@appsemble/lang-sdk 0.36.5-test.6 → 0.36.5

package/authorization.js

@@ -3,6 +3,7 @@ function checkAppPermissions(acquiredPermissions, requiredPermissions) {
     const customAppResourcePermissionPattern = /^\$resource:[^:]+:(get|history:get|query|create|delete|patch|update)$/;
     const customAppOwnResourcePermissionPattern = /^\$resource:[^:]+:own:(get|query|delete|patch|update)$/;
     const customAppResourceViewPermissionPattern = /^\$resource:[^:]+:(get|query):[^:]+$/;
+    const customAppWebhookPermissionPattern = /^\$webhook:[^:]+:invoke$/;
     return requiredPermissions.every((p) => {
         if (acquiredPermissions.includes(p)) {
             return true;
@@ -23,6 +24,14 @@ function checkAppPermissions(acquiredPermissions, requiredPermissions) {
                 acquiredPermissions.includes(`$resource:all:${resourceAction}`) ||
                 acquiredPermissions.includes(`$resource:all:${resourceAction}:${view}`));
         }
+        if (customAppWebhookPermissionPattern.test(p)) {
+            // $webhook:all:invoke grants access to all webhooks
+            // $webhook:<name>:invoke grants access to specific webhook
+            const [, webhookName] = p.split(':');
+            return (acquiredPermissions.includes('$webhook:all:invoke') ||
+                (webhookName !== 'all' &&
+                    acquiredPermissions.includes(`$webhook:${webhookName}:invoke`)));
+        }
     });
 }
 export function getAppInheritedRoles(appSecurityDefinition, roles, accumulatedRoles = []) {
@@ -113,6 +122,7 @@ export function getAppPossibleGuestPermissions(appDefinition) {
                 `$resource:all:get:${view}`,
             ]),
         ]),
+        ...Object.keys(appDefinition.webhooks || {}).map((webhookName) => `$webhook:${webhookName}:invoke`),
     ];
 }
 export function getAppPossiblePermissions(appDefinition) {

package/constants/patterns.js

@@ -13,7 +13,8 @@ export const semver = new RegExp(`^${partialSemver.source}$`);
 /**
  * A pattern for extracting a normalized string.
  */
-export const partialNormalized = /([\da-z](?:(?!.*--)[\da-z-]*[\da-z])?)/;
+// eslint-disable-next-line unicorn/better-regex
+export const partialNormalized = /([0-9a-z](?:(?!.*--)[-0-9a-z]*[0-9a-z])?)/;
 /**
  * A pattern for exactly matching a lower case hyphen separated string.
  */
@@ -26,17 +27,20 @@ export const domainPattern = new RegExp(`^(${partialNormalized.source}+\\.)+[a-z
 /**
  * A pattern to match a Google Analytics ID or an empty string.
  */
-export const googleAnalyticsIDPattern = /^(|UA-\d{4,10}-\d{1,4}|G-[\dA-Z]{4,})$/;
+// eslint-disable-next-line unicorn/better-regex
+export const googleAnalyticsIDPattern = /^(|UA-[0-9]{4,10}-[0-9]{1,4}|G-[0-9A-Z]{4,})$/;
 /**
  * A pattern to match a Meta (Facebook) Pixel ID or an empty string.
  * Meta Pixel IDs are numeric strings, usually 5–20 digits.
  */
-export const metaPixelIDPattern = /^(|\d{5,20})$/;
+// eslint-disable-next-line unicorn/better-regex
+export const metaPixelIDPattern = /^(|[0-9]{5,20})$/;
 /**
  * A pattern to match a MS Clarity Project ID or an empty string.
  * Clarity IDs are alphanumeric strings, typically 8–20 characters long.
  */
-export const msClarityIDPattern = /^(|[\dA-Za-z]{8,20})$/;
+// eslint-disable-next-line unicorn/better-regex
+export const msClarityIDPattern = /^(|[0-9A-Za-z]{8,20})$/;
 /**
  * A pattern which matches a UUID 4.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appsemble/lang-sdk",
-  "version": "0.36.5-test.6",
+  "version": "0.36.5",
   "description": "Language SDK for Appsemble",
   "keywords": [
     "app",

