@open-mercato/webhooks 0.6.4-develop.4382.1.6b4f656b77 → 0.6.4

package/src/modules/webhooks/__integration__/TC-WEBHOOK-007.spec.ts

@@ -0,0 +1,102 @@
+import { expect, test } from '@playwright/test';
+import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api';
+import { getTokenScope } from '@open-mercato/core/helpers/integration/generalFixtures';
+import { createOrganizationInDb, deleteOrganizationInDb } from '@open-mercato/core/helpers/integration/dbFixtures';
+import {
+  cleanupWebhooksUser,
+  createWebhookFixture,
+  deleteWebhookIfExists,
+  listWebhooks,
+  provisionWebhooksUser,
+  type ProvisionedWebhooksUser,
+  type WebhookCreateResponse,
+} from './helpers/fixtures';
+
+/**
+ * TC-WEBHOOK-007: Tenant/organization scoping isolation
+ * Source: https://github.com/open-mercato/open-mercato/issues/2482
+ *
+ * Webhooks are scoped by tenantId + organizationId. Within one tenant, two
+ * organization-restricted users must not see or mutate each other's webhooks:
+ * the list excludes out-of-scope rows and detail/update/delete on a foreign
+ * webhook returns 404 (existence is not revealed across the org boundary).
+ */
+const MANAGE_FEATURES = ['webhooks.view', 'webhooks.manage'];
+
+test.describe('TC-WEBHOOK-007: Tenant/organization scoping isolation', () => {
+  test('should isolate webhooks between organizations within the same tenant', async ({ request }) => {
+    const adminToken = await getAuthToken(request);
+    const { tenantId, organizationId: orgA } = getTokenScope(adminToken);
+
+    let orgB: string | null = null;
+    let userA: ProvisionedWebhooksUser | null = null;
+    let userB: ProvisionedWebhooksUser | null = null;
+    let webhookA: WebhookCreateResponse | null = null;
+    let webhookB: WebhookCreateResponse | null = null;
+
+    try {
+      orgB = await createOrganizationInDb({ name: `TC-WEBHOOK-007 Org B ${Date.now()}`, tenantId });
+
+      userA = await provisionWebhooksUser(request, adminToken, {
+        tenantId,
+        organizationId: orgA,
+        features: MANAGE_FEATURES,
+        organizations: [orgA],
+        slug: 'org-a',
+      });
+      userB = await provisionWebhooksUser(request, adminToken, {
+        tenantId,
+        organizationId: orgB,
+        features: MANAGE_FEATURES,
+        organizations: [orgB],
+        slug: 'org-b',
+      });
+
+      webhookA = await createWebhookFixture(request, userA.token, {
+        name: `TC-WEBHOOK-007 A ${Date.now()}`,
+        url: 'https://example.com/webhook-org-a',
+        subscribedEvents: ['catalog.product.created'],
+      });
+      webhookB = await createWebhookFixture(request, userB.token, {
+        name: `TC-WEBHOOK-007 B ${Date.now()}`,
+        url: 'https://example.com/webhook-org-b',
+        subscribedEvents: ['catalog.product.created'],
+      });
+
+      // Lists are scoped: each user sees only their own organization's webhook.
+      const listA = await listWebhooks(request, userA.token);
+      expect(listA.items.some((item) => item.id === webhookA!.id)).toBe(true);
+      expect(listA.items.some((item) => item.id === webhookB!.id)).toBe(false);
+
+      const listB = await listWebhooks(request, userB.token);
+      expect(listB.items.some((item) => item.id === webhookB!.id)).toBe(true);
+      expect(listB.items.some((item) => item.id === webhookA!.id)).toBe(false);
+
+      // Cross-org reads/writes are not found.
+      const crossGet = await apiRequest(request, 'GET', `/api/webhooks/${webhookB.id}`, { token: userA.token });
+      expect(crossGet.status()).toBe(404);
+
+      const crossUpdate = await apiRequest(request, 'PUT', `/api/webhooks/${webhookB.id}`, {
+        token: userA.token,
+        data: { name: `TC-WEBHOOK-007 cross-org hijack ${Date.now()}` },
+      });
+      expect(crossUpdate.status()).toBe(404);
+
+      const crossDelete = await apiRequest(request, 'DELETE', `/api/webhooks/${webhookB.id}`, { token: userA.token });
+      expect(crossDelete.status()).toBe(404);
+
+      const crossGetReverse = await apiRequest(request, 'GET', `/api/webhooks/${webhookA.id}`, { token: userB.token });
+      expect(crossGetReverse.status()).toBe(404);
+
+      // In-scope access still works after the cross-org attempts.
+      const ownGet = await apiRequest(request, 'GET', `/api/webhooks/${webhookA.id}`, { token: userA.token });
+      expect(ownGet.status()).toBe(200);
+    } finally {
+      await deleteWebhookIfExists(request, userA?.token ?? null, webhookA?.id ?? null);
+      await deleteWebhookIfExists(request, userB?.token ?? null, webhookB?.id ?? null);
+      await cleanupWebhooksUser(request, adminToken, userA);
+      await cleanupWebhooksUser(request, adminToken, userB);
+      await deleteOrganizationInDb(orgB);
+    }
+  });
+});

