make it so

Author: rvagg

.gitignore

@@ -0,0 +1 @@
+node_modules

.jshintrc

@@ -0,0 +1,59 @@
+{
+    "predef": [ ]
+  , "bitwise": false
+  , "camelcase": false
+  , "curly": false
+  , "eqeqeq": false
+  , "forin": false
+  , "immed": false
+  , "latedef": false
+  , "noarg": true
+  , "noempty": true
+  , "nonew": true
+  , "plusplus": false
+  , "quotmark": true
+  , "regexp": false
+  , "undef": true
+  , "unused": true
+  , "strict": false
+  , "trailing": true
+  , "maxlen": 120
+  , "asi": true
+  , "boss": true
+  , "debug": true
+  , "eqnull": true
+  , "esnext": true
+  , "evil": true
+  , "expr": true
+  , "funcscope": false
+  , "globalstrict": false
+  , "iterator": false
+  , "lastsemic": true
+  , "laxbreak": true
+  , "laxcomma": true
+  , "loopfunc": true
+  , "multistr": false
+  , "onecase": false
+  , "proto": false
+  , "regexdash": false
+  , "scripturl": true
+  , "smarttabs": false
+  , "shadow": false
+  , "sub": true
+  , "supernew": false
+  , "validthis": true
+  , "browser": true
+  , "couch": false
+  , "devel": false
+  , "dojo": false
+  , "mootools": false
+  , "node": true
+  , "nonstandard": true
+  , "prototypejs": false
+  , "rhino": false
+  , "worker": true
+  , "wsh": false
+  , "nomen": false
+  , "onevar": false
+  , "passfail": false
+}

LICENSE.md

@@ -0,0 +1,11 @@
+The MIT License (MIT)
+=====================
+
+Copyright (c) 2014 Rod Vagg
+---------------------------
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

README.md

@@ -0,0 +1,57 @@
+# github-webhook-handler
+
+[![NPM](https://nodei.co/npm/github-webhook-handler.svg)](https://nodei.co/npm/github-webhook-handler/)
+
+GitHub allows you to register **[Webhooks](https://developer.github.com/webhooks/)** for your repositories. Each time an event occurs on your repository, whether it be pushing code, filling issues or creating pull requests, the webhook address you register can be configured to be pinged with details.
+
+This library is a small handler (or "middleware" if you must) for Node.js web servers that handles all the logic of receiving and verifying webhook requests from GitHub.
+
+## Example
+
+```js
+var http = require('http')
+var createHandler = require('github-webhook-handler')
+var handler = createHandler({ url: '/webhook', secret: 'myhashsecret' })
+
+http.createServer(function (req, res) {
+  handler(req, res, function (err) {
+    res.statusCode = 404
+    res.end('no such location')
+  })
+}).listen(7777)
+
+handler.on('error', function (err) {
+  console.err('Error:', err.message)
+})
+
+handler.on('push', function (event) {
+  console.log('Received a push event for %s to %s',
+    event.payload.repository.name,
+    event.payload.ref)
+})
+
+handler.on('issues', function (event) {
+  console.log('Received an issue event for % action=%s: #%d %s',
+    event.payload.repository.name,
+    event.payload.action
+    event.payload.issue.number,
+    event.payload.issue.title)
+})
+```
+
+## API
+
+github-webhook-handler exports a single function, use this function to *create* a webhook handler by passing in an *options* object. Your options object should contain:
+
+ * `"url"`: the complete case sensitive URL to match when looking at `req.url` for incoming requests. Any request not matching this URL will cause the callback function to the handler to be called (sometimes called the `next` handler).
+ * `"secret"`: this is a hash key used for creating the SHA-1 HMAC signature of the JSON blob sent by GitHub. You should register the same secret key with GitHub. Any request not delivering a `X-Hub-Signature` that matches the signature generated using this key against the blob will be rejected and cause an `'error'` event (also the callback will be called with an `Error` object).
+
+The resulting **handler** function acts like a common "middleware" handler that you can insert into a processing chain. It takes `request`, `response`, and `callback` arguments. The `callback` is not called if the request is successfully handled, otherwise it is called either with an `Error` or no arguments.
+
+The **handler** function is also an `EventEmitter` that you can register to listen to any of the GitHub event types. Note you can be specific in your GitHub configuration about which events you wish to receive, or you can send them all. Note that the `"error"` event will be liberally used, even if someone tries the end-point and they can't generate a proper signature, so you should at least register a listener for it or it will throw.
+
+See the [GitHub Webhooks documentation](https://developer.github.com/webhooks/) for more details on the events you can receive.
+
+## License
+
+**github-webhook-handler** is Copyright (c) 2014 Rod Vagg [@rvagg](https://twitter.com/rvagg) and licensed under the MIT License. All rights not explicitly granted in the MIT License are reserved. See the included [LICENSE.md](./LICENSE.md) file for more details.

