@crombolo/data 0.11.0 → 0.13.1

package/src/repositories/webhooks.ts

@@ -0,0 +1,299 @@
+/**
+ * Webhooks kept in this environment, and the delivery queue and log every
+ * webhook and bundle event handler shares. docs/webhooks.md.
+ *
+ * A delivery is claimed with `UPDATE … WHERE state = 'pending' … RETURNING`, as
+ * form workflows are, so on a cluster exactly one node delivers each.
+ */
+import { randomUUID } from 'node:crypto'
+import type { Db } from '../database.ts'
+import { DbDate, fromDbBool } from '../dialect.ts'
+
+export interface WebhookRow {
+  key: string
+  name: string | null
+  description: string | null
+  url: string
+  enabled: boolean
+  events: string[]
+  contentTypeKeys: string[]
+  /** The headers as one sealed value; the server holds the key that opens it. */
+  sealedHeaders: string | null
+}
+
+const parseList = (value: unknown): string[] => {
+  try {
+    const parsed = JSON.parse(String(value ?? '[]')) as unknown
+    return Array.isArray(parsed) ? parsed.filter((item) => typeof item === 'string') : []
+  } catch {
+    return []
+  }
+}
+
+export class WebhookRepository {
+  #db: Db
+  constructor(db: Db) {
+    this.#db = db
+  }
+
+  async all(): Promise<WebhookRow[]> {
+    const rows = await this.#db.query(
+      'SELECT key, name, description, url, enabled, events, content_type_keys, headers FROM webhook ORDER BY create_date, key',
+    )
+    return rows.map((row) => ({
+      key: String(row.key),
+      name: (row.name as string | null) ?? null,
+      description: (row.description as string | null) ?? null,
+      url: String(row.url),
+      enabled: fromDbBool(row.enabled),
+      events: parseList(row.events),
+      contentTypeKeys: parseList(row.content_type_keys),
+      sealedHeaders: (row.headers as string | null) ?? null,
+    }))
+  }
+
+  async byKey(key: string): Promise<WebhookRow | undefined> {
+    return (await this.all()).find((row) => row.key === key.toLowerCase())
+  }
+
+  async save(webhook: WebhookRow): Promise<void> {
+    const now = DbDate.toDb(new Date())
+    const values = [
+      webhook.name,
+      webhook.description,
+      webhook.url,
+      this.#db.dialect.boolValue(webhook.enabled),
+      JSON.stringify(webhook.events),
+      JSON.stringify(webhook.contentTypeKeys),
+      webhook.sealedHeaders,
+      now,
+    ]
+    const updated = await this.#db.query(
+      `UPDATE webhook SET name = ?, description = ?, url = ?, enabled = ?, events = ?,
+              content_type_keys = ?, headers = ?, update_date = ?
+        WHERE key = ? RETURNING key`,
+      [...values, webhook.key.toLowerCase()],
+    )
+    if (updated.length > 0) return
+    await this.#db.exec(
+      `INSERT INTO webhook (name, description, url, enabled, events, content_type_keys, headers,
+                            update_date, key, create_date)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      [...values, webhook.key.toLowerCase(), now],
+    )
+  }
+
+  async remove(key: string): Promise<boolean> {
+    const rows = await this.#db.query('DELETE FROM webhook WHERE key = ? RETURNING key', [
+      key.toLowerCase(),
+    ])
+    return rows.length > 0
+  }
+}
+
+export type WebhookDeliveryState = 'pending' | 'running' | 'done' | 'failed'
+
+export interface WebhookDelivery {
+  id: string
+  /** A webhook's key, or `bundle:<id>` for a bundle's handler. */
