@marinoscar/platform-api 0.1.0-next.18 → 0.1.0-next.20

package/dist/webhooks/http/admin-webhooks.controller.js

@@ -0,0 +1,250 @@
+"use strict";
+// =============================================================================
+// /api/admin/webhooks: the deployment's webhook endpoints (issue #1046)
+// =============================================================================
+//
+// Permissions `system_webhooks:read` / `system_webhooks:write`, held by the
+// `admin` system role. The same routes as `/api/webhooks`, pinned to the
+// deployment's own endpoints (scope `system`, no organization): the ones that
+// receive platform events such as a worker node going offline or a job failing
+// for good.
+// =============================================================================
+//
+// Permissions `webhooks:read` / `webhooks:write`, held by every organization
+// role: a member manages the endpoints THEY own in the active organization.
+// The service pins every query to the caller, so another member's endpoint or
+// delivery answers 404, never 403. The organization and system tiers are the
+// same routes under `/api/org/webhooks` and `/api/admin/webhooks`.
+// =============================================================================
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdminWebhooksController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const webhooks_1 = require("@marinoscar/platform-contract/webhooks");
+const index_1 = require("../../core/index");
+const index_2 = require("../../identity/index");
+const webhook_endpoints_service_1 = require("../webhook-endpoints.service");
+const scope_context_1 = require("./scope-context");
+const webhook_dto_1 = require("./webhook.dto");
+const READ = webhooks_1.WEBHOOK_PERMISSIONS.SYSTEM_READ;
+const WRITE = webhooks_1.WEBHOOK_PERMISSIONS.SYSTEM_WRITE;
+/**
+ * The deployment-scope webhook routes. See the file header.
+ *
+ * @stability experimental
+ */
+let AdminWebhooksController = class AdminWebhooksController {
+    endpoints;
+    constructor(endpoints) {
+        this.endpoints = endpoints;
+    }
+    /** The events the caller may subscribe to. */
+    events(principal) {
+        return { items: this.endpoints.catalog((0, scope_context_1.webhookScopeContext)(principal, 'system')) };
+    }
+    /** One delivery, with its payload. */
+    getDelivery(principal, deliveryId) {
+        return this.endpoints.getDelivery((0, scope_context_1.webhookScopeContext)(principal, 'system'), deliveryId);
+    }
+    /** Sends a delivery again. */
+    redeliver(principal, deliveryId) {
+        return this.endpoints.redeliver((0, scope_context_1.webhookScopeContext)(principal, 'system'), deliveryId);
+    }
+    /** The caller's endpoints. */
+    async list(principal) {
+        return { items: await this.endpoints.list((0, scope_context_1.webhookScopeContext)(principal, 'system')) };
+    }
+    /** Creates an endpoint. */
+    create(principal, body) {
+        return this.endpoints.create((0, scope_context_1.webhookScopeContext)(principal, 'system'), body);
+    }
+    /** One endpoint. */
+    get(principal, id) {
+        return this.endpoints.get((0, scope_context_1.webhookScopeContext)(principal, 'system'), id);
+    }
+    /** Changes an endpoint. */
+    update(principal, id, body) {
+        return this.endpoints.update((0, scope_context_1.webhookScopeContext)(principal, 'system'), id, body);
+    }
+    /** Deletes an endpoint. */
+    remove(principal, id) {
+        return this.endpoints.remove((0, scope_context_1.webhookScopeContext)(principal, 'system'), id);
+    }
+    /** Rotates the signing secret. */
+    rotate(principal, id) {
+        return this.endpoints.rotateSecret((0, scope_context_1.webhookScopeContext)(principal, 'system'), id);
+    }
+    /** Queues a test ping. */
+    test(principal, id) {
+        return this.endpoints.test((0, scope_context_1.webhookScopeContext)(principal, 'system'), id);
+    }
+    /** An endpoint's deliveries. */
+    deliveries(principal, id, query) {
+        return this.endpoints.listDeliveries((0, scope_context_1.webhookScopeContext)(principal, 'system'), id, query);
+    }
+};
+exports.AdminWebhooksController = AdminWebhooksController;
+__decorate([
+    (0, common_1.Get)('events'),
+    (0, index_2.Auth)({ permissions: [READ] }),
+    (0, swagger_1.ApiOperation)({ summary: 'List the events a webhook endpoint can subscribe to', description: 'Each with its JSON Schema and an example. Notifications appear as `notification.<eventKey>`.' }),
+    (0, index_1.ApiDataResponse)(webhook_dto_1.WebhookEventCatalogDto, { description: 'The catalog.' }),
+    __param(0, (0, index_2.CurrentPrincipal)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Object)
+], AdminWebhooksController.prototype, "events", null);
+__decorate([
+    (0, common_1.Get)('deliveries/:deliveryId'),
+    (0, index_2.Auth)({ permissions: [READ] }),
+    (0, swagger_1.ApiOperation)({ summary: 'Get one webhook delivery', description: 'The payload that was sent and the request headers that are stable across attempts (the signature is never shown). 404 unless it belongs to one of the deployment endpoints.' }),
+    (0, swagger_1.ApiParam)({ name: 'deliveryId', type: String, format: 'uuid' }),
+    (0, index_1.ApiDataResponse)(webhook_dto_1.WebhookDeliveryDetailDto, { description: 'The delivery.' }),
+    (0, swagger_1.ApiResponse)({ status: 404, description: 'Delivery not found' }),
+    __param(0, (0, index_2.CurrentPrincipal)()),
+    __param(1, (0, common_1.Param)('deliveryId', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String]),
+    __metadata("design:returntype", Promise)
+], AdminWebhooksController.prototype, "getDelivery", null);
+__decorate([
+    (0, common_1.Post)('deliveries/:deliveryId/redeliver'),
+    (0, index_2.Auth)({ permissions: [WRITE] }),
+    (0, common_1.HttpCode)(common_1.HttpStatus.ACCEPTED),
+    (0, swagger_1.ApiOperation)({ summary: 'Redeliver a webhook delivery', description: 'Puts the same delivery back to `pending` with a fresh attempt count; the event id (`webhook-id`) is unchanged. 409 while the endpoint is disabled.' }),
+    (0, swagger_1.ApiParam)({ name: 'deliveryId', type: String, format: 'uuid' }),
+    (0, index_1.ApiDataResponse)(webhook_dto_1.WebhookDeliveryDetailDto, { status: 202, description: 'Queued.' }),
+    (0, swagger_1.ApiResponse)({ status: 404, description: 'Delivery not found' }),
+    (0, swagger_1.ApiResponse)({ status: 409, description: 'The endpoint is disabled' }),
+    __param(0, (0, index_2.CurrentPrincipal)()),
+    __param(1, (0, common_1.Param)('deliveryId', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String]),
+    __metadata("design:returntype", Promise)
+], AdminWebhooksController.prototype, "redeliver", null);
+__decorate([
+    (0, common_1.Get)(),
+    (0, index_2.Auth)({ permissions: [READ] }),
