webhook_server.py

"""
Webhook server to receive alerts from monitoring tools.
Supports Datadog, PagerDuty, Grafana, and generic webhooks.
"""

import json
import logging
from datetime import datetime
from typing import Optional
from flask import Flask, request, jsonify

from config import settings
from orchestrator import Orchestrator
from integrations_config import integrations

# Configure logging
logging.basicConfig(level=logging.INFO)
logger = logging.getLogger(__name__)

app = Flask(__name__)

# Global orchestrator instance
orchestrator = Orchestrator(verbose=True, parallel=True)


def parse_datadog_alert(payload: dict) -> str:
    """Parses Datadog webhook payload into alert string."""
    
    event_type = payload.get("event_type", "alert")
    title = payload.get("title", "Unknown Alert")
    body = payload.get("body", "")
    tags = payload.get("tags", [])
    
    # Extract service from tags
    service = "unknown"
    for tag in tags:
        if tag.startswith("service:"):
            service = tag.split(":")[1]
            break
    
    alert = f"""
[{event_type.upper()}] {title}
Service: {service}
Start: {datetime.now().strftime("%H:%M %Z")}
Environment: production

Details:
{body}

Tags: {', '.join(tags)}
    """
    
    return alert.strip()


def parse_pagerduty_alert(payload: dict) -> str:
    """Parses PagerDuty webhook payload into alert string."""
    
    messages = payload.get("messages", [])
    if not messages:
        return "Unknown PagerDuty alert"
    
    incident = messages[0].get("incident", {})
    
    title = incident.get("title", "Unknown Incident")
    urgency = incident.get("urgency", "high")
    service = incident.get("service", {}).get("name", "unknown")
    description = incident.get("description", "")
    
    alert = f"""
[{urgency.upper()}] {title}
Service: {service}
Start: {datetime.now().strftime("%H:%M %Z")}
Environment: production

Description:
{description}
    """
    
    return alert.strip()


def parse_grafana_alert(payload: dict) -> str:
    """Parses Grafana webhook payload into alert string."""
    
    state = payload.get("state", "alerting")
    title = payload.get("title", "Unknown Alert")
    message = payload.get("message", "")
    rule_name = payload.get("ruleName", "")
    
    # Extract tags/labels
    tags = payload.get("tags", {})
    service = tags.get("service", "unknown")
    
    alert = f"""
[{state.upper()}] {title}
Rule: {rule_name}
Service: {service}
Start: {datetime.now().strftime("%H:%M %Z")}
Environment: production

Message:
{message}
    """
    
    return alert.strip()


def parse_opsgenie_alert(payload: dict) -> str:
    """Parses OpsGenie webhook payload into alert string."""
    
    alert_data = payload.get("alert", {})
    
    message = alert_data.get("message", "Unknown Alert")
    priority = alert_data.get("priority", "P1")
    source = alert_data.get("source", "unknown")
    description = alert_data.get("description", "")
    
    # Extract tags
    tags = alert_data.get("tags", [])
    service = "unknown"
    for tag in tags:
        if tag.startswith("service:"):
            service = tag.split(":")[1]
            break
    
    alert = f"""
[{priority}] {message}
Service: {service}
Source: {source}
Start: {datetime.now().strftime("%H:%M %Z")}
Environment: production

Description:
{description}
    """
    
    return alert.strip()


def parse_sentry_alert(payload: dict) -> str:
    """Parses Sentry webhook payload into alert string."""
    
    # Sentry sends different event types
    action = payload.get("action", "created")
    data = payload.get("data", {})
    
    # Handle issue alerts
    if "issue" in data:
        issue = data.get("issue", {})
        event = data.get("event", {})
        
        title = issue.get("title", "Unknown Error")
        culprit = issue.get("culprit", "")
        level = issue.get("level", "error")
        count = issue.get("count", 1)
        project = issue.get("project", {}).get("name", "unknown")
        
