@open-mercato/webhooks 0.6.5-develop.4534.1.b459babe6d → 0.6.5-develop.4544.1.71c003c861

package/src/modules/webhooks/__integration__/TC-LOCK-OSS-043.spec.ts

@@ -0,0 +1,352 @@
+import { test, expect, type APIRequestContext } from '@playwright/test'
+import { getAuthToken, apiRequest } from '@open-mercato/core/modules/core/__integration__/helpers/api'
+import { login } from '@open-mercato/core/modules/core/__integration__/helpers/auth'
+import {
+  putWithLock,
+  expectConflictBody,
+  expectConflictBanner,
+  resolveApiUrl,
+} from '@open-mercato/core/modules/core/__integration__/helpers/optimisticLockUi'
+import { OPTIMISTIC_LOCK_HEADER_NAME } from '@open-mercato/shared/lib/crud/optimistic-lock-headers'
+
+/**
+ * TC-LOCK-OSS-043 — webhooks + inbox settings + data-sync schedule
+ * optimistic-lock conflict contract (WHK-01, INB-01, SYNC-01).
+ *
+ * All three surfaces guard writes with `enforceCommandOptimisticLock` inside
+ * pure command/API routes — none expose a dedicated `data-crud-field-id`
+ * CrudForm edit page for the locked record, so the conflict contract is proven
+ * at the API level: capture the record's `updated_at`, advance it out-of-band
+ * via a header-less write (the strictly-additive path always succeeds and bumps
+ * `updated_at`), then replay the now-stale write with the original
+ * expected-version header → 409 `optimistic_lock_conflict`.
+ *
+ *  - WHK-01: `PUT /api/webhooks/<id>` and `DELETE /api/webhooks/<id>`
+ *    (`packages/webhooks/src/modules/webhooks/api/webhooks/[id]/route.ts`,
+ *    `resourceKind: 'webhooks.endpoint'`).
+ *  - INB-01: `PATCH /api/inbox_ops/settings`
+ *    (`packages/core/src/modules/inbox_ops/api/settings/route.ts`,
+ *    `resourceKind: 'inbox_ops.settings'`). The settings row is a per-tenant
+ *    singleton, so the test bumps + restores `workingLanguage` instead of
+ *    creating/deleting a fixture.
+ *  - SYNC-01: `POST /api/data_sync/schedules`
+ *    (`packages/core/src/modules/data_sync/api/schedules/route.ts` →
+ *    `SyncScheduleService.saveSchedule`, `resourceKind: 'data_sync.schedule'`).
+ *    The collection POST reads the expected-version header; the service enforces
+ *    the lock when a row with the same (integrationId, entityType, direction)
+ *    key already exists.
+ */
+
+const WEBHOOKS_API = '/api/webhooks'
+const INBOX_SETTINGS_API = '/api/inbox_ops/settings'
+const SCHEDULES_API = '/api/data_sync/schedules'
+
+type InboxSettings = { id: string; workingLanguage: string; updatedAt: string }
+
+async function createWebhook(
+  request: APIRequestContext,
+  token: string,
+  stamp: number,
+): Promise<{ id: string; updatedAt: string }> {
+  const created = await apiRequest(request, 'POST', WEBHOOKS_API, {
+    token,
+    data: {
+      name: `QA Lock 043 ${stamp}`,
+      url: `https://example.com/qa-lock-043-${stamp}`,
+      subscribedEvents: ['qa.lock.test'],
+    },
+  })
+  expect(created.status(), 'POST webhook should be 201').toBe(201)
+  const body = (await created.json()) as { id?: string }
+  expect(typeof body.id, 'webhook creation should return an id').toBe('string')
+  const detail = await apiRequest(request, 'GET', `${WEBHOOKS_API}/${body.id}`, { token })
+  expect(detail.status(), 'GET webhook detail should be 200').toBe(200)
+  const detailBody = (await detail.json()) as { updatedAt?: string }
+  expect(typeof detailBody.updatedAt, 'webhook should expose updatedAt').toBe('string')
+  return { id: body.id as string, updatedAt: detailBody.updatedAt as string }
+}
+
+async function readWebhookUpdatedAt(
+  request: APIRequestContext,
+  token: string,
+  id: string,
+): Promise<string> {
+  const detail = await apiRequest(request, 'GET', `${WEBHOOKS_API}/${id}`, { token })
