Merge branch 'master' of https://github.com/inventree/InvenTree into matmair/issue2279

InvenTree/common/admin.py

@@ -38,6 +38,11 @@ class UserSettingsAdmin(ImportExportModelAdmin):
             return []
 
 
+class WebhookAdmin(ImportExportModelAdmin):
+
+    list_display = ('endpoint_id', 'name', 'active', 'user')
+
+
 class NotificationEntryAdmin(admin.ModelAdmin):
 
     list_display = ('key', 'uid', 'updated', )
@@ -54,5 +59,7 @@ class NotificationMessageAdmin(admin.ModelAdmin):
 
 admin.site.register(common.models.InvenTreeSetting, SettingsAdmin)
 admin.site.register(common.models.InvenTreeUserSetting, UserSettingsAdmin)
+admin.site.register(common.models.WebhookEndpoint, WebhookAdmin)
+admin.site.register(common.models.WebhookMessage, ImportExportModelAdmin)
 admin.site.register(common.models.NotificationEntry, NotificationEntryAdmin)
 admin.site.register(common.models.NotificationMessage, NotificationMessageAdmin)

InvenTree/common/api.py

@@ -5,14 +5,102 @@ Provides a JSON API for common components.
 # -*- coding: utf-8 -*-
 from __future__ import unicode_literals
 
+import json
+
+from django.http.response import HttpResponse
+from django.utils.decorators import method_decorator
+from django.urls import path
+from django.views.decorators.csrf import csrf_exempt
 from django.conf.urls import url, include
 
+from rest_framework.views import APIView
+from rest_framework.exceptions import NotAcceptable, NotFound
 from django_filters.rest_framework import DjangoFilterBackend
 from rest_framework import filters, generics, permissions
 from rest_framework import serializers
+from django_q.tasks import async_task
 
 import common.models
 import common.serializers
+from InvenTree.helpers import inheritors
+
+
+class CsrfExemptMixin(object):
+    """
+    Exempts the view from CSRF requirements.
+    """
+
+    @method_decorator(csrf_exempt)
+    def dispatch(self, *args, **kwargs):
+        return super(CsrfExemptMixin, self).dispatch(*args, **kwargs)
+
+
+class WebhookView(CsrfExemptMixin, APIView):
+    """
+    Endpoint for receiving webhooks.
+    """
+    authentication_classes = []
+    permission_classes = []
+    model_class = common.models.WebhookEndpoint
+    run_async = False
+
+    def post(self, request, endpoint, *args, **kwargs):
+        # get webhook definition
+        self._get_webhook(endpoint, request, *args, **kwargs)
+
+        # check headers
+        headers = request.headers
+        try:
+            payload = json.loads(request.body)
+        except json.decoder.JSONDecodeError as error:
+            raise NotAcceptable(error.msg)
+
+        # validate
+        self.webhook.validate_token(payload, headers, request)
+        # process data
+        message = self.webhook.save_data(payload, headers, request)
+        if self.run_async:
+            async_task(self._process_payload, message.id)
+        else:
+            self._process_result(
+                self.webhook.process_payload(message, payload, headers),
+                message,
+            )
+
+        # return results
+        data = self.webhook.get_return(payload, headers, request)
+        return HttpResponse(data)
+
+    def _process_payload(self, message_id):
+        message = common.models.WebhookMessage.objects.get(message_id=message_id)
+        self._process_result(
+            self.webhook.process_payload(message, message.body, message.header),
+            message,
+        )
+
+    def _process_result(self, result, message):
+        if result:
+            message.worked_on = result
+            message.save()
+        else:
+            message.delete()
+
+    def _escalate_object(self, obj):
+        classes = inheritors(obj.__class__)
+        for cls in classes:
+            mdl_name = cls._meta.model_name
+            if hasattr(obj, mdl_name):
+                return getattr(obj, mdl_name)
+        return obj
+
+    def _get_webhook(self, endpoint, request, *args, **kwargs):
+        try:
+            webhook = self.model_class.objects.get(endpoint_id=endpoint)
+            self.webhook = self._escalate_object(webhook)
+            self.webhook.init(request, *args, **kwargs)
+            return self.webhook.process_webhook()
+        except self.model_class.DoesNotExist:
+            raise NotFound()
 
 
 class SettingsList(generics.ListAPIView):
@@ -181,7 +269,6 @@ class NotificationDetail(generics.RetrieveUpdateDestroyAPIView):
 
     queryset = common.models.NotificationMessage.objects.all()
     serializer_class = common.serializers.NotificationMessageSerializer
-
     permission_classes = [
         UserSettingsPermissions,
     ]
@@ -249,6 +336,8 @@ settings_api_urls = [
 ]
 
 common_api_urls = [
+    # Webhooks
+    path('webhook/<slug:endpoint>/', WebhookView.as_view(), name='api-webhook'),
 