package/src/modules/webhooks/__integration__/TC-WEBHOOK-008.spec.ts

@@ -0,0 +1,109 @@
+import { expect, test } from '@playwright/test';
+import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api';
+import {
+  buildMockInboundUrl,
+  createWebhookFixture,
+  deleteWebhookIfExists,
+  listWebhookDeliveries,
+  sendTestDelivery,
+} from './helpers/fixtures';
+
+/**
+ * TC-WEBHOOK-008: Delivery list filtering by status and event type
+ * Source: https://github.com/open-mercato/open-mercato/issues/2482
+ *
+ * GET /api/webhooks/deliveries supports webhookId, status, and eventType filters.
+ * Seeds three deliveries on one webhook — delivered(created), delivered(updated),
+ * expired(created) — then verifies each filter and their intersection.
+ */
+const EVENT_CREATED = 'catalog.product.created';
+const EVENT_UPDATED = 'catalog.product.updated';
+
+function deliveriesPath(webhookId: string, extra: Record<string, string> = {}): string {
+  const params = new URLSearchParams({ webhookId, ...extra });
+  return `/api/webhooks/deliveries?${params.toString()}`;
+}
+
+test.describe('TC-WEBHOOK-008: Delivery list filtering by status and event type', () => {
+  test('should filter delivery logs by status, event type, and their combination', async ({ request }) => {
+    const token = await getAuthToken(request);
+    let webhookId: string | null = null;
+
+    try {
+      const created = await createWebhookFixture(request, token, {
+        name: `Webhook Filter ${Date.now()}`,
+        url: buildMockInboundUrl(),
+        subscribedEvents: [EVENT_CREATED, EVENT_UPDATED],
+        customHeaders: { 'x-mock-webhook-signature': 'valid' },
+      });
+      webhookId = created.id;
+
+      const deliveredCreated = await sendTestDelivery(request, token, created.id, { eventType: EVENT_CREATED });
+      expect(deliveredCreated.delivery.status).toBe('delivered');
+      const deliveredUpdated = await sendTestDelivery(request, token, created.id, { eventType: EVENT_UPDATED });
+      expect(deliveredUpdated.delivery.status).toBe('delivered');
+
+      // Flip the mock signature to invalid so the next attempt fails terminally (expired).
+      const invalidate = await apiRequest(request, 'PUT', `/api/webhooks/${created.id}`, {
+        token,
+        data: { customHeaders: { 'x-mock-webhook-signature': 'invalid' } },
+      });
+      expect(invalidate.status()).toBe(200);
+
+      const expiredCreated = await sendTestDelivery(request, token, created.id, { eventType: EVENT_CREATED });
+      expect(expiredCreated.delivery.status).toBe('expired');
+
+      const d1 = deliveredCreated.delivery.id;
+      const d2 = deliveredUpdated.delivery.id;
+      const d3 = expiredCreated.delivery.id;
+
+      // Unfiltered (by webhook): all three present.
+      const all = await listWebhookDeliveries(request, token, created.id, deliveriesPath(created.id));
+      expect(all.total).toBeGreaterThanOrEqual(3);
+      for (const id of [d1, d2, d3]) {
+        expect(all.items.some((item) => item.id === id)).toBe(true);
+      }
+
+      // status=delivered → d1, d2 only.
+      const delivered = await listWebhookDeliveries(request, token, created.id, deliveriesPath(created.id, { status: 'delivered' }));
+      expect(delivered.items.every((item) => item.status === 'delivered')).toBe(true);
+      expect(delivered.items.some((item) => item.id === d1)).toBe(true);
+      expect(delivered.items.some((item) => item.id === d2)).toBe(true);
+      expect(delivered.items.some((item) => item.id === d3)).toBe(false);
+
+      // status=expired → d3 only.
+      const expired = await listWebhookDeliveries(request, token, created.id, deliveriesPath(created.id, { status: 'expired' }));
+      expect(expired.items.every((item) => item.status === 'expired')).toBe(true);
+      expect(expired.items.some((item) => item.id === d3)).toBe(true);
+      expect(expired.items.some((item) => item.id === d1)).toBe(false);
+
+      // eventType=created → d1, d3 only.
+      const createdEvents = await listWebhookDeliveries(request, token, created.id, deliveriesPath(created.id, { eventType: EVENT_CREATED }));
+      expect(createdEvents.items.every((item) => item.eventType === EVENT_CREATED)).toBe(true);
+      expect(createdEvents.items.some((item) => item.id === d1)).toBe(true);
+      expect(createdEvents.items.some((item) => item.id === d3)).toBe(true);
+      expect(createdEvents.items.some((item) => item.id === d2)).toBe(false);
+
+      // Combined status=delivered & eventType=created → d1 only.
+      const combined = await listWebhookDeliveries(
+        request,
+        token,
+        created.id,
+        deliveriesPath(created.id, { status: 'delivered', eventType: EVENT_CREATED }),
+      );
+      expect(combined.items.every((item) => item.status === 'delivered' && item.eventType === EVENT_CREATED)).toBe(true);
+      expect(combined.items.some((item) => item.id === d1)).toBe(true);
+      expect(combined.items.some((item) => item.id === d2)).toBe(false);
+      expect(combined.items.some((item) => item.id === d3)).toBe(false);
+
+      // Non-matching filter → empty result set with pagination metadata.
+      const empty = await listWebhookDeliveries(request, token, created.id, deliveriesPath(created.id, { status: 'pending' }));
+      expect(empty.items).toEqual([]);
+      expect(empty.total).toBe(0);
+      expect(empty.page).toBe(1);
+      expect(empty.totalPages).toBe(0);
+    } finally {
+      await deleteWebhookIfExists(request, token, webhookId);
+    }
+  });
+});

