGateOptions('webhook', { auditPath: `/api/webhooks/${webhookId}/execute` }),
);
await compose.updateStack(webhook.stack_name, undefined, atomic);
break;
case 'git-pull': {