+  subscriber: string
+  eventAlias: string
+  payload: unknown
+  state: WebhookDeliveryState
+  attempts: number
+  lastError: string | null
+  runAfter: Date
+  createDate: Date
+}
+
+export interface WebhookLogEntry {
+  key: string
+  deliveryId: string
+  subscriber: string
+  eventAlias: string
+  url: string
+  statusCode: number | null
+  success: boolean
+  exception: boolean
+  retryCount: number
+  requestHeaders: string
+  requestBody: string
+  responseHeaders: string
+  responseBody: string
+  date: Date
+}
+
+const DELIVERY_COLUMNS =
+  'id, subscriber, event_alias, payload, state, attempts, last_error, run_after, create_date'
+
+const hydrateDelivery = (row: Record<string, unknown>): WebhookDelivery => {
+  let payload: unknown = null
+  try {
+    payload = JSON.parse(String(row.payload))
+  } catch {
+    payload = null
+  }
+  return {
+    id: String(row.id),
+    subscriber: String(row.subscriber),
+    eventAlias: String(row.event_alias),
+    payload,
+    state: String(row.state) as WebhookDeliveryState,
+    attempts: Number(row.attempts),
+    lastError: (row.last_error as string | null) ?? null,
+    runAfter: DbDate.fromDb(row.run_after) ?? new Date(0),
+    createDate: DbDate.fromDb(row.create_date) ?? new Date(0),
+  }
+}
+
+/** Bodies and headers are kept to what a person will read, not what a server sent. */
+const clip = (value: string) => value.slice(0, 10_000)
+
+export class WebhookDeliveryRepository {
+  #db: Db
+  constructor(db: Db) {
+    this.#db = db
+  }
+
+  async enqueue(
+    deliveries: ReadonlyArray<{ subscriber: string; eventAlias: string; payload: unknown }>,
+    now = new Date(),
+  ): Promise<string[]> {
+    const ids: string[] = []
+    for (const delivery of deliveries) {
+      const id = randomUUID()
+      await this.#db.exec(
+        `INSERT INTO webhook_delivery (${DELIVERY_COLUMNS}, update_date)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        [
+          id,
+          delivery.subscriber,
+          delivery.eventAlias,
+          JSON.stringify(delivery.payload),
+          'pending',
+          0,
+          null,
+          DbDate.toDb(now),
+          DbDate.toDb(now),
+          DbDate.toDb(now),
+        ],
+      )
+      ids.push(id)
+    }
+    return ids
+  }
+
+  async due(now = new Date(), limit = 25): Promise<WebhookDelivery[]> {
+    const rows = await this.#db.query(
+      `SELECT ${DELIVERY_COLUMNS} FROM webhook_delivery WHERE state = ? AND run_after <= ?
+        ORDER BY run_after, create_date LIMIT ?`,
+      ['pending', DbDate.toDb(now), limit],
+    )
+    return rows.map(hydrateDelivery)
+  }
+
+  /** Takes a delivery, or finds another node already has. */
+  async claim(id: string): Promise<WebhookDelivery | undefined> {
+    const rows = await this.#db.query(
+      `UPDATE webhook_delivery SET state = ?, attempts = attempts + 1, update_date = ?
+        WHERE id = ? AND state = ? RETURNING ${DELIVERY_COLUMNS}`,
+      ['running', DbDate.toDb(new Date()), id, 'pending'],
+    )
+    return rows[0] ? hydrateDelivery(rows[0]) : undefined
+  }
+
+  async succeed(id: string): Promise<void> {
+    await this.#db.exec(
+      'UPDATE webhook_delivery SET state = ?, last_error = NULL, update_date = ? WHERE id = ?',
+      ['done', DbDate.toDb(new Date()), id],
+    )
+  }
+