     # Notifications
     url(r'^notifications/', include([

InvenTree/common/migrations/0013_webhookendpoint_webhookmessage.py

@@ -0,0 +1,40 @@
+# Generated by Django 3.2.5 on 2021-11-19 21:34
+
+from django.conf import settings
+from django.db import migrations, models
+import django.db.models.deletion
+import uuid
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+        ('common', '0012_notificationentry'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='WebhookEndpoint',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('endpoint_id', models.CharField(default=uuid.uuid4, editable=False, help_text='Endpoint at which this webhook is received', max_length=255, verbose_name='Endpoint')),
+                ('name', models.CharField(blank=True, help_text='Name for this webhook', max_length=255, null=True, verbose_name='Name')),
+                ('active', models.BooleanField(default=True, help_text='Is this webhook active', verbose_name='Active')),
+                ('token', models.CharField(blank=True, default=uuid.uuid4, help_text='Token for access', max_length=255, null=True, verbose_name='Token')),
+                ('secret', models.CharField(blank=True, help_text='Shared secret for HMAC', max_length=255, null=True, verbose_name='Secret')),
+                ('user', models.ForeignKey(blank=True, help_text='User', null=True, on_delete=django.db.models.deletion.SET_NULL, to=settings.AUTH_USER_MODEL, verbose_name='User')),
+            ],
+        ),
+        migrations.CreateModel(
+            name='WebhookMessage',
+            fields=[
+                ('message_id', models.UUIDField(default=uuid.uuid4, editable=False, help_text='Unique identifier for this message', primary_key=True, serialize=False, verbose_name='Message ID')),
+                ('host', models.CharField(editable=False, help_text='Host from which this message was received', max_length=255, verbose_name='Host')),
+                ('header', models.CharField(blank=True, editable=False, help_text='Header of this message', max_length=255, null=True, verbose_name='Header')),
+                ('body', models.JSONField(blank=True, editable=False, help_text='Body of this message', null=True, verbose_name='Body')),
+                ('worked_on', models.BooleanField(default=False, help_text='Was the work on this message finished?', verbose_name='Worked on')),
+                ('endpoint', models.ForeignKey(blank=True, help_text='Endpoint on which this message was received', null=True, on_delete=django.db.models.deletion.SET_NULL, to='common.webhookendpoint', verbose_name='Endpoint')),
+            ],
+        ),
+    ]

InvenTree/common/models.py

@@ -9,6 +9,12 @@ from __future__ import unicode_literals
 import os
 import decimal
 import math
+import uuid
+import hmac
+import json
+import hashlib
+import base64
+from secrets import compare_digest
 from datetime import datetime, timedelta
 
 from django.db import models, transaction
@@ -25,6 +31,8 @@ from djmoney.settings import CURRENCY_CHOICES
 from djmoney.contrib.exchange.models import convert_money
 from djmoney.contrib.exchange.exceptions import MissingRate
 
+from rest_framework.exceptions import PermissionDenied
+
 from django.utils.translation import ugettext_lazy as _
 from django.core.validators import MinValueValidator, URLValidator
 from django.core.exceptions import ValidationError
@@ -58,7 +66,7 @@ class BaseInvenTreeSetting(models.Model):
     single values (e.g. one-off settings values).
     """
 
-    GLOBAL_SETTINGS = {}
+    SETTINGS = {}
 
     class Meta:
         abstract = True
@@ -70,7 +78,7 @@ class BaseInvenTreeSetting(models.Model):
 
         self.key = str(self.key).upper()
 
-        self.clean()
+        self.clean(**kwargs)
         self.validate_unique()
 
         super().save()
@@ -87,6 +95,7 @@ class BaseInvenTreeSetting(models.Model):
 
         results = cls.objects.all()
 
