@ameshkin/ticket-mate 0.1.20

package/public/webhooks/webhook-handler.js

@@ -0,0 +1,186 @@
+/**
+ * Webhook Handler (Pillar V - JIRA-TICKET-TO-GOVERNANCE)
+
+ *
+ * Processes Jira webhook events
+ */
+import { validateWebhookSecurity, isEventProcessed, markEventProcessed, } from "./webhook-security";
+import { getJiraConfig } from "../config/config";
+import { logger } from "../utils/logger";
+import { getErrorMessage } from "../types/common";
+import { processInProgressWebhook } from "./in-progress-handler";
+import { notifyTicketCreated, notifyTicketUpdated } from "./orchestrator-notifier";
+import { getIssue } from "../client/jira-client";
+/**
+ * Process webhook event
+ */
+export async function processWebhookEvent(body, signature, options) {
+    const config = getJiraConfig();
+    const { handler, validatePayload = true, blockSQLi = true, blockXSS = true, strict = false, skipSignatureVerification = false, } = options || {};
+    // Parse payload first (needed for validation)
+    let payload;
+    try {
+        payload = JSON.parse(typeof body === "string" ? body : body.toString("utf-8"));
+    }
+    catch (error) {
+        logger.error("Failed to parse webhook payload", { error: getErrorMessage(error) });
+        return { processed: false, reason: "Invalid JSON payload" };
+    }
+    const eventId = `${payload.webhookEvent}-${payload.timestamp || Date.now()}`;
+    // Verify signature and validate payload
+    if (config.webhookSecret && !skipSignatureVerification) {
+        const webhookSecret = config.webhookSecret;
+        const securityResult = await validateWebhookSecurity(body, signature || "", webhookSecret, payload, {
+            validatePayload,
+            blockSQLi,
+            blockXSS,
+            strict,
+        });
+        if (!securityResult.valid) {
+            logger.warn("Webhook security validation failed", {
+                signatureValid: securityResult.signatureValid,
+                payloadValid: securityResult.payloadValid,
+                reason: securityResult.reason,
+                threats: securityResult.threats,
+            });
+            return {
+                processed: false,
+                reason: securityResult.reason || "Security validation failed",
+                threats: securityResult.threats,
+            };
+        }
+        // Log any threats detected (even if not blocked)
+        if (securityResult.threats && securityResult.threats.length > 0) {
+            logger.info("Webhook payload threats detected (not blocked)", {
+                threats: securityResult.threats,
+            });
+        }
+    }
+    else if (!config.webhookSecret && !skipSignatureVerification) {
+        logger.warn("Webhook secret not configured, skipping signature verification");
+        // Still validate payload if requested
+        if (validatePayload) {
+            const { validateWebhookPayload } = await import("./webhook-security");
+            const payloadResult = await validateWebhookPayload(payload, {
+                blockSQLi,
+                blockXSS,
+                strict,
+            });
+            if (!payloadResult.valid || payloadResult.blocked) {
+                logger.warn("Webhook payload validation failed", {
+                    threats: payloadResult.threats,
+                });
+                return {
+                    processed: false,
+                    reason: "Payload validation failed",
+                    threats: payloadResult.threats,
+                };
+            }
+        }
+    }
+    // Check idempotency
+    if (await isEventProcessed(eventId)) {
+        logger.info("Event already processed", { eventId });
+        return { processed: false, reason: "Already processed" };
+    }
+    // Process event
+    try {
+        // Notify orchestrator of Jira events (non-blocking)
+        if (payload.issue?.key) {
+            try {
+                const ticket = await getIssue(payload.issue.key);
+                if (payload.webhookEvent === "jira:issue_created") {
+                    await notifyTicketCreated(ticket);
+                    // Create instruction automatically (webhook-driven)
+                    try {
+                        const { writeInstruction } = await import('../utils/instruction-writer');
+                        await writeInstruction(ticket.key, {
+                            issueKey: ticket.key,
+                            summary: ticket.fields.summary || '',
+                            description: typeof ticket.fields.description === "string"
+                                ? ticket.fields.description
+                                : undefined,