+  expect(detail.status(), 'GET webhook detail should be 200').toBe(200)
+  const body = (await detail.json()) as { updatedAt?: string }
+  return body.updatedAt as string
+}
+
+async function deleteWebhook(
+  request: APIRequestContext,
+  token: string,
+  id: string,
+): Promise<void> {
+  const current = await readWebhookUpdatedAt(request, token, id).catch(() => undefined)
+  await request
+    .fetch(resolveApiUrl(`${WEBHOOKS_API}/${id}`), {
+      method: 'DELETE',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json',
+        ...(current ? { [OPTIMISTIC_LOCK_HEADER_NAME]: current } : {}),
+      },
+    })
+    .catch(() => undefined)
+}
+
+async function patchInboxSettings(
+  request: APIRequestContext,
+  token: string,
+  body: Record<string, unknown>,
+  lockValue?: string,
+) {
+  return request.fetch(resolveApiUrl(INBOX_SETTINGS_API), {
+    method: 'PATCH',
+    headers: {
+      Authorization: `Bearer ${token}`,
+      'Content-Type': 'application/json',
+      ...(lockValue !== undefined ? { [OPTIMISTIC_LOCK_HEADER_NAME]: lockValue } : {}),
+    },
+    data: body,
+  })
+}
+
+async function readInboxSettings(
+  request: APIRequestContext,
+  token: string,
+): Promise<InboxSettings> {
+  const response = await apiRequest(request, 'GET', INBOX_SETTINGS_API, { token })
+  expect(response.status(), 'GET inbox settings should be 200').toBe(200)
+  const body = (await response.json()) as { settings?: InboxSettings | null }
+  expect(body.settings, 'tenant inbox settings singleton should exist').toBeTruthy()
+  return body.settings as InboxSettings
+}
+
+async function postSchedule(
+  request: APIRequestContext,
+  token: string,
+  scheduleValue: string,
+  integrationId: string,
+  lockValue?: string,
+) {
+  return request.fetch(resolveApiUrl(SCHEDULES_API), {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${token}`,
+      'Content-Type': 'application/json',
+      ...(lockValue !== undefined ? { [OPTIMISTIC_LOCK_HEADER_NAME]: lockValue } : {}),
+    },
+    data: {
+      integrationId,
+      entityType: 'products',
+      direction: 'import',
+      scheduleType: 'cron',
+      scheduleValue,
+      timezone: 'UTC',
+      fullSync: false,
+      isEnabled: true,
+    },
+  })
+}
+
+test.describe('TC-LOCK-OSS-043: webhooks + inbox settings + data-sync schedule optimistic lock', () => {
+  test('WHK-01 stale webhook PUT is refused with a 409 conflict', async ({ page }) => {
+    const token = await getAuthToken(page.request, 'admin')
+    const stamp = Date.now()
+    let webhookId: string | null = null
+    try {
+      const webhook = await createWebhook(page.request, token, stamp)
+      webhookId = webhook.id
+      const staleUpdatedAt = webhook.updatedAt
+
+      // Advance updated_at out-of-band via a header-less PUT.
+      const bump = await apiRequest(page.request, 'PUT', `${WEBHOOKS_API}/${webhookId}`, {
+        token,
+        data: { name: `QA Lock 043 bumped ${stamp}` },
+      })
+      expect(bump.status(), 'out-of-band webhook PUT should succeed').toBeLessThan(300)
+
+      // Replay the now-stale write → 409.
+      const conflict = await putWithLock(
+        page.request,
+        token,
+        `${WEBHOOKS_API}/${webhookId}`,
+        { name: `QA Lock 043 stale ${stamp}` },
+        staleUpdatedAt,
+      )
+      await expectConflictBody(conflict)
+    } finally {
+      if (webhookId) await deleteWebhook(page.request, token, webhookId)
+    }
+  })
+
+  test('WHK-01 stale webhook DELETE is refused with a 409 conflict', async ({ page }) => {
+    const token = await getAuthToken(page.request, 'admin')
+    const stamp = Date.now()
+    let webhookId: string | null = null
+    try {