+        # Optionally filter by user
         if user is not None:
             results = results.filter(user=user)
 
@@ -98,13 +107,13 @@ class BaseInvenTreeSetting(models.Model):
                 settings[setting.key.upper()] = setting.value
 
         # Specify any "default" values which are not in the database
-        for key in cls.GLOBAL_SETTINGS.keys():
+        for key in cls.SETTINGS.keys():
 
             if key.upper() not in settings:
                 settings[key.upper()] = cls.get_setting_default(key)
 
             if exclude_hidden:
-                hidden = cls.GLOBAL_SETTINGS[key].get('hidden', False)
+                hidden = cls.SETTINGS[key].get('hidden', False)
 
                 if hidden:
                     # Remove hidden items
@@ -128,98 +137,92 @@ class BaseInvenTreeSetting(models.Model):
         return settings
 
     @classmethod
-    def get_setting_name(cls, key):
+    def get_setting_definition(cls, key, **kwargs):
+        """
+        Return the 'definition' of a particular settings value, as a dict object.
+
+        - The 'settings' dict can be passed as a kwarg
+        - If not passed, look for cls.SETTINGS
+        - Returns an empty dict if the key is not found
+        """
+
+        settings = kwargs.get('settings', cls.SETTINGS)
+
+        key = str(key).strip().upper()
+
+        if settings is not None and key in settings:
+            return settings[key]
+        else:
+            return {}
+
+    @classmethod
+    def get_setting_name(cls, key, **kwargs):
         """
         Return the name of a particular setting.
 
         If it does not exist, return an empty string.
         """
 
-        key = str(key).strip().upper()
-
-        if key in cls.GLOBAL_SETTINGS:
-            setting = cls.GLOBAL_SETTINGS[key]
-            return setting.get('name', '')
-        else:
-            return ''
+        setting = cls.get_setting_definition(key, **kwargs)
+        return setting.get('name', '')
 
     @classmethod
-    def get_setting_description(cls, key):
+    def get_setting_description(cls, key, **kwargs):
         """
         Return the description for a particular setting.
 
         If it does not exist, return an empty string.
         """
 
-        key = str(key).strip().upper()
+        setting = cls.get_setting_definition(key, **kwargs)
 
-        if key in cls.GLOBAL_SETTINGS:
-            setting = cls.GLOBAL_SETTINGS[key]
-            return setting.get('description', '')
-        else:
-            return ''
+        return setting.get('description', '')
 
     @classmethod
-    def get_setting_units(cls, key):
+    def get_setting_units(cls, key, **kwargs):
         """
         Return the units for a particular setting.
 
         If it does not exist, return an empty string.
         """
 
-        key = str(key).strip().upper()
+        setting = cls.get_setting_definition(key, **kwargs)
 
-        if key in cls.GLOBAL_SETTINGS:
-            setting = cls.GLOBAL_SETTINGS[key]
-            return setting.get('units', '')
-        else:
-            return ''
+        return setting.get('units', '')
 
     @classmethod
-    def get_setting_validator(cls, key):
+    def get_setting_validator(cls, key, **kwargs):
         """
         Return the validator for a particular setting.
 
         If it does not exist, return None
         """
 
-        key = str(key).strip().upper()
+        setting = cls.get_setting_definition(key, **kwargs)
 
-        if key in cls.GLOBAL_SETTINGS:
-            setting = cls.GLOBAL_SETTINGS[key]
-            return setting.get('validator', None)
-        else:
-            return None
+        return setting.get('validator', None)
 
     @classmethod
-    def get_setting_default(cls, key):
+    def get_setting_default(cls, key, **kwargs):
         """
         Return the default value for a particular setting.
 
         If it does not exist, return an empty string
         """
 
-        key = str(key).strip().upper()
+        setting = cls.get_setting_definition(key, **kwargs)
 
-        if key in cls.GLOBAL_SETTINGS:
-            setting = cls.GLOBAL_SETTINGS[key]
-            return setting.get('default', '')
-        else:
-            return ''
+        return setting.get('default', '')
 
     @classmethod
-    def get_setting_choices(cls, key):
+    def get_setting_choices(cls, key, **kwargs):
         """
         Return the validator choices available for a particular setting.
         """
 
-        key = str(key).strip().upper()
+        setting = cls.get_setting_definition(key, **kwargs)
 