+    (0, swagger_1.ApiOperation)({ summary: 'List the deployment webhook endpoints', description: 'The deployment endpoints, newest first. The signing secret is never part of a list.' }),
+    (0, index_1.ApiDataResponse)(webhook_dto_1.WebhookEndpointListDto, { description: 'The endpoints.' }),
+    __param(0, (0, index_2.CurrentPrincipal)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AdminWebhooksController.prototype, "list", null);
+__decorate([
+    (0, common_1.Post)(),
+    (0, index_2.Auth)({ permissions: [WRITE] }),
+    (0, swagger_1.ApiOperation)({ summary: 'Create a webhook endpoint', description: 'Returns the endpoint and its signing secret ONCE (`whsec_...`); store it, it is never shown again. 422 `WEBHOOK_URL_FORBIDDEN` for a URL the server will not call (private address, non-https, userinfo, a low port), `WEBHOOK_EVENT_UNKNOWN`, `WEBHOOK_EVENT_NOT_PERMITTED` or `WEBHOOK_LIMIT_REACHED`.' }),
+    (0, swagger_1.ApiBody)({ type: webhook_dto_1.CreateWebhookEndpointDto }),
+    (0, index_1.ApiDataResponse)(webhook_dto_1.WebhookEndpointCreatedDto, { status: 201, description: 'Created.' }),
+    (0, swagger_1.ApiResponse)({ status: 422, description: 'A forbidden URL, an unknown or not-permitted event, or the endpoint limit' }),
+    __param(0, (0, index_2.CurrentPrincipal)()),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, webhook_dto_1.CreateWebhookEndpointDto]),
+    __metadata("design:returntype", Promise)
+], AdminWebhooksController.prototype, "create", null);
+__decorate([
+    (0, common_1.Get)(':id'),
+    (0, index_2.Auth)({ permissions: [READ] }),
+    (0, swagger_1.ApiOperation)({ summary: 'Get one webhook endpoint', description: '404 unless it is one of the deployment endpoints.' }),
+    (0, swagger_1.ApiParam)({ name: 'id', type: String, format: 'uuid' }),
+    (0, index_1.ApiDataResponse)(webhook_dto_1.WebhookEndpointDto, { description: 'The endpoint.' }),
+    (0, swagger_1.ApiResponse)({ status: 404, description: 'Endpoint not found' }),
+    __param(0, (0, index_2.CurrentPrincipal)()),
+    __param(1, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String]),
+    __metadata("design:returntype", Promise)
+], AdminWebhooksController.prototype, "get", null);
+__decorate([
+    (0, common_1.Patch)(':id'),
+    (0, index_2.Auth)({ permissions: [WRITE] }),
+    (0, swagger_1.ApiOperation)({ summary: 'Change a webhook endpoint', description: 'Enabling a disabled endpoint resets its failure count.' }),
+    (0, swagger_1.ApiParam)({ name: 'id', type: String, format: 'uuid' }),
+    (0, swagger_1.ApiBody)({ type: webhook_dto_1.UpdateWebhookEndpointDto }),
+    (0, index_1.ApiDataResponse)(webhook_dto_1.WebhookEndpointDto, { description: 'The endpoint.' }),
+    (0, swagger_1.ApiResponse)({ status: 404, description: 'Endpoint not found' }),
+    (0, swagger_1.ApiResponse)({ status: 422, description: 'A forbidden URL or an unknown or not-permitted event' }),
+    __param(0, (0, index_2.CurrentPrincipal)()),
+    __param(1, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __param(2, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, webhook_dto_1.UpdateWebhookEndpointDto]),
+    __metadata("design:returntype", Promise)
+], AdminWebhooksController.prototype, "update", null);
+__decorate([
+    (0, common_1.Delete)(':id'),
+    (0, index_2.Auth)({ permissions: [WRITE] }),
+    (0, common_1.HttpCode)(common_1.HttpStatus.NO_CONTENT),
+    (0, swagger_1.ApiOperation)({ summary: 'Delete a webhook endpoint', description: 'Also deletes its deliveries and its stored signing secrets.' }),
+    (0, swagger_1.ApiParam)({ name: 'id', type: String, format: 'uuid' }),
+    (0, swagger_1.ApiResponse)({ status: 204, description: 'Deleted.' }),
+    (0, swagger_1.ApiResponse)({ status: 404, description: 'Endpoint not found' }),
+    __param(0, (0, index_2.CurrentPrincipal)()),
+    __param(1, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String]),
+    __metadata("design:returntype", Promise)
+], AdminWebhooksController.prototype, "remove", null);
+__decorate([
+    (0, common_1.Post)(':id/rotate-secret'),
+    (0, index_2.Auth)({ permissions: [WRITE] }),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({ summary: 'Rotate the signing secret', description: 'Returns the new secret ONCE. The previous secret keeps signing alongside it until `previousSecretValidUntil` (24 hours by default), so a delivery carries two signatures meanwhile.' }),
+    (0, swagger_1.ApiParam)({ name: 'id', type: String, format: 'uuid' }),
+    (0, index_1.ApiDataResponse)(webhook_dto_1.RotateWebhookSecretResponseDto, { description: 'The new secret.' }),
+    (0, swagger_1.ApiResponse)({ status: 404, description: 'Endpoint not found' }),
+    __param(0, (0, index_2.CurrentPrincipal)()),
+    __param(1, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String]),
+    __metadata("design:returntype", Promise)
+], AdminWebhooksController.prototype, "rotate", null);
+__decorate([
+    (0, common_1.Post)(':id/test'),
+    (0, index_2.Auth)({ permissions: [WRITE] }),
+    (0, common_1.HttpCode)(common_1.HttpStatus.ACCEPTED),
+    (0, swagger_1.ApiOperation)({ summary: 'Send a test ping', description: 'Queues a `webhooks.ping` delivery; follow it in the delivery list.' }),
+    (0, swagger_1.ApiParam)({ name: 'id', type: String, format: 'uuid' }),
+    (0, index_1.ApiDataResponse)(webhook_dto_1.WebhookTestResponseDto, { status: 202, description: 'Queued.' }),
+    (0, swagger_1.ApiResponse)({ status: 404, description: 'Endpoint not found' }),
+    __param(0, (0, index_2.CurrentPrincipal)()),
+    __param(1, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String]),
+    __metadata("design:returntype", Promise)
+], AdminWebhooksController.prototype, "test", null);
+__decorate([
+    (0, common_1.Get)(':id/deliveries'),
+    (0, index_2.Auth)({ permissions: [READ] }),
+    (0, swagger_1.ApiOperation)({ summary: "List an endpoint's deliveries", description: 'Newest first, filterable by `status` and `eventKey`.' }),
+    (0, swagger_1.ApiParam)({ name: 'id', type: String, format: 'uuid' }),
+    (0, index_1.ApiDataResponse)(webhook_dto_1.WebhookDeliveryListDto, { description: 'A page of deliveries.' }),
+    (0, swagger_1.ApiResponse)({ status: 404, description: 'Endpoint not found' }),
+    __param(0, (0, index_2.CurrentPrincipal)()),
+    __param(1, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __param(2, (0, common_1.Query)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, webhook_dto_1.WebhookDeliveryListQueryDto]),
+    __metadata("design:returntype", Promise)
+], AdminWebhooksController.prototype, "deliveries", null);
+exports.AdminWebhooksController = AdminWebhooksController = __decorate([
+    (0, swagger_1.ApiTags)('Webhooks'),
+    (0, common_1.Controller)('admin/webhooks'),
+    __metadata("design:paramtypes", [webhook_endpoints_service_1.WebhookEndpointsService])
+], AdminWebhooksController);
+//# sourceMappingURL=admin-webhooks.controller.js.map