+      const webhook = await createWebhook(page.request, token, stamp)
+      webhookId = webhook.id
+      const staleUpdatedAt = webhook.updatedAt
+
+      const bump = await apiRequest(page.request, 'PUT', `${WEBHOOKS_API}/${webhookId}`, {
+        token,
+        data: { name: `QA Lock 043 bumped ${stamp}` },
+      })
+      expect(bump.status(), 'out-of-band webhook PUT should succeed').toBeLessThan(300)
+
+      const conflict = await page.request.fetch(resolveApiUrl(`${WEBHOOKS_API}/${webhookId}`), {
+        method: 'DELETE',
+        headers: {
+          Authorization: `Bearer ${token}`,
+          'Content-Type': 'application/json',
+          [OPTIMISTIC_LOCK_HEADER_NAME]: staleUpdatedAt,
+        },
+      })
+      await expectConflictBody(conflict)
+    } finally {
+      if (webhookId) await deleteWebhook(page.request, token, webhookId)
+    }
+  })
+
+  // WHK-01 (browser UI): now ACTIVE. The product fix is committed/verified — the webhooks
+  // server DELETE returns the structured 409 (proven by the active "WHK-01 stale webhook
+  // DELETE is refused with a 409" API test) and the list page sends the lock header
+  // (`buildOptimisticLockHeader(row.updatedAt)`) + routes the resulting 409 through
+  // surfaceRecordConflict. The RowActions menu opens on CLICK of the "Open actions" kebab and
+  // renders the items in a portal on document.body (role="menuitem"); the confirm dialog is a
+  // role="alertdialog" with a "Confirm" button. We drive that choreography robustly here:
+  // wait for the filtered list GET to settle, open the kebab, click Delete, confirm, then
+  // assert the unified conflict bar (never the success toast).
+  test('WHK-01 stale webhook DELETE in the list surfaces the conflict bar', async ({ page }) => {
+    const token = await getAuthToken(page.request, 'admin')
+    const stamp = Date.now()
+    const webhookName = `QA Lock 043 ${stamp}`
+    let webhookId: string | null = null
+    try {
+      const webhook = await createWebhook(page.request, token, stamp)
+      webhookId = webhook.id
+
+      await login(page, 'admin')
+      await page.goto('/backend/webhooks')
+      // Wait for the list GET to settle before interacting. The list reflects the
+      // freshly created fixture immediately (newest-first), so a unique name makes
+      // the row unambiguous.
+      await page
+        .waitForResponse(
+          (response) =>
+            response.url().includes('/api/webhooks') &&
+            response.request().method() === 'GET' &&
+            response.ok(),
+          { timeout: 20_000 },
+        )
+        .catch(() => undefined)
+
+      const row = page.getByRole('row', { name: new RegExp(`${webhookName}\\b`) }).first()
+      await expect(row, 'created webhook should appear in the list').toBeVisible({ timeout: 20_000 })
+
+      // Advance updated_at out-of-band → the in-page row token is now stale.
+      const bump = await apiRequest(page.request, 'PUT', `${WEBHOOKS_API}/${webhookId}`, {
+        token,
+        data: { name: `QA Lock 043 bumped ${stamp}` },
+      })
+      expect(bump.status(), 'out-of-band webhook PUT should succeed').toBeLessThan(300)
+
+      // Open the row's RowActions kebab (opens on click) and trigger Delete. The
+      // menu renders in a portal on document.body, so query it at the page level.
+      const kebab = row.getByRole('button', { name: /open actions/i })
+      await expect(kebab, 'row should expose an Open actions trigger').toBeVisible()
+      await kebab.click()
+      const deleteItem = page.getByRole('menuitem', { name: /^delete$/i })
+      await expect(deleteItem, 'delete menu item should be visible').toBeVisible({ timeout: 10_000 })
+      await deleteItem.click()
+