package/src/modules/webhooks/__integration__/TC-WEBHOOK-009.spec.ts

@@ -0,0 +1,94 @@
+import { expect, test } from '@playwright/test';
+import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api';
+import { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures';
+import { readIntegrationEnvFlag } from '@open-mercato/core/helpers/integration/standaloneEnv';
+import { createWebhookFixture, deleteWebhookIfExists } from './helpers/fixtures';
+
+/**
+ * TC-WEBHOOK-009: Invalid and unsafe URL rejection
+ * Source: https://github.com/open-mercato/open-mercato/issues/2482
+ *
+ * Webhook URLs go through the shared outbound-URL safety check. Forbidden schemes,
+ * embedded credentials, and malformed URLs are rejected with 400 on both create and
+ * update regardless of configuration. Private/loopback hosts are rejected unless the
+ * deployment opts in via OM_WEBHOOKS_ALLOW_PRIVATE_URLS (the integration env enables
+ * it so the loopback mock receiver works) — this spec asserts whichever behavior the
+ * active flag dictates. Exhaustive private-IP coverage lives in the unit suites
+ * (data/__tests__/validators.test.ts, lib/__tests__/url-safety.test.ts).
+ */
+const PRIVATE_URLS_ALLOWED = readIntegrationEnvFlag('OM_WEBHOOKS_ALLOW_PRIVATE_URLS');
+
+const ALWAYS_UNSAFE_URLS = [
+  'ftp://example.com/webhook',
+  'file:///etc/passwd',
+  'http://user:pass@example.com/webhook',
+  'not-a-valid-url',
+];
+
+const PRIVATE_HOST_URLS = [
+  'http://127.0.0.1:9001/webhook',
+  'http://10.0.0.1/webhook',
+  'http://[::1]:9001/webhook',
+];
+
+function createBody(url: string) {
+  return {
+    name: `Webhook URL Safety ${Date.now()}`,
+    url,
+    subscribedEvents: ['catalog.product.created'],
+  };
+}
+
+test.describe('TC-WEBHOOK-009: Invalid and unsafe URL rejection', () => {
+  test('should reject unsafe webhook URLs on create and update and accept valid external URLs', async ({ request }) => {
+    const token = await getAuthToken(request);
+    let webhookId: string | null = null;
+    const strayPrivateWebhookIds: string[] = [];
+
+    try {
+      // Always-unsafe URLs are rejected at create regardless of the private-URL flag.
+      for (const url of ALWAYS_UNSAFE_URLS) {
+        const response = await apiRequest(request, 'POST', '/api/webhooks', { token, data: createBody(url) });
+        expect(response.status(), `POST should reject unsafe url ${url}`).toBe(400);
+      }
+
+      // A valid external https URL is accepted.
+      const created = await createWebhookFixture(request, token, {
+        name: `Webhook URL Safety Valid ${Date.now()}`,
+        url: 'https://example.com/webhook-url-safety',
+        subscribedEvents: ['catalog.product.created'],
+      });
+      webhookId = created.id;
+
+      // Updating an existing webhook to an unsafe URL is rejected; the record is unchanged.
+      for (const url of ALWAYS_UNSAFE_URLS) {
+        const response = await apiRequest(request, 'PUT', `/api/webhooks/${created.id}`, { token, data: { url } });
+        expect(response.status(), `PUT should reject unsafe url ${url}`).toBe(400);
+      }
+
+      // Updating to another valid external URL succeeds.
+      const validUpdate = await apiRequest(request, 'PUT', `/api/webhooks/${created.id}`, {
+        token,
+        data: { url: 'https://example.org/webhook-url-safety-updated' },
+      });
+      expect(validUpdate.status()).toBe(200);
+
+      // Private/loopback hosts: behavior depends on the deployment flag.
+      for (const url of PRIVATE_HOST_URLS) {
+        const response = await apiRequest(request, 'POST', '/api/webhooks', { token, data: createBody(url) });
+        if (PRIVATE_URLS_ALLOWED) {
+          expect(response.status(), `POST should accept private url ${url} when allowed`).toBe(201);
+          const body = await readJsonSafe<{ id?: string }>(response);
+          if (body?.id) strayPrivateWebhookIds.push(body.id);
+        } else {
+          expect(response.status(), `POST should reject private url ${url} when not allowed`).toBe(400);
+        }
+      }
+    } finally {
+      await deleteWebhookIfExists(request, token, webhookId);
+      for (const id of strayPrivateWebhookIds) {
+        await deleteWebhookIfExists(request, token, id);
+      }
+    }
+  });
+});