package/dist/webhooks/http/admin-webhooks.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-webhooks.controller.js","sourceRoot":"","sources":["../../../src/webhooks/http/admin-webhooks.controller.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,wEAAwE;AACxE,gFAAgF;AAChF,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,8EAA8E;AAC9E,+EAA+E;AAC/E,YAAY;AACZ,gFAAgF;AAChF,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,mEAAmE;AACnE,gFAAgF;;;;;;;;;;;;;;;AAEhF,2CAA+H;AAC/H,6CAAwF;AACxF,qEAagD;AAEhD,4CAAmD;AAEnD,gDAA8D;AAC9D,4EAAuE;AACvE,mDAAsD;AACtD,+CAYuB;AAEvB,MAAM,IAAI,GAAG,8BAAmB,CAAC,WAAW,CAAC;AAC7C,MAAM,KAAK,GAAG,8BAAmB,CAAC,YAAY,CAAC;AAE/C;;;;GAIG;AAGI,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IACL;IAA7B,YAA6B,SAAkC;QAAlC,cAAS,GAAT,SAAS,CAAyB;IAAG,CAAC;IAEnE,8CAA8C;IAK9C,MAAM,CAAqB,SAAgC;QACzD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAA,mCAAmB,EAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;IACrF,CAAC;IAED,sCAAsC;IAOtC,WAAW,CAAqB,SAAgC,EAAsC,UAAkB;QACtH,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAA,mCAAmB,EAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;IAC1F,CAAC;IAED,8BAA8B;IAS9B,SAAS,CAAqB,SAAgC,EAAsC,UAAkB;QACpH,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAA,mCAAmB,EAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;IACxF,CAAC;IAED,8BAA8B;IAKxB,AAAN,KAAK,CAAC,IAAI,CAAqB,SAAgC;QAC7D,OAAO,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAA,mCAAmB,EAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;IACxF,CAAC;IAED,2BAA2B;IAO3B,MAAM,CAAqB,SAAgC,EAAU,IAA8B;QACjG,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAA,mCAAmB,EAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAwC,CAAC,CAAC;IACnH,CAAC;IAED,oBAAoB;IAOpB,GAAG,CAAqB,SAAgC,EAA8B,EAAU;QAC9F,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAA,mCAAmB,EAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,2BAA2B;IAS3B,MAAM,CAAqB,SAAgC,EAA8B,EAAU,EAAU,IAA8B;QACzI,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAA,mCAAmB,EAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAwC,CAAC,CAAC;IACvH,CAAC;IAED,2BAA2B;IAQ3B,MAAM,CAAqB,SAAgC,EAA8B,EAAU;QACjG,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAA,mCAAmB,EAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,kCAAkC;IAQlC,MAAM,CAAqB,SAAgC,EAA8B,EAAU;QACjG,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAA,mCAAmB,EAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,0BAA0B;IAQ1B,IAAI,CAAqB,SAAgC,EAA8B,EAAU;QAC/F,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAA,mCAAmB,EAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,gCAAgC;IAOhC,UAAU,CAAqB,SAAgC,EAA8B,EAAU,EAAW,KAAkC;QAClJ,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,IAAA,mCAAmB,EAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,KAA4C,CAAC,CAAC;IACnI,CAAC;CACF,CAAA;AA9HY,0DAAuB;AAQlC;IAJC,IAAA,YAAG,EAAC,QAAQ,CAAC;IACb,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;IAC7B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,qDAAqD,EAAE,WAAW,EAAE,8FAA8F,EAAE,CAAC;IAC7L,IAAA,uBAAe,EAAC,oCAAsB,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;IACjE,WAAA,IAAA,wBAAgB,GAAE,CAAA;;;;qDAEzB;AASD;IANC,IAAA,YAAG,EAAC,wBAAwB,CAAC;IAC7B,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;IAC7B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,6KAA6K,EAAE,CAAC;IACjP,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC9D,IAAA,uBAAe,EAAC,sCAAwB,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IAC3E,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACnD,WAAA,IAAA,wBAAgB,GAAE,CAAA;IAAoC,WAAA,IAAA,cAAK,EAAC,YAAY,EAAE,sBAAa,CAAC,CAAA;;;;0DAEpG;AAWD;IARC,IAAA,aAAI,EAAC,kCAAkC,CAAC;IACxC,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,QAAQ,CAAC;IAC7B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,WAAW,EAAE,oJAAoJ,EAAE,CAAC;IAC5N,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC9D,IAAA,uBAAe,EAAC,sCAAwB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IAClF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IAC/D,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;IAC3D,WAAA,IAAA,wBAAgB,GAAE,CAAA;IAAoC,WAAA,IAAA,cAAK,EAAC,YAAY,EAAE,sBAAa,CAAC,CAAA;;;;wDAElG;AAOK;IAJL,IAAA,YAAG,GAAE;IACL,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;IAC7B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,WAAW,EAAE,qFAAqF,EAAE,CAAC;IACtK,IAAA,uBAAe,EAAC,oCAAsB,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAC/D,WAAA,IAAA,wBAAgB,GAAE,CAAA;;;;mDAE7B;AASD;IANC,IAAA,aAAI,GAAE;IACN,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,WAAW,EAAE,0SAA0S,EAAE,CAAC;IAC/W,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sCAAwB,EAAE,CAAC;IAC3C,IAAA,uBAAe,EAAC,uCAAyB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;IACpF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2EAA2E,EAAE,CAAC;IAC/G,WAAA,IAAA,wBAAgB,GAAE,CAAA;IAAoC,WAAA,IAAA,aAAI,GAAE,CAAA;;6CAAO,sCAAwB;;qDAElG;AASD;IANC,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;IAC7B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC;IACvH,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtD,IAAA,uBAAe,EAAC,gCAAkB,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IACrE,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IAC3D,WAAA,IAAA,wBAAgB,GAAE,CAAA;IAAoC,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;kDAEpF;AAWD;IARC,IAAA,cAAK,EAAC,KAAK,CAAC;IACZ,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,WAAW,EAAE,wDAAwD,EAAE,CAAC;IAC7H,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sCAAwB,EAAE,CAAC;IAC3C,IAAA,uBAAe,EAAC,gCAAkB,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IACrE,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IAC/D,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,sDAAsD,EAAE,CAAC;IAC1F,WAAA,IAAA,wBAAgB,GAAE,CAAA;IAAoC,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;IAAc,WAAA,IAAA,aAAI,GAAE,CAAA;;qDAAO,sCAAwB;;qDAE1I;AAUD;IAPC,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,UAAU,CAAC;IAC/B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,WAAW,EAAE,6DAA6D,EAAE,CAAC;IAClI,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;IACrD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACxD,WAAA,IAAA,wBAAgB,GAAE,CAAA;IAAoC,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;qDAEvF;AAUD;IAPC,IAAA,aAAI,EAAC,mBAAmB,CAAC;IACzB,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,WAAW,EAAE,qLAAqL,EAAE,CAAC;IAC1P,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtD,IAAA,uBAAe,EAAC,4CAA8B,EAAE,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACnF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACxD,WAAA,IAAA,wBAAgB,GAAE,CAAA;IAAoC,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;qDAEvF;AAUD;IAPC,IAAA,aAAI,EAAC,UAAU,CAAC;IAChB,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,QAAQ,CAAC;IAC7B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,oEAAoE,EAAE,CAAC;IAChI,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtD,IAAA,uBAAe,EAAC,oCAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IAChF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IAC1D,WAAA,IAAA,wBAAgB,GAAE,CAAA;IAAoC,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;mDAErF;AASD;IANC,IAAA,YAAG,EAAC,gBAAgB,CAAC;IACrB,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;IAC7B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,WAAW,EAAE,sDAAsD,EAAE,CAAC;IAC/H,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtD,IAAA,uBAAe,EAAC,oCAAsB,EAAE,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC;IACjF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpD,WAAA,IAAA,wBAAgB,GAAE,CAAA;IAAoC,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;IAAc,WAAA,IAAA,cAAK,GAAE,CAAA;;qDAAQ,yCAA2B;;yDAEnJ;kCA7HU,uBAAuB;IAFnC,IAAA,iBAAO,EAAC,UAAU,CAAC;IACnB,IAAA,mBAAU,EAAC,gBAAgB,CAAC;qCAEa,mDAAuB;GADpD,uBAAuB,CA8HnC"}

