Struct WebhookConfig 

pub struct WebhookConfig {
    pub secret: Arc<dyn WebhookSecretResolver>,
    pub branch: Option<String>,
    pub repo: Option<String>,
    pub dedup: Arc<Mutex<DeliveryDedupCache>>,
    pub extractor: Arc<dyn WebhookPayloadExtractor>,
    pub concurrency: Option<Arc<WebhookConcurrencyLimit>>,
    pub rate_limit: Option<Arc<WebhookRateLimiter>>,
}

Per-route config attached to the webhook handler.

Fields

secret: Arc<dyn WebhookSecretResolver>

Resolves the shared secret on every request so a wizard rotate flow doesn’t require a router rebuild.

branch: Option<String>

When Some(branch), only payloads whose ref equals refs/heads/<branch> trigger a scan. None accepts any branch.

repo: Option<String>

Optional repo filter forwarded to the ScanTrigger. None scans every enabled repo, matching the API’s manual-trigger behaviour.

dedup: Arc<Mutex<DeliveryDedupCache>>

Bounded set of delivery ids already processed, so a webhook-UI redelivery (or a hostile replay of a captured-and-still-valid HMAC body) does not retrigger the dispatcher. Shared across clones of the config so a router rebuild keeps the cache hot.

extractor: Arc<dyn WebhookPayloadExtractor>

Provider-specific decoder for the verified push body. Operators pick this via [triggers].webhook_provider; the default (refheads) covers GitHub / Gitea / Forgejo / Gogs / GitLab, which all ship the branch under top-level ref.

concurrency: Option<Arc<WebhookConcurrencyLimit>>

Optional cap on simultaneous in-flight handler invocations. None disables the gate (every request is admitted). When set, requests past the cap return 429 before HMAC verification so a flood of valid-signed pushes cannot peg the executor.

rate_limit: Option<Arc<WebhookRateLimiter>>

Optional per-source-IP token bucket. None disables the gate (every IP is admitted). When set, requests past the per-IP budget return 429 before HMAC verification. The handler reads the source IP from the request’s ConnectInfo extension; deployments that route through a reverse proxy without preserving the peer address will not see per-IP throttling and fall back to the global concurrency cap.

Implementations

impl WebhookConfig

pub fn new( secret: Arc<dyn WebhookSecretResolver>, branch: Option<String>, repo: Option<String>, ) -> Self

Build a webhook config with a fresh dedup cache and the default ref: refs/heads/<branch> extractor.

pub fn with_extractor( secret: Arc<dyn WebhookSecretResolver>, branch: Option<String>, repo: Option<String>, extractor: Arc<dyn WebhookPayloadExtractor>, ) -> Self

Build a webhook config with a fresh dedup cache and an explicit extractor. Used when the operator’s [triggers].webhook_provider names a non-default shape (Bitbucket Server, Sourcehut, …).

pub fn with_concurrency_limit(self, limit: Arc<WebhookConcurrencyLimit>) -> Self

Attach a concurrency cap. Subsequent requests past the cap return 429 before HMAC verification.

pub fn with_rate_limit(self, limit: Arc<WebhookRateLimiter>) -> Self

Attach a per-source-IP rate limiter. Requests past the per-IP budget return 429 before HMAC verification.

Trait Implementations

impl Clone for WebhookConfig

fn clone(&self) -> WebhookConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.