@oktis-works/core 0.5.15 → 0.7.0

package/dist/webhooks/service.js

@@ -0,0 +1,57 @@
+// @oktis-works/core - Webhook secret rotation (Item 19 do plugin-parity-plan)
+//
+// Versioned secrets for webhook signing: `rotate` creates the next version,
+// deactivates the previous one (keeping it recorded with rotated_at so
+// consumers have a 24h grace window to swap the key) and returns the new
+// secret exactly once. Signing itself happens in the worker, which picks the
+// newest active version and stamps X-Webhook-Secret-Version.
+import { randomUUID, randomBytes } from 'node:crypto';
+import { getConnection } from '@oktis-works/database';
+export class WebhookSecretService {
+    /**
+     * Rotates the signing secret: creates version N+1 as the only active one
+     * and stamps the previous version with rotated_at (24h grace for
+     * consumers). Returns the new secret ONCE — it is never listed again.
+     */
+    async rotate(webhookId) {
+        const sql = getConnection();
+        const webhook = await sql.unsafe('SELECT id FROM webhooks WHERE id = $1', [webhookId]);
+        if (webhook.length === 0)
+            return null;
+        const versionRows = await sql.unsafe('SELECT COALESCE(MAX(version), 0)::int AS max_version FROM webhook_secrets WHERE webhook_id = $1', [webhookId]);
+        const nextVersion = Number(versionRows[0]?.max_version ?? 0) + 1;
+        // Deactivate previous versions (kept for the 24h grace window).
+        await sql.unsafe('UPDATE webhook_secrets SET is_active = false, rotated_at = NOW() WHERE webhook_id = $1 AND is_active = true', [webhookId]);
+        const secret = randomBytes(32).toString('hex');
+        const id = randomUUID();
+        await sql.unsafe('INSERT INTO webhook_secrets (id, webhook_id, secret, version, is_active) VALUES ($1, $2, $3, $4, true)', [id, webhookId, secret, nextVersion]);
+        return { id, webhookId, version: nextVersion, isActive: true, rotatedAt: null, createdAt: new Date(), secret };
+    }
+    /** Versioned history WITHOUT the secret values (safe to list). */
+    async listVersions(webhookId) {
+        const sql = getConnection();
+        const rows = await sql.unsafe(`SELECT id, webhook_id, version, is_active, rotated_at, created_at
+       FROM webhook_secrets WHERE webhook_id = $1 ORDER BY version DESC`, [webhookId]);
+        return rows;
+    }
+    /** Newest active secret for signing (worker-side; legacy fallback). */
+    async getActiveSecret(webhookId) {
+        const sql = getConnection();
+        const rows = await sql.unsafe(`SELECT secret, version FROM webhook_secrets
+       WHERE webhook_id = $1 AND is_active = true ORDER BY version DESC LIMIT 1`, [webhookId]);
+        const row = rows[0];
+        return row ? { secret: row.secret, version: row.version } : null;
+    }
+    /**
+     * Records a delivery that exhausted its retries into the dead-letter
+     * table — one row per failed delivery job (BullMQ already applied the
+     * exponential backoff before the handler gives up).
+     */
+    async recordDeadLetter(webhookId, event, payload, error) {
+        const sql = getConnection();
+        await sql.unsafe(`INSERT INTO webhook_dead_letters (webhook_id, event, payload, error, attempts)
+       VALUES ($1, $2, $3::jsonb, $4, 1)`, [webhookId, event, JSON.stringify(payload ?? {}), error]);
+    }
+}
+export const webhookSecretService = new WebhookSecretService();
+//# sourceMappingURL=service.js.map

package/dist/webhooks/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/webhooks/service.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,4EAA4E;AAC5E,uEAAuE;AACvE,yEAAyE;AACzE,6EAA6E;AAC7E,6DAA6D;AAE7D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAatD,MAAM,OAAO,oBAAoB;IAC/B;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAE5B,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,uCAAuC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACvF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEtC,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,MAAM,CAClC,iGAAiG,EACjG,CAAC,SAAS,CAAC,CACZ,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,CAAE,WAAW,CAAC,CAAC,CAA0C,EAAE,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAE3G,gEAAgE;QAChE,MAAM,GAAG,CAAC,MAAM,CACd,6GAA6G,EAC7G,CAAC,SAAS,CAAC,CACZ,CAAC;QAEF,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,GAAG,CAAC,MAAM,CACd,wGAAwG,EACxG,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,CACrC,CAAC;QAEF,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC;IACjH,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,YAAY,CAAC,SAAiB;QAClC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,CAC3B;wEACkE,EAClE,CAAC,SAAS,CAAC,CACZ,CAAC;QACF,OAAO,IAA8D,CAAC;IACxE,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,eAAe,CAAC,SAAiB;QACrC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,CAC3B;gFAC0E,EAC1E,CAAC,SAAS,CAAC,CACZ,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAA+D,CAAC;QAClF,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,SAAiB,EAAE,KAAa,EAAE,OAAgB,EAAE,KAAa;QACtF,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,GAAG,CAAC,MAAM,CACd;yCACmC,EACnC,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CACzD,CAAC;IACJ,CAAC;CACF;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,oBAAoB,EAAE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oktis-works/core",
-  "version": "0.5.15",
+  "version": "0.7.0",
   "private": false,
   "type": "module",
   "main": "./dist/index.js",
@@ -21,11 +21,11 @@
     "clean": "rm -rf dist tsconfig.tsbuildinfo"
   },
   "dependencies": {
-    "@oktis-works/types": "^0.7.0",
-    "@oktis-works/validation": "^0.6.0",
-    "@oktis-works/config": "^0.6.2",
-    "@oktis-works/database": "^0.7.0",
-    "@oktis-works/plugin-runtime": "^0.5.10",
+    "@oktis-works/types": "^0.9.0",
+    "@oktis-works/validation": "^0.7.0",
+    "@oktis-works/config": "^0.6.4",
+    "@oktis-works/database": "^0.8.0",
+    "@oktis-works/plugin-runtime": "^0.7.0",
     "@aws-sdk/client-s3": "3.700.0",
     "bullmq": "5.0.0",
     "ioredis": "5.3.0",