+  /** `retryAt` puts it back in the queue; without one it has failed for good. */
+  async fail(id: string, error: string, retryAt?: Date): Promise<void> {
+    await this.#db.exec(
+      'UPDATE webhook_delivery SET state = ?, last_error = ?, run_after = ?, update_date = ? WHERE id = ?',
+      [
+        retryAt ? 'pending' : 'failed',
+        error.slice(0, 2000),
+        DbDate.toDb(retryAt ?? new Date()),
+        DbDate.toDb(new Date()),
+        id,
+      ],
+    )
+  }
+
+  async byId(id: string): Promise<WebhookDelivery | undefined> {
+    const rows = await this.#db.query(
+      `SELECT ${DELIVERY_COLUMNS} FROM webhook_delivery WHERE id = ?`,
+      [id],
+    )
+    return rows[0] ? hydrateDelivery(rows[0]) : undefined
+  }
+
+  async log(entry: Omit<WebhookLogEntry, 'key' | 'date'>, date = new Date()): Promise<void> {
+    await this.#db.exec(
+      `INSERT INTO webhook_log (key, delivery_id, subscriber, event_alias, url, status_code, success,
+         exception, retry_count, request_headers, request_body, response_headers, response_body, log_date)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      [
+        randomUUID(),
+        entry.deliveryId,
+        entry.subscriber,
+        entry.eventAlias,
+        entry.url,
+        entry.statusCode,
+        this.#db.dialect.boolValue(entry.success),
+        this.#db.dialect.boolValue(entry.exception),
+        entry.retryCount,
+        clip(entry.requestHeaders),
+        clip(entry.requestBody),
+        clip(entry.responseHeaders),
+        clip(entry.responseBody),
+        DbDate.toDb(date),
+      ],
+    )
+  }
+
+  /** The log, newest first; one subscriber's when named. */
+  async logs(options: {
+    subscriber?: string
+    skip: number
+    take: number
+  }): Promise<{ total: number; items: WebhookLogEntry[] }> {
+    const where = options.subscriber ? 'WHERE subscriber = ?' : ''
+    const params = options.subscriber ? [options.subscriber] : []
+    const total = await this.#db.query<{ n: number }>(
+      `SELECT COUNT(*) AS n FROM webhook_log ${where}`,
+      params,
+    )
+    const rows = await this.#db.query(
+      `SELECT key, delivery_id, subscriber, event_alias, url, status_code, success, exception,
+              retry_count, request_headers, request_body, response_headers, response_body, log_date
+         FROM webhook_log ${where} ORDER BY log_date DESC, retry_count DESC, key LIMIT ? OFFSET ?`,
+      [...params, options.take, options.skip],
+    )
+    return {
+      total: Number(total[0]?.n ?? 0),
+      items: rows.map((row) => ({
+        key: String(row.key),
+        deliveryId: String(row.delivery_id),
+        subscriber: String(row.subscriber),
+        eventAlias: String(row.event_alias),
+        url: String(row.url),
+        statusCode:
+          row.status_code === null || row.status_code === undefined
+            ? null
+            : Number(row.status_code),
+        success: fromDbBool(row.success),
+        exception: fromDbBool(row.exception),
+        retryCount: Number(row.retry_count),
+        requestHeaders: String(row.request_headers),
+        requestBody: String(row.request_body),
+        responseHeaders: String(row.response_headers),
+        responseBody: String(row.response_body),
+        date: DbDate.fromDb(row.log_date) ?? new Date(0),
+      })),
+    }
+  }
+}