        # Extract stack trace info
        stack_info = ""
        if event:
            entries = event.get("entries", [])
            for entry in entries:
                if entry.get("type") == "exception":
                    exceptions = entry.get("data", {}).get("values", [])
                    if exceptions:
                        exc = exceptions[0]
                        exc_type = exc.get("type", "")
                        exc_value = exc.get("value", "")
                        frames = exc.get("stacktrace", {}).get("frames", [])
                        if frames:
                            last_frame = frames[-1]
                            filename = last_frame.get("filename", "")
                            line_no = last_frame.get("lineNo", "")
                            function = last_frame.get("function", "")
                            stack_info = f"""
Exception: {exc_type}: {exc_value}
Location: {filename}:{line_no} in {function}
"""
        
        # Extract release if available
        release = event.get("release", "")
        if isinstance(release, dict):
            release = release.get("version", "")
        
        # Extract tags
        tags = issue.get("tags", [])
        tag_str = ", ".join([f"{t['key']}:{t['value']}" for t in tags[:5]]) if tags else ""
        
        alert = f"""
[{level.upper()}] {title}
Service: {project}
Culprit: {culprit}
Occurrences: {count}
Start: {datetime.now().strftime("%H:%M %Z")}
Environment: production
Release: {release}
{stack_info}
Tags: {tag_str}
        """
        
        return alert.strip()
    
    # Handle metric alerts
    elif "metric_alert" in data:
        metric_alert = data.get("metric_alert", {})
        title = metric_alert.get("title", "Metric Alert")
        
        alert = f"""
[METRIC ALERT] {title}
Start: {datetime.now().strftime("%H:%M %Z")}
Environment: production
        """
        
        return alert.strip()
    
    # Fallback for unknown format
    return f"[SENTRY] Unknown alert format: {json.dumps(payload)[:200]}"


def parse_generic_alert(payload: dict) -> str:
    """Parses generic webhook payload into alert string."""
    
    # Try common fields
    title = payload.get("title") or payload.get("name") or payload.get("message") or "Unknown Alert"
    service = payload.get("service") or payload.get("source") or "unknown"
    severity = payload.get("severity") or payload.get("priority") or payload.get("level") or "alert"
    description = payload.get("description") or payload.get("body") or payload.get("text") or ""
    
    alert = f"""
[{severity.upper()}] {title}
Service: {service}
Start: {datetime.now().strftime("%H:%M %Z")}
Environment: production

Description:
{description}
    """
    
    return alert.strip()


@app.route("/health", methods=["GET"])
def health():
    """Health check endpoint."""
    return jsonify({
        "status": "healthy",
        "timestamp": datetime.now().isoformat()
    })


@app.route("/webhook/datadog", methods=["POST"])
def webhook_datadog():
    """Receives webhooks from Datadog."""
    
    try:
        payload = request.json
        logger.info(f"Received Datadog webhook: {json.dumps(payload)[:200]}")
        
        alert = parse_datadog_alert(payload)
        
        # Run investigation
        report = orchestrator.investigate(alert)
        
        return jsonify({
            "status": "processed",
            "alert_source": "datadog",
            "report_preview": report[:500]
        })
        
    except Exception as e:
        logger.error(f"Error processing Datadog webhook: {e}")
        return jsonify({"error": str(e)}), 500


@app.route("/webhook/pagerduty", methods=["POST"])
def webhook_pagerduty():
    """Receives webhooks from PagerDuty."""
    
    try:
        payload = request.json
        logger.info(f"Received PagerDuty webhook: {json.dumps(payload)[:200]}")
        
        alert = parse_pagerduty_alert(payload)
        
        # Run investigation
        report = orchestrator.investigate(alert)
        
        return jsonify({
            "status": "processed",
            "alert_source": "pagerduty",
            "report_preview": report[:500]
        })
        
    except Exception as e:
        logger.error(f"Error processing PagerDuty webhook: {e}")
        return jsonify({"error": str(e)}), 500


@app.route("/webhook/grafana", methods=["POST"])
def webhook_grafana():
    """Receives webhooks from Grafana."""
    
    try:
        payload = request.json
        logger.info(f"Received Grafana webhook: {json.dumps(payload)[:200]}")
        
        alert = parse_grafana_alert(payload)
        
