angee.integrate.webhooks

Outbound webhook delivery: a signed POST over the shared HTTP client.

The delivery orchestration (which subscriptions receive an event) lives on WebhookSubscription's manager, and a subscription delivers itself via WebhookSubscription.deliver. This module owns only the webhook signature and maps the shared client's result to a delivery error — the SSRF-pinned transport is :class:angee.integrate.http.HttpClient, so the resolve-once-and-pin mechanics live in exactly one place.

SIGNATURE_HEADER

Header carrying the HMAC-SHA256 signature for outbound webhook bodies.

WebhookDeliveryError

class WebhookDeliveryError(Exception)

Raised when a webhook endpoint returns a non-success HTTP status.

__init__

def __init__(message: str, *, status: str = "") -> None

Record the delivery status when one is available.

PinnedWebhookClient

class PinnedWebhookClient()

Posts a signed body to one HTTP(S) URL over the shared SSRF-pinned client.

The shared client resolves the host once, rejects any non-public answer, and dials the pinned address, so a DNS rebind between check and connect cannot redirect the POST; this class adds only the Angee webhook signature.

__init__

def __init__(url: str) -> None

Parse and gate the delivery URL (scheme + host) up front.

post

def post(*, secret: str, body: bytes) -> str

POST body signed with secret and return the HTTP status, or raise.