package/src/schema/approvals.ts

@@ -0,0 +1,77 @@
+/**
+ * Migration 038 — approval requests (story 028): a request per page sent for
+ * approval, a row per stage it reaches, and its history. The workflow it runs
+ * under is copied onto the request, so a workflow changed later does not
+ * change one already in flight unless the workflow says so. Also gives the
+ * groups that edit content the Workflow section. docs/workflows.md.
+ */
+import type { Db } from '../database.ts'
+import type { Migration } from '../migrations.ts'
+import { STATE_DELIVERY_MEMBER_TOKENS } from './delivery-member-tokens.ts'
+
+export const STATE_APPROVALS = '{8e4c0a3d-0038-4b62-9c07-3d5f2b0e6c48}'
+
+/** The section the Workflow screens live in, given where content is edited. */
+export const WORKFLOW_SECTION_GROUPS = ['admin', 'editor', 'writer']
+
+export const approvalsMigration: Migration = {
+  from: STATE_DELIVERY_MEMBER_TOKENS,
+  to: STATE_APPROVALS,
+  name: 'AddApprovals',
+  kind: 'expand',
+  release: '0.13.1',
+  async up(db: Db) {
+    const t = db.dialect.types
+    await db.exec(
+      `CREATE TABLE approval_request (
+         id ${t.identity},
+         key ${t.uuid} NOT NULL,
+         node_key ${t.uuid} NOT NULL,
+         cultures ${t.text},
+         action ${t.varchar(16)} NOT NULL,
+         event_id ${t.bigint},
+         workflow_key ${t.varchar(64)} NOT NULL,
+         workflow_version ${t.varchar(32)} NOT NULL,
+         workflow ${t.json} NOT NULL,
+         state ${t.varchar(16)} NOT NULL,
+         requested_by ${t.varchar(64)} NOT NULL,
+         requested_at ${t.timestamp} NOT NULL,
+         finished_at ${t.timestamp}
+       )`,
+    )
+    await db.exec('CREATE UNIQUE INDEX ux_approval_request_key ON approval_request (key)')
+    await db.exec('CREATE INDEX ix_approval_request_node ON approval_request (node_key, state)')
+    await db.exec(
+      `CREATE TABLE approval_step (
+         id ${t.identity},
+         request_id ${t.integer} NOT NULL,
+         stage ${t.varchar(64)} NOT NULL,
+         state ${t.varchar(16)} NOT NULL,
+         reached_at ${t.timestamp} NOT NULL,
+         done_at ${t.timestamp}
+       )`,
+    )
+    await db.exec('CREATE INDEX ix_approval_step_request ON approval_step (request_id, state)')
+    await db.exec(
+      `CREATE TABLE approval_history (
+         id ${t.identity},
+         request_id ${t.integer} NOT NULL,
+         step_id ${t.integer},
+         stage ${t.varchar(64)},
+         kind ${t.varchar(16)} NOT NULL,
+         user_key ${t.varchar(64)},
+         comment ${t.text},
+         create_date ${t.timestamp} NOT NULL
+       )`,
+    )
+    await db.exec('CREATE INDEX ix_approval_history_request ON approval_history (request_id)')
+    for (const alias of WORKFLOW_SECTION_GROUPS)
+      await db.exec(
+        `INSERT INTO user_group_section (user_group_id, app_alias)
+         SELECT g.id, 'workflow' FROM user_group g
+         WHERE g.alias = ? AND NOT EXISTS (
+           SELECT 1 FROM user_group_section s WHERE s.user_group_id = g.id AND s.app_alias = 'workflow')`,
+        [alias],
+      )
+  },
+}

package/src/schema/delivery-member-tokens.ts

@@ -0,0 +1,40 @@
+/**
+ * Migration 037 — the Delivery API's member tokens (story 050):
+ * authorization codes, access and refresh tokens, each stored as the SHA-256
+ * of what the client holds, never the token itself. docs/delivery-api.md,
+ * "Member sign-in".
+ */
+import type { Db } from '../database.ts'
+import type { Migration } from '../migrations.ts'
+import { STATE_TRANSFER_ANSWERS } from './transfer-answers.ts'
+
+export const STATE_DELIVERY_MEMBER_TOKENS = '{7d3b9e2c-0037-4a51-b8f6-2c4e1a9d5b37}'
+
+export const deliveryMemberTokensMigration: Migration = {
+  from: STATE_TRANSFER_ANSWERS,
+  to: STATE_DELIVERY_MEMBER_TOKENS,
+  name: 'AddDeliveryMemberTokens',
+  kind: 'expand',
+  release: '0.12.0',
+  async up(db: Db) {
+    const t = db.dialect.types
+    await db.exec(
+      `CREATE TABLE delivery_member_token (
+         hash ${t.varchar(64)} NOT NULL,
+         kind ${t.varchar(16)} NOT NULL,
+         member_key ${t.varchar(64)} NOT NULL,
+         client_id ${t.varchar(255)} NOT NULL,
+         scopes ${t.varchar(255)} NOT NULL,
+         redirect_uri ${t.text},
+         code_challenge ${t.varchar(128)},
+         expires_at ${t.timestamp} NOT NULL,
+         redeemed_at ${t.timestamp},
+         create_date ${t.timestamp} NOT NULL,
+         PRIMARY KEY (hash)
+       )`,
+    )
+    await db.exec(
+      'CREATE INDEX ix_delivery_member_token_member ON delivery_member_token (member_key)',
+    )
+  },
+}

