feat(webhooks): manage inbound receiver lifecycle (#95)

Author: phucnguyen1707

app/api/projects/[id]/inbound-webhooks/[receiverId]/route.ts

@@ -0,0 +1,40 @@
+import { NextRequest, NextResponse } from "next/server";
+import { requireUser, unauthorized, bad } from "@/lib/api";
+import { authorizeProject } from "@/lib/authz";
+import {
+  deleteProjectInboundWebhook,
+  setProjectInboundWebhookActive,
+} from "@/lib/db";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+type Params = { params: Promise<{ id: string; receiverId: string }> };
+
+export async function PATCH(req: NextRequest, ctx: Params) {
+  const u = await requireUser(req);
+  if (!u) return unauthorized();
+  const { id: projectId, receiverId } = await ctx.params;
+  const az = await authorizeProject(u.sub, projectId, "webhook.manage");
+  if (!az.ok) return bad(az.error, az.status);
+
+  const body = await req.json().catch(() => null);
+  if (!body || typeof body.active !== "boolean") {
+    return bad("active must be a boolean");
+  }
+  const ok = await setProjectInboundWebhookActive(receiverId, projectId, body.active);
+  if (!ok) return bad("Inbound webhook receiver not found", 404);
+  return NextResponse.json({ ok: true, id: receiverId, active: body.active });
+}
+
+export async function DELETE(req: NextRequest, ctx: Params) {
+  const u = await requireUser(req);
+  if (!u) return unauthorized();
+  const { id: projectId, receiverId } = await ctx.params;
+  const az = await authorizeProject(u.sub, projectId, "webhook.manage");
+  if (!az.ok) return bad(az.error, az.status);
+
+  const ok = await deleteProjectInboundWebhook(receiverId, projectId);
+  if (!ok) return bad("Inbound webhook receiver not found", 404);
+  return NextResponse.json({ ok: true, id: receiverId });
+}

lib/db.ts

@@ -712,6 +712,39 @@ export async function deleteProjectWebhook(id: string, projectId: string): Promi
   return Number(r.rowsAffected || 0) > 0;
 }
 
+/** Pause or resume one inbound receiver without rotating its shared secret. */
+export async function setProjectInboundWebhookActive(
+  id: string,
+  projectId: string,
+  active: boolean,
+): Promise<boolean> {
+  await ensureSchema();
+  const r = await db().execute({
+    sql: `UPDATE inbound_webhooks SET active = ? WHERE id = ? AND project_id = ?`,
+    args: [active ? 1 : 0, id, projectId],
+  });
+  return Number(r.rowsAffected || 0) > 0;
+}
+
+/** Delete one inbound receiver and its idempotency/event history. */
+export async function deleteProjectInboundWebhook(id: string, projectId: string): Promise<boolean> {
+  await ensureSchema();
+  const [, receiverDelete] = await db().batch([
+    {
+      sql: `DELETE FROM inbound_events
+            WHERE inbound_id IN (
+              SELECT id FROM inbound_webhooks WHERE id = ? AND project_id = ?
+            )`,
+      args: [id, projectId],
+    },
+    {
+      sql: `DELETE FROM inbound_webhooks WHERE id = ? AND project_id = ?`,
+      args: [id, projectId],
+    },
+  ], "write");
+  return Number(receiverDelete.rowsAffected || 0) > 0;
+}
+
 /** Deletes a project and its webhook config/history (SQLite has no cascade). */
 export async function deleteProject(id: string): Promise<void> {
   await ensureSchema();

tests/project-inbound-webhook-management.test.mjs

@@ -0,0 +1,96 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+process.env.TURSO_DATABASE_URL = "file::memory:";
+
+const {
+  db,
+  deleteProjectInboundWebhook,
+  ensureSchema,
+  setProjectInboundWebhookActive,
+} = await import("../lib/db.ts");
+
+await ensureSchema();
+
+async function insertReceiver(projectId, suffix) {
+  const id = `receiver-${suffix}`;
+  await db().execute({
+    sql: `INSERT INTO inbound_webhooks (id, project_id, provider, secret)
+          VALUES (?, ?, ?, ?)`,
+    args: [id, projectId, `provider-${suffix}`, `whrcv_${suffix}`],
+  });
+  return id;
+}
+
+test("inbound receivers pause and resume without losing configuration", async () => {
+  const id = await insertReceiver("project-pause", "pause");
+
+  assert.equal(await setProjectInboundWebhookActive(id, "project-pause", false), true);
+  const paused = await db().execute({
+    sql: `SELECT provider, secret, active FROM inbound_webhooks WHERE id = ?`,
+    args: [id],
+  });
+  assert.deepEqual(
+    {
+      provider: String(paused.rows[0].provider),
+      secret: String(paused.rows[0].secret),
+      active: Number(paused.rows[0].active),
+    },
+    { provider: "provider-pause", secret: "whrcv_pause", active: 0 },
+  );
+
+  assert.equal(await setProjectInboundWebhookActive(id, "project-pause", true), true);
+  const resumed = await db().execute({
+    sql: `SELECT active FROM inbound_webhooks WHERE id = ?`,
+    args: [id],
+  });
+  assert.equal(Number(resumed.rows[0].active), 1);
+});
+
+test("project scoping prevents cross-project receiver changes", async () => {
+  const id = await insertReceiver("project-owner", "scoped");
+  await db().execute({
+    sql: `INSERT INTO inbound_events
+            (id, inbound_id, provider, idempotency_key, status)
+          VALUES (?, ?, ?, ?, 'accepted')`,
+    args: ["inbound-event-scoped", id, "provider-scoped", "event-scoped"],
+  });
+
+  assert.equal(await setProjectInboundWebhookActive(id, "project-other", false), false);
+  assert.equal(await deleteProjectInboundWebhook(id, "project-other"), false);
+
+  const receiver = await db().execute({
+    sql: `SELECT active FROM inbound_webhooks WHERE id = ?`,
+    args: [id],
+  });
+  assert.equal(Number(receiver.rows[0].active), 1);
+  const events = await db().execute({
+    sql: `SELECT 1 FROM inbound_events WHERE inbound_id = ?`,
+    args: [id],
+  });
+  assert.equal(events.rows.length, 1);
+});
+
+test("deleting an inbound receiver also deletes its event history", async () => {
+  const id = await insertReceiver("project-delete", "delete");
+  await db().execute({
+    sql: `INSERT INTO inbound_events
+            (id, inbound_id, provider, idempotency_key, status)
+          VALUES (?, ?, ?, ?, 'accepted')`,
+    args: ["inbound-event-delete", id, "provider-delete", "event-delete"],
+  });
+
+  assert.equal(await deleteProjectInboundWebhook(id, "project-delete"), true);
+  assert.equal(await deleteProjectInboundWebhook(id, "project-delete"), false);
+
+  const receivers = await db().execute({
+    sql: `SELECT 1 FROM inbound_webhooks WHERE id = ?`,
+    args: [id],
+  });
+  const events = await db().execute({
+    sql: `SELECT 1 FROM inbound_events WHERE inbound_id = ?`,
+    args: [id],
+  });
+  assert.equal(receivers.rows.length, 0);
+  assert.equal(events.rows.length, 0);
+});