feat: fetch secret from IOptionsMonitor if defined

src/Octokit.Webhooks.AspNetCore/GitHubWebhookExtensions.cs

@@ -12,49 +12,63 @@
 using Microsoft.AspNetCore.Routing;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
 
 /// <summary>
 /// A class containing extension methods for <see cref="IEndpointRouteBuilder"/>
 /// for adding an HTTP endpoint for processing GitHub webhook payloads.
 /// </summary>
 public static partial class GitHubWebhookExtensions
 {
-    public static IEndpointConventionBuilder MapGitHubWebhooks(this IEndpointRouteBuilder endpoints, string path = "/api/github/webhooks", string secret = null!) =>
-        endpoints.MapPost(path, async context =>
-        {
-            var logger = context.RequestServices.GetRequiredService<ILogger<WebhookEventProcessor>>();
-
-            // Verify content type
-            if (!VerifyContentType(context, MediaTypeNames.Application.Json))
-            {
-                Log.IncorrectContentType(logger);
-                return;
-            }
-
-            // Get body
-            var body = await GetBodyAsync(context).ConfigureAwait(false);
-
-            // Verify signature
-            if (!await VerifySignatureAsync(context, secret, body).ConfigureAwait(false))
-            {
-                Log.SignatureValidationFailed(logger);
-                return;
-            }
-
-            // Process body
-            try
-            {
-                var service = context.RequestServices.GetRequiredService<WebhookEventProcessor>();
-                await service.ProcessWebhookAsync(context.Request.Headers, body)
-                    .ConfigureAwait(false);
-                context.Response.StatusCode = 200;
-            }
-            catch (Exception ex)
+    public static IEndpointConventionBuilder MapGitHubWebhooks(
+        this IEndpointRouteBuilder endpoints,
+        string path = "/api/github/webhooks",
+        string? secret = null)
+    {
+        var options = endpoints.ServiceProvider.GetService<IOptionsMonitor<GitHubWebhookOptions>>();
+        return endpoints.MapPost(
+            path,
+            async context =>
             {
-                Log.ProcessingFailed(logger, ex);
-                context.Response.StatusCode = 500;
-            }
-        });
+                var logger = context.RequestServices.GetRequiredService<ILogger<WebhookEventProcessor>>();
+
+                // Verify content type
+                if (!VerifyContentType(context, MediaTypeNames.Application.Json))
+                {
+                    Log.IncorrectContentType(logger);
+                    return;
+                }
+
+                // Get body
+                var body = await GetBodyAsync(context).ConfigureAwait(false);
+
+                if (secret is null && options is not null)
+                {
+                    secret = options.CurrentValue.Secret;
+                }
+
+                // Verify signature
+                if (!await VerifySignatureAsync(context, secret, body).ConfigureAwait(false))
+                {
+                    Log.SignatureValidationFailed(logger);
+                    return;
+                }
+
+                // Process body
+                try
+                {
+                    var service = context.RequestServices.GetRequiredService<WebhookEventProcessor>();
+                    await service.ProcessWebhookAsync(context.Request.Headers, body)
+                        .ConfigureAwait(false);
+                    context.Response.StatusCode = 200;
+                }
+                catch (Exception ex)
+                {
+                    Log.ProcessingFailed(logger, ex);
+                    context.Response.StatusCode = 500;
+                }
+            });
+    }
 
     private static bool VerifyContentType(HttpContext context, string expectedContentType)
     {
@@ -79,7 +93,7 @@ private static async Task<string> GetBodyAsync(HttpContext context)
         return await reader.ReadToEndAsync().ConfigureAwait(false);
     }
 
-    private static async Task<bool> VerifySignatureAsync(HttpContext context, string secret, string body)
+    private static async Task<bool> VerifySignatureAsync(HttpContext context, string? secret, string body)
     {
         _ = context.Request.Headers.TryGetValue("X-Hub-Signature-256", out var signatureSha256);
 
@@ -106,7 +120,7 @@ await context.Response.WriteAsync("Payload includes a secret, so the webhook rec
             return false;
         }
 
-        var keyBytes = Encoding.UTF8.GetBytes(secret);
+        var keyBytes = Encoding.UTF8.GetBytes(secret!);
         var bodyBytes = Encoding.UTF8.GetBytes(body);
 
         var hash = HMACSHA256.HashData(keyBytes, bodyBytes);

src/Octokit.Webhooks.AspNetCore/GitHubWebhookOptions.cs

@@ -0,0 +1,6 @@
+namespace Octokit.Webhooks.AspNetCore;
+
+public sealed record GitHubWebhookOptions
+{
+    public string? Secret { get; set; }
+}