package/dist/webhooks/http/org-webhooks.controller.d.ts

@@ -0,0 +1,36 @@
+import { type RotateWebhookSecretResponse, type WebhookDeliveryDetail, type WebhookDeliveryList, type WebhookEndpoint, type WebhookEndpointCreated, type WebhookEndpointList, type WebhookEventCatalog, type WebhookTestResponse } from '@marinoscar/platform-contract/webhooks';
+import type { Principal } from '../../core/index';
+import { WebhookEndpointsService } from '../webhook-endpoints.service';
+import { CreateWebhookEndpointDto, UpdateWebhookEndpointDto, WebhookDeliveryListQueryDto } from './webhook.dto';
+/**
+ * The organization-scope webhook routes. See the file header.
+ *
+ * @stability experimental
+ */
+export declare class OrgWebhooksController {
+    private readonly endpoints;
+    constructor(endpoints: WebhookEndpointsService);
+    /** The events the caller may subscribe to. */
+    events(principal: Principal | undefined): WebhookEventCatalog;
+    /** One delivery, with its payload. */
+    getDelivery(principal: Principal | undefined, deliveryId: string): Promise<WebhookDeliveryDetail>;
+    /** Sends a delivery again. */
+    redeliver(principal: Principal | undefined, deliveryId: string): Promise<WebhookDeliveryDetail>;
+    /** The caller's endpoints. */
+    list(principal: Principal | undefined): Promise<WebhookEndpointList>;
+    /** Creates an endpoint. */
+    create(principal: Principal | undefined, body: CreateWebhookEndpointDto): Promise<WebhookEndpointCreated>;
+    /** One endpoint. */
+    get(principal: Principal | undefined, id: string): Promise<WebhookEndpoint>;
+    /** Changes an endpoint. */
+    update(principal: Principal | undefined, id: string, body: UpdateWebhookEndpointDto): Promise<WebhookEndpoint>;
+    /** Deletes an endpoint. */
+    remove(principal: Principal | undefined, id: string): Promise<void>;
+    /** Rotates the signing secret. */
+    rotate(principal: Principal | undefined, id: string): Promise<RotateWebhookSecretResponse>;
+    /** Queues a test ping. */
+    test(principal: Principal | undefined, id: string): Promise<WebhookTestResponse>;
+    /** An endpoint's deliveries. */
+    deliveries(principal: Principal | undefined, id: string, query: WebhookDeliveryListQueryDto): Promise<WebhookDeliveryList>;
+}
+//# sourceMappingURL=org-webhooks.controller.d.ts.map

package/dist/webhooks/http/org-webhooks.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-webhooks.controller.d.ts","sourceRoot":"","sources":["../../../src/webhooks/http/org-webhooks.controller.ts"],"names":[],"mappings":"AAmBA,OAAO,EAGL,KAAK,2BAA2B,EAEhC,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EAExB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACzB,MAAM,wCAAwC,CAAC;AAGhD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EACL,wBAAwB,EAExB,wBAAwB,EAGxB,2BAA2B,EAM5B,MAAM,eAAe,CAAC;AAKvB;;;;GAIG;AACH,qBAEa,qBAAqB;IACpB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,uBAAuB;IAE/D,8CAA8C;IAK9C,MAAM,CAAqB,SAAS,EAAE,SAAS,GAAG,SAAS,GAAG,mBAAmB;IAIjF,sCAAsC;IAOtC,WAAW,CAAqB,SAAS,EAAE,SAAS,GAAG,SAAS,EAAsC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAIzJ,8BAA8B;IAS9B,SAAS,CAAqB,SAAS,EAAE,SAAS,GAAG,SAAS,EAAsC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAIvJ,8BAA8B;IAKxB,IAAI,CAAqB,SAAS,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAI9F,2BAA2B;IAO3B,MAAM,CAAqB,SAAS,EAAE,SAAS,GAAG,SAAS,EAAU,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAIrI,oBAAoB;IAOpB,GAAG,CAAqB,SAAS,EAAE,SAAS,GAAG,SAAS,EAA8B,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAI3H,2BAA2B;IAS3B,MAAM,CAAqB,SAAS,EAAE,SAAS,GAAG,SAAS,EAA8B,EAAE,EAAE,MAAM,EAAU,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,eAAe,CAAC;IAItK,2BAA2B;IAQ3B,MAAM,CAAqB,SAAS,EAAE,SAAS,GAAG,SAAS,EAA8B,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInH,kCAAkC;IAQlC,MAAM,CAAqB,SAAS,EAAE,SAAS,GAAG,SAAS,EAA8B,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAI1I,0BAA0B;IAQ1B,IAAI,CAAqB,SAAS,EAAE,SAAS,GAAG,SAAS,EAA8B,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAIhI,gCAAgC;IAOhC,UAAU,CAAqB,SAAS,EAAE,SAAS,GAAG,SAAS,EAA8B,EAAE,EAAE,MAAM,EAAW,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAGpL"}