+      // Confirm the destructive alertdialog (the row still holds the stale
+      // updated_at captured at render time, so the DELETE 409s).
+      const dialog = page.getByRole('alertdialog')
+      await expect(dialog, 'confirm dialog should open').toBeVisible({ timeout: 10_000 })
+      await dialog.getByRole('button', { name: /^(confirm|delete)$/i }).click()
+
+      // The client must route the 409 to the unified conflict bar, never the
+      // success toast.
+      await expectConflictBanner(page)
+    } finally {
+      if (webhookId) await deleteWebhook(page.request, token, webhookId)
+    }
+  })
+
+  test('INB-01 stale inbox-settings PATCH is refused with a 409 conflict', async ({ page }) => {
+    const token = await getAuthToken(page.request, 'admin')
+    const before = await readInboxSettings(page.request, token)
+    const originalLanguage = before.workingLanguage
+    const staleUpdatedAt = before.updatedAt
+    const bumpLanguage = originalLanguage === 'de' ? 'en' : 'de'
+    const staleLanguage = originalLanguage === 'es' ? 'pl' : 'es'
+    try {
+      // Advance updated_at out-of-band via a header-less PATCH.
+      const bump = await patchInboxSettings(page.request, token, { workingLanguage: bumpLanguage })
+      expect(bump.status(), 'out-of-band inbox PATCH should succeed').toBeLessThan(300)
+
+      // Replay the now-stale write with the original expected-version → 409.
+      const conflict = await patchInboxSettings(
+        page.request,
+        token,
+        { workingLanguage: staleLanguage },
+        staleUpdatedAt,
+      )
+      await expectConflictBody(conflict)
+    } finally {
+      // Restore the original working language with a fresh lock token.
+      const current = await readInboxSettings(page.request, token).catch(() => null)
+      if (current) {
+        await patchInboxSettings(
+          page.request,
+          token,
+          { workingLanguage: originalLanguage },
+          current.updatedAt,
+        ).catch(() => undefined)
+      }
+    }
+  })
+
+  test('SYNC-01 stale data-sync schedule save is refused with a 409 conflict', async ({ page }) => {
+    const token = await getAuthToken(page.request, 'admin')
+    const stamp = Date.now()
+    const integrationId = `qa-lock-043-${stamp}`
+    let scheduleId: string | null = null
+    try {
+      const created = await postSchedule(page.request, token, '0 * * * *', integrationId)
+      expect(created.status(), 'POST schedule should be 201').toBe(201)
+      const createdBody = (await created.json()) as { id?: string; updatedAt?: string }
+      scheduleId = createdBody.id ?? null
+      const staleUpdatedAt = createdBody.updatedAt
+      expect(typeof scheduleId, 'schedule creation should return an id').toBe('string')
+      expect(typeof staleUpdatedAt, 'schedule should expose updatedAt').toBe('string')
+
+      // Advance updated_at out-of-band via the header-less [id] PUT route.
+      const bump = await apiRequest(page.request, 'PUT', `${SCHEDULES_API}/${scheduleId}`, {
+        token,
+        data: { scheduleValue: '5 * * * *' },
+      })
+      expect(bump.status(), 'out-of-band schedule PUT should succeed').toBeLessThan(300)
+
+      // Replay the save for the same (integrationId, entityType, direction) key
+      // with the now-stale expected-version → 409.
+      const conflict = await postSchedule(
+        page.request,
+        token,
+        '9 * * * *',
+        integrationId,
+        staleUpdatedAt as string,
+      )
+      await expectConflictBody(conflict)
+    } finally {
+      if (scheduleId) {
+        await apiRequest(page.request, 'DELETE', `${SCHEDULES_API}/${scheduleId}`, { token }).catch(
+          () => undefined,
+        )
+      }
+    }
+  })
+})