+                            status: ticket.fields.status?.name,
+                            assignee: ticket.fields.assignee?.displayName || ticket.fields.assignee?.accountId,
+                            priority: ticket.fields.priority?.name,
+                            labels: ticket.fields.labels || [],
+                            issueType: ticket.fields.issuetype?.name,
+                        });
+                        logger.info('Instruction created from webhook (ticket created)', { issueKey: ticket.key });
+                    }
+                    catch (error) {
+                        logger.warn('Failed to create instruction from webhook', {
+                            issueKey: ticket.key,
+                            error: getErrorMessage(error),
+                        });
+                        // Continue processing even if this fails
+                    }
+                }
+                else if (payload.webhookEvent === "jira:issue_updated") {
+                    // Extract previous status from changelog if available
+                    const previousStatus = payload.changelog?.items?.find((item) => item.field === "status")?.fromString;
+                    await notifyTicketUpdated(ticket, previousStatus);
+                }
+            }
+            catch (error) {
+                logger.warn("Failed to notify orchestrator of Jira event", {
+                    eventId,
+                    error: getErrorMessage(error),
+                });
+                // Continue processing even if orchestrator notification fails
+            }
+        }
+        // TEAMS-003: Route event to Teams subscriptions (non-blocking)
+        try {
+            const { transformToJiraEvent } = await import("../lib/integrations/teams/transformer");
+            const { routeJiraEvent } = await import("../lib/integrations/teams/event-router");
+            // Transform raw payload to standardized event envelope
+            // workspaceId could come from account context if available
+            const teamsEvent = transformToJiraEvent(payload);
+            // Route to matching subscriptions (async, non-blocking)
+            routeJiraEvent(teamsEvent).catch((err) => {
+                logger.warn("[webhook] Teams event routing failed (non-blocking)", {
+                    issueKey: payload.issue?.key,
+                    error: err instanceof Error ? err.message : String(err),
+                });
+            });
+        }
+        catch (teamsError) {
+            logger.warn("[webhook] Failed to initialize Teams event routing", {
+                error: teamsError instanceof Error ? teamsError.message : String(teamsError),
+            });
+            // Continue processing even if Teams routing fails
+        }
+        const inProgressResult = await processInProgressWebhook(payload);
+        if (inProgressResult.handled) {
+            logger.info("In Progress transition handled", {
+                issueKey: payload.issue?.key,
+                result: inProgressResult.result,
+            });
+        }
+        // Call custom handler if provided
+        if (handler) {
+            try {
+                await handler(payload);
+            }
+            catch (error) {
+                logger.error("Custom webhook handler failed", {
+                    eventId,
+                    error: getErrorMessage(error),
+                });
+                // Continue processing even if custom handler fails
+            }
+        }
+        // Mark as processed
+        await markEventProcessed(eventId, payload.webhookEvent, payload.issue?.key || undefined, undefined, payload);
+        logger.info("Webhook event processed", { eventId, eventType: payload.webhookEvent });
+        return { processed: true };
+    }
+    catch (error) {
+        logger.error("Failed to process webhook event", { eventId, error: getErrorMessage(error) });
+        // Mark as processed with error
+        await markEventProcessed(eventId, payload.webhookEvent, payload.issue?.key || undefined, undefined, payload, getErrorMessage(error));
+        return { processed: false, reason: getErrorMessage(error) };
+    }
+}
+//# sourceMappingURL=webhook-handler.js.map