package/src/modules/webhooks/__integration__/TC-WEBHOOK-010.spec.ts

@@ -0,0 +1,89 @@
+import { expect, test } from '@playwright/test';
+import { getAuthToken } from '@open-mercato/core/helpers/integration/api';
+import {
+  buildMockInboundUrl,
+  createWebhookFixture,
+  deleteWebhookIfExists,
+  getDeliveryDetail,
+  sendTestDelivery,
+} from './helpers/fixtures';
+
+/**
+ * TC-WEBHOOK-010: Delivery detail response includes full payload and response body
+ * Source: https://github.com/open-mercato/open-mercato/issues/2482
+ *
+ * The delivery detail endpoint must expose the complete sent payload and the full
+ * response captured from the endpoint (status, body, headers) plus attempt/timing
+ * metadata, so admins can debug a delivery end-to-end.
+ */
+const EVENT_TYPE = 'webhooks.test.detail';
+
+test.describe('TC-WEBHOOK-010: Delivery detail full payload and response body', () => {
+  test('should expose the complete payload and response details for a delivery', async ({ request }) => {
+    const token = await getAuthToken(request);
+    let webhookId: string | null = null;
+
+    try {
+      const created = await createWebhookFixture(request, token, {
+        name: `Webhook Detail ${Date.now()}`,
+        url: buildMockInboundUrl(),
+        subscribedEvents: ['catalog.product.created'],
+        customHeaders: { 'x-mock-webhook-signature': 'valid' },
+      });
+      webhookId = created.id;
+
+      const eventData = { sku: 'TEST-123', nested: { value: 42 } };
+
+      const testResult = await sendTestDelivery(request, token, created.id, {
+        eventType: EVENT_TYPE,
+        payload: eventData,
+      });
+      expect(testResult.delivery.status).toBe('delivered');
+      const deliveryId = testResult.delivery.id;
+
+      const detail = await getDeliveryDetail(request, token, deliveryId);
+
+      // Identity + routing
+      expect(detail.id).toBe(deliveryId);
+      expect(detail.webhookId).toBe(created.id);
+      expect(detail.eventType).toBe(EVENT_TYPE);
+      expect(detail.targetUrl).toBe(created.url);
+      expect(typeof detail.messageId).toBe('string');
+      expect(detail.messageId.length).toBeGreaterThan(0);
+
+      // Outcome
+      expect(detail.status).toBe('delivered');
+      expect(detail.responseStatus).toBe(200);
+      expect(detail.errorMessage).toBeNull();
+
+      // The delivery body wraps the event data in the Standard-Webhooks envelope
+      // { type, timestamp, data }; the sent payload is preserved under `data`.
+      expect(detail.payload).toMatchObject({
+        type: EVENT_TYPE,
+        data: { sku: 'TEST-123', nested: { value: 42 } },
+      });
+      const envelopeTimestamp = (detail.payload as { timestamp?: unknown }).timestamp;
+      expect(typeof envelopeTimestamp).toBe('string');
+      expect(Number.isNaN(Date.parse(envelopeTimestamp as string))).toBe(false);
+
+      // Full captured response (the mock receiver replies { ok: true } as JSON)
+      expect(detail.responseBody).toBe(JSON.stringify({ ok: true }));
+      expect(detail.responseHeaders).not.toBeNull();
+      expect(detail.responseHeaders?.['content-type']).toContain('application/json');
+
+      // Attempt + timing metadata
+      expect(detail.attemptNumber).toBeGreaterThanOrEqual(1);
+      expect(detail.maxAttempts).toBeGreaterThanOrEqual(1);
+      expect(typeof detail.durationMs).toBe('number');
+      expect(detail.durationMs as number).toBeGreaterThanOrEqual(0);
+      expect(detail.nextRetryAt).toBeNull();
+
+      for (const timestamp of [detail.createdAt, detail.enqueuedAt, detail.lastAttemptAt, detail.deliveredAt, detail.updatedAt]) {
+        expect(typeof timestamp).toBe('string');
+        expect(Number.isNaN(Date.parse(timestamp as string))).toBe(false);
+      }
+    } finally {
+      await deleteWebhookIfExists(request, token, webhookId);
+    }
+  });
+});