package/reference-schemas/actions/miscellaneous.js

@@ -18,6 +18,7 @@ import { RequestActionDefinition } from '../../schemas/actions/RequestActionDefi
 import { ShareActionDefinition } from '../../schemas/actions/ShareActionDefinition.js';
 import { StaticActionDefinition } from '../../schemas/actions/StaticActionDefinition.js';
 import { ThrowActionDefinition } from '../../schemas/actions/ThrowActionDefinition.js';
+import { WebhookActionDefinition } from '../../schemas/actions/WebhookActionDefinition.js';
 export const miscellaneousActions = {
     analytics: AnalyticsActionDefinition,
     condition: ConditionActionDefinition,
@@ -39,5 +40,6 @@ export const miscellaneousActions = {
     share: ShareActionDefinition,
     static: StaticActionDefinition,
     throw: ThrowActionDefinition,
+    webhook: WebhookActionDefinition,
 };
 //# sourceMappingURL=miscellaneous.js.map

package/schemas/actions/ActionDefinition.js

@@ -91,6 +91,7 @@ export const ActionDefinition = {
                 { $ref: '#/components/schemas/AppMemberPropertiesPatchActionDefinition' },
                 { $ref: '#/components/schemas/AppMemberQueryActionDefinition' },
                 { $ref: '#/components/schemas/AppMemberDeleteActionDefinition' },
+                { $ref: '#/components/schemas/WebhookActionDefinition' },
             ],
         },
     ],

package/schemas/actions/WebhookActionDefinition.d.ts

@@ -0,0 +1 @@
+export declare const WebhookActionDefinition: import("openapi-types").OpenAPIV3.SchemaObject;

package/schemas/actions/WebhookActionDefinition.js

@@ -0,0 +1,32 @@
+import { BaseActionDefinition } from './BaseActionDefinition.js';
+import { extendJSONSchema } from '../utils/extendJSONSchema.js';
+export const WebhookActionDefinition = extendJSONSchema(BaseActionDefinition, {
+    type: 'object',
+    additionalProperties: false,
+    required: ['type', 'name'],
+    properties: {
+        type: {
+            enum: ['webhook'],
+            description: `Invoke a webhook defined in the app.
+
+The webhook's action is executed server-side, allowing secure operations like
+generating verification codes, sending emails, and modifying resources without
+exposing sensitive logic to the client.
+
+The user must have the \`$webhook:<webhookName>:invoke\` permission to call this action.
+`,
+        },
+        name: {
+            type: 'string',
+            description: 'The name of the webhook to invoke. Must match a webhook defined in the app.',
+        },
+        body: {
+            $ref: '#/components/schemas/RemapperDefinition',
+            description: `A remapper for the webhook body.
+
+If not specified, the raw input data is passed to the webhook.
+`,
+        },
+    },
+});
+//# sourceMappingURL=WebhookActionDefinition.js.map

package/schemas/index.d.ts

@@ -66,6 +66,7 @@ export * from './actions/StorageSubtractActionDefinition.js';
 export * from './actions/StorageUpdateActionDefinition.js';
 export * from './actions/StorageWriteActionDefinition.js';
 export * from './actions/ThrowActionDefinition.js';
+export * from './actions/WebhookActionDefinition.js';
 export * from './AppDefinition.js';
 export * from './AppLayoutDefinition.js';
 export * from './AppMemberPropertyDefinition.js';

package/schemas/index.js

@@ -66,6 +66,7 @@ export * from './actions/StorageSubtractActionDefinition.js';
 export * from './actions/StorageUpdateActionDefinition.js';
 export * from './actions/StorageWriteActionDefinition.js';
 export * from './actions/ThrowActionDefinition.js';
+export * from './actions/WebhookActionDefinition.js';
 export * from './AppDefinition.js';
 export * from './AppLayoutDefinition.js';
 export * from './AppMemberPropertyDefinition.js';

