@open-mercato/webhooks 0.6.4-develop.4382.1.6b4f656b77 → 0.6.4

package/src/modules/webhooks/api/webhooks/[id]/__tests__/optimistic-lock.test.ts

@@ -0,0 +1,101 @@
+/** @jest-environment node */
+
+import { OPTIMISTIC_LOCK_HEADER_NAME } from '@open-mercato/shared/lib/crud/optimistic-lock-headers'
+
+const WEBHOOK_ID = '123e4567-e89b-12d3-a456-426614174070'
+const CURRENT_VERSION = '2026-06-01T10:00:00.000Z'
+const STALE_VERSION = '2026-06-01T09:00:00.000Z'
+
+const webhookRecord = {
+  id: WEBHOOK_ID,
+  name: 'Hook',
+  description: null,
+  url: 'https://example.com/hook',
+  subscribedEvents: ['a.b.c'],
+  httpMethod: 'POST',
+  isActive: true,
+  organizationId: 'org-1',
+  tenantId: 'tenant-1',
+  updatedAt: new Date(CURRENT_VERSION),
+  deletedAt: null as Date | null,
+}
+
+const mockEm = {
+  fork: jest.fn(() => mockEm),
+  flush: jest.fn(async () => undefined),
+}
+
+const mockEmitWebhooksEvent = jest.fn(async () => undefined)
+
+jest.mock('../../../../events', () => ({
+  emitWebhooksEvent: (...args: unknown[]) => mockEmitWebhooksEvent(...args),
+}))
+
+jest.mock('../../../helpers', () => ({
+  json: (payload: unknown, init: ResponseInit = { status: 200 }) =>
+    new Response(JSON.stringify(payload), {
+      ...init,
+      headers: { 'content-type': 'application/json' },
+    }),
+  resolveWebhookRequestScope: jest.fn(async () => ({ em: mockEm, tenantId: 'tenant-1', organizationId: 'org-1' })),
+  findScopedWebhook: jest.fn(async () => (webhookRecord.deletedAt ? null : webhookRecord)),
+  serializeWebhookDetail: (item: { id: string; updatedAt: Date }) => ({
+    id: item.id,
+    updatedAt: item.updatedAt.toISOString(),
+  }),
+}))
+
+jest.mock('@open-mercato/shared/lib/i18n/server', () => ({
+  resolveTranslations: jest.fn(async () => ({ translate: (_key: string, fallback?: string) => fallback ?? '' })),
+}))
+
+import { PUT, DELETE } from '../route'
+
+function request(method: string, headerVersion: string | null, body?: unknown) {
+  const headers: Record<string, string> = { 'content-type': 'application/json' }
+  if (headerVersion) headers[OPTIMISTIC_LOCK_HEADER_NAME] = headerVersion
+  return new Request(`http://localhost/api/webhooks/${WEBHOOK_ID}`, {
+    method,
+    headers,
+    body: body !== undefined ? JSON.stringify(body) : undefined,
+  })
+}
+
+const context = { params: Promise.resolve({ id: WEBHOOK_ID }) }
+
+describe('webhook endpoint PUT/DELETE optimistic locking', () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+    webhookRecord.deletedAt = null
+    delete process.env.OM_OPTIMISTIC_LOCK
+  })
+
+  it('PUT returns 409 with the structured conflict body when the expected version is stale', async () => {
+    const res = await PUT(request('PUT', STALE_VERSION, { name: 'X' }), context)
+    expect(res.status).toBe(409)
+    const body = await res.json()
+    expect(body.code).toBe('optimistic_lock_conflict')
+    expect(body.currentUpdatedAt).toBe(CURRENT_VERSION)
+    expect(mockEm.flush).not.toHaveBeenCalled()
+  })
+
+  it('PUT succeeds when the expected version matches', async () => {
+    const res = await PUT(request('PUT', CURRENT_VERSION, { name: 'X' }), context)
+    expect(res.status).toBe(200)
+    expect(mockEm.flush).toHaveBeenCalled()
+  })
+
+  it('PUT is a no-op (no 409) when the client sends no expected-version header', async () => {
+    const res = await PUT(request('PUT', null, { name: 'X' }), context)
+    expect(res.status).toBe(200)
+    expect(mockEm.flush).toHaveBeenCalled()
+  })
+
+  it('DELETE returns 409 when the expected version is stale', async () => {
+    const res = await DELETE(request('DELETE', STALE_VERSION), context)
+    expect(res.status).toBe(409)
+    const body = await res.json()
+    expect(body.code).toBe('optimistic_lock_conflict')
+    expect(mockEm.flush).not.toHaveBeenCalled()
+  })
+})

package/src/modules/webhooks/api/webhooks/[id]/route.ts

@@ -4,6 +4,8 @@ import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { emitWebhooksEvent } from '../../../events'
 import { findScopedWebhook, json, resolveWebhookRequestScope, serializeWebhookDetail } from '../../helpers'
 import { webhookUpdateSchema } from '../../../data/validators'
+import { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 
 export const metadata = {
   GET: { requireAuth: true, requireFeatures: ['webhooks.view'] },
@@ -69,6 +71,18 @@ export async function PUT(request: Request, context: RouteContext): Promise<Resp
     return json({ error: 'Webhook not found' }, { status: 404 })
   }
 