-        if key in cls.GLOBAL_SETTINGS:
-            setting = cls.GLOBAL_SETTINGS[key]
-            choices = setting.get('choices', None)
-        else:
-            choices = None
+        choices = setting.get('choices', None)
 
         if callable(choices):
             # Evaluate the function (we expect it will return a list of tuples...)
@@ -242,17 +245,40 @@ class BaseInvenTreeSetting(models.Model):
 
         key = str(key).strip().upper()
 
+        settings = cls.objects.all()
+
+        # Filter by user
+        user = kwargs.get('user', None)
+
+        if user is not None:
+            settings = settings.filter(user=user)
+
         try:
-            setting = cls.objects.filter(**cls.get_filters(key, **kwargs)).first()
+            setting = settings.filter(**cls.get_filters(key, **kwargs)).first()
         except (ValueError, cls.DoesNotExist):
             setting = None
         except (IntegrityError, OperationalError):
             setting = None
 
+        plugin = kwargs.pop('plugin', None)
+
+        if plugin:
+            from plugin import InvenTreePlugin
+
+            if issubclass(plugin.__class__, InvenTreePlugin):
+                plugin = plugin.plugin_config()
+
+            kwargs['plugin'] = plugin
+
         # Setting does not exist! (Try to create it)
         if not setting:
 
-            setting = cls(key=key, value=cls.get_setting_default(key), **kwargs)
+            # Attempt to create a new settings object
+            setting = cls(
+                key=key,
+                value=cls.get_setting_default(key, **kwargs),
+                **kwargs
+            )
 
             try:
                 # Wrap this statement in "atomic", so it can be rolled back if it fails
@@ -264,21 +290,6 @@ class BaseInvenTreeSetting(models.Model):
 
         return setting
 
-    @classmethod
-    def get_setting_pk(cls, key):
-        """
-        Return the primary-key value for a given setting.
-
-        If the setting does not exist, return None
-        """
-
-        setting = cls.get_setting_object(cls)
-
-        if setting:
-            return setting.pk
-        else:
-            return None
-
     @classmethod
     def get_setting(cls, key, backup_value=None, **kwargs):
         """
@@ -288,18 +299,19 @@ class BaseInvenTreeSetting(models.Model):
 
         # If no backup value is specified, atttempt to retrieve a "default" value
         if backup_value is None:
-            backup_value = cls.get_setting_default(key)
+            backup_value = cls.get_setting_default(key, **kwargs)
 
         setting = cls.get_setting_object(key, **kwargs)
 
         if setting:
             value = setting.value
 
-            # If the particular setting is defined as a boolean, cast the value to a boolean
-            if setting.is_bool():
+            # Cast to boolean if necessary
+            if setting.is_bool(**kwargs):
                 value = InvenTree.helpers.str2bool(value)
 
-            if setting.is_int():
+            # Cast to integer if necessary
+            if setting.is_int(**kwargs):
                 try:
                     value = int(value)
                 except (ValueError, TypeError):
@@ -362,7 +374,7 @@ class BaseInvenTreeSetting(models.Model):
     def units(self):
         return self.__class__.get_setting_units(self.key)
 
-    def clean(self):
+    def clean(self, **kwargs):
         """
         If a validator (or multiple validators) are defined for a particular setting key,
         run them against the 'value' field.
@@ -370,25 +382,16 @@ class BaseInvenTreeSetting(models.Model):
 
         super().clean()
 
-        validator = self.__class__.get_setting_validator(self.key)
+        validator = self.__class__.get_setting_validator(self.key, **kwargs)
 
-        if self.is_bool():
-            self.value = InvenTree.helpers.str2bool(self.value)
-
-        if self.is_int():
-            try:
-                self.value = int(self.value)
-            except (ValueError):
-                raise ValidationError(_('Must be an integer value'))
+        if validator is not None:
+            self.run_validator(validator)
 
         options = self.valid_options()
 
         if options and self.value not in options:
             raise ValidationError(_("Chosen value is not a valid option"))
 
-        if validator is not None:
-            self.run_validator(validator)
-
     def run_validator(self, validator):
         """
         Run a validator against the 'value' field for this InvenTreeSetting object.
@@ -400,7 +403,7 @@ class BaseInvenTreeSetting(models.Model):
         value = self.value
 
