relay: forward raw Gitea events unchanged

services/dev/gitea-hermes-webhook-relay.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Normalize authenticated Gitea PR webhooks for Hermes Agent."""
+"""Relay authenticated Gitea webhook requests to Hermes Agent."""
 from __future__ import annotations
 
 import hashlib
@@ -40,13 +40,6 @@ def json_bytes(payload: dict) -> bytes:
     return json.dumps(payload, ensure_ascii=False, separators=(",", ":")).encode()
 
 
-def normalized_event(headers, payload: dict) -> str:
-    event = headers.get("X-Gitea-Event-Type", "") or headers.get("X-Gitea-Event", "")
-    if event == "issue_comment" and payload.get("is_pull") is True:
-        return "pull_request_comment"
-    return event or "unknown"
-
-
 class Handler(BaseHTTPRequestHandler):
     server_version = "gitea-hermes-relay/1.0"
 
@@ -82,15 +75,6 @@ class Handler(BaseHTTPRequestHandler):
             return
 
         body = self.rfile.read(content_length)
-        try:
-            payload = json.loads(body)
-        except json.JSONDecodeError:
-            self.send_json(400, {"status": "invalid_json"})
-            return
-        if not isinstance(payload, dict):
-            self.send_json(400, {"status": "invalid_payload"})
-            return
-
         try:
             secret = load_secret()
         except RuntimeError as exc:
@@ -107,22 +91,26 @@ class Handler(BaseHTTPRequestHandler):
             self.send_json(401, {"status": "invalid_signature"})
             return
 
-        event = normalized_event(self.headers, payload)
-        normalized = dict(payload)
-        normalized["event_type"] = event
-        normalized["relay_source"] = "gitea"
-        forwarded_body = json_bytes(normalized)
+        # Keep the incoming body unchanged. Event interpretation and policy
+        # belong to Hermes, not to this transport service.
+        forwarded_body = body
         forwarded_signature = hmac.new(
             secret, forwarded_body, hashlib.sha256
         ).hexdigest()
+        gitea_event = self.headers.get("X-Gitea-Event", "")
+        gitea_event_type = self.headers.get("X-Gitea-Event-Type", "")
         delivery_id = self.headers.get("X-Gitea-Delivery", "")
         forwarded_headers = {
             "Content-Type": "application/json",
-            "X-GitHub-Event": event,
             "X-Webhook-Signature": forwarded_signature,
         }
+        if gitea_event:
+            forwarded_headers["X-Gitea-Event"] = gitea_event
+        if gitea_event_type:
+            forwarded_headers["X-Gitea-Event-Type"] = gitea_event_type
         if delivery_id:
             forwarded_headers["X-Request-ID"] = delivery_id
+            forwarded_headers["X-Gitea-Delivery"] = delivery_id
 
         request = Request(
             HERMES_URL,
@@ -148,12 +136,11 @@ class Handler(BaseHTTPRequestHandler):
             return
 
         LOG.info(
-            "forwarded %s action=%s delivery=%s",
-            event,
-            payload.get("action", ""),
+            "forwarded Gitea event=%s delivery=%s",
+            gitea_event or gitea_event_type or "unknown",
             delivery_id or "none",
         )
-        self.send_json(200, {"status": "forwarded", "event": event})
+        self.send_json(200, {"status": "forwarded"})
 
 
 def main() -> None: