@objectstack/plugin-webhooks 17.0.0 → 17.1.0

package/dist/index.cjs

@@ -1,6 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
-var _chunkQ4FEMGD6cjs = require('./chunk-Q4FEMGD6.cjs');
+var _chunkDRHJ2M45cjs = require('./chunk-DRHJ2M45.cjs');
 
 // src/webhook-secret.ts
 var WEBHOOK_SECRET_FIELD = "signing_secret";
@@ -1062,6 +1062,98 @@ function unbindWebhookProvenanceStamp(engine) {
   }
 }
 
+// src/webhook-headers-gate.ts
+var WEBHOOK_HEADERS_SHAPE_REFUSAL_CODE = "VALIDATION_ERROR";
+var WEBHOOK_HEADERS_SHAPE_REFUSAL_STATUS = 400;
+var DECLARED_SHAPE = 'Custom HTTP headers sent with each delivery, as a JSON object ({"Authorization": "Bearer ..."})';
+var WebhookHeadersShapeError = class extends Error {
+  constructor(object, field, diagnosis) {
+    super(
+      `Custom headers refused for "${object}.${field}": ${diagnosis}. The required shape is a FLAT JSON object of string values, which is what the field itself asks for \u2014 its description reads: "${DECLARED_SHAPE}". This is checked at the write door because one step later there is nothing left to check: the engine encrypts this value into sys_secret and every read path returns only the mask, so a stored value that can never be used is indistinguishable from one that works until the next delivery tries to send it \u2014 at which point the subscription parks and the report arrives an unbounded time later, in a different surface from the one it was typed into (#7986, #8558, #8566). ${HEADERS_REMEDY}`
+    );
+    this.code = WEBHOOK_HEADERS_SHAPE_REFUSAL_CODE;
+    this.status = WEBHOOK_HEADERS_SHAPE_REFUSAL_STATUS;
+    this.name = "WebhookHeadersShapeError";
+    this.object = object;
+    this.field = field;
+  }
+};
+function describeParsed(parsed) {
+  if (parsed === null) return "null";
+  if (Array.isArray(parsed)) return "a JSON array";
+  if (typeof parsed !== "object") return `a JSON ${typeof parsed}`;
+  const entries = Object.entries(parsed);
+  if (entries.length === 0) {
+    return 'an EMPTY JSON object, which is not the same thing as "send no custom headers"';
+  }
+  const bad = entries.filter(([, v]) => typeof v !== "string");
+  if (bad.length > 0) {
+    const named = bad.map(([k, v]) => `${JSON.stringify(k)} (${Array.isArray(v) ? "array" : v === null ? "null" : typeof v})`).join(", ");
+    return `a JSON object, but the wire carries only strings and ${bad.length === 1 ? "this value is" : "these values are"} not a string: ${named}`;
+  }
+  return "a JSON object the header seam does not accept";
+}
+function describeRejected(value) {
+  if (typeof value === "string") {
+    let parsed;
+    try {
+      parsed = JSON.parse(value);
+    } catch (e10) {
+      return "the value is a string that is not valid JSON at all \u2014 check for unquoted keys or values ({X-Team: crm}), single quotes instead of double, or a trailing comma";
+    }
+    return `the value parses as JSON but is ${describeParsed(parsed)}`;
+  }
+  return `the value is ${describeParsed(value)}`;
+}
+function assertWritableWebhookHeaders(data, object = WEBHOOK_OBJECT, field = WEBHOOK_HEADERS_FIELD) {
+  if (!data || typeof data !== "object") return;
+  if (!Object.prototype.hasOwnProperty.call(data, field)) return;
+  const value = data[field];
+  if (value === null || typeof value === "undefined") return;
+  if (value === "") return;
+  if (isOpaqueSecretForm(value)) return;
+  let serialized;
+  if (typeof value === "string") {
+    serialized = value;
+  } else {
+    try {
+      serialized = JSON.stringify(value);
+    } catch (e11) {
+      throw new WebhookHeadersShapeError(
+        object,
+        field,
+        "the value cannot be serialized to JSON at all (it contains a circular reference)"
+      );
+    }
+    if (typeof serialized !== "string") {
+      throw new WebhookHeadersShapeError(object, field, `the value is a ${typeof value}`);
+    }
+  }
+  if (parseStoredHeaders(serialized)) return;
+  throw new WebhookHeadersShapeError(object, field, describeRejected(value));
+}
+var WEBHOOK_HEADERS_GATE_PACKAGE = "plugin-webhooks:headers-shape-gate";
+var GATE_PRIORITY = 50;
+function bindWebhookHeadersShapeGate(engine, logger) {
+  if (typeof _optionalChain([engine, 'optionalAccess', _125 => _125.registerHook]) !== "function") return;
+  const handler = (ctx) => {
+    assertWritableWebhookHeaders(_optionalChain([ctx, 'optionalAccess', _126 => _126.input, 'optionalAccess', _127 => _127.data]));
+  };
+  for (const event of ["beforeInsert", "beforeUpdate"]) {
+    engine.registerHook(event, handler, {
+      object: WEBHOOK_OBJECT,
+      packageId: WEBHOOK_HEADERS_GATE_PACKAGE,
+      priority: GATE_PRIORITY
+    });
+  }
+  _optionalChain([logger, 'optionalAccess', _128 => _128.info, 'optionalCall', _129 => _129("[webhook] headers_secret shape gate bound (refuses non-flat-string-map plaintext)")]);
+}
+function unbindWebhookHeadersShapeGate(engine) {
+  if (typeof _optionalChain([engine, 'optionalAccess', _130 => _130.unregisterHooksByPackage]) === "function") {
+    engine.unregisterHooksByPackage(WEBHOOK_HEADERS_GATE_PACKAGE);
+  }
+}
+
 // src/webhook-outbox-plugin.ts
 var WebhookOutboxPlugin = class {
   constructor(options = {}) {
@@ -1092,7 +1184,7 @@ var WebhookOutboxPlugin = class {
         scope: "system",
         name: "Webhook Schemas",
         description: "Registers sys_webhook (configuration). Deliveries use messaging's sys_http_delivery outbox.",
-        objects: [_chunkQ4FEMGD6cjs.SysWebhook],
+        objects: [_chunkDRHJ2M45cjs.SysWebhook],
         navigationContributions: [
           {
             app: "setup",
@@ -1106,7 +1198,7 @@ var WebhookOutboxPlugin = class {
         ]
       });
     } else {
-      _optionalChain([ctx, 'access', _125 => _125.logger, 'access', _126 => _126.warn, 'optionalCall', _127 => _127(
+      _optionalChain([ctx, 'access', _131 => _131.logger, 'access', _132 => _132.warn, 'optionalCall', _133 => _133(
         "[webhook-outbox] manifest service unavailable \u2014 sys_webhook will NOT appear in REST or Studio nav. Register MetadataService before WebhookOutboxPlugin."
       )]);
     }
@@ -1115,12 +1207,12 @@ var WebhookOutboxPlugin = class {
         try {
           const i18n = ctx.getService("i18n");
           if (i18n && typeof i18n.loadTranslations === "function") {
-            const { WebhooksTranslations } = await Promise.resolve().then(() => _interopRequireWildcard(require("./translations-H5ZYI6YP.cjs")));
+            const { WebhooksTranslations } = await Promise.resolve().then(() => _interopRequireWildcard(require("./translations-IHRALWSP.cjs")));
             for (const [locale, data] of Object.entries(WebhooksTranslations)) {
               i18n.loadTranslations(locale, data);
             }
           }
-        } catch (e10) {
+        } catch (e12) {
         }
       });
     }
@@ -1132,16 +1224,20 @@ var WebhookOutboxPlugin = class {
         this.registerAdminRoutes(ctx);
       });
     }
-    _optionalChain([ctx, 'access', _128 => _128.logger, 'access', _129 => _129.info, 'optionalCall', _130 => _130("[webhook-outbox] initialised (delivery via shared messaging HTTP outbox)", {
+    _optionalChain([ctx, 'access', _134 => _134.logger, 'access', _135 => _135.info, 'optionalCall', _136 => _136("[webhook-outbox] initialised (delivery via shared messaging HTTP outbox)", {
       autoEnqueue: autoEnqueueOpt !== false
     })]);
   }
   async dispose() {
-    await _optionalChain([this, 'access', _131 => _131.autoEnqueuer, 'optionalAccess', _132 => _132.stop, 'call', _133 => _133()]);
+    await _optionalChain([this, 'access', _137 => _137.autoEnqueuer, 'optionalAccess', _138 => _138.stop, 'call', _139 => _139()]);
     if (this.boundEngine) {
       try {
         unbindWebhookProvenanceStamp(this.boundEngine);
-      } catch (e11) {
+      } catch (e13) {
+      }
+      try {
+        unbindWebhookHeadersShapeGate(this.boundEngine);
+      } catch (e14) {
       }
       this.boundEngine = void 0;
     }
@@ -1165,28 +1261,29 @@ var WebhookOutboxPlugin = class {
   async bootDeclaredWebhooks(ctx) {
     const engine = this.tryGetService(ctx, ["objectql", "data"]);
     if (!engine) {
-      _optionalChain([ctx, 'access', _134 => _134.logger, 'access', _135 => _135.warn, 'optionalCall', _136 => _136("[webhook] declared-webhook bootstrap skipped \u2014 no data engine available")]);
+      _optionalChain([ctx, 'access', _140 => _140.logger, 'access', _141 => _141.warn, 'optionalCall', _142 => _142("[webhook] declared-webhook bootstrap skipped \u2014 no data engine available")]);
       return;
     }
     this.boundEngine = engine;
     bindWebhookProvenanceStamp(engine, ctx.logger);
+    bindWebhookHeadersShapeGate(engine, ctx.logger);
     let metadataService;
     try {
       metadataService = ctx.getService("metadata");
-    } catch (e12) {
+    } catch (e15) {
     }
     try {
       await bootstrapDeclaredWebhooks(engine, metadataService, ctx.logger);
     } catch (err) {
-      _optionalChain([ctx, 'access', _137 => _137.logger, 'access', _138 => _138.warn, 'optionalCall', _139 => _139("[webhook] declared-webhook bootstrap failed (dispatcher still serves admin rows)", {
-        error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _140 => _140.message]), () => ( String(err)))
+      _optionalChain([ctx, 'access', _143 => _143.logger, 'access', _144 => _144.warn, 'optionalCall', _145 => _145("[webhook] declared-webhook bootstrap failed (dispatcher still serves admin rows)", {
+        error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _146 => _146.message]), () => ( String(err)))
       })]);
     }
     try {
       await migrateLegacyWebhookSecrets(engine, ctx.logger);
     } catch (err) {
-      _optionalChain([ctx, 'access', _141 => _141.logger, 'access', _142 => _142.warn, 'optionalCall', _143 => _143("[webhook] legacy signing-secret sweep failed (rows left unchanged)", {
-        error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _144 => _144.message]), () => ( String(err)))
+      _optionalChain([ctx, 'access', _147 => _147.logger, 'access', _148 => _148.warn, 'optionalCall', _149 => _149("[webhook] legacy signing-secret sweep failed (rows left unchanged)", {
+        error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _150 => _150.message]), () => ( String(err)))
       })]);
     }
   }
@@ -1196,14 +1293,14 @@ var WebhookOutboxPlugin = class {
     const realtime = this.tryGetService(ctx, ["realtime"]);
     const messaging = this.getMessaging(ctx);
     if (!engine || !realtime || !messaging) {
-      _optionalChain([ctx, 'access', _145 => _145.logger, 'access', _146 => _146.warn, 'optionalCall', _147 => _147(
+      _optionalChain([ctx, 'access', _151 => _151.logger, 'access', _152 => _152.warn, 'optionalCall', _153 => _153(
         "[webhook-auto-enqueuer] disabled \u2014 ObjectQL, Realtime, or Messaging service not available",
         { hasEngine: !!engine, hasRealtime: !!realtime, hasMessaging: !!messaging }
       )]);
       return;
     }
     if (!messaging.isHttpDeliveryReady()) {
-      _optionalChain([ctx, 'access', _148 => _148.logger, 'access', _149 => _149.warn, 'optionalCall', _150 => _150(
+      _optionalChain([ctx, 'access', _154 => _154.logger, 'access', _155 => _155.warn, 'optionalCall', _156 => _156(
         "[webhook-auto-enqueuer] messaging HTTP outbox not ready (no data engine / reliableDelivery off) \u2014 webhook deliveries will not be durable"
       )]);
     }
@@ -1217,7 +1314,7 @@ var WebhookOutboxPlugin = class {
     );
     await this.autoEnqueuer.start();
     ctx.registerService("webhook.autoEnqueuer", this.autoEnqueuer);
-    _optionalChain([ctx, 'access', _151 => _151.logger, 'access', _152 => _152.info, 'optionalCall', _153 => _153("[webhook-auto-enqueuer] started (enqueues source=webhook onto sys_http_delivery)")]);
+    _optionalChain([ctx, 'access', _157 => _157.logger, 'access', _158 => _158.info, 'optionalCall', _159 => _159("[webhook-auto-enqueuer] started (enqueues source=webhook onto sys_http_delivery)")]);
   }
   /**
    * [#8069] Register {@link createWebhookRedeliverGuard} with messaging, so
@@ -1233,7 +1330,7 @@ var WebhookOutboxPlugin = class {
    */
   installRedeliverGuard(ctx, messaging, engine, subscriptionsObject) {
     if (typeof messaging.registerRedeliverGuard !== "function") {
-      _optionalChain([ctx, 'access', _154 => _154.logger, 'access', _155 => _155.error, 'optionalCall', _156 => _156(
+      _optionalChain([ctx, 'access', _160 => _160.logger, 'access', _161 => _161.error, 'optionalCall', _162 => _162(
         "[webhook-outbox] messaging service exposes no registerRedeliverGuard() \u2014 redelivery of a webhook whose signing configuration is gone CANNOT be refused, so an operator pressing redeliver may send a delivery that can no longer be authenticated (#7799, #8069). The POST /api/v1/webhooks/redeliver endpoint is reachable by any authenticated user. Fix: upgrade @objectstack/service-messaging to a build that implements registerRedeliverGuard."