+  try {
+    enforceCommandOptimisticLock({
+      resourceKind: 'webhooks.endpoint',
+      resourceId: webhook.id,
+      current: webhook.updatedAt ?? null,
+      request,
+    })
+  } catch (err) {
+    if (isCrudHttpError(err)) return json(err.body, { status: err.status })
+    throw err
+  }
+
   const parsed = webhookUpdateSchema.safeParse(await request.json().catch(() => null))
   if (!parsed.success) {
     return json({ error: 'Invalid request payload' }, { status: 400 })
@@ -114,6 +128,18 @@ export async function DELETE(request: Request, context: RouteContext): Promise<R
     return json({ error: translate('webhooks.errors.notFound', 'Webhook not found') }, { status: 404 })
   }
 
+  try {
+    enforceCommandOptimisticLock({
+      resourceKind: 'webhooks.endpoint',
+      resourceId: webhook.id,
+      current: webhook.updatedAt ?? null,
+      request,
+    })
+  } catch (err) {
+    if (isCrudHttpError(err)) return json(err.body, { status: err.status })
+    throw err
+  }
+
   webhook.deletedAt = new Date()
   await em.flush()
 

package/src/modules/webhooks/backend/webhooks/[id]/page.tsx

@@ -16,6 +16,8 @@ import { FormHeader } from '@open-mercato/ui/backend/forms'
 import { RowActions } from '@open-mercato/ui/backend/RowActions'
 import { CrudForm } from '@open-mercato/ui/backend/CrudForm'
 import { deleteCrud, updateCrud } from '@open-mercato/ui/backend/utils/crud'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
+import { surfaceRecordConflict } from '@open-mercato/ui/backend/conflicts'
 import { Alert, AlertDescription } from '@open-mercato/ui/primitives/alert'
 import {
   buildWebhookFormContentHeader,
@@ -362,10 +364,14 @@ export default function WebhookDetailPage() {
   const handleDelete = React.useCallback(async () => {
     if (!webhook) return
     try {
-      await deleteCrud(`webhooks/${encodeURIComponent(webhook.id)}`, { fallbackResult: null })
+      await deleteCrud(`webhooks/${encodeURIComponent(webhook.id)}`, {
+        fallbackResult: null,
+        headers: buildOptimisticLockHeader(webhook.updatedAt),
+      })
       flash(t('webhooks.list.deleteSuccess'), 'success')
       router.push('/backend/webhooks')
-    } catch {
+    } catch (error) {
+      if (surfaceRecordConflict(error, t)) return
       flash(t('webhooks.list.deleteError'), 'error')
     }
   }, [router, t, webhook])
@@ -497,6 +503,7 @@ export default function WebhookDetailPage() {
             fields={fields}
             groups={groups}
             initialValues={createWebhookInitialValues(webhook)}
+            optimisticLockUpdatedAt={webhook.updatedAt}
             submitLabel={t('common.save')}
             cancelHref={`/backend/webhooks/${webhook.id}`}
             contentHeader={contentHeader}

package/src/modules/webhooks/backend/webhooks/page.tsx

@@ -8,12 +8,15 @@ import type { ColumnDef } from '@tanstack/react-table'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { RowActions } from '@open-mercato/ui/backend/RowActions'
 import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
+import { surfaceRecordConflict } from '@open-mercato/ui/backend/conflicts'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
 import type { FilterDef, FilterValues } from '@open-mercato/ui/backend/FilterBar'
 import { Alert, AlertDescription, AlertTitle } from '@open-mercato/ui/primitives/alert'
+import { ListEmptyState } from '@open-mercato/ui/backend/filters/ListEmptyState'
 import { useWebhookFeatureAccess } from './useWebhookFeatureAccess'
 
 type Row = {
@@ -107,10 +110,11 @@ export default function WebhooksListPage() {
     try {
       const call = await apiCall<{ error?: string }>(
         `/api/webhooks/${encodeURIComponent(row.id)}`,
-        { method: 'DELETE' },
+        { method: 'DELETE', headers: buildOptimisticLockHeader(row.updatedAt) },
         { fallback: null },
       )
       if (!call.ok) {
+        if (surfaceRecordConflict({ status: call.status, body: call.result }, t)) return
         const errorPayload = call.result as { error?: string } | undefined
         const message = typeof errorPayload?.error === 'string' ? errorPayload.error : t('webhooks.list.deleteError')
         flash(message, 'error')
@@ -276,6 +280,13 @@ export default function WebhooksListPage() {
 