package/types/action.d.ts

@@ -48,5 +48,5 @@ export type ResourcePatchAction = RequestLikeAction<'resource.patch'>;
 /**
  * An action that can be called from within a block.
  */
-export type Action = BaseAction<'analytics'> | BaseAction<'app.member.current.patch'> | BaseAction<'app.member.delete'> | BaseAction<'app.member.invite'> | BaseAction<'app.member.login'> | BaseAction<'app.member.logout'> | BaseAction<'app.member.properties.patch'> | BaseAction<'app.member.query'> | BaseAction<'app.member.register'> | BaseAction<'app.member.role.update'> | BaseAction<'condition'> | BaseAction<'controller'> | BaseAction<'csv.parse'> | BaseAction<'dialog.error'> | BaseAction<'dialog.ok'> | BaseAction<'dialog'> | BaseAction<'download'> | BaseAction<'each'> | BaseAction<'email'> | BaseAction<'event'> | BaseAction<'flow.back'> | BaseAction<'flow.cancel'> | BaseAction<'flow.finish'> | BaseAction<'flow.next'> | BaseAction<'flow.to'> | BaseAction<'group.member.create'> | BaseAction<'group.member.delete'> | BaseAction<'group.member.invite'> | BaseAction<'group.member.query'> | BaseAction<'group.member.role.update'> | BaseAction<'group.query'> | BaseAction<'group.selected.update'> | BaseAction<'link.back'> | BaseAction<'link.next'> | BaseAction<'match'> | BaseAction<'message'> | BaseAction<'noop'> | BaseAction<'notify'> | BaseAction<'resource.subscription.status'> | BaseAction<'resource.subscription.subscribe'> | BaseAction<'resource.subscription.toggle'> | BaseAction<'resource.subscription.unsubscribe'> | BaseAction<'share'> | BaseAction<'static'> | BaseAction<'storage.append'> | BaseAction<'storage.delete'> | BaseAction<'storage.read'> | BaseAction<'storage.subtract'> | BaseAction<'storage.update'> | BaseAction<'storage.write'> | BaseAction<'throw'> | LinkAction | LogAction | RequestAction | ResourceCountAction | ResourceCreateAction | ResourceDeleteAction | ResourceDeleteAllAction | ResourceDeleteBulkAction | ResourceGetAction | ResourceHistoryGetAction | ResourcePatchAction | ResourceQueryAction | ResourceUpdateAction | ResourceUpdateGroupAction | ResourceUpdatePositionsAction;
+export type Action = BaseAction<'analytics'> | BaseAction<'app.member.current.patch'> | BaseAction<'app.member.delete'> | BaseAction<'app.member.invite'> | BaseAction<'app.member.login'> | BaseAction<'app.member.logout'> | BaseAction<'app.member.properties.patch'> | BaseAction<'app.member.query'> | BaseAction<'app.member.register'> | BaseAction<'app.member.role.update'> | BaseAction<'condition'> | BaseAction<'controller'> | BaseAction<'csv.parse'> | BaseAction<'dialog.error'> | BaseAction<'dialog.ok'> | BaseAction<'dialog'> | BaseAction<'download'> | BaseAction<'each'> | BaseAction<'email'> | BaseAction<'event'> | BaseAction<'flow.back'> | BaseAction<'flow.cancel'> | BaseAction<'flow.finish'> | BaseAction<'flow.next'> | BaseAction<'flow.to'> | BaseAction<'group.member.create'> | BaseAction<'group.member.delete'> | BaseAction<'group.member.invite'> | BaseAction<'group.member.query'> | BaseAction<'group.member.role.update'> | BaseAction<'group.query'> | BaseAction<'group.selected.update'> | BaseAction<'link.back'> | BaseAction<'link.next'> | BaseAction<'match'> | BaseAction<'message'> | BaseAction<'noop'> | BaseAction<'notify'> | BaseAction<'resource.subscription.status'> | BaseAction<'resource.subscription.subscribe'> | BaseAction<'resource.subscription.toggle'> | BaseAction<'resource.subscription.unsubscribe'> | BaseAction<'share'> | BaseAction<'static'> | BaseAction<'storage.append'> | BaseAction<'storage.delete'> | BaseAction<'storage.read'> | BaseAction<'storage.subtract'> | BaseAction<'storage.update'> | BaseAction<'storage.write'> | BaseAction<'throw'> | BaseAction<'webhook'> | LinkAction | LogAction | RequestAction | ResourceCountAction | ResourceCreateAction | ResourceDeleteAction | ResourceDeleteAllAction | ResourceDeleteBulkAction | ResourceGetAction | ResourceHistoryGetAction | ResourcePatchAction | ResourceQueryAction | ResourceUpdateAction | ResourceUpdateGroupAction | ResourceUpdatePositionsAction;
 export {};

