Josep Piguillem
9390db18c2
Events are {resource}.created, .updated, .deleted and .restored for content,
the inbox, redirects, repositories and media, taken from the audit log so the
two agree on what happened. Subscriptions take wildcards. Users, tokens,
webhooks and settings are never sent, nor what the application does by
itself; the inbox's own words only with personal data enabled.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
55 lines
1.7 KiB
PHP
55 lines
1.7 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Http\Requests\Api\V1;
|
|
|
|
use App\Models\Webhook;
|
|
use App\Rules\PublicHttpsUrl;
|
|
use Closure;
|
|
use Illuminate\Foundation\Http\FormRequest;
|
|
|
|
class WebhookRequest extends FormRequest
|
|
{
|
|
public function authorize(): bool
|
|
{
|
|
return true;
|
|
}
|
|
|
|
/**
|
|
* @return array<string, mixed>
|
|
*/
|
|
public function rules(): array
|
|
{
|
|
$creating = ! $this->route('webhook') instanceof Webhook;
|
|
$sometimes = $creating ? 'required' : 'sometimes';
|
|
|
|
return [
|
|
'name' => [$sometimes, 'string', 'max:120'],
|
|
'url' => [
|
|
$sometimes,
|
|
'string',
|
|
'url',
|
|
'max:2048',
|
|
// Refused now rather than at the first delivery; checked
|
|
// again at every delivery all the same.
|
|
new PublicHttpsUrl,
|
|
],
|
|
'events' => [$sometimes, 'array', 'min:1'],
|
|
'events.*' => [
|
|
'string',
|
|
'distinct',
|
|
function (string $attribute, mixed $value, Closure $fail): void {
|
|
if (! is_string($value) || ! Webhook::isSubscribable($value)) {
|
|
$fail(__('rules.webhooks.event', ['event' => (string) (is_scalar($value) ? $value : '')]));
|
|
}
|
|
},
|
|
],
|
|
'secret' => [$creating ? 'sometimes' : 'prohibited', 'nullable', 'string', 'min:16', 'max:255'],
|
|
'rotate_secret' => [$creating ? 'prohibited' : 'sometimes', 'boolean'],
|
|
'include_personal_data' => ['sometimes', 'boolean'],
|
|
'is_active' => ['sometimes', 'boolean'],
|
|
];
|
|
}
|
|
}
|