package/public/webhooks/webhook-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-handler.js","sourceRoot":"","sources":["../../src/webhooks/webhook-handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACnF,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAsEjD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAqB,EACrB,SAAwB,EACxB,OAA+B;IAE/B,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,MAAM,EACJ,OAAO,EACP,eAAe,GAAG,IAAI,EACtB,SAAS,GAAG,IAAI,EAChB,QAAQ,GAAG,IAAI,EACf,MAAM,GAAG,KAAK,EACd,yBAAyB,GAAG,KAAK,GAClC,GAAG,OAAO,IAAI,EAAE,CAAC;IAElB,8CAA8C;IAC9C,IAAI,OAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAqB,CAAC;IACrG,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAE7E,wCAAwC;IACxC,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACvD,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QAC3C,MAAM,cAAc,GAAG,MAAM,uBAAuB,CAClD,IAAI,EACJ,SAAS,IAAI,EAAE,EACf,aAAa,EACb,OAAO,EACP;YACE,eAAe;YACf,SAAS;YACT,QAAQ;YACR,MAAM;SACP,CACF,CAAC;QAEF,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;gBAChD,cAAc,EAAE,cAAc,CAAC,cAAc;gBAC7C,YAAY,EAAE,cAAc,CAAC,YAAY;gBACzC,MAAM,EAAE,cAAc,CAAC,MAAM;gBAC7B,OAAO,EAAE,cAAc,CAAC,OAAO;aAChC,CAAC,CAAC;YACH,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,cAAc,CAAC,MAAM,IAAI,4BAA4B;gBAC7D,OAAO,EAAE,cAAc,CAAC,OAAO;aAChC,CAAC;QACJ,CAAC;QAED,iDAAiD;QACjD,IAAI,cAAc,CAAC,OAAO,IAAI,cAAc,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChE,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;gBAC5D,OAAO,EAAE,cAAc,CAAC,OAAO;aAChC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;QAE9E,sCAAsC;QACtC,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;YACtE,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE;gBAC1D,SAAS;gBACT,QAAQ;gBACR,MAAM;aACP,CAAC,CAAC;YAEH,IAAI,CAAC,aAAa,CAAC,KAAK,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;gBAClD,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;oBAC/C,OAAO,EAAE,aAAa,CAAC,OAAO;iBAC/B,CAAC,CAAC;gBACH,OAAO;oBACL,SAAS,EAAE,KAAK;oBAChB,MAAM,EAAE,2BAA2B;oBACnC,OAAO,EAAE,aAAa,CAAC,OAAO;iBAC/B,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,IAAI,MAAM,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC3D,CAAC;IAED,gBAAgB;IAChB,IAAI,CAAC;QACH,oDAAoD;QACpD,IAAI,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAEjD,IAAI,OAAO,CAAC,YAAY,KAAK,oBAAoB,EAAE,CAAC;oBAClD,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;oBAElC,oDAAoD;oBACpD,IAAI,CAAC;wBACH,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;wBACzE,MAAM,gBAAgB,CAAC,MAAM,CAAC,GAAG,EAAE;4BACjC,QAAQ,EAAE,MAAM,CAAC,GAAG;4BACpB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE;4BACpC,WAAW,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ;gCACxD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW;gCAC3B,CAAC,CAAC,SAAS;4BACb,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI;4BAClC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS;4BAClF,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI;4BACtC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE;4BAClC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI;yBACzC,CAAC,CAAC;wBACH,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;oBAC7F,CAAC;oBAAC,OAAO,KAAc,EAAE,CAAC;wBACxB,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE;4BACvD,QAAQ,EAAE,MAAM,CAAC,GAAG;4BACpB,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;yBAC9B,CAAC,CAAC;wBACH,yCAAyC;oBAC3C,CAAC;gBACH,CAAC;qBAAM,IAAI,OAAO,CAAC,YAAY,KAAK,oBAAoB,EAAE,CAAC;oBACzD,sDAAsD;oBACtD,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CACnD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,CAClC,EAAE,UAAU,CAAC;oBACd,MAAM,mBAAmB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE;oBACzD,OAAO;oBACP,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;iBAC9B,CAAC,CAAC;gBACH,8DAA8D;YAChE,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,IAAI,CAAC;YACH,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,uCAAuC,CAAC,CAAC;YACvF,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,wCAAwC,CAAC,CAAC;YAElF,uDAAuD;YACvD,2DAA2D;YAC3D,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;YAEjD,wDAAwD;YACxD,cAAc,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACvC,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE;oBACjE,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG;oBAC5B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE;gBAChE,KAAK,EAAE,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;aAC7E,CAAC,CAAC;YACH,kDAAkD;QACpD,CAAC;QACD,MAAM,gBAAgB,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;QACjE,IAAI,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;gBAC5C,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG;gBAC5B,MAAM,EAAE,gBAAgB,CAAC,MAAM;aAChC,CAAC,CAAC;QACL,CAAC;QAED,kCAAkC;QAClC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE;oBAC5C,OAAO;oBACP,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;iBAC9B,CAAC,CAAC;gBACH,mDAAmD;YACrD,CAAC;QACH,CAAC;QAED,oBAAoB;QACpB,MAAM,kBAAkB,CACtB,OAAO,EACP,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,SAAS,EAC/B,SAAS,EACT,OAAO,CACR,CAAC;QAEF,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;QACrF,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAE5F,+BAA+B;QAC/B,MAAM,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;QAErI,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9D,CAAC;AACH,CAAC"}