package/types/actionDefinition.d.ts

@@ -3,8 +3,8 @@ import { type BlockDefinition } from './block.js';
 import { type BulmaColor } from './bulma.js';
 import { type HTTPMethods } from './http.js';
 import { type Remapper } from './remapper.js';
-export type ActionDefinition = AnalyticsAction | AppMemberCurrentPatchAction | AppMemberDeleteAction | AppMemberInviteAction | AppMemberLoginAction | AppMemberLogoutAction | AppMemberPropertiesPatchAction | AppMemberQueryAction | AppMemberRegisterAction | AppMemberRoleUpdateAction | BaseActionDefinition<'dialog.error'> | BaseActionDefinition<'dialog.ok'> | BaseActionDefinition<'flow.back'> | BaseActionDefinition<'flow.cancel'> | BaseActionDefinition<'flow.finish'> | BaseActionDefinition<'flow.next'> | BaseActionDefinition<'group.query'> | BaseActionDefinition<'link.back'> | BaseActionDefinition<'link.next'> | BaseActionDefinition<'noop'> | BaseActionDefinition<'throw'> | ConditionActionDefinition | ControllerActionDefinition | CsvParserActionDefinition | DialogActionDefinition | DownloadActionDefinition | EachActionDefinition | EmailActionDefinition | EventActionDefinition | FlowToActionDefinition | GroupMemberCreateActionDefinition | GroupMemberDeleteActionDefinition | GroupMemberInviteActionDefinition | GroupMemberQueryActionDefinition | GroupMemberRoleUpdateActionDefinition | GroupSelectedUpdateActionDefinition | LinkActionDefinition | LogActionDefinition | MatchActionDefinition | MessageActionDefinition | NotifyActionDefinition | RequestActionDefinition | ResourceCountActionDefinition | ResourceCreateActionDefinition | ResourceDeleteActionDefinition | ResourceDeleteAllActionDefinition | ResourceDeleteBulkActionDefinition | ResourceGetActionDefinition | ResourceHistoryGetActionDefinition | ResourcePatchActionDefinition | ResourceQueryActionDefinition | ResourceSubscriptionStatusActionDefinition | ResourceSubscriptionSubscribeActionDefinition | ResourceSubscriptionToggleActionDefinition | ResourceSubscriptionUnsubscribeActionDefinition | ResourceUpdateActionDefinition | ResourceUpdateGroupActionDefinition | ResourceUpdatePositionsActionDefinition | ShareActionDefinition | StaticActionDefinition | StorageAppendActionDefinition | StorageDeleteActionDefinition | StorageReadActionDefinition | StorageSubtractActionDefinition | StorageUpdateActionDefinition | StorageWriteActionDefinition;
-export type ActionName = 'analytics' | 'app.member.current.patch' | 'app.member.delete' | 'app.member.invite' | 'app.member.login' | 'app.member.logout' | 'app.member.properties.patch' | 'app.member.query' | 'app.member.register' | 'app.member.role.update' | 'condition' | 'controller' | 'csv.parse' | 'dialog.error' | 'dialog.ok' | 'dialog' | 'download' | 'each' | 'email' | 'event' | 'flow.back' | 'flow.cancel' | 'flow.finish' | 'flow.next' | 'flow.to' | 'group.member.create' | 'group.member.delete' | 'group.member.invite' | 'group.member.query' | 'group.member.role.update' | 'group.query' | 'group.selected.update' | 'link.back' | 'link.next' | 'link' | 'log' | 'match' | 'message' | 'noop' | 'notify' | 'request' | 'resource.count' | 'resource.create' | 'resource.delete.all' | 'resource.delete.bulk' | 'resource.delete' | 'resource.get' | 'resource.history.get' | 'resource.patch' | 'resource.query' | 'resource.subscription.status' | 'resource.subscription.subscribe' | 'resource.subscription.toggle' | 'resource.subscription.unsubscribe' | 'resource.update.group' | 'resource.update.positions' | 'resource.update' | 'share' | 'static' | 'storage.append' | 'storage.delete' | 'storage.read' | 'storage.subtract' | 'storage.update' | 'storage.write' | 'throw';