        # Run investigation
        report = orchestrator.investigate(alert)
        
        return jsonify({
            "status": "processed",
            "alert_source": "grafana",
            "report_preview": report[:500]
        })
        
    except Exception as e:
        logger.error(f"Error processing Grafana webhook: {e}")
        return jsonify({"error": str(e)}), 500


@app.route("/webhook/opsgenie", methods=["POST"])
def webhook_opsgenie():
    """Receives webhooks from OpsGenie."""
    
    try:
        payload = request.json
        logger.info(f"Received OpsGenie webhook: {json.dumps(payload)[:200]}")
        
        alert = parse_opsgenie_alert(payload)
        
        # Run investigation
        report = orchestrator.investigate(alert)
        
        return jsonify({
            "status": "processed",
            "alert_source": "opsgenie",
            "report_preview": report[:500]
        })
        
    except Exception as e:
        logger.error(f"Error processing OpsGenie webhook: {e}")
        return jsonify({"error": str(e)}), 500


@app.route("/webhook/sentry", methods=["POST"])
def webhook_sentry():
    """Receives webhooks from Sentry."""
    
    try:
        payload = request.json
        logger.info(f"Received Sentry webhook: {json.dumps(payload)[:200]}")
        
        # Sentry sends a verification request on setup
        if payload.get("action") == "verification":
            return jsonify({"status": "ok"})
        
        alert = parse_sentry_alert(payload)
        
        # Run investigation
        report = orchestrator.investigate(alert)
        
        return jsonify({
            "status": "processed",
            "alert_source": "sentry",
            "report_preview": report[:500]
        })
        
    except Exception as e:
        logger.error(f"Error processing Sentry webhook: {e}")
        return jsonify({"error": str(e)}), 500


@app.route("/webhook", methods=["POST"])
def webhook_generic():
    """Receives generic webhooks."""
    
    try:
        payload = request.json
        logger.info(f"Received generic webhook: {json.dumps(payload)[:200]}")
        
        alert = parse_generic_alert(payload)
        
        # Run investigation
        report = orchestrator.investigate(alert)
        
        return jsonify({
            "status": "processed",
            "alert_source": "generic",
            "report_preview": report[:500]
        })
        
    except Exception as e:
        logger.error(f"Error processing generic webhook: {e}")
        return jsonify({"error": str(e)}), 500


@app.route("/analyze", methods=["POST"])
def analyze_manual():
    """Manual analysis endpoint - accepts raw alert text."""
    
    try:
        payload = request.json
        alert = payload.get("alert", "")
        
        if not alert:
            return jsonify({"error": "Missing 'alert' field"}), 400
        
        logger.info(f"Manual analysis requested: {alert[:100]}")
        
        # Run investigation
        report = orchestrator.investigate(alert)
        
        return jsonify({
            "status": "processed",
            "report": report
        })
        
    except Exception as e:
        logger.error(f"Error in manual analysis: {e}")
        return jsonify({"error": str(e)}), 500


def run_server(host: str = "0.0.0.0", port: int = 8080, debug: bool = False):
    """Runs the webhook server."""
    
    logger.info(f"Starting webhook server on {host}:{port}")
    logger.info("Available endpoints:")
    logger.info("  GET  /health           - Health check")
    logger.info("  POST /webhook/sentry   - Sentry webhooks")
    logger.info("  POST /webhook/datadog  - Datadog webhooks")
    logger.info("  POST /webhook/pagerduty - PagerDuty webhooks")
    logger.info("  POST /webhook/grafana  - Grafana webhooks")
    logger.info("  POST /webhook/opsgenie - OpsGenie webhooks")
    logger.info("  POST /webhook          - Generic webhooks")
    logger.info("  POST /analyze          - Manual analysis")
    
    app.run(host=host, port=port, debug=debug)


if __name__ == "__main__":
    import argparse
    
    parser = argparse.ArgumentParser(description="Anomaly Analysis Webhook Server")
    parser.add_argument("--host", default="0.0.0.0", help="Host to bind")
    parser.add_argument("--port", type=int, default=8080, help="Port to bind")
    parser.add_argument("--debug", action="store_true", help="Enable debug mode")
    
    args = parser.parse_args()
    
    run_server(host=args.host, port=args.port, debug=args.debug)