package/dist/webhooks/http/org-webhooks.controller.js

@@ -0,0 +1,249 @@
+"use strict";
+// =============================================================================
+// /api/org/webhooks: the active organization's webhook endpoints (issue #1046)
+// =============================================================================
+//
+// Permissions `org_webhooks:read` / `org_webhooks:write`, held by `org_admin`.
+// The same routes as `/api/webhooks`, pinned to the organization's own
+// endpoints (scope `org`) instead of the caller's; an endpoint of another
+// organization, or one a member owns, answers 404.
+// =============================================================================
+//
+// Permissions `webhooks:read` / `webhooks:write`, held by every organization
+// role: a member manages the endpoints THEY own in the active organization.
+// The service pins every query to the caller, so another member's endpoint or
+// delivery answers 404, never 403. The organization and system tiers are the
+// same routes under `/api/org/webhooks` and `/api/admin/webhooks`.
+// =============================================================================
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgWebhooksController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const webhooks_1 = require("@marinoscar/platform-contract/webhooks");
+const index_1 = require("../../core/index");
+const index_2 = require("../../identity/index");
+const webhook_endpoints_service_1 = require("../webhook-endpoints.service");
+const scope_context_1 = require("./scope-context");
+const webhook_dto_1 = require("./webhook.dto");
+const READ = webhooks_1.WEBHOOK_PERMISSIONS.ORG_READ;
+const WRITE = webhooks_1.WEBHOOK_PERMISSIONS.ORG_WRITE;
+/**
+ * The organization-scope webhook routes. See the file header.
+ *
+ * @stability experimental
+ */
+let OrgWebhooksController = class OrgWebhooksController {
+    endpoints;
+    constructor(endpoints) {
+        this.endpoints = endpoints;
+    }
+    /** The events the caller may subscribe to. */
+    events(principal) {
+        return { items: this.endpoints.catalog((0, scope_context_1.webhookScopeContext)(principal, 'org')) };
+    }
+    /** One delivery, with its payload. */
+    getDelivery(principal, deliveryId) {
+        return this.endpoints.getDelivery((0, scope_context_1.webhookScopeContext)(principal, 'org'), deliveryId);
+    }
+    /** Sends a delivery again. */
+    redeliver(principal, deliveryId) {
+        return this.endpoints.redeliver((0, scope_context_1.webhookScopeContext)(principal, 'org'), deliveryId);
+    }
+    /** The caller's endpoints. */
+    async list(principal) {
+        return { items: await this.endpoints.list((0, scope_context_1.webhookScopeContext)(principal, 'org')) };
+    }
+    /** Creates an endpoint. */
+    create(principal, body) {
+        return this.endpoints.create((0, scope_context_1.webhookScopeContext)(principal, 'org'), body);
+    }
+    /** One endpoint. */
+    get(principal, id) {
+        return this.endpoints.get((0, scope_context_1.webhookScopeContext)(principal, 'org'), id);
+    }
+    /** Changes an endpoint. */
+    update(principal, id, body) {
+        return this.endpoints.update((0, scope_context_1.webhookScopeContext)(principal, 'org'), id, body);
+    }
+    /** Deletes an endpoint. */
+    remove(principal, id) {
+        return this.endpoints.remove((0, scope_context_1.webhookScopeContext)(principal, 'org'), id);
+    }
+    /** Rotates the signing secret. */
+    rotate(principal, id) {
+        return this.endpoints.rotateSecret((0, scope_context_1.webhookScopeContext)(principal, 'org'), id);
+    }
+    /** Queues a test ping. */
+    test(principal, id) {
+        return this.endpoints.test((0, scope_context_1.webhookScopeContext)(principal, 'org'), id);
+    }
+    /** An endpoint's deliveries. */
+    deliveries(principal, id, query) {
+        return this.endpoints.listDeliveries((0, scope_context_1.webhookScopeContext)(principal, 'org'), id, query);
+    }
+};
+exports.OrgWebhooksController = OrgWebhooksController;
+__decorate([
+    (0, common_1.Get)('events'),
+    (0, index_2.Auth)({ permissions: [READ] }),
+    (0, swagger_1.ApiOperation)({ summary: 'List the events a webhook endpoint can subscribe to', description: 'Each with its JSON Schema and an example. Notifications appear as `notification.<eventKey>`.' }),
+    (0, index_1.ApiDataResponse)(webhook_dto_1.WebhookEventCatalogDto, { description: 'The catalog.' }),
+    __param(0, (0, index_2.CurrentPrincipal)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Object)
+], OrgWebhooksController.prototype, "events", null);
+__decorate([
+    (0, common_1.Get)('deliveries/:deliveryId'),
+    (0, index_2.Auth)({ permissions: [READ] }),
+    (0, swagger_1.ApiOperation)({ summary: 'Get one webhook delivery', description: 'The payload that was sent and the request headers that are stable across attempts (the signature is never shown). 404 unless it belongs to one of the organization endpoints.' }),
+    (0, swagger_1.ApiParam)({ name: 'deliveryId', type: String, format: 'uuid' }),
+    (0, index_1.ApiDataResponse)(webhook_dto_1.WebhookDeliveryDetailDto, { description: 'The delivery.' }),
+    (0, swagger_1.ApiResponse)({ status: 404, description: 'Delivery not found' }),
+    __param(0, (0, index_2.CurrentPrincipal)()),
+    __param(1, (0, common_1.Param)('deliveryId', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String]),
+    __metadata("design:returntype", Promise)
+], OrgWebhooksController.prototype, "getDelivery", null);
+__decorate([
+    (0, common_1.Post)('deliveries/:deliveryId/redeliver'),
+    (0, index_2.Auth)({ permissions: [WRITE] }),
+    (0, common_1.HttpCode)(common_1.HttpStatus.ACCEPTED),
+    (0, swagger_1.ApiOperation)({ summary: 'Redeliver a webhook delivery', description: 'Puts the same delivery back to `pending` with a fresh attempt count; the event id (`webhook-id`) is unchanged. 409 while the endpoint is disabled.' }),
+    (0, swagger_1.ApiParam)({ name: 'deliveryId', type: String, format: 'uuid' }),
+    (0, index_1.ApiDataResponse)(webhook_dto_1.WebhookDeliveryDetailDto, { status: 202, description: 'Queued.' }),
+    (0, swagger_1.ApiResponse)({ status: 404, description: 'Delivery not found' }),
+    (0, swagger_1.ApiResponse)({ status: 409, description: 'The endpoint is disabled' }),
+    __param(0, (0, index_2.CurrentPrincipal)()),
+    __param(1, (0, common_1.Param)('deliveryId', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String]),
+    __metadata("design:returntype", Promise)
+], OrgWebhooksController.prototype, "redeliver", null);
+__decorate([
+    (0, common_1.Get)(),
+    (0, index_2.Auth)({ permissions: [READ] }),
+    (0, swagger_1.ApiOperation)({ summary: 'List the organization webhook endpoints', description: 'The organization endpoints, newest first. The signing secret is never part of a list.' }),