package/src/schema/diagnostics.ts

@@ -0,0 +1,28 @@
+/**
+ * Migration 034 — diagnostics and choice sources. docs/diagnostics.md, docs/forms.md.
+ *
+ * `server.crombolo_version` is the Crombolo release each node runs, beside the
+ * schema set version `server.version` already holds, so the cluster health check
+ * can say when nodes disagree. `form_entry_value.label` is the option label a
+ * visitor saw for a choice drawn from a source, so an entry still reads after the
+ * node or dictionary item behind it is renamed or removed.
+ */
+import type { Db } from '../database.ts'
+import type { Migration } from '../migrations.ts'
+import { schemaOps } from '../schema-ops.ts'
+import { STATE_AUDIT_LOG } from './audit-log.ts'
+
+export const STATE_DIAGNOSTICS = '{6f1d4a8e-0034-4c1a-9e7d-3a5b8c2d4e34}'
+
+export const diagnosticsMigration: Migration = {
+  from: STATE_AUDIT_LOG,
+  to: STATE_DIAGNOSTICS,
+  name: 'AddNodeVersionAndChoiceLabel',
+  kind: 'expand',
+  release: '0.12.0',
+  async up(db: Db) {
+    const ops = schemaOps(db)
+    await ops.addColumn('server', 'crombolo_version', db.dialect.types.varchar(64))
+    await ops.addColumn('form_entry_value', 'label', db.dialect.types.text)
+  },
+}

package/src/schema/plan.ts

@@ -11,7 +11,9 @@
  * may only ship in a major (`x.0.0`), because every minor and patch is rolled
  * under live nodes. The first contract will therefore name 1.0.0 at the earliest.
  */
+
 import { MigrationPlan } from '../migrations.ts'
+import { approvalsMigration } from './approvals.ts'
 import { assistantMigration } from './assistant.ts'
 import { auditLogMigration } from './audit-log.ts'
 import { bundleComponentsMigration } from './bundle-components.ts'
@@ -22,6 +24,8 @@ import { clientIdPrefixMigration } from './client-id-prefix.ts'
 import { contentMigration } from './content.ts'
 import { contentEditingMigration } from './content-editing.ts'
 import { createdPackagesMigration } from './created-packages.ts'
+import { deliveryMemberTokensMigration } from './delivery-member-tokens.ts'
+import { diagnosticsMigration } from './diagnostics.ts'
 import { elementsMigration } from './elements.ts'
 import { formPermissionPrefixMigration } from './form-permission-prefix.ts'
 import { formPermissionsMigration } from './form-permissions.ts'
@@ -40,11 +44,13 @@ import { richTextUiMigration } from './rich-text-ui.ts'
 import { searchIndexMigration } from './search-index.ts'
 import { serverRoleMigration } from './server-role.ts'
 import { sinceVersionMigration } from './since-version.ts'
+import { transferAnswersMigration } from './transfer-answers.ts'
 import { transferRunPackageMigration } from './transfer-run-package.ts'
 import { transferRunsMigration } from './transfer-runs.ts'
 import { upgradeReportMigration } from './upgrade-report.ts'
 import { usersLocalisationMigration } from './users-localisation.ts'
 import { valuesMigration } from './values.ts'
+import { webhooksMigration } from './webhooks.ts'
 
 export const cromboloPlan = new MigrationPlan([
   identityMigration,
@@ -80,4 +86,9 @@ export const cromboloPlan = new MigrationPlan([
   searchIndexMigration,
   propertySearchableMigration,
   auditLogMigration,
+  diagnosticsMigration,
+  webhooksMigration,
+  transferAnswersMigration,
+  deliveryMemberTokensMigration,
+  approvalsMigration,
 ])

