Hook'lar

  istek  →  guardrail  →  dry-run  →  HOOK (stage: plan)
                                          │
                                          ├─ deny     → plan DENIED, onay kartı hiç doğmaz
                                          ├─ elevate  → onay kartı "kaynağın adını yaz" ister
                                          └─ allow    → onay kartı açılır
                                                          │
                                             kullanıcı onaya basar
                                                          │
                                                       HOOK (stage: approve)
                                                          │
                                          ┌───────────────┴─ deny → 409, plan BEKLEMEDE kalır
                                          │
                                        apply
                                          │
                                       HOOK (stage: notify)  ← kuyruktan, asenkron

{
  "schemaVersion": 1,
  "hookId": "change-board",
  "deliveryId": "6f1c9d84-2b77-4a51-9e0e-7a2f1c0d8b33",
  "stage": "plan",
  "plan": {
    "id": "op-01KZGTWSG5WSSR8PDZ35",
    "clusterId": "c-3",
    "source": "ui",
    "createdAt": "2026-08-08T14:02:09.144Z",
    "actor":    { "userId": "u-2", "username": "deniz" },
    "identity": { "user": "deniz", "groups": ["platform"] },
    "origins": [
      { "method": "PATCH", "path": "/apis/apps/v1/namespaces/uretim/deployments/api" }
    ],
    "steps": [
      {
        "target": {
          "schemaId": "apps/v1/Deployment", "group": "apps", "version": "v1",
          "kind": "Deployment", "resource": "deployments",
          "namespaced": true, "namespace": "uretim", "name": "api",
          "subresource": null, "uid": "9c1…", "resourceVersion": "122835"
        },
        "classification": { "severity": "mutating", "flags": ["owner-managed"] },
        "changedPaths": ["/spec/replicas"],
        "dryRun": { "status": "ok" }
      }
    ],
    "policy": {
      "verdict": "allow",
      "approvalLevel": "standard",
      "matches": [
        { "policyId": "uretim.replica-tavani", "effect": "allow", "message": null }
      ]
    }
  }
}

{
  "schemaVersion": 1,
  "hookId": "slack-kanali",
  "deliveryId": "b3d0…",
  "stage": "notify",
  "event": { "type": "plan.applied", "ts": "2026-08-08T14:02:14.881Z" },
  "operation": {
    "id": "op-01KZGTWSG5WSSR8PDZ35",
    "clusterId": "c-3",
    "source": "ui",
    "revertOf": null,
    "actor":    { "userId": "u-2", "username": "deniz" },
    "identity": { "user": "deniz", "groups": ["platform"] },
    "origins": [ { "method": "PATCH", "path": "/apis/apps/v1/…" } ],
    "steps":   [ { "target": { … }, "classification": { … }, "changedPaths": ["/spec/replicas"] } ],
    "result": {
      "state": "APPLIED",
      "stepsApplied": 1,
      "appliedAt": "2026-08-08T14:02:14.702Z",
      "reason": null
    }
  }
}

HTTP/1.1 200 OK
content-type: application/json

{ "verdict": "deny", "reason": "CHG-0042 kapalı — açık change kaydı yok" }

// Node.js — express, ham gövde ile
import { createHmac, timingSafeEqual } from "node:crypto";

app.post("/yeke/hook", express.raw({ type: "application/json" }), (req, res) => {
  const expected = createHmac("sha256", process.env.YEKE_HOOK_SECRET)
    .update(req.body)                      // Buffer — ayrıştırılmamış hâli
    .digest("hex");
  const got = req.get("x-yeke-signature-256") ?? "";

  // Uzunluk eşit değilse timingSafeEqual FIRLATIR; önce onu ele.
  if (got.length !== expected.length ||
      !timingSafeEqual(Buffer.from(got), Buffer.from(expected))) {
    return res.status(401).json({ error: "bad signature" });
  }

  const body = JSON.parse(req.body.toString("utf8"));
  res.json({ verdict: "allow" });
});

# Python — Flask
import hmac, hashlib, os
from flask import request, jsonify

@app.post("/yeke/hook")
def yeke_hook():
    raw = request.get_data()               # bytes, ayrıştırılmamış
    expected = hmac.new(os.environ["YEKE_HOOK_SECRET"].encode(),
                        raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, request.headers.get("x-yeke-signature-256", "")):
        return jsonify(error="bad signature"), 401

    body = request.get_json()
    return jsonify(verdict="allow")

YEKE_HOOK_ALLOWED_HOSTS=itsm.ic.ornek.com,change-board

// node yeke-hook.mjs — :8787/hook (doğrulama) ve :8787/notify (bildirim)
import { createServer } from "node:http";
import { createHmac, timingSafeEqual } from "node:crypto";

const SECRET = process.env.YEKE_HOOK_SECRET;
const seen = new Set();                    // idempotency: deliveryId

const read = async (req) => {
  const chunks = [];
  for await (const c of req) chunks.push(c);
  return Buffer.concat(chunks);
};

const signatureOk = (raw, header) => {
  if (!SECRET) return true;                // sır yoksa imza da yok
  const expected = createHmac("sha256", SECRET).update(raw).digest("hex");
  const got = header ?? "";
  return got.length === expected.length &&
         timingSafeEqual(Buffer.from(got), Buffer.from(expected));
};

createServer(async (req, res) => {
  const raw = await read(req);
  const json = (code, payload) => {
    res.writeHead(code, { "content-type": "application/json" });
    res.end(JSON.stringify(payload));
  };

  if (!signatureOk(raw, req.headers["x-yeke-signature-256"])) {
    return json(401, { error: "bad signature" });
  }

  const body = JSON.parse(raw.toString("utf8") || "{}");

  // ── doğrulama ────────────────────────────────────────────────
  if (req.url === "/hook") {
    // Sınama çağrısında plan YOK; ulaşılabilirlik ölçülüyor.
    if (body.stage === "test") return json(200, { verdict: "allow" });

    // Karar YALNIZCA dışarının bildiği bir şeye dayanmalı.
    const ns = body.plan?.steps?.[0]?.target?.namespace;
    const ticket = await acikChangeKaydi(ns);          // ← sizin ITSM'iniz

    return ticket
      ? json(200, { verdict: "allow" })
      : json(200, { verdict: "deny",
                    reason: `${ns} için açık change kaydı yok` });
  }

  // ── bildirim ─────────────────────────────────────────────────
  if (req.url === "/notify") {
    // Aynı teslim iki kez gelebilir; yan etki bir kez koşmalı.
    if (!seen.has(body.deliveryId)) {
      seen.add(body.deliveryId);
      await kanalaYaz(body.event.type, body.operation);   // ← sizin Slack'iniz
    }
    res.writeHead(204).end();                // 2xx = teslim alındı
    return;
  }

  json(404, { error: "not found" });
}).listen(8787);