WebhookController.java

package edu.ucsb.cs156.frontiers.controllers;

import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.databind.JsonNode;
import edu.ucsb.cs156.frontiers.entities.Course;
import edu.ucsb.cs156.frontiers.entities.CourseStaff;
import edu.ucsb.cs156.frontiers.entities.RosterStudent;
import edu.ucsb.cs156.frontiers.enums.OrgStatus;
import edu.ucsb.cs156.frontiers.repositories.CourseRepository;
import edu.ucsb.cs156.frontiers.repositories.CourseStaffRepository;
import edu.ucsb.cs156.frontiers.repositories.RosterStudentRepository;
import edu.ucsb.cs156.frontiers.utilities.WebhookSecurityUtils;
import io.swagger.v3.oas.annotations.tags.Tag;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.util.Optional;
import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestHeader;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@Tag(name = "Webhooks Controller")
@RestController
@RequestMapping("/api/webhooks")
@Slf4j
public class WebhookController {

  private final CourseRepository courseRepository;
  private final RosterStudentRepository rosterStudentRepository;
  private final CourseStaffRepository courseStaffRepository;

  @Value("${app.webhook.secret}")
  private String webhookSecret;

  public WebhookController(
      CourseRepository courseRepository,
      RosterStudentRepository rosterStudentRepository,
      CourseStaffRepository courseStaffRepository) {
    this.courseRepository = courseRepository;
    this.rosterStudentRepository = rosterStudentRepository;
    this.courseStaffRepository = courseStaffRepository;
  }

  /**
   * Accepts webhooks from GitHub, currently to update the membership status of a RosterStudent.
   *
   * @param jsonBody body of the webhook. The description of the currently used webhook is available
   *     in docs/webhooks.md
   * @param signature the GitHub webhook signature header for security validation
   * @return either the word success so GitHub will not flag the webhook as a failure, or the
   *     updated RosterStudent
   */
  @PostMapping("/github")
  public ResponseEntity<String> createGitHubWebhook(
      @RequestBody String requestBody,
      @RequestHeader(value = "X-Hub-Signature-256", required = false) String signature)
      throws JsonProcessingException, NoSuchAlgorithmException, InvalidKeyException {

    // Validate webhook signature
    if (!WebhookSecurityUtils.validateGitHubSignature(requestBody, signature, webhookSecret)) {
      log.error("Webhook signature validation failed");
      return ResponseEntity.status(401).body("Unauthorized: Invalid signature");
    }

    // Parse JSON after signature validation
    JsonNode jsonBody;
    try {
      jsonBody = new com.fasterxml.jackson.databind.ObjectMapper().readTree(requestBody);
    } catch (JsonProcessingException e) {
      log.error("Failed to parse webhook JSON body", e);
      return ResponseEntity.badRequest().body("Invalid JSON");
    }

    log.info("Received GitHub webhook: {}", jsonBody.toString());

    if (!jsonBody.has("action")) {
      return ResponseEntity.ok().body("success");
    }

    String action = jsonBody.get("action").asText();
    log.info("Webhook action: {}", action);

    // Handle GitHub App uninstall (installation deleted)
    if (action.equals("deleted")) {
      if (!jsonBody.has("installation") || !jsonBody.get("installation").has("id")) {
        return ResponseEntity.ok().body("success");
      }
      String installationIdForUninstall = jsonBody.get("installation").get("id").asText();
      log.info("Processing uninstall for Installation ID: {}", installationIdForUninstall);
      Optional<Course> courseForUninstall =
          courseRepository.findByInstallationId(installationIdForUninstall);
      log.info("Course found for uninstall: {}", courseForUninstall.isPresent());
      if (courseForUninstall.isPresent()) {
        Course c = courseForUninstall.get();
        c.setInstallationId(null);
        c.setOrgName(null);
        courseRepository.save(c);
      } else {
        log.warn(
            "No course found with installation ID for uninstall: {}", installationIdForUninstall);
      }
      return ResponseEntity.ok().body("success");
    }