package/src/schema/seed.ts

@@ -160,6 +160,7 @@ export const BUILT_IN_GROUPS = [
       'forms',
       'translation',
       'library',
+      'workflow',
     ],
   },
   {
@@ -169,7 +170,7 @@ export const BUILT_IN_GROUPS = [
     name: 'Writers',
     icon: 'icon-edit',
     hasAccessToAllLanguages: true,
-    sections: ['content', 'library'],
+    sections: ['content', 'library', 'workflow'],
   },
   {
     id: 3,
@@ -178,7 +179,7 @@ export const BUILT_IN_GROUPS = [
     name: 'Editors',
     icon: 'icon-tools',
     hasAccessToAllLanguages: true,
-    sections: ['content', 'media', 'forms', 'library'],
+    sections: ['content', 'media', 'forms', 'library', 'workflow'],
   },
   {
     id: 4,
@@ -211,7 +212,8 @@ export interface SeedAdmin {
 }
 
 export interface SeedOptions {
-  admin: SeedAdmin
+  /** Omitted, the site is left for its owner to set up from the browser. */
+  admin?: SeedAdmin
   hashPassword: (password: string) => Promise<string>
   passwordConfig: string
 }
@@ -259,6 +261,17 @@ export async function seedIdentity(db: Db, options: SeedOptions): Promise<boolea
   if (sync) await db.exec(sync)
   await grantBuiltInPermissions(db)
 
+  if (options.admin) await insertSuperUser(db, { ...options, admin: options.admin })
+  return true
+}
+
+/** Creates Umbraco's super user, in Administrators and Sensitive data. */
+export async function insertSuperUser(
+  db: Db,
+  options: SeedOptions & { admin: SeedAdmin },
+): Promise<void> {
+  const now = DbDate.toDb(new Date())
+  const bool = (value: boolean) => db.dialect.boolValue(value)
   await db.exec(
     `INSERT INTO user_account
        (key, user_name, login, email, password_hash, password_config, security_stamp, language,
@@ -294,5 +307,4 @@ export async function seedIdentity(db: Db, options: SeedOptions): Promise<boolea
       groupId,
     ])
   }
-  return true
 }

package/src/schema/transfer-answers.ts

@@ -0,0 +1,50 @@
+/**
+ * Migration 036 — a pending import and its answers, so a content transfer's
+ * conflicts can be answered in the backoffice. docs/content-transfer.md.
+ *
+ * `transfer_pending` is the last check of each bundle: where it was found and
+ * what the check was asked to do, so the dashboard can run the same import.
+ * `transfer_answer` holds the choices made there, one per node and property
+ * handle, as `resolutions.json` would.
+ */
+import type { Db } from '../database.ts'
+import type { Migration } from '../migrations.ts'
+import { STATE_WEBHOOKS } from './webhooks.ts'
+
+export const STATE_TRANSFER_ANSWERS = '{2c8e5b1a-0036-4f3d-8a6e-9d1c4b7a2e36}'
+
+export const transferAnswersMigration: Migration = {
+  from: STATE_WEBHOOKS,
+  to: STATE_TRANSFER_ANSWERS,
+  name: 'AddTransferAnswers',
+  kind: 'expand',
+  release: '0.12.0',
+  async up(db: Db) {
+    const t = db.dialect.types
+    await db.exec(
+      `CREATE TABLE transfer_pending (
+         bundle_id ${t.varchar(64)} NOT NULL,
+         label ${t.varchar(255)},
+         target ${t.text} NOT NULL,
+         target_kind ${t.varchar(16)} NOT NULL,
+         under_target ${t.text},
+         publish ${t.boolean} NOT NULL,
+         allow_missing_blobs ${t.boolean} NOT NULL,
+         checked_at ${t.timestamp} NOT NULL,
+         checked_by ${t.varchar(255)},
+         PRIMARY KEY (bundle_id)
+       )`,
+    )
+    await db.exec(
+      `CREATE TABLE transfer_answer (
+         bundle_id ${t.varchar(64)} NOT NULL,
+         node_key ${t.varchar(64)} NOT NULL,
+         handle ${t.varchar(255)} NOT NULL,
+         resolution ${t.varchar(16)} NOT NULL,
+         answered_by ${t.varchar(255)},
+         answered_at ${t.timestamp} NOT NULL,
+         PRIMARY KEY (bundle_id, node_key, handle)
+       )`,
+    )
+  },
+}