package/public/webhooks/webhook-security.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Webhook Security
+ *
+ * Implements webhook signature verification and basic payload validation
+ */
+export interface WebhookSignatureResult {
+    valid: boolean;
+    error?: string;
+}
+export interface PayloadValidationResult {
+    valid: boolean;
+    blocked: boolean;
+    threats?: string[];
+    sanitized?: unknown;
+}
+/**
+ * Check if event has already been processed
+ */
+export declare function isEventProcessed(eventId: string): Promise<boolean>;
+/**
+ * Mark event as processed
+ */
+export declare function markEventProcessed(eventId: string, eventType: string, _issueKey?: string, _ticketId?: string, _payload?: unknown, _error?: unknown): Promise<void>;
+/**
+ * Clear processed events (useful for testing)
+ */
+export declare function clearProcessedEvents(): void;
+/**
+ * Verify webhook signature using HMAC SHA256
+ */
+export declare function verifyWebhookSignature(payload: string | Buffer, signature: string, secret: string): WebhookSignatureResult;
+/**
+ * Validate webhook payload with basic checks
+ *
+ * Performs basic validation: length checks, type validation
+ */
+export declare function validateWebhookPayload(payload: unknown, options?: {
+    blockSQLi?: boolean;
+    blockXSS?: boolean;
+    strict?: boolean;
+}): Promise<PayloadValidationResult>;
+/**
+ * Validate webhook security (signature + payload)
+ */
+export declare function validateWebhookSecurity(body: string | Buffer, signature: string, secret: string, payload: unknown, options?: {
+    validatePayload?: boolean;
+    blockSQLi?: boolean;
+    blockXSS?: boolean;
+    strict?: boolean;
+}): Promise<{
+    valid: boolean;
+    signatureValid: boolean;
+    payloadValid: boolean;
+    blocked: boolean;
+    reason?: string;
+    threats?: string[];
+}>;
+//# sourceMappingURL=webhook-security.d.ts.map

package/public/webhooks/webhook-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-security.d.ts","sourceRoot":"","sources":["../../src/webhooks/webhook-security.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AASD;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAExE;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,OAAO,EAClB,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,CAcf;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,sBAAsB,CAkExB;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,GACA,OAAO,CAAC,uBAAuB,CAAC,CAkHlC;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,GAAG,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE;IACR,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,GACA,OAAO,CAAC;IACT,KAAK,EAAE,OAAO,CAAC;IACf,cAAc,EAAE,OAAO,CAAC;IACxB,YAAY,EAAE,OAAO,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC,CAuDD"}

package/public/webhooks/webhook-security.js

@@ -0,0 +1,258 @@
+/**
+ * Webhook Security
+ *
+ * Implements webhook signature verification and basic payload validation
+ */
+import crypto from "crypto";
+import { logger } from "../utils/logger";
+import { getErrorMessage } from "../types/common";
+/**
+ * Simple in-memory idempotency store
+ *
+ * Note: In production, this should use a database or Redis
+ */
+const processedEvents = new Map();
+/**
+ * Check if event has already been processed
+ */
+export async function isEventProcessed(eventId) {
+    return processedEvents.has(eventId);
+}
+/**
+ * Mark event as processed
+ */
+export async function markEventProcessed(eventId, eventType, _issueKey, _ticketId, _payload, _error) {
+    processedEvents.set(eventId, {
+        timestamp: new Date(),
+        eventType,
+    });
+    // Clean up old events (keep last 1000)
+    if (processedEvents.size > 1000) {
+        const entries = Array.from(processedEvents.entries());
+        entries.sort((a, b) => a[1].timestamp.getTime() - b[1].timestamp.getTime());
+        const toRemove = entries.slice(0, entries.length - 1000);
+        for (const [id] of toRemove) {
+            processedEvents.delete(id);
+        }
+    }
+}
+/**
+ * Clear processed events (useful for testing)
+ */
+export function clearProcessedEvents() {
+    processedEvents.clear();
+}
+/**
+ * Verify webhook signature using HMAC SHA256
+ */
+export function verifyWebhookSignature(payload, signature, secret) {
+    try {
+        if (!secret) {
+            return { valid: false, error: "Webhook secret not configured" };
+        }
+        if (!signature) {
+            return { valid: false, error: "Signature header missing" };
+        }
+        // Extract signature from header (format: "sha256=...")
