Upload 2 files

Dockerfile

@@ -0,0 +1,8 @@
+FROM python:3.12-slim
+RUN useradd --create-home --uid 1000 appuser
+WORKDIR /app
+COPY --chown=appuser:appuser receiver.py /app/receiver.py
+USER appuser
+ENV PYTHONUNBUFFERED=1
+EXPOSE 7860
+CMD ["python", "receiver.py"]

receiver.py

@@ -0,0 +1,90 @@
+"""Temporary webhook payload inspector. No Telegram/LLM calls are made."""
+import json
+import os
+import secrets
+import sqlite3
+from datetime import datetime, timezone
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+from urllib.parse import urlsplit
+
+MAX_BYTES = 1024 * 1024
+
+
+def make_server(host="0.0.0.0", port=7860, *, secret, db_path):
+    if len(secret) < 24 or not secret.isascii() or not all(c.isalnum() or c in "-_" for c in secret):
+        raise ValueError("WEBHOOK_SECRET must contain at least 24 ASCII letters, digits, '-' or '_'")
+    path = Path(db_path)
+    path.parent.mkdir(parents=True, exist_ok=True)
+    with sqlite3.connect(path) as db:
+        db.execute("CREATE TABLE IF NOT EXISTS samples (id INTEGER PRIMARY KEY, received_at TEXT, content_type TEXT, body TEXT)")
+
+    class Handler(BaseHTTPRequestHandler):
+        def log_message(self, *_args):
+            pass  # Request paths contain the secret. Never log them.
+
+        def reply(self, code, payload):
+            raw = json.dumps(payload, ensure_ascii=False, indent=2).encode()
+            self.send_response(code)
+            self.send_header("Content-Type", "application/json; charset=utf-8")
+            self.send_header("Content-Length", str(len(raw)))
+            self.send_header("Cache-Control", "no-store")
+            self.send_header("X-Content-Type-Options", "nosniff")
+            self.end_headers()
+            self.wfile.write(raw)
+
+        def authorized(self, prefix):
+            return secrets.compare_digest(urlsplit(self.path).path.encode("utf-8"), (prefix + secret).encode("utf-8"))
+
+        def do_GET(self):
+            if urlsplit(self.path).path in ("/", "/health"):
+                return self.reply(200, {"status": "receiver_ready", "mode": "payload_inspection_only"})
+            if not self.authorized("/samples/"):
+                return self.reply(404, {"error": "not_found"})
+            with sqlite3.connect(path, timeout=10) as db:
+                rows = db.execute("SELECT id, received_at, content_type, body FROM samples ORDER BY id DESC LIMIT 3").fetchall()
+            result = []
+            for sample_id, received_at, content_type, body in rows:
+                try:
+                    payload = json.loads(body)
+                except ValueError:
+                    payload = body
+                result.append({"id": sample_id, "received_at": received_at, "content_type": content_type, "payload": payload})
+            return self.reply(200, {"count": len(result), "samples": result})
+
+        def do_POST(self):
+            if not self.authorized("/medialogia/"):
+                return self.reply(404, {"error": "not_found"})
+            try:
+                size = int(self.headers["Content-Length"])
+            except (ValueError, TypeError):
+                return self.reply(411, {"error": "content_length_required"})
+            if size < 0 or size > MAX_BYTES:
+                return self.reply(413, {"error": "payload_too_large"})
+            self.connection.settimeout(20)
+            try:
+                raw = self.rfile.read(size)
+            except (OSError, TimeoutError):
+                return self.reply(408, {"error": "request_timeout"})
+            if len(raw) != size:
+                return self.reply(400, {"error": "incomplete_body"})
+            try:
+                body = raw.decode("utf-8")
+            except UnicodeDecodeError:
+                return self.reply(400, {"error": "expected_utf8"})
+            try:
+                with sqlite3.connect(path, timeout=10) as db:
+                    db.execute("INSERT INTO samples(received_at,content_type,body) VALUES(?,?,?)", (datetime.now(timezone.utc).isoformat(), self.headers.get("Content-Type", ""), body))
+                    db.execute("DELETE FROM samples WHERE id NOT IN (SELECT id FROM samples ORDER BY id DESC LIMIT 20)")
+            except sqlite3.Error:
+                return self.reply(503, {"error": "storage_unavailable"})
+            print("Webhook sample saved", flush=True)
+            return self.reply(200, {"ok": True, "mode": "payload_inspection_only"})
+
+    return ThreadingHTTPServer((host, port), Handler)
+
+
+if __name__ == "__main__":
+    server = make_server(port=int(os.getenv("PORT", "7860")), secret=os.getenv("WEBHOOK_SECRET", ""), db_path=os.getenv("PROBE_DB_PATH", "/tmp/webhook-probe/samples.sqlite3"))
+    print("Receiver ready on port 7860; inspection only; local samples are temporary", flush=True)
+    server.serve_forever()