src/Core/Framework/Webhook/WebhookDispatcher.php line 52

  1. <?php declare(strict_types=1);
  3. namespace Shopware\Core\Framework\Webhook;
  5. use Doctrine\DBAL\Connection;
  6. use GuzzleHttp\Client;
  7. use GuzzleHttp\Pool;
  8. use GuzzleHttp\Psr7\Request;
  9. use Shopware\Core\DevOps\Environment\EnvironmentHelper;
  10. use Shopware\Core\Framework\App\AppLocaleProvider;
  11. use Shopware\Core\Framework\App\Event\AppChangedEvent;
  12. use Shopware\Core\Framework\App\Event\AppDeletedEvent;
  13. use Shopware\Core\Framework\App\Event\AppFlowActionEvent;
  14. use Shopware\Core\Framework\App\Exception\AppUrlChangeDetectedException;
  15. use Shopware\Core\Framework\App\Hmac\Guzzle\AuthMiddleware;
  16. use Shopware\Core\Framework\App\Hmac\RequestSigner;
  17. use Shopware\Core\Framework\App\ShopId\ShopIdProvider;
  18. use Shopware\Core\Framework\Context;
  19. use Shopware\Core\Framework\DataAbstractionLayer\EntityRepository;
  20. use Shopware\Core\Framework\DataAbstractionLayer\Event\EntityWrittenContainerEvent;
  21. use Shopware\Core\Framework\DataAbstractionLayer\Search\Criteria;
  22. use Shopware\Core\Framework\DataAbstractionLayer\Search\Filter\EqualsFilter;
  23. use Shopware\Core\Framework\Event\FlowEventAware;
  24. use Shopware\Core\Framework\Log\Package;
  25. use Shopware\Core\Framework\Uuid\Uuid;
  26. use Shopware\Core\Framework\Webhook\EventLog\WebhookEventLogDefinition;
  27. use Shopware\Core\Framework\Webhook\Hookable\HookableEventFactory;
  28. use Shopware\Core\Framework\Webhook\Message\WebhookEventMessage;
  29. use Shopware\Core\Profiling\Profiler;
  30. use Symfony\Component\DependencyInjection\ContainerInterface;
  31. use Symfony\Component\EventDispatcher\EventDispatcherInterface;
  32. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  33. use Symfony\Component\Messenger\MessageBusInterface;
  35. #[Package('core')]
  36. class WebhookDispatcher implements EventDispatcherInterface
  37. {
  38.     private ?WebhookCollection $webhooks = null;
  40.     /**
  41.      * @var array<string, mixed>
  42.      */
  43.     private array $privileges = [];
  45.     /**
  46.      * @internal
  47.      */
  48.     public function __construct(private readonly EventDispatcherInterface $dispatcher, private readonly Connection $connection, private readonly Client $guzzle, private readonly string $shopUrl, private readonly ContainerInterface $container, private readonly HookableEventFactory $eventFactory, private readonly string $shopwareVersion, private readonly MessageBusInterface $bus, private readonly bool $isAdminWorkerEnabled)
  49.     {
  50.     }
  52.     public function dispatch(object $event, ?string $eventName = null): object
  53.     {
  54.         $event = $this->dispatcher->dispatch($event, $eventName);
  56.         if (EnvironmentHelper::getVariable('DISABLE_EXTENSIONS', false)) {
  57.             return $event;
  58.         }
  60.         foreach ($this->eventFactory->createHookablesFor($event) as $hookable) {
  61.             $context = Context::createDefaultContext();
  62.             if ($event instanceof FlowEventAware || $event instanceof AppChangedEvent || $event instanceof EntityWrittenContainerEvent) {
  63.                 $context = $event->getContext();
  64.             }
  66.             $this->callWebhooks($hookable, $context);
  67.         }
  69.         // always return the original event and never our wrapped events
  70.         // this would lead to problems in the `BusinessEventDispatcher` from core
  71.         return $event;
  72.     }
  74.     /**
  75.      * @param callable $listener
  76.      */
  77.     public function addListener(string $eventName, $listener, int $priority = 0): void
  78.     {
  79.         $this->dispatcher->addListener($eventName, $listener, $priority);
  80.     }
  82.     public function addSubscriber(EventSubscriberInterface $subscriber): void
  83.     {
  84.         $this->dispatcher->addSubscriber($subscriber);
  85.     }
  87.     /**
  88.      * @param callable $listener