+        const signatureHash = signature.replace(/^sha256=/, "");
+        // Calculate expected signature
+        const expectedSignature = crypto
+            .createHmac("sha256", secret)
+            .update(payload)
+            .digest("hex");
+        // Validate hex format and length before comparison
+        if (!/^[0-9a-f]+$/i.test(signatureHash)) {
+            logger.warn("Webhook signature is not valid hex", {
+                signature: signatureHash.substring(0, 8) + "...",
+            });
+            return { valid: false, error: "Invalid signature format" };
+        }
+        // Check if lengths match (timingSafeEqual requires same length)
+        if (signatureHash.length !== expectedSignature.length) {
+            logger.warn("Webhook signature length mismatch", {
+                expected: expectedSignature.length,
+                received: signatureHash.length,
+            });
+            return { valid: false, error: "Invalid signature" };
+        }
+        // Compare signatures using constant-time comparison
+        let isValid;
+        try {
+            isValid = crypto.timingSafeEqual(Buffer.from(signatureHash, "hex"), Buffer.from(expectedSignature, "hex"));
+        }
+        catch (error) {
+            logger.error("Error comparing signatures", {
+                error: getErrorMessage(error),
+            });
+            return { valid: false, error: "Signature comparison failed" };
+        }
+        if (!isValid) {
+            logger.warn("Webhook signature verification failed", {
+                expected: expectedSignature.substring(0, 8) + "...",
+                received: signatureHash.substring(0, 8) + "...",
+            });
+            return { valid: false, error: "Invalid signature" };
+        }
+        return { valid: true };
+    }
+    catch (error) {
+        logger.error("Error verifying webhook signature", {
+            error: getErrorMessage(error),
+            stack: error instanceof Error ? error.stack : undefined,
+        });
+        return { valid: false, error: getErrorMessage(error) };
+    }
+}
+/**
+ * Validate webhook payload with basic checks
+ *
+ * Performs basic validation: length checks, type validation
+ */
+export async function validateWebhookPayload(payload, options) {
+    const { strict = false, blockSQLi = true, blockXSS = true, } = options || {};
+    try {
+        // Basic validation: check payload size
+        const payloadString = JSON.stringify(payload);
+        if (payloadString.length > 1000000) { // 1MB limit
+            logger.warn("Webhook payload too large", {
+                size: payloadString.length,
+            });
+            return {
+                valid: false,
+                blocked: true,
+                threats: ["Payload exceeds size limit"],
+            };
+        }
+        // Basic type validation
+        if (payload === null || payload === undefined) {
+            if (strict) {
+                return {
+                    valid: false,
+                    blocked: true,
+                    threats: ["Payload is null or undefined"],
+                };
+            }
+            return { valid: true, blocked: false };
+        }
+        // For objects, check for suspicious patterns (basic checks)
+        if (typeof payload === 'object') {
+            const payloadStr = JSON.stringify(payload);
+            // Basic SQL injection pattern detection (very simple)
+            const sqlPatterns = [
+                /(\b(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|EXEC|EXECUTE)\b)/i,
+                /('|(\\')|(;)|(--)|(\/\*)|(\*\/))/,
+            ];
+            // Basic XSS pattern detection (very simple)
+            const xssPatterns = [
+                /<script[^>]*>/i,
+                /javascript:/i,
+                /on\w+\s*=/i,
+            ];
+            const threats = [];
+            if (options?.blockSQLi) {
+                for (const pattern of sqlPatterns) {
+                    if (pattern.test(payloadStr)) {
+                        threats.push("Potential SQL injection detected");
+                        break;
+                    }
+                }
+            }
+            if (options?.blockXSS) {
+                for (const pattern of xssPatterns) {
+                    if (pattern.test(payloadStr)) {
+                        threats.push("Potential XSS detected");
+                        break;
+                    }
+                }
+            }
+            if (threats.length > 0) {
+                logger.warn("Webhook payload contains suspicious patterns", {