+export type ActionDefinition = AnalyticsAction | AppMemberCurrentPatchAction | AppMemberDeleteAction | AppMemberInviteAction | AppMemberLoginAction | AppMemberLogoutAction | AppMemberPropertiesPatchAction | AppMemberQueryAction | AppMemberRegisterAction | AppMemberRoleUpdateAction | BaseActionDefinition<'dialog.error'> | BaseActionDefinition<'dialog.ok'> | BaseActionDefinition<'flow.back'> | BaseActionDefinition<'flow.cancel'> | BaseActionDefinition<'flow.finish'> | BaseActionDefinition<'flow.next'> | BaseActionDefinition<'group.query'> | BaseActionDefinition<'link.back'> | BaseActionDefinition<'link.next'> | BaseActionDefinition<'noop'> | BaseActionDefinition<'throw'> | ConditionActionDefinition | ControllerActionDefinition | CsvParserActionDefinition | DialogActionDefinition | DownloadActionDefinition | EachActionDefinition | EmailActionDefinition | EventActionDefinition | FlowToActionDefinition | GroupMemberCreateActionDefinition | GroupMemberDeleteActionDefinition | GroupMemberInviteActionDefinition | GroupMemberQueryActionDefinition | GroupMemberRoleUpdateActionDefinition | GroupSelectedUpdateActionDefinition | LinkActionDefinition | LogActionDefinition | MatchActionDefinition | MessageActionDefinition | NotifyActionDefinition | RequestActionDefinition | ResourceCountActionDefinition | ResourceCreateActionDefinition | ResourceDeleteActionDefinition | ResourceDeleteAllActionDefinition | ResourceDeleteBulkActionDefinition | ResourceGetActionDefinition | ResourceHistoryGetActionDefinition | ResourcePatchActionDefinition | ResourceQueryActionDefinition | ResourceSubscriptionStatusActionDefinition | ResourceSubscriptionSubscribeActionDefinition | ResourceSubscriptionToggleActionDefinition | ResourceSubscriptionUnsubscribeActionDefinition | ResourceUpdateActionDefinition | ResourceUpdateGroupActionDefinition | ResourceUpdatePositionsActionDefinition | ShareActionDefinition | StaticActionDefinition | StorageAppendActionDefinition | StorageDeleteActionDefinition | StorageReadActionDefinition | StorageSubtractActionDefinition | StorageUpdateActionDefinition | StorageWriteActionDefinition | WebhookActionDefinition;
+export type ActionName = 'analytics' | 'app.member.current.patch' | 'app.member.delete' | 'app.member.invite' | 'app.member.login' | 'app.member.logout' | 'app.member.properties.patch' | 'app.member.query' | 'app.member.register' | 'app.member.role.update' | 'condition' | 'controller' | 'csv.parse' | 'dialog.error' | 'dialog.ok' | 'dialog' | 'download' | 'each' | 'email' | 'event' | 'flow.back' | 'flow.cancel' | 'flow.finish' | 'flow.next' | 'flow.to' | 'group.member.create' | 'group.member.delete' | 'group.member.invite' | 'group.member.query' | 'group.member.role.update' | 'group.query' | 'group.selected.update' | 'link.back' | 'link.next' | 'link' | 'log' | 'match' | 'message' | 'noop' | 'notify' | 'request' | 'resource.count' | 'resource.create' | 'resource.delete.all' | 'resource.delete.bulk' | 'resource.delete' | 'resource.get' | 'resource.history.get' | 'resource.patch' | 'resource.query' | 'resource.subscription.status' | 'resource.subscription.subscribe' | 'resource.subscription.toggle' | 'resource.subscription.unsubscribe' | 'resource.update.group' | 'resource.update.positions' | 'resource.update' | 'share' | 'static' | 'storage.append' | 'storage.delete' | 'storage.read' | 'storage.subtract' | 'storage.update' | 'storage.write' | 'throw' | 'webhook';
 export interface BaseActionDefinition<T extends ActionName> {
     /**
      * The type of the action.
@@ -638,4 +638,18 @@ export interface CsvParserActionDefinition extends BaseActionDefinition<'csv.par
      */
     delimiter?: Remapper;
 }
+export interface WebhookActionDefinition extends BaseActionDefinition<'webhook'> {
+    /**
+     * The name of the webhook to invoke.
+     *
+     * This must be a webhook defined in the app's `webhooks` section.
+     */
+    name: string;
+    /**
+     * A remapper for the webhook body.
+     *
+     * If this isn't specified, the raw input data is passed to the webhook.
+     */
+    body?: Remapper;
+}
 export {};

