Rename robots when we rename a user. Do not use the namespace from the path to check permissions from the incoming webhooks since the namespace may have changed and we cannot recreate them in remote services easily.

endpoints/webhooks.py

@@ -67,20 +67,22 @@ def stripe_webhook():
   return make_response('Okay')
 
 
-@webhooks.route('/push/<path:repository>/trigger/<trigger_uuid>',
-                methods=['POST'])
+@webhooks.route('/push/<path:repository>/trigger/<trigger_uuid>', methods=['POST'])
 @process_auth
-@parse_repository_name
-def build_trigger_webhook(namespace, repository, trigger_uuid):
-  logger.debug('Webhook received for %s/%s with uuid %s', namespace,
-               repository, trigger_uuid)
+def build_trigger_webhook(_, trigger_uuid):
+  logger.debug('Webhook received with uuid %s', trigger_uuid)
+  
+  try:
+    trigger = model.get_build_trigger(trigger_uuid)
+  except model.InvalidBuildTriggerException:
+    # It is ok to return 404 here, since letting an attacker know that a trigger UUID is valid
+    # doesn't leak anything
+    abort(404)
+
+  namespace = trigger.repository.namespace_user.username
+  repository = trigger.repository.name
   permission = ModifyRepositoryPermission(namespace, repository)
   if permission.can():
-    try:
-      trigger = model.get_build_trigger(namespace, repository, trigger_uuid)
-    except model.InvalidBuildTriggerException:
-      abort(404)
-
     handler = BuildTrigger.get_trigger_for_service(trigger.service.name)
 
     logger.debug('Passing webhook request to handler %s', handler)