  89.      */
  90.     public function removeListener(string $eventName, $listener): void
  91.     {
  92.         $this->dispatcher->removeListener($eventName, $listener);
  93.     }
  95.     public function removeSubscriber(EventSubscriberInterface $subscriber): void
  96.     {
  97.         $this->dispatcher->removeSubscriber($subscriber);
  98.     }
  100.     /**
  101.      * @return array<array-key, array<array-key, callable>|callable>
  102.      */
  103.     public function getListeners(?string $eventName = null): array
  104.     {
  105.         return $this->dispatcher->getListeners($eventName);
  106.     }
  108.     /**
  109.      * @param callable $listener
  110.      */
  111.     public function getListenerPriority(string $eventName, $listener): ?int
  112.     {
  113.         return $this->dispatcher->getListenerPriority($eventName, $listener);
  114.     }
  116.     public function hasListeners(?string $eventName = null): bool
  117.     {
  118.         return $this->dispatcher->hasListeners($eventName);
  119.     }
  121.     public function clearInternalWebhookCache(): void
  122.     {
  123.         $this->webhooks = null;
  124.     }
  126.     public function clearInternalPrivilegesCache(): void
  127.     {
  128.         $this->privileges = [];
  129.     }
  131.     private function callWebhooks(Hookable $event, Context $context): void
  132.     {
  133.         /** @var WebhookCollection $webhooksForEvent */
  134.         $webhooksForEvent = $this->getWebhooks()->filterForEvent($event->getName());
  136.         if ($webhooksForEvent->count() === 0) {
  137.             return;
  138.         }
  140.         $affectedRoleIds = $webhooksForEvent->getAclRoleIdsAsBinary();
  141.         $languageId = $context->getLanguageId();
  142.         $userLocale = $this->getAppLocaleProvider()->getLocaleFromContext($context);
  144.         // If the admin worker is enabled we send all events synchronously, as we can't guarantee timely delivery otherwise.
  145.         // Additionally, all app lifecycle events are sent synchronously as those can lead to nasty race conditions otherwise.
  146.         if ($this->isAdminWorkerEnabled || $event instanceof AppDeletedEvent || $event instanceof AppChangedEvent) {
  147.             Profiler::trace('webhook::dispatch-sync', function () use ($userLocale, $languageId, $affectedRoleIds, $event, $webhooksForEvent): void {
  148.                 $this->callWebhooksSynchronous($webhooksForEvent, $event, $affectedRoleIds, $languageId, $userLocale);
  149.             });
  151.             return;
  152.         }
  154.         Profiler::trace('webhook::dispatch-async', function () use ($userLocale, $languageId, $affectedRoleIds, $event, $webhooksForEvent): void {
  155.             $this->dispatchWebhooksToQueue($webhooksForEvent, $event, $affectedRoleIds, $languageId, $userLocale);
  156.         });
  157.     }
  159.     private function getWebhooks(): WebhookCollection
  160.     {
  161.         if ($this->webhooks) {
  162.             return $this->webhooks;
  163.         }
  165.         $criteria = new Criteria();
  166.         $criteria->setTitle('apps::webhooks');
  167.         $criteria->addFilter(new EqualsFilter('active', true));
  168.         $criteria->addAssociation('app');
  170.         /** @var WebhookCollection $webhooks */
  171.         $webhooks = $this->container->get('webhook.repository')->search($criteria, Context::createDefaultContext())->getEntities();
  173.         return $this->webhooks = $webhooks;
  174.     }
  176.     /**
  177.      * @param array<string> $affectedRoles
  178.      */
  179.     private function isEventDispatchingAllowed(WebhookEntity $webhook, Hookable $event, array $affectedRoles): bool
  180.     {
  181.         $app = $webhook->getApp();
  183.         if ($app === null) {
  184.             return true;
  185.         }
  187.         // Only app lifecycle hooks can be received if app is deactivated