package/types/index.d.ts

@@ -54,6 +54,10 @@ export interface ProjectConfig {
      * ^\d+\.\d+\.\d+$
      */
     version: string;
+    /**
+     * The URL to the source code repository of the project.
+     */
+    repositoryUrl?: string;
 }
 export interface ProjectImplementations {
     /**

package/types/permission.d.ts

@@ -103,5 +103,9 @@ export declare enum AppPermission {
     /**
      * The permission to delete own app resources.
      */
-    DeleteOwnResources = "$resource:all:own:delete"
+    DeleteOwnResources = "$resource:all:own:delete",
+    /**
+     * The permission to invoke any app webhook.
+     */
+    InvokeWebhooks = "$webhook:all:invoke"
 }

package/types/permission.js

@@ -105,5 +105,9 @@ export var AppPermission;
      * The permission to delete own app resources.
      */
     AppPermission["DeleteOwnResources"] = "$resource:all:own:delete";
+    /**
+     * The permission to invoke any app webhook.
+     */
+    AppPermission["InvokeWebhooks"] = "$webhook:all:invoke";
 })(AppPermission || (AppPermission = {}));
 //# sourceMappingURL=permission.js.map

package/types/security.d.ts

@@ -4,7 +4,8 @@ import { type AppRole, type PredefinedAppRole } from './roles.js';
 export type CustomAppResourcePermission = `$resource:${string}:${ResourceAction}`;
 export type CustomAppOwnResourcePermission = `$resource:${string}:own:${OwnResourceAction}`;
 export type CustomAppResourceViewPermission = `$resource:${string}:${ResourceViewAction}:${string}`;
-export type CustomAppGuestPermission = AppPermission | CustomAppResourcePermission | CustomAppResourceViewPermission;
+export type CustomAppWebhookPermission = `$webhook:${string}:invoke`;
+export type CustomAppGuestPermission = AppPermission | CustomAppResourcePermission | CustomAppResourceViewPermission | CustomAppWebhookPermission;
 export type CustomAppPermission = CustomAppGuestPermission | CustomAppOwnResourcePermission;
 export interface GuestDefinition {
     permissions?: CustomAppPermission[];