package/src/modules/webhooks/api/webhooks/[id]/__tests__/optimistic-lock.test.ts

@@ -0,0 +1,101 @@
+/** @jest-environment node */
+
+import { OPTIMISTIC_LOCK_HEADER_NAME } from '@open-mercato/shared/lib/crud/optimistic-lock-headers'
+
+const WEBHOOK_ID = '123e4567-e89b-12d3-a456-426614174070'
+const CURRENT_VERSION = '2026-06-01T10:00:00.000Z'
+const STALE_VERSION = '2026-06-01T09:00:00.000Z'
+
+const webhookRecord = {
+  id: WEBHOOK_ID,
+  name: 'Hook',
+  description: null,
+  url: 'https://example.com/hook',
+  subscribedEvents: ['a.b.c'],
+  httpMethod: 'POST',
+  isActive: true,
+  organizationId: 'org-1',
+  tenantId: 'tenant-1',
+  updatedAt: new Date(CURRENT_VERSION),
+  deletedAt: null as Date | null,
+}
+
+const mockEm = {
+  fork: jest.fn(() => mockEm),
+  flush: jest.fn(async () => undefined),
+}
+
+const mockEmitWebhooksEvent = jest.fn(async () => undefined)
+
+jest.mock('../../../../events', () => ({
+  emitWebhooksEvent: (...args: unknown[]) => mockEmitWebhooksEvent(...args),
+}))
+
+jest.mock('../../../helpers', () => ({
+  json: (payload: unknown, init: ResponseInit = { status: 200 }) =>
+    new Response(JSON.stringify(payload), {
+      ...init,
+      headers: { 'content-type': 'application/json' },
+    }),
+  resolveWebhookRequestScope: jest.fn(async () => ({ em: mockEm, tenantId: 'tenant-1', organizationId: 'org-1' })),
+  findScopedWebhook: jest.fn(async () => (webhookRecord.deletedAt ? null : webhookRecord)),
+  serializeWebhookDetail: (item: { id: string; updatedAt: Date }) => ({
+    id: item.id,
+    updatedAt: item.updatedAt.toISOString(),
+  }),
+}))
+
+jest.mock('@open-mercato/shared/lib/i18n/server', () => ({
+  resolveTranslations: jest.fn(async () => ({ translate: (_key: string, fallback?: string) => fallback ?? '' })),
+}))
+
+import { PUT, DELETE } from '../route'
+
+function request(method: string, headerVersion: string | null, body?: unknown) {
+  const headers: Record<string, string> = { 'content-type': 'application/json' }
+  if (headerVersion) headers[OPTIMISTIC_LOCK_HEADER_NAME] = headerVersion
+  return new Request(`http://localhost/api/webhooks/${WEBHOOK_ID}`, {
+    method,
+    headers,
+    body: body !== undefined ? JSON.stringify(body) : undefined,
+  })
+}
+
+const context = { params: Promise.resolve({ id: WEBHOOK_ID }) }
+
+describe('webhook endpoint PUT/DELETE optimistic locking', () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+    webhookRecord.deletedAt = null
+    delete process.env.OM_OPTIMISTIC_LOCK
+  })
+
+  it('PUT returns 409 with the structured conflict body when the expected version is stale', async () => {
+    const res = await PUT(request('PUT', STALE_VERSION, { name: 'X' }), context)
+    expect(res.status).toBe(409)
+    const body = await res.json()
+    expect(body.code).toBe('optimistic_lock_conflict')
+    expect(body.currentUpdatedAt).toBe(CURRENT_VERSION)
+    expect(mockEm.flush).not.toHaveBeenCalled()
+  })
+
+  it('PUT succeeds when the expected version matches', async () => {
+    const res = await PUT(request('PUT', CURRENT_VERSION, { name: 'X' }), context)
+    expect(res.status).toBe(200)
+    expect(mockEm.flush).toHaveBeenCalled()
+  })
+
+  it('PUT is a no-op (no 409) when the client sends no expected-version header', async () => {
+    const res = await PUT(request('PUT', null, { name: 'X' }), context)
+    expect(res.status).toBe(200)
+    expect(mockEm.flush).toHaveBeenCalled()
+  })
+
+  it('DELETE returns 409 when the expected version is stale', async () => {
+    const res = await DELETE(request('DELETE', STALE_VERSION), context)
+    expect(res.status).toBe(409)
+    const body = await res.json()
+    expect(body.code).toBe('optimistic_lock_conflict')
+    expect(mockEm.flush).not.toHaveBeenCalled()
+  })
+})

package/src/modules/webhooks/api/webhooks/[id]/route.ts

@@ -4,6 +4,8 @@ import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { emitWebhooksEvent } from '../../../events'
 import { findScopedWebhook, json, resolveWebhookRequestScope, serializeWebhookDetail } from '../../helpers'
 import { webhookUpdateSchema } from '../../../data/validators'
+import { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 
 export const metadata = {
   GET: { requireAuth: true, requireFeatures: ['webhooks.view'] },
@@ -69,6 +71,18 @@ export async function PUT(request: Request, context: RouteContext): Promise<Resp
     return json({ error: 'Webhook not found' }, { status: 404 })
   }
 