+                    threats,
+                });
+                if (strict) {
+                    return {
+                        valid: false,
+                        blocked: true,
+                        threats,
+                    };
+                }
+                // In non-strict mode, warn but allow
+                return {
+                    valid: true,
+                    blocked: false,
+                    threats,
+                };
+            }
+        }
+        return {
+            valid: true,
+            blocked: false,
+        };
+    }
+    catch (error) {
+        logger.error("Error validating webhook payload", {
+            error: getErrorMessage(error),
+            stack: error instanceof Error ? error.stack : undefined,
+        });
+        // In strict mode, block on validation errors
+        if (strict) {
+            return {
+                valid: false,
+                blocked: true,
+                threats: [getErrorMessage(error)],
+            };
+        }
+        // In non-strict mode, allow on validation errors
+        return { valid: true, blocked: false };
+    }
+}
+/**
+ * Validate webhook security (signature + payload)
+ */
+export async function validateWebhookSecurity(body, signature, secret, payload, options) {
+    const { validatePayload: shouldValidatePayload = true, blockSQLi = true, blockXSS = true, strict = false, } = options || {};
+    // Step 1: Verify signature
+    const signatureResult = verifyWebhookSignature(body, signature, secret);
+    if (!signatureResult.valid) {
+        return {
+            valid: false,
+            signatureValid: false,
+            payloadValid: true, // Not checked yet
+            blocked: true,
+            reason: signatureResult.error || "Invalid webhook signature",
+        };
+    }
+    // Step 2: Validate payload if requested
+    if (shouldValidatePayload) {
+        const payloadResult = await validateWebhookPayload(payload, {
+            blockSQLi,
+            blockXSS,
+            strict,
+        });
+        if (!payloadResult.valid || payloadResult.blocked) {
+            return {
+                valid: false,
+                signatureValid: true,
+                payloadValid: false,
+                blocked: true,
+                reason: "Payload validation failed",
+                threats: payloadResult.threats,
+            };
+        }
+        return {
+            valid: true,
+            signatureValid: true,
+            payloadValid: true,
+            blocked: false,
+            threats: payloadResult.threats,
+        };
+    }
+    // Signature valid, payload validation skipped
+    return {
+        valid: true,
+        signatureValid: true,
+        payloadValid: true, // Not checked, but not required
+        blocked: false,
+    };
+}
+//# sourceMappingURL=webhook-security.js.map

package/public/webhooks/webhook-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-security.js","sourceRoot":"","sources":["../../src/webhooks/webhook-security.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAclD;;;;GAIG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkD,CAAC;AAElF;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAe;IACpD,OAAO,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe,EACf,SAAiB,EACjB,SAAkB,EAClB,SAAkB,EAClB,QAAkB,EAClB,MAAgB;IAEhB,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE;QAC3B,SAAS,EAAE,IAAI,IAAI,EAAE;QACrB,SAAS;KACV,CAAC,CAAC;IACH,uCAAuC;IACvC,IAAI,eAAe,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5E,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QACzD,KAAK,MAAM,CAAC,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC;YAC5B,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,eAAe,CAAC,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAwB,EACxB,SAAiB,EACjB,MAAc;IAEd,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QAClE,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;QAC7D,CAAC;QAED,uDAAuD;QACvD,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAExD,+BAA+B;QAC/B,MAAM,iBAAiB,GAAG,MAAM;aAC7B,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;aAC5B,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC,KAAK,CAAC,CAAC;QAEjB,mDAAmD;QACnD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;gBAChD,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;aACjD,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;QAC7D,CAAC;QAED,gEAAgE;QAChE,IAAI,aAAa,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;YACtD,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;gBAC/C,QAAQ,EAAE,iBAAiB,CAAC,MAAM;gBAClC,QAAQ,EAAE,aAAa,CAAC,MAAM;aAC/B,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QACtD,CAAC;QAED,oDAAoD;QACpD,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,CAAC,eAAe,CAC9B,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,EACjC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,CACtC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE;gBACzC,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;aAC9B,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;QAChE,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE;gBACnD,QAAQ,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;gBACnD,QAAQ,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;aAChD,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QACtD,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE;YAChD,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;YAC7B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SACxD,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAgB,EAChB,OAIC;IAED,MAAM,EACJ,MAAM,GAAG,KAAK,EACd,SAAS,GAAG,IAAI,EAChB,QAAQ,GAAG,IAAI,GAChB,GAAG,OAAO,IAAI,EAAE,CAAC;IAElB,IAAI,CAAC;QACH,uCAAuC;QACvC,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,aAAa,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC,CAAC,YAAY;YAChD,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;gBACvC,IAAI,EAAE,aAAa,CAAC,MAAM;aAC3B,CAAC,CAAC;YACH,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC,4BAA4B,CAAC;aACxC,CAAC;QACJ,CAAC;QAED,wBAAwB;QACxB,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC9C,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,CAAC,8BAA8B,CAAC;iBAC1C,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACzC,CAAC;QAED,4DAA4D;QAC5D,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAE3C,sDAAsD;YACtD,MAAM,WAAW,GAAG;gBAClB,qEAAqE;gBACrE,kCAAkC;aACnC,CAAC;YAEF,4CAA4C;YAC5C,MAAM,WAAW,GAAG;gBAClB,gBAAgB;gBAChB,cAAc;gBACd,YAAY;aACb,CAAC;YAEF,MAAM,OAAO,GAAa,EAAE,CAAC;YAE7B,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;gBACvB,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;oBAClC,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC7B,OAAO,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;wBACjD,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACtB,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;oBAClC,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC7B,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;wBACvC,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE;oBAC1D,OAAO;iBACR,CAAC,CAAC;gBAEH,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO;wBACL,KAAK,EAAE,KAAK;wBACZ,OAAO,EAAE,IAAI;wBACb,OAAO;qBACR,CAAC;gBACJ,CAAC;gBAED,qCAAqC;gBACrC,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,KAAK;oBACd,OAAO;iBACR,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE;YAC/C,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;YAC7B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SACxD,CAAC,CAAC;QAEH,6CAA6C;QAC7C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;aAClC,CAAC;QACJ,CAAC;QAED,iDAAiD;QACjD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAqB,EACrB,SAAiB,EACjB,MAAc,EACd,OAAgB,EAChB,OAKC;IASD,MAAM,EACJ,eAAe,EAAE,qBAAqB,GAAG,IAAI,EAC7C,SAAS,GAAG,IAAI,EAChB,QAAQ,GAAG,IAAI,EACf,MAAM,GAAG,KAAK,GACf,GAAG,OAAO,IAAI,EAAE,CAAC;IAElB,2BAA2B;IAC3B,MAAM,eAAe,GAAG,sBAAsB,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACxE,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC3B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,cAAc,EAAE,KAAK;YACrB,YAAY,EAAE,IAAI,EAAE,kBAAkB;YACtC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,eAAe,CAAC,KAAK,IAAI,2BAA2B;SAC7D,CAAC;IACJ,CAAC;IAED,wCAAwC;IACxC,IAAI,qBAAqB,EAAE,CAAC;QAC1B,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE;YAC1D,SAAS;YACT,QAAQ;YACR,MAAM;SACP,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,CAAC,KAAK,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;YAClD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,cAAc,EAAE,IAAI;gBACpB,YAAY,EAAE,KAAK;gBACnB,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,2BAA2B;gBACnC,OAAO,EAAE,aAAa,CAAC,OAAO;aAC/B,CAAC;QACJ,CAAC;QAED,OAAO;YACL,KAAK,EAAE,IAAI;YACX,cAAc,EAAE,IAAI;YACpB,YAAY,EAAE,IAAI;YAClB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,aAAa,CAAC,OAAO;SAC/B,CAAC;IACJ,CAAC;IAED,8CAA8C;IAC9C,OAAO;QACL,KAAK,EAAE,IAAI;QACX,cAAc,EAAE,IAAI;QACpB,YAAY,EAAE,IAAI,EAAE,gCAAgC;QACpD,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC"}

package/public/workers/teams-delivery-worker.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Teams Delivery Worker (TEAMS-004)
+ *
+ * Reliable message delivery with exponential backoff, retry logic,
+ * and dead-letter queue for failed deliveries.
