From e9852250958cefa397c03a06fb301c2c05a4bffa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=93=B8=E6=B8=8A=20=28ICE-GL-ZY001=29?=
 <zhuyuan@guanghulab.com>
Date: Wed, 13 May 2026 04:49:26 +0000
Subject: [PATCH] =?UTF-8?q?fix:=20Git=20Sync=20Webhook=20=E7=AD=BE?=
 =?UTF-8?q?=E5=90=8D=E9=AA=8C=E8=AF=81=20=E2=80=94=20=E4=BD=BF=E7=94=A8=20?=
 =?UTF-8?q?raw=20body=20=E6=9B=BF=E4=BB=A3=20JSON.stringify?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 server/git-sync/server.js | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/server/git-sync/server.js b/server/git-sync/server.js
index b79b920..aa24866 100644
--- a/server/git-sync/server.js
+++ b/server/git-sync/server.js
@@ -29,7 +29,14 @@ const fs = require("fs");
 const path = require("path");
 
 const app = express();
-app.use(express.json({ limit: "1mb" }));
+
+// 捕获 raw body 用于 Webhook 签名验证
+app.use(express.json({
+  limit: "1mb",
+  verify: (req, _res, buf) => {
+    req.rawBody = buf.toString("utf8");
+  }
+}));
 
 // ─── 配置 ─────────────────────────────────────────────────────
 const CONFIG = {
@@ -201,7 +208,8 @@ async function syncWithRetry(commitSha, committer, message) {
 // Webhook 接收端点
 app.post("/webhook", async (req, res) => {
   const signature = req.headers["x-gitea-signature"] || req.headers["x-hub-signature-256"] || "";
-  const payload = JSON.stringify(req.body);
+  // 使用 raw body 验证签名（Express JSON 解析后 stringify 会和原始 body 不一致）
+  const payload = req.rawBody || JSON.stringify(req.body);
 
   // 验证签名
   if (!verifyWebhook(payload, signature)) {