+    (0, index_1.ApiDataResponse)(webhook_dto_1.WebhookEndpointListDto, { description: 'The endpoints.' }),
+    __param(0, (0, index_2.CurrentPrincipal)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], OrgWebhooksController.prototype, "list", null);
+__decorate([
+    (0, common_1.Post)(),
+    (0, index_2.Auth)({ permissions: [WRITE] }),
+    (0, swagger_1.ApiOperation)({ summary: 'Create a webhook endpoint', description: 'Returns the endpoint and its signing secret ONCE (`whsec_...`); store it, it is never shown again. 422 `WEBHOOK_URL_FORBIDDEN` for a URL the server will not call (private address, non-https, userinfo, a low port), `WEBHOOK_EVENT_UNKNOWN`, `WEBHOOK_EVENT_NOT_PERMITTED` or `WEBHOOK_LIMIT_REACHED`.' }),
+    (0, swagger_1.ApiBody)({ type: webhook_dto_1.CreateWebhookEndpointDto }),
+    (0, index_1.ApiDataResponse)(webhook_dto_1.WebhookEndpointCreatedDto, { status: 201, description: 'Created.' }),
+    (0, swagger_1.ApiResponse)({ status: 422, description: 'A forbidden URL, an unknown or not-permitted event, or the endpoint limit' }),
+    __param(0, (0, index_2.CurrentPrincipal)()),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, webhook_dto_1.CreateWebhookEndpointDto]),
+    __metadata("design:returntype", Promise)
+], OrgWebhooksController.prototype, "create", null);
+__decorate([
+    (0, common_1.Get)(':id'),
+    (0, index_2.Auth)({ permissions: [READ] }),
+    (0, swagger_1.ApiOperation)({ summary: 'Get one webhook endpoint', description: '404 unless it is one of the organization endpoints.' }),
+    (0, swagger_1.ApiParam)({ name: 'id', type: String, format: 'uuid' }),
+    (0, index_1.ApiDataResponse)(webhook_dto_1.WebhookEndpointDto, { description: 'The endpoint.' }),
+    (0, swagger_1.ApiResponse)({ status: 404, description: 'Endpoint not found' }),
+    __param(0, (0, index_2.CurrentPrincipal)()),
+    __param(1, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String]),
+    __metadata("design:returntype", Promise)
+], OrgWebhooksController.prototype, "get", null);
+__decorate([
+    (0, common_1.Patch)(':id'),
+    (0, index_2.Auth)({ permissions: [WRITE] }),
+    (0, swagger_1.ApiOperation)({ summary: 'Change a webhook endpoint', description: 'Enabling a disabled endpoint resets its failure count.' }),
+    (0, swagger_1.ApiParam)({ name: 'id', type: String, format: 'uuid' }),
+    (0, swagger_1.ApiBody)({ type: webhook_dto_1.UpdateWebhookEndpointDto }),
+    (0, index_1.ApiDataResponse)(webhook_dto_1.WebhookEndpointDto, { description: 'The endpoint.' }),
+    (0, swagger_1.ApiResponse)({ status: 404, description: 'Endpoint not found' }),
+    (0, swagger_1.ApiResponse)({ status: 422, description: 'A forbidden URL or an unknown or not-permitted event' }),
+    __param(0, (0, index_2.CurrentPrincipal)()),
+    __param(1, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __param(2, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, webhook_dto_1.UpdateWebhookEndpointDto]),
+    __metadata("design:returntype", Promise)
+], OrgWebhooksController.prototype, "update", null);
+__decorate([
+    (0, common_1.Delete)(':id'),
+    (0, index_2.Auth)({ permissions: [WRITE] }),
+    (0, common_1.HttpCode)(common_1.HttpStatus.NO_CONTENT),
+    (0, swagger_1.ApiOperation)({ summary: 'Delete a webhook endpoint', description: 'Also deletes its deliveries and its stored signing secrets.' }),
+    (0, swagger_1.ApiParam)({ name: 'id', type: String, format: 'uuid' }),
+    (0, swagger_1.ApiResponse)({ status: 204, description: 'Deleted.' }),
+    (0, swagger_1.ApiResponse)({ status: 404, description: 'Endpoint not found' }),
+    __param(0, (0, index_2.CurrentPrincipal)()),
+    __param(1, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String]),
+    __metadata("design:returntype", Promise)
+], OrgWebhooksController.prototype, "remove", null);
+__decorate([
+    (0, common_1.Post)(':id/rotate-secret'),
+    (0, index_2.Auth)({ permissions: [WRITE] }),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({ summary: 'Rotate the signing secret', description: 'Returns the new secret ONCE. The previous secret keeps signing alongside it until `previousSecretValidUntil` (24 hours by default), so a delivery carries two signatures meanwhile.' }),
+    (0, swagger_1.ApiParam)({ name: 'id', type: String, format: 'uuid' }),
+    (0, index_1.ApiDataResponse)(webhook_dto_1.RotateWebhookSecretResponseDto, { description: 'The new secret.' }),
+    (0, swagger_1.ApiResponse)({ status: 404, description: 'Endpoint not found' }),
+    __param(0, (0, index_2.CurrentPrincipal)()),
+    __param(1, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String]),
+    __metadata("design:returntype", Promise)
+], OrgWebhooksController.prototype, "rotate", null);
+__decorate([
+    (0, common_1.Post)(':id/test'),
+    (0, index_2.Auth)({ permissions: [WRITE] }),
+    (0, common_1.HttpCode)(common_1.HttpStatus.ACCEPTED),
+    (0, swagger_1.ApiOperation)({ summary: 'Send a test ping', description: 'Queues a `webhooks.ping` delivery; follow it in the delivery list.' }),
+    (0, swagger_1.ApiParam)({ name: 'id', type: String, format: 'uuid' }),
+    (0, index_1.ApiDataResponse)(webhook_dto_1.WebhookTestResponseDto, { status: 202, description: 'Queued.' }),
+    (0, swagger_1.ApiResponse)({ status: 404, description: 'Endpoint not found' }),
+    __param(0, (0, index_2.CurrentPrincipal)()),
+    __param(1, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String]),
+    __metadata("design:returntype", Promise)
+], OrgWebhooksController.prototype, "test", null);
+__decorate([
+    (0, common_1.Get)(':id/deliveries'),
+    (0, index_2.Auth)({ permissions: [READ] }),
+    (0, swagger_1.ApiOperation)({ summary: "List an endpoint's deliveries", description: 'Newest first, filterable by `status` and `eventKey`.' }),
+    (0, swagger_1.ApiParam)({ name: 'id', type: String, format: 'uuid' }),
+    (0, index_1.ApiDataResponse)(webhook_dto_1.WebhookDeliveryListDto, { description: 'A page of deliveries.' }),
+    (0, swagger_1.ApiResponse)({ status: 404, description: 'Endpoint not found' }),
+    __param(0, (0, index_2.CurrentPrincipal)()),
+    __param(1, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __param(2, (0, common_1.Query)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, webhook_dto_1.WebhookDeliveryListQueryDto]),
+    __metadata("design:returntype", Promise)
+], OrgWebhooksController.prototype, "deliveries", null);
+exports.OrgWebhooksController = OrgWebhooksController = __decorate([
+    (0, swagger_1.ApiTags)('Webhooks'),
+    (0, common_1.Controller)('org/webhooks'),
+    __metadata("design:paramtypes", [webhook_endpoints_service_1.WebhookEndpointsService])
+], OrgWebhooksController);
+//# sourceMappingURL=org-webhooks.controller.js.map

package/dist/webhooks/http/org-webhooks.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-webhooks.controller.js","sourceRoot":"","sources":["../../../src/webhooks/http/org-webhooks.controller.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,EAAE;AACF,+EAA+E;AAC/E,uEAAuE;AACvE,0EAA0E;AAC1E,mDAAmD;AACnD,gFAAgF;AAChF,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,mEAAmE;AACnE,gFAAgF;;;;;;;;;;;;;;;AAEhF,2CAA+H;AAC/H,6CAAwF;AACxF,qEAagD;AAEhD,4CAAmD;AAEnD,gDAA8D;AAC9D,4EAAuE;AACvE,mDAAsD;AACtD,+CAYuB;AAEvB,MAAM,IAAI,GAAG,8BAAmB,CAAC,QAAQ,CAAC;AAC1C,MAAM,KAAK,GAAG,8BAAmB,CAAC,SAAS,CAAC;AAE5C;;;;GAIG;AAGI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IACH;IAA7B,YAA6B,SAAkC;QAAlC,cAAS,GAAT,SAAS,CAAyB;IAAG,CAAC;IAEnE,8CAA8C;IAK9C,MAAM,CAAqB,SAAgC;QACzD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAA,mCAAmB,EAAC,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;IAClF,CAAC;IAED,sCAAsC;IAOtC,WAAW,CAAqB,SAAgC,EAAsC,UAAkB;QACtH,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAA,mCAAmB,EAAC,SAAS,EAAE,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC;IACvF,CAAC;IAED,8BAA8B;IAS9B,SAAS,CAAqB,SAAgC,EAAsC,UAAkB;QACpH,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAA,mCAAmB,EAAC,SAAS,EAAE,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC;IACrF,CAAC;IAED,8BAA8B;IAKxB,AAAN,KAAK,CAAC,IAAI,CAAqB,SAAgC;QAC7D,OAAO,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAA,mCAAmB,EAAC,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;IACrF,CAAC;IAED,2BAA2B;IAO3B,MAAM,CAAqB,SAAgC,EAAU,IAA8B;QACjG,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAA,mCAAmB,EAAC,SAAS,EAAE,KAAK,CAAC,EAAE,IAAwC,CAAC,CAAC;IAChH,CAAC;IAED,oBAAoB;IAOpB,GAAG,CAAqB,SAAgC,EAA8B,EAAU;QAC9F,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAA,mCAAmB,EAAC,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,2BAA2B;IAS3B,MAAM,CAAqB,SAAgC,EAA8B,EAAU,EAAU,IAA8B;QACzI,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAA,mCAAmB,EAAC,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,IAAwC,CAAC,CAAC;IACpH,CAAC;IAED,2BAA2B;IAQ3B,MAAM,CAAqB,SAAgC,EAA8B,EAAU;QACjG,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAA,mCAAmB,EAAC,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,kCAAkC;IAQlC,MAAM,CAAqB,SAAgC,EAA8B,EAAU;QACjG,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAA,mCAAmB,EAAC,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,0BAA0B;IAQ1B,IAAI,CAAqB,SAAgC,EAA8B,EAAU;QAC/F,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAA,mCAAmB,EAAC,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,gCAAgC;IAOhC,UAAU,CAAqB,SAAgC,EAA8B,EAAU,EAAW,KAAkC;QAClJ,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,IAAA,mCAAmB,EAAC,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,KAA4C,CAAC,CAAC;IAChI,CAAC;CACF,CAAA;AA9HY,sDAAqB;AAQhC;IAJC,IAAA,YAAG,EAAC,QAAQ,CAAC;IACb,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;IAC7B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,qDAAqD,EAAE,WAAW,EAAE,8FAA8F,EAAE,CAAC;IAC7L,IAAA,uBAAe,EAAC,oCAAsB,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;IACjE,WAAA,IAAA,wBAAgB,GAAE,CAAA;;;;mDAEzB;AASD;IANC,IAAA,YAAG,EAAC,wBAAwB,CAAC;IAC7B,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;IAC7B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,+KAA+K,EAAE,CAAC;IACnP,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC9D,IAAA,uBAAe,EAAC,sCAAwB,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IAC3E,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACnD,WAAA,IAAA,wBAAgB,GAAE,CAAA;IAAoC,WAAA,IAAA,cAAK,EAAC,YAAY,EAAE,sBAAa,CAAC,CAAA;;;;wDAEpG;AAWD;IARC,IAAA,aAAI,EAAC,kCAAkC,CAAC;IACxC,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,QAAQ,CAAC;IAC7B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,WAAW,EAAE,oJAAoJ,EAAE,CAAC;IAC5N,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC9D,IAAA,uBAAe,EAAC,sCAAwB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IAClF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IAC/D,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;IAC3D,WAAA,IAAA,wBAAgB,GAAE,CAAA;IAAoC,WAAA,IAAA,cAAK,EAAC,YAAY,EAAE,sBAAa,CAAC,CAAA;;;;sDAElG;AAOK;IAJL,IAAA,YAAG,GAAE;IACL,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;IAC7B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,yCAAyC,EAAE,WAAW,EAAE,uFAAuF,EAAE,CAAC;IAC1K,IAAA,uBAAe,EAAC,oCAAsB,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAC/D,WAAA,IAAA,wBAAgB,GAAE,CAAA;;;;iDAE7B;AASD;IANC,IAAA,aAAI,GAAE;IACN,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,WAAW,EAAE,0SAA0S,EAAE,CAAC;IAC/W,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sCAAwB,EAAE,CAAC;IAC3C,IAAA,uBAAe,EAAC,uCAAyB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;IACpF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2EAA2E,EAAE,CAAC;IAC/G,WAAA,IAAA,wBAAgB,GAAE,CAAA;IAAoC,WAAA,IAAA,aAAI,GAAE,CAAA;;6CAAO,sCAAwB;;mDAElG;AASD;IANC,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;IAC7B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC;IACzH,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtD,IAAA,uBAAe,EAAC,gCAAkB,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IACrE,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IAC3D,WAAA,IAAA,wBAAgB,GAAE,CAAA;IAAoC,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;gDAEpF;AAWD;IARC,IAAA,cAAK,EAAC,KAAK,CAAC;IACZ,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,WAAW,EAAE,wDAAwD,EAAE,CAAC;IAC7H,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sCAAwB,EAAE,CAAC;IAC3C,IAAA,uBAAe,EAAC,gCAAkB,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IACrE,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IAC/D,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,sDAAsD,EAAE,CAAC;IAC1F,WAAA,IAAA,wBAAgB,GAAE,CAAA;IAAoC,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;IAAc,WAAA,IAAA,aAAI,GAAE,CAAA;;qDAAO,sCAAwB;;mDAE1I;AAUD;IAPC,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,UAAU,CAAC;IAC/B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,WAAW,EAAE,6DAA6D,EAAE,CAAC;IAClI,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;IACrD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACxD,WAAA,IAAA,wBAAgB,GAAE,CAAA;IAAoC,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;mDAEvF;AAUD;IAPC,IAAA,aAAI,EAAC,mBAAmB,CAAC;IACzB,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,WAAW,EAAE,qLAAqL,EAAE,CAAC;IAC1P,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtD,IAAA,uBAAe,EAAC,4CAA8B,EAAE,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACnF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACxD,WAAA,IAAA,wBAAgB,GAAE,CAAA;IAAoC,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;mDAEvF;AAUD;IAPC,IAAA,aAAI,EAAC,UAAU,CAAC;IAChB,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,QAAQ,CAAC;IAC7B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,oEAAoE,EAAE,CAAC;IAChI,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtD,IAAA,uBAAe,EAAC,oCAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IAChF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IAC1D,WAAA,IAAA,wBAAgB,GAAE,CAAA;IAAoC,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;iDAErF;AASD;IANC,IAAA,YAAG,EAAC,gBAAgB,CAAC;IACrB,IAAA,YAAI,EAAC,EAAE,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;IAC7B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,WAAW,EAAE,sDAAsD,EAAE,CAAC;IAC/H,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtD,IAAA,uBAAe,EAAC,oCAAsB,EAAE,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC;IACjF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpD,WAAA,IAAA,wBAAgB,GAAE,CAAA;IAAoC,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;IAAc,WAAA,IAAA,cAAK,GAAE,CAAA;;qDAAQ,yCAA2B;;uDAEnJ;gCA7HU,qBAAqB;IAFjC,IAAA,iBAAO,EAAC,UAAU,CAAC;IACnB,IAAA,mBAAU,EAAC,cAAc,CAAC;qCAEe,mDAAuB;GADpD,qBAAqB,CA8HjC"}