         # Boolean validator
-        if self.is_bool():
+        if validator is bool:
             # Value must "look like" a boolean value
             if InvenTree.helpers.is_bool(value):
                 # Coerce into either "True" or "False"
@@ -411,7 +414,7 @@ class BaseInvenTreeSetting(models.Model):
                 })
 
         # Integer validator
-        if self.is_int():
+        if validator is int:
 
             try:
                 # Coerce into an integer value
@@ -464,12 +467,12 @@ class BaseInvenTreeSetting(models.Model):
 
         return [opt[0] for opt in choices]
 
-    def is_bool(self):
+    def is_bool(self, **kwargs):
         """
         Check if this setting is required to be a boolean value
         """
 
-        validator = self.__class__.get_setting_validator(self.key)
+        validator = self.__class__.get_setting_validator(self.key, **kwargs)
 
         return self.__class__.validator_is_bool(validator)
 
@@ -482,15 +485,15 @@ class BaseInvenTreeSetting(models.Model):
 
         return InvenTree.helpers.str2bool(self.value)
 
-    def setting_type(self):
+    def setting_type(self, **kwargs):
         """
         Return the field type identifier for this setting object
         """
 
-        if self.is_bool():
+        if self.is_bool(**kwargs):
             return 'boolean'
 
-        elif self.is_int():
+        elif self.is_int(**kwargs):
             return 'integer'
 
         else:
@@ -509,12 +512,12 @@ class BaseInvenTreeSetting(models.Model):
 
         return False
 
-    def is_int(self):
+    def is_int(self, **kwargs):
         """
         Check if the setting is required to be an integer value:
         """
 
-        validator = self.__class__.get_setting_validator(self.key)
+        validator = self.__class__.get_setting_validator(self.key, **kwargs)
 
         return self.__class__.validator_is_int(validator)
 
@@ -546,21 +549,20 @@ class BaseInvenTreeSetting(models.Model):
         return value
 
     @classmethod
-    def is_protected(cls, key):
+    def is_protected(cls, key, **kwargs):
         """
         Check if the setting value is protected
         """
 
-        key = str(key).strip().upper()
+        setting = cls.get_setting_definition(key, **kwargs)
 
-        if key in cls.GLOBAL_SETTINGS:
-            return cls.GLOBAL_SETTINGS[key].get('protected', False)
-        else:
-            return False
+        return setting.get('protected', False)
 
 
 def settings_group_options():
-    """build up group tuple for settings based on gour choices"""
+    """
+    Build up group tuple for settings based on your choices
+    """
     return [('', _('No group')), *[(str(a.id), str(a)) for a in Group.objects.all()]]
 
 
@@ -582,7 +584,7 @@ class InvenTreeSetting(BaseInvenTreeSetting):
         super().save()
 
         if self.requires_restart():
-            InvenTreeSetting.set_setting('SERVER_REQUIRES_RESTART', True, None)
+            InvenTreeSetting.set_setting('SERVER_RESTART_REQUIRED', True, None)
 
     """
     Dict of all global settings values:
@@ -600,7 +602,7 @@ class InvenTreeSetting(BaseInvenTreeSetting):
     The keys must be upper-case
     """
 
-    GLOBAL_SETTINGS = {
+    SETTINGS = {
 
         'SERVER_RESTART_REQUIRED': {
             'name': _('Restart required'),
@@ -883,13 +885,6 @@ class InvenTreeSetting(BaseInvenTreeSetting):
             'validator': bool,
         },
 
