Documentation
¶
Overview ¶
Package hooks provides Standard Webhooks helpers and wiring for go-service.
This package integrates the Standard Webhooks Go library (github.com/standard-webhooks/standard-webhooks/libraries/go) by providing:
configuration for webhook signing/verification secrets (see Config), loaded via the go-service "source string" pattern (resolved by os.FS.ReadSource), and
constructors for creating Standard Webhooks webhook instances (see NewHook) and generating new secrets (see Generator).
Secrets and source strings ¶
The secret configured in Config.Secret is a "source string" and may be:
- "env:NAME" to read the secret from an environment variable,
- "file:/path/to/secret" to read the secret from a file, or
- any other value treated as the literal secret.
The resolved secret bytes are passed to the Standard Webhooks library as a string. Empty resolved secrets are rejected. Keep this value private and avoid logging it.
Downstream integrations ¶
Transport integrations (for example `transport/http/hooks`) build on top of this package to verify incoming webhook signatures and/or sign outbound webhook requests.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrEmptySecret = errors.New("hooks: empty secret")
ErrEmptySecret indicates that webhook secret configuration resolved to empty bytes.
var Module = di.Module( di.Constructor(NewGenerator), di.Constructor(NewHook), )
Module wires Standard Webhooks helpers into Fx/Dig.
It provides constructors for:
- *Generator (via NewGenerator), which generates new secret values suitable for Standard Webhooks, and
- *standardwebhooks.Webhook (via NewHook), which constructs a webhook instance from configuration.
Disabled behavior: if hooks configuration is disabled (nil *Config), NewHook returns (nil, nil) so downstream consumers can treat webhook verification/signing as optional.
Functions ¶
func NewHook ¶ added in v2.73.0
NewHook constructs a Standard Webhooks webhook instance from cfg.
Disabled behavior: if cfg is nil/disabled, NewHook returns (nil, nil).
Enabled behavior: NewHook resolves the configured secret using Config.GetSecret and constructs a Standard Webhooks Webhook instance using that secret.
Secret encoding expectations: The secret bytes are converted to a string and passed to the Standard Webhooks library. In typical setups this string is the base64-encoded secret generated by (*Generator).Generate, but NewHook does not enforce a particular encoding beyond what the downstream library expects. Empty resolved secrets are rejected with ErrEmptySecret.
Types ¶
type Config ¶
type Config struct {
// Secret is a "source string" that resolves to the webhook signing/verification secret bytes.
//
// It supports the go-service source string pattern implemented by `os.FS.ReadSource`:
// - "env:NAME" to read the secret from an environment variable,
// - "file:/path/to/secret" to read the secret from a file, or
// - any other value treated as the literal secret.
//
// Security note: keep this secret private and avoid logging it.
Secret string `yaml:"secret,omitempty" json:"secret,omitempty" toml:"secret,omitempty"`
}
Config configures Standard Webhooks secret loading.
type Generator ¶
type Generator struct {
// contains filtered or unexported fields
}
Generator generates secret values suitable for Standard Webhooks.
func NewGenerator ¶
NewGenerator constructs a Generator for creating Standard Webhooks secrets.
The returned Generator uses a cryptographically-secure random generator.
Source Files