package/dist/webhooks/http/scope-context.d.ts

@@ -0,0 +1,17 @@
+import type { WebhookScope } from '@marinoscar/platform-contract/webhooks';
+import type { Principal } from '../../core/index';
+import type { WebhookScopeContext } from '../webhook-endpoints.service';
+/**
+ * The request's principal as the service's context. A worker node's credential
+ * manages no webhooks, and an organization-bound scope needs an active
+ * organization.
+ *
+ * @param principal - the request principal.
+ * @param scope - the scope of the controller.
+ * @returns the context.
+ * @throws ForbiddenException for a non-user principal or a missing active organization.
+ *
+ * @stability experimental
+ */
+export declare function webhookScopeContext(principal: Principal | undefined, scope: WebhookScope): WebhookScopeContext;
+//# sourceMappingURL=scope-context.d.ts.map

package/dist/webhooks/http/scope-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-context.d.ts","sourceRoot":"","sources":["../../../src/webhooks/http/scope-context.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AAE3E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAExE;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,EAAE,KAAK,EAAE,YAAY,GAAG,mBAAmB,CAK9G"}

package/dist/webhooks/http/scope-context.js

@@ -0,0 +1,28 @@
+"use strict";
+// =============================================================================
+// The caller, as a webhook scope context (issue #1046)
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.webhookScopeContext = webhookScopeContext;
+const common_1 = require("@nestjs/common");
+/**
+ * The request's principal as the service's context. A worker node's credential
+ * manages no webhooks, and an organization-bound scope needs an active
+ * organization.
+ *
+ * @param principal - the request principal.
+ * @param scope - the scope of the controller.
+ * @returns the context.
+ * @throws ForbiddenException for a non-user principal or a missing active organization.
+ *
+ * @stability experimental
+ */
+function webhookScopeContext(principal, scope) {
+    if (!principal || principal.kind !== 'user')
+        throw new common_1.ForbiddenException('Webhooks are for signed-in users');
+    const orgId = principal.activeOrgId ?? null;
+    if (scope !== 'system' && !orgId)
+        throw new common_1.ForbiddenException('This credential has no active organization');
+    return { scope, userId: principal.userId, orgId: scope === 'system' ? null : orgId, permissions: principal.permissions };
+}
+//# sourceMappingURL=scope-context.js.map

package/dist/webhooks/http/scope-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-context.js","sourceRoot":"","sources":["../../../src/webhooks/http/scope-context.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,uDAAuD;AACvD,gFAAgF;;AAoBhF,kDAKC;AAvBD,2CAAoD;AAMpD;;;;;;;;;;;GAWG;AACH,SAAgB,mBAAmB,CAAC,SAAgC,EAAE,KAAmB;IACvF,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;QAAE,MAAM,IAAI,2BAAkB,CAAC,kCAAkC,CAAC,CAAC;IAC9G,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,IAAI,IAAI,CAAC;IAC5C,IAAI,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,2BAAkB,CAAC,4CAA4C,CAAC,CAAC;IAC7G,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC;AAC3H,CAAC"}