-        'STOCK_GROUP_BY_PART': {
-            'name': _('Group by Part'),
-            'description': _('Group stock items by part reference in table views'),
-            'default': True,
-            'validator': bool,
-        },
-
         'BUILDORDER_REFERENCE_PREFIX': {
             'name': _('Build Order Reference Prefix'),
             'description': _('Prefix value for build order reference'),
@@ -968,6 +963,8 @@ class InvenTreeSetting(BaseInvenTreeSetting):
             'default': False,
             'validator': bool,
         },
+
+        # Settings for plugin mixin features
         'ENABLE_PLUGINS_URL': {
             'name': _('Enable URL integration'),
             'description': _('Enable plugins to add URL routes'),
@@ -982,16 +979,23 @@ class InvenTreeSetting(BaseInvenTreeSetting):
             'validator': bool,
             'requires_restart': True,
         },
-        'ENABLE_PLUGINS_GLOBALSETTING': {
-            'name': _('Enable global setting integration'),
-            'description': _('Enable plugins to integrate into inventree global settings'),
+        'ENABLE_PLUGINS_APP': {
+            'name': _('Enable app integration'),
+            'description': _('Enable plugins to add apps'),
             'default': False,
             'validator': bool,
             'requires_restart': True,
         },
-        'ENABLE_PLUGINS_APP': {
-            'name': _('Enable app integration'),
-            'description': _('Enable plugins to add apps'),
+        'ENABLE_PLUGINS_SCHEDULE': {
+            'name': _('Enable schedule integration'),
+            'description': _('Enable plugins to run scheduled tasks'),
+            'default': False,
+            'validator': bool,
+            'requires_restart': True,
+        },
+        'ENABLE_PLUGINS_EVENTS': {
+            'name': _('Enable event integration'),
+            'description': _('Enable plugins to respond to internal events'),
             'default': False,
             'validator': bool,
             'requires_restart': True,
@@ -1022,7 +1026,7 @@ class InvenTreeSetting(BaseInvenTreeSetting):
         Return True if this setting requires a server restart after changing
         """
 
-        options = InvenTreeSetting.GLOBAL_SETTINGS.get(self.key, None)
+        options = InvenTreeSetting.SETTINGS.get(self.key, None)
 
         if options:
             return options.get('requires_restart', False)
@@ -1035,7 +1039,7 @@ class InvenTreeUserSetting(BaseInvenTreeSetting):
     An InvenTreeSetting object with a usercontext
     """
 
-    GLOBAL_SETTINGS = {
+    SETTINGS = {
         'HOMEPAGE_PART_STARRED': {
             'name': _('Show subscribed parts'),
             'description': _('Show subscribed parts on the homepage'),
@@ -1400,6 +1404,184 @@ class ColorTheme(models.Model):
         return False
 