+ */
+/**
+ * Custom error for delivery failures
+ */
+export declare class DeliveryError extends Error {
+    statusCode: number;
+    retryAfter?: number | undefined;
+    constructor(statusCode: number, message: string, retryAfter?: number | undefined);
+}
+/**
+ * Teams Delivery Worker Class
+ */
+export declare class TeamsDeliveryWorker {
+    private isRunning;
+    private stopPromise;
+    private stopResolve;
+    /**
+     * Start the worker (polling loop)
+     */
+    start(): Promise<void>;
+    /**
+     * Gracefully stop the worker
+     */
+    stop(): Promise<void>;
+    /**
+     * Process a batch of pending deliveries
+     */
+    processBatch(): Promise<void>;
+    /**
+     * Process a single delivery job
+     */
+    processJob(job: {
+        id: string;
+        webhookId: string | null;
+        eventType: string;
+        payloadExcerpt: string | null;
+        attempts: number;
+        maxAttempts: number;
+    }): Promise<void>;
+    /**
+     * Deliver message to Teams webhook
+     */
+    deliver(job: {
+        webhookId: string | null;
+        eventType: string;
+        payloadExcerpt: string | null;
+    }): Promise<void>;
+    /**
+     * Mark delivery as successful
+     */
+    markSuccess(job: {
+        id: string;
+    }): Promise<void>;
+    /**
+     * Handle delivery failure with retry logic
+     */
+    handleFailure(job: {
+        id: string;
+        attempts: number;
+        maxAttempts: number;
+    }, error: unknown): Promise<void>;
+    /**
+     * Mark job as dead letter (permanently failed)
+     */
+    markDeadLetter(job: {
+        id: string;
+    }, error: DeliveryError): Promise<void>;
+    /**
+     * Determine if delivery should be retried based on status code and attempts
+     */
+    shouldRetry(statusCode: number, attempts: number, maxAttempts: number): boolean;
+    /**
+     * Calculate next retry time with exponential backoff
+     */
+    calculateNextRetry(attempts: number, error: DeliveryError): Date;
+    /**
+     * Sleep utility
+     */
+    private sleep;
+}
+export declare function getTeamsDeliveryWorker(): TeamsDeliveryWorker;
+/**
+ * Process a single job immediately (for testing or one-off processing)
+ */
+export declare function processDeliveryJob(jobId: string): Promise<void>;
+//# sourceMappingURL=teams-delivery-worker.d.ts.map

package/public/workers/teams-delivery-worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams-delivery-worker.d.ts","sourceRoot":"","sources":["../../src/workers/teams-delivery-worker.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH;;GAEG;AACH,qBAAa,aAAc,SAAQ,KAAK;IAEzB,UAAU,EAAE,MAAM;IAElB,UAAU,CAAC,EAAE,MAAM;gBAFnB,UAAU,EAAE,MAAM,EACzB,OAAO,EAAE,MAAM,EACR,UAAU,CAAC,EAAE,MAAM,YAAA;CAKjC;AAmDD;;GAEG;AACH,qBAAa,mBAAmB;IAC5B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,WAAW,CAA8B;IACjD,OAAO,CAAC,WAAW,CAA6B;IAEhD;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA0B5B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAiB3B;;OAEG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAqBnC;;OAEG;IACG,UAAU,CAAC,GAAG,EAAE;QAClB,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,IAAI,CAAC;IAejB;;OAEG;IACG,OAAO,CAAC,GAAG,EAAE;QACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;KACjC,GAAG,OAAO,CAAC,IAAI,CAAC;IAoEjB;;OAEG;IACG,WAAW,CAAC,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAUrD;;OAEG;IACG,aAAa,CACf,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAC1D,KAAK,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC;IAgChB;;OAEG;IACG,cAAc,CAAC,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAe9E;;OAEG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO;IAc/E;;OAEG;IACH,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI;IAahE;;OAEG;IACH,OAAO,CAAC,KAAK;CAGhB;AAOD,wBAAgB,sBAAsB,IAAI,mBAAmB,CAK5D;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWrE"}