       )]);
       return;
@@ -1242,14 +1339,14 @@ var WebhookOutboxPlugin = class {
       "webhook",
       createWebhookRedeliverGuard(engine, subscriptionsObject)
     );
-    _optionalChain([ctx, 'access', _157 => _157.logger, 'access', _158 => _158.debug, 'optionalCall', _159 => _159("[webhook-outbox] redeliver guard installed for source=webhook")]);
+    _optionalChain([ctx, 'access', _163 => _163.logger, 'access', _164 => _164.debug, 'optionalCall', _165 => _165("[webhook-outbox] redeliver guard installed for source=webhook")]);
   }
   tryGetService(ctx, names) {
     for (const n of names) {
       try {
         const svc = ctx.getService(n);
         if (svc) return svc;
-      } catch (e13) {
+      } catch (e16) {
       }
     }
     return void 0;
@@ -1262,7 +1359,7 @@ var WebhookOutboxPlugin = class {
   registerAdminRoutes(ctx) {
     const http = this.tryGetService(ctx, ["http-server"]);
     if (!http || typeof http.getRawApp !== "function") {
-      _optionalChain([ctx, 'access', _160 => _160.logger, 'access', _161 => _161.debug, 'optionalCall', _162 => _162("[webhook-outbox] HTTP server not available; redeliver endpoint not mounted")]);
+      _optionalChain([ctx, 'access', _166 => _166.logger, 'access', _167 => _167.debug, 'optionalCall', _168 => _168("[webhook-outbox] HTTP server not available; redeliver endpoint not mounted")]);
       return;
     }
     const rawApp = http.getRawApp();
@@ -1279,10 +1376,10 @@ var WebhookOutboxPlugin = class {
       let body;
       try {
         body = await c.req.json();
-      } catch (e14) {
+      } catch (e17) {
         return c.json({ success: false, error: { code: "INVALID_REQUEST", message: "Request body must be JSON." } }, 400);
       }
-      const deliveryId = typeof _optionalChain([body, 'optionalAccess', _163 => _163.deliveryId]) === "string" ? body.deliveryId.trim() : "";
+      const deliveryId = typeof _optionalChain([body, 'optionalAccess', _169 => _169.deliveryId]) === "string" ? body.deliveryId.trim() : "";
       if (!deliveryId) {
         return c.json(
           { success: false, error: { code: "MISSING_REQUIRED_FIELD", message: "Body must include `deliveryId: string`." } },
@@ -1291,24 +1388,24 @@ var WebhookOutboxPlugin = class {
       }
       try {
         const row = await messaging.redeliverHttp(deliveryId);
-        _optionalChain([ctx, 'access', _164 => _164.logger, 'access', _165 => _165.info, 'optionalCall', _166 => _166("[webhook-outbox] redelivered", { deliveryId, requestedBy: userId })]);
+        _optionalChain([ctx, 'access', _170 => _170.logger, 'access', _171 => _171.info, 'optionalCall', _172 => _172("[webhook-outbox] redelivered", { deliveryId, requestedBy: userId })]);
         return c.json({ success: true, data: { id: row.id, status: row.status } });
       } catch (err) {
-        const code = _optionalChain([err, 'optionalAccess', _167 => _167.code]);
+        const code = _optionalChain([err, 'optionalAccess', _173 => _173.code]);
         if (code === "RESOURCE_NOT_FOUND") {
           return c.json({ success: false, error: { code, message: err.message } }, 404);
         }
         if (code === "DELIVERY_NOT_ELIGIBLE" || code === "DELIVERY_NEVER_SENT") {