  188.         if (!$app->isActive() && !($event instanceof AppChangedEvent || $event instanceof AppDeletedEvent)) {
  189.             return false;
  190.         }
  192.         if (!($this->privileges[$event->getName()] ?? null)) {
  193.             $this->loadPrivileges($event->getName(), $affectedRoles);
  194.         }
  196.         $privileges = $this->privileges[$event->getName()][$app->getAclRoleId()]
  197.             ?? new AclPrivilegeCollection([]);
  199.         if (!$event->isAllowed($app->getId(), $privileges)) {
  200.             return false;
  201.         }
  203.         return true;
  204.     }
  206.     /**
  207.      * @param array<string> $affectedRoleIds
  208.      */
  209.     private function callWebhooksSynchronous(
  210.         WebhookCollection $webhooksForEvent,
  211.         Hookable $event,
  212.         array $affectedRoleIds,
  213.         string $languageId,
  214.         string $userLocale
  215.     ): void {
  216.         $requests = [];
  218.         foreach ($webhooksForEvent as $webhook) {
  219.             if (!$this->isEventDispatchingAllowed($webhook, $event, $affectedRoleIds)) {
  220.                 continue;
  221.             }
  223.             try {
  224.                 $webhookData = $this->getPayloadForWebhook($webhook, $event);
  225.             } catch (AppUrlChangeDetectedException) {
  226.                 // don't dispatch webhooks for apps if url changed
  227.                 continue;
  228.             }
  230.             $timestamp = time();
  231.             $webhookData['timestamp'] = $timestamp;
  233.             /** @var string $jsonPayload */
  234.             $jsonPayload = json_encode($webhookData, \JSON_THROW_ON_ERROR);
  236.             $headers = [
  237.                 'Content-Type' => 'application/json',
  238.                 'sw-version' => $this->shopwareVersion,
  239.                 AuthMiddleware::SHOPWARE_CONTEXT_LANGUAGE => $languageId,
  240.                 AuthMiddleware::SHOPWARE_USER_LANGUAGE => $userLocale,
  241.             ];
  243.             if ($event instanceof AppFlowActionEvent) {
  244.                 $headers = array_merge($headers, $event->getWebhookHeaders());
  245.             }
  247.             $request = new Request(
  248.                 'POST',
  249.                 $webhook->getUrl(),
  250.                 $headers,
  251.                 $jsonPayload
  252.             );
  254.             if ($webhook->getApp() !== null && $webhook->getApp()->getAppSecret() !== null) {
  255.                 $request = $request->withHeader(
  256.                     RequestSigner::SHOPWARE_SHOP_SIGNATURE,
  257.                     (new RequestSigner())->signPayload($jsonPayload, $webhook->getApp()->getAppSecret())
  258.                 );
  259.             }
  261.             $requests[] = $request;
  262.         }
  264.         if (\count($requests) > 0) {
  265.             $pool = new Pool($this->guzzle, $requests);
  266.             $pool->promise()->wait();
  267.         }
  268.     }
  270.     /**
  271.      * @param array<string> $affectedRoleIds
  272.      */
  273.     private function dispatchWebhooksToQueue(
  274.         WebhookCollection $webhooksForEvent,
  275.         Hookable $event,
  276.         array $affectedRoleIds,
  277.         string $languageId,
  278.         string $userLocale
  279.     ): void {
  280.         foreach ($webhooksForEvent as $webhook) {
  281.             if (!$this->isEventDispatchingAllowed($webhook, $event, $affectedRoleIds)) {
  282.                 continue;
  283.             }
  285.             try {
  286.                 $webhookData = $this->getPayloadForWebhook($webhook, $event);
  287.             } catch (AppUrlChangeDetectedException) {
  288.                 // don't dispatch webhooks for apps if url changed
  289.                 continue;
  290.             }
  292.             $webhookEventId = $webhookData['source']['eventId'];
  294.             $appId = $webhook->getApp() !== null ? $webhook->getApp()->getId() : null;