package/validation.js

@@ -15,6 +15,8 @@ const allOwnResourcePermissionPattern = /^\$resource:all:own:(get|query|delete|p
 const ownResourcePermissionPattern = /^\$resource:[^:]+:own:(get|query|delete|patch|update)$/;
 const allResourceViewPermissionPattern = /^\$resource:all:(get|query):[^:]+$/;
 const resourceViewPermissionPattern = /^\$resource:[^:]+:(get|query):[^:]+$/;
+const allWebhookPermissionPattern = /^\$webhook:all:invoke$/;
+const webhookPermissionPattern = /^\$webhook:[^:]+:invoke$/;
 /**
  * Check whether or not the given link represents a link related to the Appsemble core.
  *
@@ -558,6 +560,13 @@ function validatePermissions(appDefinition, permissions, inheritedPermissions, p
                     }
                 }
             }
+            if (webhookPermissionPattern.test(permission)) {
+                const [, webhookName] = permission.split(':');
+                if (webhookName !== 'all' && !appDefinition.webhooks?.[webhookName]) {
+                    report(appDefinition, `webhook ${webhookName} does not exist in the app's webhooks definition`, [...path, 'permissions', index]);
+                    return;
+                }
+            }
             report(appDefinition, 'invalid permission', [...path, 'permissions', index]);
             return;
         }
@@ -1064,7 +1073,8 @@ function validateActions(definition, report) {
                         report(action.type, 'missing security definition', [...path, 'resource']);
                         return;
                     }
-                    const allPermissions = definition.security.guest?.permissions || [];
+                    // IMPORTANT: Create a COPY of the permissions array to avoid mutating the definition
+                    const allPermissions = [...(definition.security.guest?.permissions || [])];
                     if (definition.security?.cron) {
                         allPermissions.push(...(definition.security.cron.permissions ?? []));
                     }
@@ -1086,22 +1096,47 @@ function validateActions(definition, report) {
                                 (permissionResourceAction === resourceAction ||
                                     (resourceAction === 'count' && permissionResourceAction === 'query')));
                         }
+                        if (view && resourceViewPermissionPattern.test(permission)) {
+                            const [, permissionResourceName, permissionResourceAction, permissionResourceView] = permission.split(':');
+                            return (['all', resourceName].includes(permissionResourceName) &&
+                                permissionResourceAction === resourceAction &&
+                                (!permissionResourceView || permissionResourceView === view));
+                        }
                         return false;
                     })) {
                         report(action.type, 'there is no one in the app who has permissions to use this action', [...path, 'resource']);
                         return;
                     }
-                    if (view &&
-                        !allPermissions.some((permission) => {
-                            if (resourceViewPermissionPattern.test(permission)) {
-                                const [, permissionResourceName, permissionResourceAction, permissionResourceView] = permission.split(':');
-                                return (['all', resourceName].includes(permissionResourceName) &&
-                                    permissionResourceAction === resourceAction &&
-                                    (!permissionResourceView || permissionResourceView === view));
-                            }
-                            return false;
-                        })) {
-                        report(action.type, 'there is no one in the app who has permissions to use this action', [...path, 'resource']);
+                }
+            }
+            if (action.type === 'webhook') {
+                const { name: webhookName } = action;
+                if (!definition.webhooks?.[webhookName]) {
+                    report(action.type, `webhook '${webhookName}' does not exist in the app's webhooks definition`, [...path, 'name']);
+                    return;
+                }
+                // Check if anyone has permission to invoke this webhook
+                if (definition.security) {
+                    // IMPORTANT: Create a COPY of the permissions array to avoid mutating the definition
+                    const webhookAllPermissions = [
+                        ...(definition.security.guest?.permissions || []),