+  try {
+    enforceCommandOptimisticLock({
+      resourceKind: 'webhooks.endpoint',
+      resourceId: webhook.id,
+      current: webhook.updatedAt ?? null,
+      request,
+    })
+  } catch (err) {
+    if (isCrudHttpError(err)) return json(err.body, { status: err.status })
+    throw err
+  }
+
   const parsed = webhookUpdateSchema.safeParse(await request.json().catch(() => null))
   if (!parsed.success) {
     return json({ error: 'Invalid request payload' }, { status: 400 })
@@ -114,6 +128,18 @@ export async function DELETE(request: Request, context: RouteContext): Promise<R
     return json({ error: translate('webhooks.errors.notFound', 'Webhook not found') }, { status: 404 })
   }
 
+  try {
+    enforceCommandOptimisticLock({
+      resourceKind: 'webhooks.endpoint',
+      resourceId: webhook.id,
+      current: webhook.updatedAt ?? null,
+      request,
+    })
+  } catch (err) {
+    if (isCrudHttpError(err)) return json(err.body, { status: err.status })
+    throw err
+  }
+
   webhook.deletedAt = new Date()
   await em.flush()
 

package/src/modules/webhooks/backend/webhooks/[id]/page.tsx

@@ -16,6 +16,8 @@ import { FormHeader } from '@open-mercato/ui/backend/forms'
 import { RowActions } from '@open-mercato/ui/backend/RowActions'
 import { CrudForm } from '@open-mercato/ui/backend/CrudForm'
 import { deleteCrud, updateCrud } from '@open-mercato/ui/backend/utils/crud'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
+import { surfaceRecordConflict } from '@open-mercato/ui/backend/conflicts'
 import { Alert, AlertDescription } from '@open-mercato/ui/primitives/alert'
 import {
   buildWebhookFormContentHeader,
@@ -362,10 +364,14 @@ export default function WebhookDetailPage() {
   const handleDelete = React.useCallback(async () => {
     if (!webhook) return
     try {
-      await deleteCrud(`webhooks/${encodeURIComponent(webhook.id)}`, { fallbackResult: null })
+      await deleteCrud(`webhooks/${encodeURIComponent(webhook.id)}`, {
+        fallbackResult: null,
+        headers: buildOptimisticLockHeader(webhook.updatedAt),
+      })
       flash(t('webhooks.list.deleteSuccess'), 'success')
       router.push('/backend/webhooks')
-    } catch {
+    } catch (error) {
+      if (surfaceRecordConflict(error, t)) return
       flash(t('webhooks.list.deleteError'), 'error')
     }
   }, [router, t, webhook])
@@ -497,6 +503,7 @@ export default function WebhookDetailPage() {
             fields={fields}
             groups={groups}
             initialValues={createWebhookInitialValues(webhook)}
+            optimisticLockUpdatedAt={webhook.updatedAt}
             submitLabel={t('common.save')}
             cancelHref={`/backend/webhooks/${webhook.id}`}
             contentHeader={contentHeader}

package/src/modules/webhooks/backend/webhooks/page.tsx

@@ -8,6 +8,8 @@ import type { ColumnDef } from '@tanstack/react-table'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { RowActions } from '@open-mercato/ui/backend/RowActions'
 import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
+import { surfaceRecordConflict } from '@open-mercato/ui/backend/conflicts'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
@@ -107,10 +109,11 @@ export default function WebhooksListPage() {
     try {
       const call = await apiCall<{ error?: string }>(
         `/api/webhooks/${encodeURIComponent(row.id)}`,
-        { method: 'DELETE' },
+        { method: 'DELETE', headers: buildOptimisticLockHeader(row.updatedAt) },
         { fallback: null },
       )
       if (!call.ok) {
+        if (surfaceRecordConflict({ status: call.status, body: call.result }, t)) return
         const errorPayload = call.result as { error?: string } | undefined
         const message = typeof errorPayload?.error === 'string' ? errorPayload.error : t('webhooks.list.deleteError')
         flash(message, 'error')