             return <RowActions items={items} />
           }}
+          emptyState={(
+            <ListEmptyState
+              entityName={t('webhooks.list.title')}
+              createHref={access.canManage ? '/backend/webhooks/create' : undefined}
+              createLabel={access.canManage ? t('webhooks.nav.create') : undefined}
+            />
+          )}
           pagination={{ page, pageSize: 20, total, totalPages, onPageChange: setPage }}
           isLoading={isLoading}
         />

package/src/modules/webhooks/i18n/de.json

@@ -29,6 +29,7 @@
   "webhooks.detail.actions.deactivate": "Deactivate",
   "webhooks.detail.actions.rotateSecret": "Rotate Secret",
   "webhooks.detail.actions.test": "Send Test",
+  "webhooks.detail.backToList": "Zurück zu Webhooks",
   "webhooks.detail.consecutiveFailures": "Consecutive Failures",
   "webhooks.detail.deliveryTip": "Start with a test delivery before enabling a broad event pattern. The delivery log below shows exactly what your consumer returned.",
   "webhooks.detail.loadError": "Failed to load webhook.",

package/src/modules/webhooks/i18n/en.json

@@ -29,6 +29,7 @@
   "webhooks.detail.actions.deactivate": "Deactivate",
   "webhooks.detail.actions.rotateSecret": "Rotate Secret",
   "webhooks.detail.actions.test": "Send Test",
+  "webhooks.detail.backToList": "Back to webhooks",
   "webhooks.detail.consecutiveFailures": "Consecutive Failures",
   "webhooks.detail.deliveryTip": "Start with a test delivery before enabling a broad event pattern. The delivery log below shows exactly what your consumer returned.",
   "webhooks.detail.loadError": "Failed to load webhook.",

package/src/modules/webhooks/i18n/es.json

@@ -29,6 +29,7 @@
   "webhooks.detail.actions.deactivate": "Deactivate",
   "webhooks.detail.actions.rotateSecret": "Rotate Secret",
   "webhooks.detail.actions.test": "Send Test",
+  "webhooks.detail.backToList": "Volver a webhooks",
   "webhooks.detail.consecutiveFailures": "Consecutive Failures",
   "webhooks.detail.deliveryTip": "Start with a test delivery before enabling a broad event pattern. The delivery log below shows exactly what your consumer returned.",
   "webhooks.detail.loadError": "Failed to load webhook.",

package/src/modules/webhooks/i18n/pl.json

@@ -29,6 +29,7 @@
   "webhooks.detail.actions.deactivate": "Deactivate",
   "webhooks.detail.actions.rotateSecret": "Rotate Secret",
   "webhooks.detail.actions.test": "Send Test",
+  "webhooks.detail.backToList": "Wróć do webhooków",
   "webhooks.detail.consecutiveFailures": "Consecutive Failures",
   "webhooks.detail.deliveryTip": "Start with a test delivery before enabling a broad event pattern. The delivery log below shows exactly what your consumer returned.",
   "webhooks.detail.loadError": "Failed to load webhook.",

package/src/modules/webhooks/subscribers/__tests__/outbound-dispatch.test.ts

@@ -102,6 +102,37 @@ describe('webhooks outbound dispatch subscriber', () => {
     })
   })
 
+  it('normalizes a missing organizationId to null in the decryption scope', async () => {
+    const { rootEm } = createDispatchEntityManagers()
+
+    ;(findWithDecryption as jest.Mock).mockResolvedValue([])
+
+    await handler(
+      {
+        id: 'product-1',
+        tenantId: 'tenant-1',
+      },
+      {
+        eventName: 'catalog.product.deleted',
+        resolve: <T,>(name: string): T => {
+          if (name === 'em') return rootEm as T
+          throw new Error(`Unexpected dependency: ${name}`)
+        },
+      },
+    )
+
+    expect(findWithDecryption).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.anything(),
+      expect.objectContaining({ tenantId: 'tenant-1' }),
+      expect.anything(),
+      { tenantId: 'tenant-1', organizationId: null },
+    )
+    const decryptionScope = (findWithDecryption as jest.Mock).mock.calls[0][4]
+    expect(decryptionScope.organizationId).toBeNull()
+    expect(decryptionScope.organizationId).not.toBe('')
+  })
+
   it('checks integration state once per organization when multiple webhooks match', async () => {
     const { rootEm, handlerEm } = createDispatchEntityManagers()
 

package/src/modules/webhooks/subscribers/outbound-dispatch.ts

@@ -67,7 +67,7 @@ export default async function handler(
       ...(organizationId ? { organizationId } : {}),
     },
     {},
-    { tenantId, organizationId: organizationId ?? '' },
+    { tenantId, organizationId: organizationId ?? null },
   )
 
   if (!webhooks.length) return