package/src/schema/webhooks.ts

@@ -0,0 +1,78 @@
+/**
+ * Migration 035 — webhooks. docs/webhooks.md.
+ *
+ * `webhook` holds the ones kept in this environment; the ones kept with the
+ * site's files are read from `schema/webhooks/`. Their headers are one encrypted
+ * blob, because a header is where an API token goes.
+ *
+ * `webhook_delivery` is the queue, for a webhook's request or a bundle's
+ * handler alike: claimed with `UPDATE … WHERE state = 'pending' … RETURNING`, so
+ * one node of a cluster delivers each. `webhook_log` keeps every attempt.
+ */
+import type { Db } from '../database.ts'
+import type { Migration } from '../migrations.ts'
+import { STATE_DIAGNOSTICS } from './diagnostics.ts'
+
+export const STATE_WEBHOOKS = '{6f1d4a8e-0035-4c1a-9e7d-3a5b8c2d4e35}'
+
+export const webhooksMigration: Migration = {
+  from: STATE_DIAGNOSTICS,
+  to: STATE_WEBHOOKS,
+  name: 'AddWebhooks',
+  kind: 'expand',
+  release: '0.12.0',
+  async up(db: Db) {
+    const t = db.dialect.types
+    await db.exec(
+      `CREATE TABLE webhook (
+         key ${t.varchar(64)} NOT NULL,
+         name ${t.varchar(255)},
+         description ${t.text},
+         url ${t.text} NOT NULL,
+         enabled ${t.boolean} NOT NULL,
+         events ${t.text} NOT NULL,
+         content_type_keys ${t.text} NOT NULL,
+         headers ${t.text},
+         create_date ${t.timestamp} NOT NULL,
+         update_date ${t.timestamp} NOT NULL,
+         PRIMARY KEY (key)
+       )`,
+    )
+    await db.exec(
+      `CREATE TABLE webhook_delivery (
+         id ${t.varchar(64)} NOT NULL,
+         subscriber ${t.varchar(255)} NOT NULL,
+         event_alias ${t.varchar(128)} NOT NULL,
+         payload ${t.text} NOT NULL,
+         state ${t.varchar(16)} NOT NULL,
+         attempts ${t.integer} NOT NULL,
+         last_error ${t.text},
+         run_after ${t.timestamp} NOT NULL,
+         create_date ${t.timestamp} NOT NULL,
+         update_date ${t.timestamp} NOT NULL,
+         PRIMARY KEY (id)
+       )`,
+    )
+    await db.exec('CREATE INDEX ix_webhook_delivery_due ON webhook_delivery (state, run_after)')
+    await db.exec(
+      `CREATE TABLE webhook_log (
+         key ${t.varchar(64)} NOT NULL,
+         delivery_id ${t.varchar(64)} NOT NULL,
+         subscriber ${t.varchar(255)} NOT NULL,
+         event_alias ${t.varchar(128)} NOT NULL,
+         url ${t.text} NOT NULL,
+         status_code ${t.integer},
+         success ${t.boolean} NOT NULL,
+         exception ${t.boolean} NOT NULL,
+         retry_count ${t.integer} NOT NULL,
+         request_headers ${t.text} NOT NULL,
+         request_body ${t.text} NOT NULL,
+         response_headers ${t.text} NOT NULL,
+         response_body ${t.text} NOT NULL,
+         log_date ${t.timestamp} NOT NULL,
+         PRIMARY KEY (key)
+       )`,
+    )
+    await db.exec('CREATE INDEX ix_webhook_log_subscriber ON webhook_log (subscriber, log_date)')
+  },
+}