feat: 支持 HMAC-SHA256 签名校验并优化测试用例

application/common/library/WebhookHandler.php

@@ -20,9 +20,8 @@ class WebhookHandler
 
     public function handle(array $server, array $get, string $rawBody): array
     {
-        // 1. 验证 Token (支持 Header 与 URL 参数)
-        $token = $server['HTTP_X_GITEA_TOKEN'] ?? $server['HTTP_X_GIT_TOKEN'] ?? $server['HTTP_X_GITLAB_TOKEN'] ?? ($get['token'] ?? '');
-        if ($token === '' || !hash_equals($this->secret, $token)) {
+        // 1. 验证权限 (支持 Header 明文 Token、URL Token 以及 HMAC-SHA256 签名)
+        if (!$this->verifyAuth($server, $get, $rawBody)) {
             return ['code' => 403, 'data' => ['status' => 'error', 'message' => 'Invalid token']];
         }
 
@@ -33,7 +32,7 @@ class WebhookHandler
         }
 
         // 3. 处理 Ping / Test 事件
-        $event = strtolower($server['HTTP_X_GITEA_EVENT'] ?? $server['HTTP_X_GIT_EVENT'] ?? '');
+        $event = strtolower($server['HTTP_X_GITEA_EVENT'] ?? $server['HTTP_X_GIT_EVENT'] ?? $server['HTTP_X_GITHUB_EVENT'] ?? '');
         if ($event === 'ping') {
             return ['code' => 200, 'data' => ['status' => 'success', 'message' => 'pong']];
         }
@@ -69,4 +68,27 @@ class WebhookHandler
             ]
         ];
     }
+
+    private function verifyAuth(array $server, array $get, string $rawBody): bool
+    {
+        // A. 明文 Token 校验
+        $token = $server['HTTP_X_GITEA_TOKEN'] ?? $server['HTTP_X_GIT_TOKEN'] ?? $server['HTTP_X_GITLAB_TOKEN'] ?? ($get['token'] ?? '');
+        if ($token !== '' && hash_equals($this->secret, $token)) {
+            return true;
+        }
+
+        // B. HMAC-SHA256 签名校验 (Gitea / GitHub)
+        $signature = $server['HTTP_X_GITEA_SIGNATURE'] ?? $server['HTTP_X_HUB_SIGNATURE_256'] ?? '';
+        if ($signature !== '') {
+            if (strpos($signature, 'sha256=') === 0) {
+                $signature = substr($signature, 7);
+            }
+            $expected = hash_hmac('sha256', $rawBody, $this->secret);
+            if (hash_equals($expected, $signature)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
 }