package/src/modules/webhooks/__integration__/TC-WH-CRUDFORM-001.spec.ts

@@ -0,0 +1,126 @@
+import { expect, test, type APIRequestContext } from '@playwright/test';
+import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api';
+import { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures';
+import {
+  runCrudFormRoundTrip,
+  skipIfCrudFormExtensionTestsDisabled,
+  type CrudRecord,
+} from '@open-mercato/core/helpers/integration/crudFormPersistence';
+
+/**
+ * TC-WH-CRUDFORM-001: Webhook CrudForm persists scalars, the events multiselect, and the
+ * custom-headers JSON object (#2466, Tier B — hand-written / non-makeCrud saves).
+ *
+ * Webhooks is the first hand-written surface in the sweep. The backend CrudForm
+ * (`backend/webhooks`) submits through the canonical, hand-written routes — `POST /api/webhooks`,
+ * `PUT /api/webhooks/:id`, `DELETE /api/webhooks/:id` — NOT the makeCrud `/api/webhooks/webhooks`
+ * alias, so this spec drives those exact endpoints via the harness `recordPath` seam to prove the
+ * real form-submit path persists every field.
+ *
+ * Verified contract:
+ * - Responses are camelCase (hand-written serializer), so scalar assertions use camelCase keys.
+ * - `subscribedEvents` is a multiselect string[] (the form `tags` field); `customHeaders` is a JSON
+ *   object (the form `JsonBuilder`). Both round-trip through deep equality.
+ * - `PUT /api/webhooks/:id` is a partial patch; the spec sends the full field set on update.
+ * - Read-back uses the detail GET `/api/webhooks/:id` — the list GET omits `customHeaders` and has no
+ *   `id` filter. Cleanup soft-deletes via `DELETE /api/webhooks/:id` in the harness `finally`.
+ * - The webhook entity has no custom fields, so the rich coverage here is the multiselect + JSON.
+ * - Self-contained: a single webhook fixture, created and deleted within the round-trip.
+ *
+ * Gated by `OM_INTEGRATION_CRUDFORM_EXTENSION_TESTS_DISABLED` (default off → runs).
+ */
+const WEBHOOKS_PATH = '/api/webhooks';
+
+async function readWebhookById(
+  request: APIRequestContext,
+  token: string,
+  id: string,
+): Promise<CrudRecord | null> {
+  const response = await apiRequest(request, 'GET', `${WEBHOOKS_PATH}/${encodeURIComponent(id)}`, { token });
+  if (response.status() === 404) return null;
+  expect(response.status(), `read-back webhook failed: ${response.status()}`).toBe(200);
+  const body = await readJsonSafe<CrudRecord>(response);
+  return body && body.id === id ? body : null;
+}
+
+test.describe('TC-WH-CRUDFORM-001: Webhook CrudForm persists scalars, events multiselect + headers JSON', () => {
+  test.beforeAll(() => {
+    skipIfCrudFormExtensionTestsDisabled();
+  });
+
+  test('round-trips scalars, subscribedEvents array, and customHeaders JSON on create and update', async ({ request }) => {