+                    ];
+                    if (definition.security?.cron) {
+                        webhookAllPermissions.push(...(definition.security.cron.permissions ?? []));
+                    }
+                    if (definition.security.roles) {
+                        const allRolePermissions = getAppRolePermissions(definition.security, Object.keys(definition.security.roles));
+                        webhookAllPermissions.push(...allRolePermissions);
+                    }
+                    if (!webhookAllPermissions.some((permission) => {
+                        if (webhookPermissionPattern.test(permission) ||
+                            allWebhookPermissionPattern.test(permission)) {
+                            const [, permissionWebhookName] = permission.split(':');
+                            return permissionWebhookName === 'all' || permissionWebhookName === webhookName;
+                        }
+                        return false;
+                    })) {
+                        report(action.type, 'there is no one in the app who has permissions to invoke this webhook', [...path, 'name']);
                         return;
                     }
                 }
@@ -1357,34 +1392,39 @@ export async function validateAppDefinition(definition, getBlockVersions, contro
         result.addError('App definition can not be null');
         return result;
     }
-    const blocks = getAppBlocks(definition);
-    const blockVersions = await getBlockVersions(blocks);
-    const blockVersionMap = new Map();
-    for (const version of blockVersions) {
-        if (!blockVersionMap.has(version.name)) {
-            blockVersionMap.set(version.name, new Map());
-        }
-        blockVersionMap.get(version.name).set(version.version, version);
-    }
     const report = (instance, message, path) => {
         result.errors.push(new ValidationError(message, instance, undefined, path));
     };
     try {
-        validateController(definition, controllerImplementations, report);
-        validateCronJobs(definition, report);
-        validateDefaultPage(definition, report);
-        validateHooks(definition, report);
-        validateLanguage(definition, report);
-        validateResourceReferences(definition, report);
-        validateMembersSchema(definition, report);
-        validatePhoneNumberDefinition(definition, report);
-        validateResourceSchemas(definition, report);
-        validateSecurity(definition, report);
-        validateBlocks(definition, blockVersionMap, report);
-        validateActions(definition, report);
-        validateEvents(definition, blockVersionMap, report);
-        validateUniquePageNames(definition, report);
-        validateGridLayout(definition, report);
+        // IMPORTANT: Create a deep copy to prevent validation logic from mutating the original definition.
+        // The imperative/procedural-style algorithms below (e.g., in validateActions) build up arrays
+        // using .push(), which can accidentally mutate the original definition if passed by reference.
+        // This clone acts as a safeguard against such side effects.
+        const clonedDefinition = structuredClone(definition);
+        const blocks = getAppBlocks(clonedDefinition);
+        const blockVersions = await getBlockVersions(blocks);
+        const blockVersionMap = new Map();
+        for (const version of blockVersions) {
+            if (!blockVersionMap.has(version.name)) {
+                blockVersionMap.set(version.name, new Map());
+            }
+            blockVersionMap.get(version.name).set(version.version, version);
+        }
+        validateController(clonedDefinition, controllerImplementations, report);
+        validateCronJobs(clonedDefinition, report);
+        validateDefaultPage(clonedDefinition, report);
+        validateHooks(clonedDefinition, report);
+        validateLanguage(clonedDefinition, report);
+        validateResourceReferences(clonedDefinition, report);
+        validateMembersSchema(clonedDefinition, report);
+        validatePhoneNumberDefinition(clonedDefinition, report);
+        validateResourceSchemas(clonedDefinition, report);
+        validateSecurity(clonedDefinition, report);
+        validateBlocks(clonedDefinition, blockVersionMap, report);
+        validateActions(clonedDefinition, report);
+        validateEvents(clonedDefinition, blockVersionMap, report);
+        validateUniquePageNames(clonedDefinition, report);
+        validateGridLayout(clonedDefinition, report);
     }
     catch (error) {
         report(null, `Unexpected error: ${error instanceof Error ? error.message : error}`, []);