github-webhook-handler.js

@@ -0,0 +1,88 @@
+const EventEmitter = require('events').EventEmitter
+    , inherits     = require('util').inherits
+    , crypto       = require('crypto')
+    , bl           = require('bl')
+
+
+function signBlob (key, blob) {
+  return 'sha1=' + crypto.createHmac('sha1', key).update(blob).digest('hex')
+}
+
+
+function create (options) {
+  if (typeof options != 'object')
+    throw new TypeError('must provide an options object')
+
+  if (typeof options.url != 'string')
+    throw new TypeError('must provide a \'url\' option')
+
+  if (typeof options.secret != 'string')
+    throw new TypeError('must provide a \'secret\' option')
+
+  // make it an EventEmitter, sort of
+  EventEmitter.call(handler)
+  Object.keys(EventEmitter.prototype).forEach(function (k) {
+    handler[k] = EventEmitter.prototype[k]
+  })
+
+  return handler
+
+
+  function handler (req, res, callback) {
+    if (req.url !== options.url)
+      return callback()
+
+    function hasError (msg) {
+      res.writeHead(400, { 'content-type': 'application/json' })
+      res.end(JSON.stringify({ error: msg }))
+
+      var err = new Error(msg)
+
+      handler.emit('error', err, req)
+      callback(err)
+    }
+
+    var sig   = req.headers['x-hub-signature']
+      , event = req.headers['x-github-event']
+      , id    = req.headers['x-github-delivery']
+
+    if (!sig)
+      return hasError('No X-Hub-Signature found on request')
+
+    if (!event)
+      return hasError('No X-Github-Event found on request')
+
+    if (!id)
+      return hasError('No X-Github-Delivery found on request')
+
+    req.pipe(bl(function (err, data) {
+      if (err) {
+        handler.emit('error', err, req)
+        return callback(err)
+      }
+
+      var obj
+
+      if (sig !== signBlob(options.secret, data))
+        return hasError('X-Hub-Signature does not match blob signature')
+
+      try {
+        obj = JSON.parse(data.toString())
+      } catch (e) {
+        return hasError(e)
+      }
+
+      res.writeHead(200, { 'content-type': 'application/json' })
+      res.end('{"ok":true}')
+
+      handler.emit(event, {
+          event   : event
+        , id      : id
+        , payload : obj
+      })
+    }))
+  }
+}
+
+
+module.exports = create

package.json

@@ -0,0 +1,22 @@
+{
+  "name": "github-webhook-handler",
+  "version": "0.0.0",
+  "description": "Web handler / middleware for processing GitHub Webhooks",
+  "main": "github-webhook-handler.js",
+  "scripts": {
+    "test": "node test.js"
+  },
+  "keywords": [
+    "github",
+    "webhooks"
+  ],
+  "author": "Rod Vagg <[email protected]> (http://r.va.gg)",
+  "license": "MIT",
+  "dependencies": {
+    "bl": "^0.8.0"
+  },
+  "devDependencies": {
+    "tape": "^2.12.3",
+    "through2": "^0.4.1"
+  }
+}