  295.             $secret = $webhook->getApp() !== null ? $webhook->getApp()->getAppSecret() : null;
  297.             $webhookEventMessage = new WebhookEventMessage(
  298.                 $webhookEventId,
  299.                 $webhookData,
  300.                 $appId,
  301.                 $webhook->getId(),
  302.                 $this->shopwareVersion,
  303.                 $webhook->getUrl(),
  304.                 $secret,
  305.                 $languageId,
  306.                 $userLocale
  307.             );
  309.             $this->logWebhookWithEvent($webhook, $webhookEventMessage);
  311.             $this->bus->dispatch($webhookEventMessage);
  312.         }
  313.     }
  315.     /**
  316.      * @return array<string, mixed>
  317.      */
  318.     private function getPayloadForWebhook(WebhookEntity $webhook, Hookable $event): array
  319.     {
  320.         if ($event instanceof AppFlowActionEvent) {
  321.             return $event->getWebhookPayload();
  322.         }
  324.         $data = [
  325.             'payload' => $event->getWebhookPayload(),
  326.             'event' => $event->getName(),
  327.         ];
  329.         $source = [
  330.             'url' => $this->shopUrl,
  331.             'eventId' => Uuid::randomHex(),
  332.         ];
  334.         if ($webhook->getApp() !== null) {
  335.             $shopIdProvider = $this->getShopIdProvider();
  337.             $source['appVersion'] = $webhook->getApp()->getVersion();
  338.             $source['shopId'] = $shopIdProvider->getShopId();
  339.         }
  341.         return [
  342.             'data' => $data,
  343.             'source' => $source,
  344.         ];
  345.     }
  347.     private function logWebhookWithEvent(WebhookEntity $webhook, WebhookEventMessage $webhookEventMessage): void
  348.     {
  349.         /** @var EntityRepository $webhookEventLogRepository */
  350.         $webhookEventLogRepository = $this->container->get('webhook_event_log.repository');
  352.         $webhookEventLogRepository->create([
  353.             [
  354.                 'id' => $webhookEventMessage->getWebhookEventId(),
  355.                 'appName' => $webhook->getApp() !== null ? $webhook->getApp()->getName() : null,
  356.                 'deliveryStatus' => WebhookEventLogDefinition::STATUS_QUEUED,
  357.                 'webhookName' => $webhook->getName(),
  358.                 'eventName' => $webhook->getEventName(),
  359.                 'appVersion' => $webhook->getApp() !== null ? $webhook->getApp()->getVersion() : null,
  360.                 'url' => $webhook->getUrl(),
  361.                 'serializedWebhookMessage' => serialize($webhookEventMessage),
  362.             ],
  363.         ], Context::createDefaultContext());
  364.     }
  366.     /**
  367.      * @param array<string> $affectedRoleIds
  368.      */
  369.     private function loadPrivileges(string $eventName, array $affectedRoleIds): void
  370.     {
  371.         $roles = $this->connection->fetchAllAssociative('
  372.             SELECT `id`, `privileges`
  373.             FROM `acl_role`
  374.             WHERE `id` IN (:aclRoleIds)
  375.         ', ['aclRoleIds' => $affectedRoleIds], ['aclRoleIds' => Connection::PARAM_STR_ARRAY]);
  377.         if (!$roles) {
  378.             $this->privileges[$eventName] = [];
  379.         }
  381.         foreach ($roles as $privilege) {
  382.             $this->privileges[$eventName][Uuid::fromBytesToHex($privilege['id'])]
  383.                 = new AclPrivilegeCollection(json_decode((string) $privilege['privileges'], true, 512, \JSON_THROW_ON_ERROR));
  384.         }
  385.     }
  387.     private function getShopIdProvider(): ShopIdProvider
  388.     {
  389.         return $this->container->get(ShopIdProvider::class);
  390.     }
  392.     private function getAppLocaleProvider(): AppLocaleProvider
  393.     {
  394.         return $this->container->get(AppLocaleProvider::class);
  395.     }
  396. }