 
+class VerificationMethod:
+    NONE = 0
+    TOKEN = 1
+    HMAC = 2
+
+
+class WebhookEndpoint(models.Model):
+    """ Defines a Webhook entdpoint
+
+    Attributes:
+        endpoint_id: Path to the webhook,
+        name: Name of the webhook,
+        active: Is this webhook active?,
+        user: User associated with webhook,
+        token: Token for sending a webhook,
+        secret: Shared secret for HMAC verification,
+    """
+
+    # Token
+    TOKEN_NAME = "Token"
+    VERIFICATION_METHOD = VerificationMethod.NONE
+
+    MESSAGE_OK = "Message was received."
+    MESSAGE_TOKEN_ERROR = "Incorrect token in header."
+
+    endpoint_id = models.CharField(
+        max_length=255,
+        verbose_name=_('Endpoint'),
+        help_text=_('Endpoint at which this webhook is received'),
+        default=uuid.uuid4,
+        editable=False,
+    )
+
+    name = models.CharField(
+        max_length=255,
+        blank=True, null=True,
+        verbose_name=_('Name'),
+        help_text=_('Name for this webhook')
+    )
+
+    active = models.BooleanField(
+        default=True,
+        verbose_name=_('Active'),
+        help_text=_('Is this webhook active')
+    )
+
+    user = models.ForeignKey(
+        User,
+        on_delete=models.SET_NULL,
+        blank=True, null=True,
+        verbose_name=_('User'),
+        help_text=_('User'),
+    )
+
+    token = models.CharField(
+        max_length=255,
+        blank=True, null=True,
+        verbose_name=_('Token'),
+        help_text=_('Token for access'),
+        default=uuid.uuid4,
+    )
+
+    secret = models.CharField(
+        max_length=255,
+        blank=True, null=True,
+        verbose_name=_('Secret'),
+        help_text=_('Shared secret for HMAC'),
+    )
+
+    # To be overridden
+
+    def init(self, request, *args, **kwargs):
+        self.verify = self.VERIFICATION_METHOD
+
+    def process_webhook(self):
+        if self.token:
+            self.token = self.token
+            self.verify = VerificationMethod.TOKEN
+            # TODO make a object-setting
+        if self.secret:
+            self.secret = self.secret
+            self.verify = VerificationMethod.HMAC
+            # TODO make a object-setting
+        return True
+
+    def validate_token(self, payload, headers, request):
+        token = headers.get(self.TOKEN_NAME, "")
+
+        # no token
+        if self.verify == VerificationMethod.NONE:
+            pass
+
+        # static token
+        elif self.verify == VerificationMethod.TOKEN:
+            if not compare_digest(token, self.token):
+                raise PermissionDenied(self.MESSAGE_TOKEN_ERROR)
+
+        # hmac token
+        elif self.verify == VerificationMethod.HMAC:
+            digest = hmac.new(self.secret.encode('utf-8'), request.body, hashlib.sha256).digest()
+            computed_hmac = base64.b64encode(digest)
+            if not hmac.compare_digest(computed_hmac, token.encode('utf-8')):
+                raise PermissionDenied(self.MESSAGE_TOKEN_ERROR)
+
+        return True
+
+    def save_data(self, payload, headers=None, request=None):
+        return WebhookMessage.objects.create(
+            host=request.get_host(),
+            header=json.dumps({key: val for key, val in headers.items()}),
+            body=payload,
+            endpoint=self,
+        )
+
+    def process_payload(self, message, payload=None, headers=None):
+        return True
+
+    def get_return(self, payload, headers=None, request=None):
+        return self.MESSAGE_OK
+
+
+class WebhookMessage(models.Model):
+    """ Defines a webhook message
+
+    Attributes:
+        message_id: Unique identifier for this message,
+        host: Host from which this message was received,
+        header: Header of this message,
+        body: Body of this message,
+        endpoint: Endpoint on which this message was received,
+        worked_on: Was the work on this message finished?
+    """
+
+    message_id = models.UUIDField(
+        verbose_name=_('Message ID'),
+        help_text=_('Unique identifier for this message'),
+        primary_key=True,
+        default=uuid.uuid4,
+        editable=False,
+    )
+
+    host = models.CharField(
+        max_length=255,
+        verbose_name=_('Host'),
+        help_text=_('Host from which this message was received'),
+        editable=False,
+    )
+
+    header = models.CharField(
+        max_length=255,
+        blank=True, null=True,
+        verbose_name=_('Header'),
+        help_text=_('Header of this message'),
+        editable=False,
+    )
+
+    body = models.JSONField(
+        blank=True, null=True,
+        verbose_name=_('Body'),
+        help_text=_('Body of this message'),
+        editable=False,
+    )
+
+    endpoint = models.ForeignKey(
+        WebhookEndpoint,
+        on_delete=models.SET_NULL,
+        blank=True, null=True,
+        verbose_name=_('Endpoint'),
+        help_text=_('Endpoint on which this message was received'),
+    )
+
+    worked_on = models.BooleanField(
+        default=False,
+        verbose_name=_('Worked on'),
+        help_text=_('Was the work on this message finished?'),
+    )
+
+
 class NotificationEntry(models.Model):
     """
     A NotificationEntry records the last time a particular notifaction was sent out.

InvenTree/common/tests.py

@@ -1,13 +1,14 @@
 # -*- coding: utf-8 -*-
 from __future__ import unicode_literals
-
+from http import HTTPStatus
+import json
 from datetime import timedelta
 
-from django.test import TestCase
+from django.test import TestCase, Client
 from django.contrib.auth import get_user_model
 
-from .models import InvenTreeSetting
-from .models import NotificationEntry
+from .models import InvenTreeSetting, WebhookEndpoint, WebhookMessage, NotificationEntry
+from .api import WebhookView
 
 
 class SettingsTest(TestCase):
@@ -49,9 +50,9 @@ class SettingsTest(TestCase):
         - Ensure that every global setting has a description.
         """
 
-        for key in InvenTreeSetting.GLOBAL_SETTINGS.keys():
+        for key in InvenTreeSetting.SETTINGS.keys():
 
-            setting = InvenTreeSetting.GLOBAL_SETTINGS[key]
+            setting = InvenTreeSetting.SETTINGS[key]
 
             name = setting.get('name', None)
 
@@ -64,14 +65,14 @@ class SettingsTest(TestCase):
                 raise ValueError(f'Missing GLOBAL_SETTING description for {key}')
 
             if not key == key.upper():
-                raise ValueError(f"GLOBAL_SETTINGS key '{key}' is not uppercase")
+                raise ValueError(f"SETTINGS key '{key}' is not uppercase")
 
     def test_defaults(self):
         """
         Populate the settings with default values
         """
 