+    const token = await getAuthToken(request, 'admin');
+    const stamp = Date.now();
+    const createEvents = ['catalog.product.created', 'catalog.product.updated'];
+    const updateEvents = ['sales.quote.created', 'catalog.product.deleted', 'sales.order.placed'];
+    const createHeaders = { 'X-Source': 'om-qa', 'X-Trace': `crudform-${stamp}` };
+    const updateHeaders = { 'X-Env': 'integration', 'X-Rotated': 'true' };
+
+    await runCrudFormRoundTrip({
+      request,
+      token,
+      collectionPath: WEBHOOKS_PATH,
+      recordPath: (id) => `${WEBHOOKS_PATH}/${encodeURIComponent(id)}`,
+      readById: (id) => readWebhookById(request, token, id),
+      create: {
+        payload: {
+          name: `QA CRUDFORM Webhook ${stamp}`,
+          description: 'Original webhook description',
+          url: `https://example.com/hooks/crudform-${stamp}`,
+          subscribedEvents: createEvents,
+          httpMethod: 'POST',
+          maxRetries: 3,
+          timeoutMs: 5000,
+          rateLimitPerMinute: 0,
+          autoDisableThreshold: 5,
+          customHeaders: createHeaders,
+        },
+      },
+      expectAfterCreate: {
+        scalars: {
+          name: `QA CRUDFORM Webhook ${stamp}`,
+          description: 'Original webhook description',
+          url: `https://example.com/hooks/crudform-${stamp}`,
+          subscribedEvents: createEvents,
+          httpMethod: 'POST',
+          isActive: true,
+          maxRetries: 3,
+          timeoutMs: 5000,
+          rateLimitPerMinute: 0,
+          autoDisableThreshold: 5,
+          customHeaders: createHeaders,
+        },
+      },
+      update: {
+        payload: () => ({
+          name: `QA CRUDFORM Webhook ${stamp} EDITED`,
+          description: 'Updated webhook description',
+          url: `https://example.com/hooks/crudform-${stamp}-edited`,
+          subscribedEvents: updateEvents,
+          httpMethod: 'PUT',
+          isActive: false,
+          maxRetries: 7,
+          timeoutMs: 20000,
+          rateLimitPerMinute: 120,
+          autoDisableThreshold: 25,
+          customHeaders: updateHeaders,
+        }),
+      },
+      expectAfterUpdate: {
+        scalars: {
+          name: `QA CRUDFORM Webhook ${stamp} EDITED`,
+          description: 'Updated webhook description',
+          url: `https://example.com/hooks/crudform-${stamp}-edited`,
+          subscribedEvents: updateEvents,
+          httpMethod: 'PUT',
+          isActive: false,
+          maxRetries: 7,
+          timeoutMs: 20000,
+          rateLimitPerMinute: 120,
+          autoDisableThreshold: 25,
+          customHeaders: updateHeaders,
+        },
+      },
+    });
+  });
+});

