feat(orb): relay registration — a brokered self-host registers its event target - #1349
Merged
Conversation
…ent target Event-relay foundation (#1255). A brokered self-host installs the central Orb App + holds only its enrollment secret; the central Orb receives its repos' webhooks. For the container to actually review, the Orb must FORWARD those events to it — this PR lets the container register WHERE + establishes the per-tenant signing material. POST /v1/orb/relay/register (Bearer = the container's own enrollment secret, flag-gated): validates the secret → the bound, registered, non-suspended install (same gate as the token broker), SSRF-validates the relay URL via the shared isSafeHttpUrl (https + public host — so a registered URL can never coerce the Orb into hitting an internal service), then stores the URL + the enrollment secret ENCRYPTED at rest (AES-256-GCM via TOKEN_ENCRYPTION_SECRET). The Orb HMAC-signs each forwarded event with that secret; the container verifies with its own ORB_ENROLLMENT_SECRET — per-enrollment isolation, and a DB-only leak can't forge (the encryption key is a separate secret). migration 0069 adds the relay_url + encrypted-secret columns to orb_enrollments. The forward (Orb → container) + the container's /v1/orb/relay receiver land in the next PRs. Advances #1255.
Contributor
|
Superagent didn't find any vulnerabilities or security issues in this PR. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1349 +/- ##
=======================================
Coverage 95.28% 95.28%
=======================================
Files 188 189 +1
Lines 20371 20395 +24
Branches 7343 7357 +14
=======================================
+ Hits 19410 19434 +24
Misses 378 378
Partials 583 583
🚀 New features to boost your workflow:
|
This was referenced Jun 25, 2026
JSONbored
added a commit
that referenced
this pull request
Jun 25, 2026
…#1354) The container side of the event relay (#1255), completing brokered self-host end-to-end: the central Orb now forwards a registered install's events (#1352), and this is where the container RECEIVES them. POST /v1/orb/relay verifies the Orb's HMAC signature (x-orb-signature-256) against the container's own ORB_ENROLLMENT_SECRET — in constant time (crypto.subtle.verify) — then enqueues the event exactly like a GitHub webhook. So a brokered container (central Orb App + an enrollment secret, no own App key) now both RECEIVES its repos' events and ACTS on them via brokered tokens. - relayVerify (src/orb/relay.ts): constant-time HMAC verify of the sha256= signature; rejects wrong-secret, malformed/odd-length hex, and missing secret/header. - handleOrbRelay (src/github/webhook.ts): 400 (no headers) / 404 (not a brokered self-host) / 413 (oversized) / 401 (bad signature) / 202 (verified → enqueued). The GitHub webhook receiver's post-verify path is extracted into the shared enqueueVerifiedWebhook (parse → dedup → record → WEBHOOKS lane → 202); both receivers reuse it. - Route + token-exemption (auth IS the relay signature) + strict rate class. Auto-registering the container's relay URL on boot is the remaining convenience follow-up (the registration endpoint #1349 already exists). Advances #1255.
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Event-relay foundation for brokered self-host (#1255). A brokered self-host installs the central Orb App and holds only its enrollment secret; the central Orb receives its repos' webhooks. For the container to actually review, the Orb must forward those events to it — this PR lets the container register where, and establishes the per-tenant signing material.
POST /v1/orb/relay/register(Bearer = the container's own enrollment secret, flag-gated):isSafeHttpUrl(https + public host — a registered URL can never coerce the Orb into hitting an internal service);TOKEN_ENCRYPTION_SECRET). The Orb HMAC-signs each forwarded event with that secret; the container verifies with its ownORB_ENROLLMENT_SECRET— per-enrollment isolation, and a DB-only leak can't forge (the encryption key is a separate secret).migration
0069addsrelay_url+ the encrypted-secret columns toorb_enrollments. The forward (Orb → container) + the container's/v1/orb/relayreceiver land in the next PRs.Validation
npm run test:cigreen; 100% branch coverage onrelay.ts(every eligibility arm — unregistered/suspended/removed/deleted; SSRF loopback+localhost; no-encryption; success) + the endpoint status mapping (401/403/400/500/404, unparseable body) + the exemption + rate class.Safety
Advances #1255.