-        for key in InvenTreeSetting.GLOBAL_SETTINGS.keys():
+        for key in InvenTreeSetting.SETTINGS.keys():
 
             value = InvenTreeSetting.get_setting_default(key)
 
@@ -90,7 +91,119 @@ class SettingsTest(TestCase):
                     raise ValueError(f'Non-boolean default value specified for {key}')
 
 
-class NotificationEntryTest(TestCase):
+class WebhookMessageTests(TestCase):
+    def setUp(self):
+        self.endpoint_def = WebhookEndpoint.objects.create()
+        self.url = f'/api/webhook/{self.endpoint_def.endpoint_id}/'
+        self.client = Client(enforce_csrf_checks=True)
+
+    def test_bad_method(self):
+        response = self.client.get(self.url)
+
+        assert response.status_code == HTTPStatus.METHOD_NOT_ALLOWED
+
+    def test_missing_token(self):
+        response = self.client.post(
+            self.url,
+            content_type='application/json',
+        )
+
+        assert response.status_code == HTTPStatus.FORBIDDEN
+        assert (
+            json.loads(response.content)['detail'] == WebhookView.model_class.MESSAGE_TOKEN_ERROR
+        )
+
+    def test_bad_token(self):
+        response = self.client.post(
+            self.url,
+            content_type='application/json',
+            **{'HTTP_TOKEN': '1234567fghj'},
+        )
+
+        assert response.status_code == HTTPStatus.FORBIDDEN
+        assert (json.loads(response.content)['detail'] == WebhookView.model_class.MESSAGE_TOKEN_ERROR)
+
+    def test_bad_url(self):
+        response = self.client.post(
+            '/api/webhook/1234/',
+            content_type='application/json',
+        )
+
+        assert response.status_code == HTTPStatus.NOT_FOUND
+
+    def test_bad_json(self):
+        response = self.client.post(
+            self.url,
+            data="{'this': 123}",
+            content_type='application/json',
+            **{'HTTP_TOKEN': str(self.endpoint_def.token)},
+        )
+
+        assert response.status_code == HTTPStatus.NOT_ACCEPTABLE
+        assert (
+            json.loads(response.content)['detail'] == 'Expecting property name enclosed in double quotes'
+        )
+
+    def test_success_no_token_check(self):
+        # delete token
+        self.endpoint_def.token = ''
+        self.endpoint_def.save()
+
+        # check
+        response = self.client.post(
+            self.url,
+            content_type='application/json',
+        )
+
+        assert response.status_code == HTTPStatus.OK
+        assert str(response.content, 'utf-8') == WebhookView.model_class.MESSAGE_OK
+
+    def test_bad_hmac(self):
+        # delete token
+        self.endpoint_def.token = ''
+        self.endpoint_def.secret = '123abc'
+        self.endpoint_def.save()
+
+        # check
+        response = self.client.post(
+            self.url,
+            content_type='application/json',
+        )
+
+        assert response.status_code == HTTPStatus.FORBIDDEN
+        assert (json.loads(response.content)['detail'] == WebhookView.model_class.MESSAGE_TOKEN_ERROR)
+
+    def test_success_hmac(self):
+        # delete token
+        self.endpoint_def.token = ''
+        self.endpoint_def.secret = '123abc'
+        self.endpoint_def.save()
+
+        # check
+        response = self.client.post(
+            self.url,
+            content_type='application/json',
+            **{'HTTP_TOKEN': str('68MXtc/OiXdA5e2Nq9hATEVrZFpLb3Zb0oau7n8s31I=')},
+        )
+
+        assert response.status_code == HTTPStatus.OK
+        assert str(response.content, 'utf-8') == WebhookView.model_class.MESSAGE_OK
+
+    def test_success(self):
+        response = self.client.post(
+            self.url,
+            data={"this": "is a message"},
+            content_type='application/json',
+            **{'HTTP_TOKEN': str(self.endpoint_def.token)},
+        )
+
+        assert response.status_code == HTTPStatus.OK
+        assert str(response.content, 'utf-8') == WebhookView.model_class.MESSAGE_OK
+        message = WebhookMessage.objects.get()
+        assert message.body == {"this": "is a message"}
+
+
+class NotificationTest(TestCase):
 
     def test_check_notification_entries(self):