    // Early return if not an action we care about
    if (!action.equals("member_added") && !action.equals("member_invited")) {
      return ResponseEntity.ok().body("success");
    }

    // Extract GitHub login based on payload structure
    String githubLogin = null;
    String installationId = null;
    OrgStatus role = null;

    // For member_added events, the structure is different
    if (action.equals("member_added")) {
      if (!jsonBody.has("membership")
          || !jsonBody.get("membership").has("user")
          || !jsonBody.get("membership").has("role")
          || !jsonBody.get("membership").get("user").has("login")
          || !jsonBody.has("installation")
          || !jsonBody.get("installation").has("id")) {
        return ResponseEntity.ok().body("success");
      }

      githubLogin = jsonBody.get("membership").get("user").get("login").asText();
      installationId = jsonBody.get("installation").get("id").asText();
      String textRole = jsonBody.get("membership").get("role").asText();
      if (textRole.equals("admin")) {
        role = OrgStatus.OWNER;
      } else {
        role = OrgStatus.MEMBER;
      }
    }
    // For member_invited events, use the original structure
    else { // must be "member_invited" based on earlier check
      if (!jsonBody.has("user")
          || !jsonBody.get("user").has("login")
          || !jsonBody.has("installation")
          || !jsonBody.get("installation").has("id")) {
        return ResponseEntity.ok().body("success");
      }

      githubLogin = jsonBody.get("user").get("login").asText();
      installationId = jsonBody.get("installation").get("id").asText();
    }

    log.info("GitHub login: {}, Installation ID: {}", githubLogin, installationId);

    Optional<Course> course = courseRepository.findByInstallationId(installationId);
    log.info("Course found: {}", course.isPresent());

    if (!course.isPresent()) {
      log.warn("No course found with installation ID: {}", installationId);
      return ResponseEntity.ok().body("success");
    }

    Optional<RosterStudent> student =
        rosterStudentRepository.findByCourseAndGithubLogin(course.get(), githubLogin);
    Optional<CourseStaff> staff =
        courseStaffRepository.findByCourseAndGithubLogin(course.get(), githubLogin);
    log.info("Student found: {}", student.isPresent());
    log.info("Staff found: {}", staff.isPresent());

    if (!student.isPresent() && !staff.isPresent()) {
      log.warn(
          "No student or staff found with GitHub login: {} in course: {}",
          githubLogin,
          course.get().getCourseName());
      return ResponseEntity.ok().body("success");
    }
    StringBuilder response = new StringBuilder();
    if (student.isPresent()) {
      RosterStudent updatedStudent = student.get();
      log.info("Current student org status: {}", updatedStudent.getOrgStatus());

      // Update status based on action
      if (action.equals("member_added")) {
        updatedStudent.setOrgStatus(role);
        log.info("Setting status to {}", role.toString());
      } else { // must be "member_invited" based on earlier check
        updatedStudent.setOrgStatus(OrgStatus.INVITED);
        log.info("Setting status to INVITED");
      }

      rosterStudentRepository.save(updatedStudent);
      log.info("Student saved with new org status: {}", updatedStudent.getOrgStatus());
      response.append(updatedStudent);
    }
    if (staff.isPresent()) {
      CourseStaff updatedStaff = staff.get();
      log.info("Current course staff member org status: {}", updatedStaff.getOrgStatus());

      // Update status based on action
      if (action.equals("member_added")) {
        updatedStaff.setOrgStatus(role);
        log.info("Setting status to {}", role.toString());
      } else { // must be "member_invited" based on earlier check
        updatedStaff.setOrgStatus(OrgStatus.INVITED);
        log.info("Setting status to INVITED");
      }

      courseStaffRepository.save(updatedStaff);
      log.info("Course staff member saved with new org status: {}", updatedStaff.getOrgStatus());
      response.append(updatedStaff);
    }
    return ResponseEntity.ok().body(response.toString());
  }
}











































Active mutators

CONDITIONALS_BOUNDARY
EMPTY_RETURNS
FALSE_RETURNS
INCREMENTS
INVERT_NEGS
MATH
NEGATE_CONDITIONALS
NULL_RETURNS
PRIMITIVE_RETURNS
TRUE_RETURNS
VOID_METHOD_CALLS