           return c.json({ success: false, error: { code, message: err.message } }, 409);
         }
-        _optionalChain([ctx, 'access', _168 => _168.logger, 'access', _169 => _169.error, 'optionalCall', _170 => _170("[webhook-outbox] redeliver failed", err)]);
+        _optionalChain([ctx, 'access', _174 => _174.logger, 'access', _175 => _175.error, 'optionalCall', _176 => _176("[webhook-outbox] redeliver failed", err)]);
         return c.json(
-          { success: false, error: { code: "INTERNAL_ERROR", message: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _171 => _171.message]), () => ( String(err))) } },
+          { success: false, error: { code: "INTERNAL_ERROR", message: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _177 => _177.message]), () => ( String(err))) } },
           500
         );
       }
     });
-    _optionalChain([ctx, 'access', _172 => _172.logger, 'access', _173 => _173.info, 'optionalCall', _174 => _174("[webhook-outbox] redeliver endpoint mounted at POST /api/v1/webhooks/redeliver")]);
+    _optionalChain([ctx, 'access', _178 => _178.logger, 'access', _179 => _179.info, 'optionalCall', _180 => _180("[webhook-outbox] redeliver endpoint mounted at POST /api/v1/webhooks/redeliver")]);
   }
   async resolveSessionUserId(ctx, c) {
     try {
@@ -1318,11 +1415,11 @@ var WebhookOutboxPlugin = class {
       if (!api && typeof authService.getApi === "function") {
         api = await authService.getApi();
       }
-      if (!_optionalChain([api, 'optionalAccess', _175 => _175.getSession])) return void 0;
+      if (!_optionalChain([api, 'optionalAccess', _181 => _181.getSession])) return void 0;
       const session = await api.getSession({ headers: c.req.raw.headers });
-      const uid2 = _optionalChain([session, 'optionalAccess', _176 => _176.user, 'optionalAccess', _177 => _177.id]);
+      const uid2 = _optionalChain([session, 'optionalAccess', _182 => _182.user, 'optionalAccess', _183 => _183.id]);
       return typeof uid2 === "string" && uid2.length > 0 ? uid2 : void 0;
-    } catch (e15) {
+    } catch (e18) {
       return void 0;
     }
   }
@@ -1334,5 +1431,11 @@ var WebhookOutboxPlugin = class {
 
 
 
-exports.AutoEnqueuer = AutoEnqueuer; exports.SysWebhook = _chunkQ4FEMGD6cjs.SysWebhook; exports.WEBHOOK_HEADERS_FIELD = WEBHOOK_HEADERS_FIELD; exports.WEBHOOK_SECRET_FIELD = WEBHOOK_SECRET_FIELD; exports.WebhookOutboxPlugin = WebhookOutboxPlugin; exports.migrateLegacyWebhookSecrets = migrateLegacyWebhookSecrets;
+
+
+
+
+
+
+exports.AutoEnqueuer = AutoEnqueuer; exports.SysWebhook = _chunkDRHJ2M45cjs.SysWebhook; exports.WEBHOOK_HEADERS_FIELD = WEBHOOK_HEADERS_FIELD; exports.WEBHOOK_HEADERS_SHAPE_REFUSAL_CODE = WEBHOOK_HEADERS_SHAPE_REFUSAL_CODE; exports.WEBHOOK_HEADERS_SHAPE_REFUSAL_STATUS = WEBHOOK_HEADERS_SHAPE_REFUSAL_STATUS; exports.WEBHOOK_SECRET_FIELD = WEBHOOK_SECRET_FIELD; exports.WebhookHeadersShapeError = WebhookHeadersShapeError; exports.WebhookOutboxPlugin = WebhookOutboxPlugin; exports.assertWritableWebhookHeaders = assertWritableWebhookHeaders; exports.bindWebhookHeadersShapeGate = bindWebhookHeadersShapeGate; exports.migrateLegacyWebhookSecrets = migrateLegacyWebhookSecrets; exports.unbindWebhookHeadersShapeGate = unbindWebhookHeadersShapeGate;
 //# sourceMappingURL=index.cjs.map