feat(webhook): Phase 2 — dispatcher service + HMAC + SSRF guard
WebhookDispatcher (@Scheduled, conditional ordinis.webhook.enabled=true):
- matchTick (every 2s): scan unpublished outbox_events × active subs,
INSERT pending deliveries idempotently (ON CONFLICT DO NOTHING)
- sendTick (every 1s): scan due deliveries (status pending/retrying AND
next_attempt_at <= now), POST URL with HMAC-SHA256 + SSRF check,
mark delivered (2xx) / retrying (backoff) / dlq (>= 1000 attempts)
HmacSigner:
- HMAC-SHA256 hex signing для X-Ordinis-Signature header
- Format: `sha256=<hex>` — receiver verifies через shared secret
- JDK Mac, no external deps
SsrfGuard:
- Reject URLs резолвящиеся в private CIDR (10/8, 172.16/12,
192.168/16, 127/8, 169.254/16, link-local, multicast)
- Через InetAddress.getAllByName() + isXxxAddress() checks
- Allowlist через ordinis.webhook.allowed-hosts CSV для testing
HttpClient: JDK 21 native, connectTimeout 3s, send timeout configurable
ordinis.webhook.send-timeout-ms (default 5000ms)
Метрики Micrometer:
- nsi_webhook_delivered_total (success counter)
- nsi_webhook_failed_total (retry counter)
- nsi_webhook_dlq_total (DLQ counter)
- nsi_webhook_ssrf_rejected_total (SSRF guard counter)
- nsi_webhook_delivery_duration_seconds (timer)
Headers отправляемые receiver'у:
- Content-Type: application/json
- User-Agent: Ordinis-Webhook/1.0
- X-Ordinis-Signature: sha256=<hex>
- X-Ordinis-Event-Id: <id>
- X-Ordinis-Event-Type: <event_type>
- X-Ordinis-Scope: <PUBLIC|INTERNAL|RESTRICTED>
Ещё впереди: REST API CRUD subscriptions (admin-only), unit tests
для HmacSigner/SsrfGuard, admin-ui /webhooks page.
Zimin A.N.
9ac35e9ff2