package/src/modules/webhooks/__integration__/helpers/fixtures.ts

@@ -1,6 +1,8 @@
 import { expect, type APIRequestContext } from '@playwright/test';
-import { apiRequest } from '@open-mercato/core/helpers/integration/api';
+import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api';
 import { expectId, readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures';
+import { createUserFixture, deleteUserIfExists } from '@open-mercato/core/helpers/integration/authFixtures';
+import { deleteUserAclInDb, setUserAclInDb } from '@open-mercato/core/helpers/integration/dbFixtures';
 
 const BASE_URL = process.env.BASE_URL?.trim() || 'http://localhost:3000';
 
@@ -247,3 +249,101 @@ export async function deleteWebhookIfExists(
     return;
   }
 }
+
+export type WebhookRotateSecretResponse = {
+  success: true;
+  secret: string;
+  previousSecretSetAt: string | null;
+};
+
+export async function rotateWebhookSecret(
+  request: APIRequestContext,
+  token: string,
+  webhookId: string,
+  path = `/api/webhooks/${webhookId}/rotate-secret`,
+): Promise<WebhookRotateSecretResponse> {
+  const response = await apiRequest(request, 'POST', path, { token });
+  expect(response.status()).toBe(200);
+  const body = await readJsonSafe<WebhookRotateSecretResponse>(response);
+  if (!body) {
+    throw new Error(`Expected rotate-secret response for ${webhookId}`);
+  }
+  return body;
+}
+
+export type WebhookTestDeliveryResponse = {
+  success: true;
+  delivery: WebhookDeliveryDetailResponse;
+};
+
+export async function sendTestDelivery(
+  request: APIRequestContext,
+  token: string,
+  webhookId: string,
+  input: { eventType?: string; payload?: Record<string, unknown> } = {},
+  path = `/api/webhooks/${webhookId}/test`,
+): Promise<WebhookTestDeliveryResponse> {
+  const response = await apiRequest(request, 'POST', path, { token, data: input });
+  expect(response.status()).toBe(200);
+  const body = await readJsonSafe<WebhookTestDeliveryResponse>(response);
+  if (!body) {
+    throw new Error(`Expected test delivery response for ${webhookId}`);
+  }
+  return body;
+}
+
+export type ProvisionedWebhooksUser = {
+  userId: string;
+  email: string;
+  password: string;
+  token: string;
+};
+
+/**
+ * Creates a self-contained, role-less user and grants it an exact webhooks feature
+ * set (and optional organization-visibility list) through a per-user ACL row, then
+ * logs it in. The DB ACL path mirrors the org-scope fixtures: granting features via
+ * the ACL API requires a super-admin actor, while `setUserAclInDb` keeps the spec
+ * self-contained and deterministic. Login happens AFTER the ACL is written so the
+ * fresh session resolves the new grants.
+ */
+export async function provisionWebhooksUser(
+  request: APIRequestContext,
+  adminToken: string,
+  input: {
+    tenantId: string;
+    organizationId: string;
+    features: string[];
+    organizations?: string[] | null;
+    slug: string;
+  },
+): Promise<ProvisionedWebhooksUser> {
+  const unique = `${Date.now()}${Math.floor(Math.random() * 1_000_000)}`;
+  const email = `qa-webhooks-${input.slug}-${unique}@acme.com`;
+  const password = 'Valid1!Webhooks';
+  const userId = await createUserFixture(request, adminToken, {
+    email,
+    password,
+    organizationId: input.organizationId,
+    roles: [],
+    name: `QA Webhooks ${input.slug}`,
+  });
+  await setUserAclInDb({
+    userId,
+    tenantId: input.tenantId,
+    features: input.features,
+    organizations: input.organizations ?? null,
+  });
+  const token = await getAuthToken(request, email, password);
+  return { userId, email, password, token };
+}
+
+export async function cleanupWebhooksUser(
+  request: APIRequestContext,
+  adminToken: string | null,
+  user: ProvisionedWebhooksUser | null,
+): Promise<void> {
+  if (!user) return;
+  await deleteUserAclInDb(user.userId).catch(() => undefined);
+  await deleteUserIfExists(request, adminToken, user.userId).catch(() => undefined);
+}