Tests examined

edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:successfulWebhook_memberInvited()] (5 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:successfulWebhook_admin()] (6 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:successfulWebhook_member()] (24 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:successfulWebhook_member_course_staff()] (6 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:courseStaffInvited()] (11 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:successfulWebhook_admin_course_staff()] (10 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:memberAdded_missingInstallationIdField()] (4 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:noCourse()] (4 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:noStudent()] (5 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:memberInvited_missingInstallationField()] (3 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:memberInvited_missingLoginField()] (4 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:memberInvited_missingInstallationIdField()] (4 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:memberInvited_missingUserField()] (9 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:uninstall_missingInstallationField_returns_success_noops()] (3 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:uninstall_noCourseFound_returns_success()] (4 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:uninstall_missingInstallationIdField_returns_success_noops()] (6 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:uninstall_success_clears_installation_and_orgName()] (5 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:unsuccessfulWebhook_badJSON()] (9 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:memberAdded_missingInstallationField()] (7 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:testUnrecognizedAction_withValidFields()] (4 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:memberAdded_missingUserField()] (4 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:testMemberRemoved_withValidFields()] (5 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:action_wrong()] (5 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:memberAdded_missingLoginField()] (4 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:testNullGithubLoginAndInstallationId()] (5 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:memberAdded_missingMembershipField()] (10 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:no_action()] (10 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:unsuccessfulWebhook_invalidSignature()] (3 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:unsuccessfulWebhook_noXHubSignature()] (3 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:webhookWithoutSignature_returnsUnauthorized()] (3 ms)
edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests.[engine:junit-jupiter]/[class:edu.ucsb.cs156.frontiers.controllers.WebhookControllerTests]/[method:webhookWithInvalidSignature_returnsUnauthorized()] (5 ms)

Report generated by PIT 1.17.0

1		package edu.ucsb.cs156.frontiers.controllers;
2
3		import com.fasterxml.jackson.core.JsonProcessingException;
4		import com.fasterxml.jackson.databind.JsonNode;
5		import edu.ucsb.cs156.frontiers.entities.Course;
6		import edu.ucsb.cs156.frontiers.entities.CourseStaff;
7		import edu.ucsb.cs156.frontiers.entities.RosterStudent;
8		import edu.ucsb.cs156.frontiers.enums.OrgStatus;
9		import edu.ucsb.cs156.frontiers.repositories.CourseRepository;
10		import edu.ucsb.cs156.frontiers.repositories.CourseStaffRepository;
11		import edu.ucsb.cs156.frontiers.repositories.RosterStudentRepository;
12		import edu.ucsb.cs156.frontiers.utilities.WebhookSecurityUtils;
13		import io.swagger.v3.oas.annotations.tags.Tag;
14		import java.security.InvalidKeyException;
15		import java.security.NoSuchAlgorithmException;
16		import java.util.Optional;
17		import lombok.extern.slf4j.Slf4j;
18		import org.springframework.beans.factory.annotation.Value;
19		import org.springframework.http.ResponseEntity;
20		import org.springframework.web.bind.annotation.PostMapping;
21		import org.springframework.web.bind.annotation.RequestBody;
22		import org.springframework.web.bind.annotation.RequestHeader;
23		import org.springframework.web.bind.annotation.RequestMapping;
24		import org.springframework.web.bind.annotation.RestController;
25
26		@Tag(name = "Webhooks Controller")
27		@RestController
28		@RequestMapping("/api/webhooks")
29		@Slf4j
30		public class WebhookController {
31
32		private final CourseRepository courseRepository;
33		private final RosterStudentRepository rosterStudentRepository;
34		private final CourseStaffRepository courseStaffRepository;
35
36		@Value("${app.webhook.secret}")
37		private String webhookSecret;
38
39		public WebhookController(
40		CourseRepository courseRepository,

WebhookController.java

Mutations

Active mutators

Tests examined