@open-mercato/webhooks 0.6.5-develop.4534.1.b459babe6d → 0.6.5-develop.4559.1.839e136509

package/src/modules/webhooks/__integration__/TC-LOCK-OSS-043.spec.ts

@@ -0,0 +1,352 @@
+import { test, expect, type APIRequestContext } from '@playwright/test'
+import { getAuthToken, apiRequest } from '@open-mercato/core/modules/core/__integration__/helpers/api'
+import { login } from '@open-mercato/core/modules/core/__integration__/helpers/auth'
+import {
+  putWithLock,
+  expectConflictBody,
+  expectConflictBanner,
+  resolveApiUrl,
+} from '@open-mercato/core/modules/core/__integration__/helpers/optimisticLockUi'
+import { OPTIMISTIC_LOCK_HEADER_NAME } from '@open-mercato/shared/lib/crud/optimistic-lock-headers'
+
+/**
+ * TC-LOCK-OSS-043 — webhooks + inbox settings + data-sync schedule
+ * optimistic-lock conflict contract (WHK-01, INB-01, SYNC-01).
+ *
+ * All three surfaces guard writes with `enforceCommandOptimisticLock` inside
+ * pure command/API routes — none expose a dedicated `data-crud-field-id`
+ * CrudForm edit page for the locked record, so the conflict contract is proven
+ * at the API level: capture the record's `updated_at`, advance it out-of-band
+ * via a header-less write (the strictly-additive path always succeeds and bumps
+ * `updated_at`), then replay the now-stale write with the original
+ * expected-version header → 409 `optimistic_lock_conflict`.
+ *
+ *  - WHK-01: `PUT /api/webhooks/<id>` and `DELETE /api/webhooks/<id>`
+ *    (`packages/webhooks/src/modules/webhooks/api/webhooks/[id]/route.ts`,
+ *    `resourceKind: 'webhooks.endpoint'`).
+ *  - INB-01: `PATCH /api/inbox_ops/settings`
+ *    (`packages/core/src/modules/inbox_ops/api/settings/route.ts`,
+ *    `resourceKind: 'inbox_ops.settings'`). The settings row is a per-tenant
+ *    singleton, so the test bumps + restores `workingLanguage` instead of
+ *    creating/deleting a fixture.
+ *  - SYNC-01: `POST /api/data_sync/schedules`
+ *    (`packages/core/src/modules/data_sync/api/schedules/route.ts` →
+ *    `SyncScheduleService.saveSchedule`, `resourceKind: 'data_sync.schedule'`).
+ *    The collection POST reads the expected-version header; the service enforces
+ *    the lock when a row with the same (integrationId, entityType, direction)
+ *    key already exists.
+ */
+
+const WEBHOOKS_API = '/api/webhooks'
+const INBOX_SETTINGS_API = '/api/inbox_ops/settings'
+const SCHEDULES_API = '/api/data_sync/schedules'
+
+type InboxSettings = { id: string; workingLanguage: string; updatedAt: string }
+
+async function createWebhook(
+  request: APIRequestContext,
+  token: string,
+  stamp: number,
+): Promise<{ id: string; updatedAt: string }> {
+  const created = await apiRequest(request, 'POST', WEBHOOKS_API, {
+    token,
+    data: {
+      name: `QA Lock 043 ${stamp}`,
+      url: `https://example.com/qa-lock-043-${stamp}`,
+      subscribedEvents: ['qa.lock.test'],
+    },
+  })
+  expect(created.status(), 'POST webhook should be 201').toBe(201)
+  const body = (await created.json()) as { id?: string }
+  expect(typeof body.id, 'webhook creation should return an id').toBe('string')
+  const detail = await apiRequest(request, 'GET', `${WEBHOOKS_API}/${body.id}`, { token })
+  expect(detail.status(), 'GET webhook detail should be 200').toBe(200)
+  const detailBody = (await detail.json()) as { updatedAt?: string }
+  expect(typeof detailBody.updatedAt, 'webhook should expose updatedAt').toBe('string')
+  return { id: body.id as string, updatedAt: detailBody.updatedAt as string }
+}
+
+async function readWebhookUpdatedAt(
+  request: APIRequestContext,
+  token: string,
+  id: string,
+): Promise<string> {
+  const detail = await apiRequest(request, 'GET', `${WEBHOOKS_API}/${id}`, { token })
+  expect(detail.status(), 'GET webhook detail should be 200').toBe(200)
+  const body = (await detail.json()) as { updatedAt?: string }
+  return body.updatedAt as string
+}
+
+async function deleteWebhook(
+  request: APIRequestContext,
+  token: string,
+  id: string,
+): Promise<void> {
+  const current = await readWebhookUpdatedAt(request, token, id).catch(() => undefined)
+  await request
+    .fetch(resolveApiUrl(`${WEBHOOKS_API}/${id}`), {
+      method: 'DELETE',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json',
+        ...(current ? { [OPTIMISTIC_LOCK_HEADER_NAME]: current } : {}),
+      },
+    })
+    .catch(() => undefined)
+}
+
+async function patchInboxSettings(
+  request: APIRequestContext,
+  token: string,
+  body: Record<string, unknown>,
+  lockValue?: string,
+) {
+  return request.fetch(resolveApiUrl(INBOX_SETTINGS_API), {
+    method: 'PATCH',
+    headers: {
+      Authorization: `Bearer ${token}`,
+      'Content-Type': 'application/json',
+      ...(lockValue !== undefined ? { [OPTIMISTIC_LOCK_HEADER_NAME]: lockValue } : {}),
+    },
+    data: body,
+  })
+}
+
+async function readInboxSettings(
+  request: APIRequestContext,
+  token: string,
+): Promise<InboxSettings> {
+  const response = await apiRequest(request, 'GET', INBOX_SETTINGS_API, { token })
+  expect(response.status(), 'GET inbox settings should be 200').toBe(200)
+  const body = (await response.json()) as { settings?: InboxSettings | null }
+  expect(body.settings, 'tenant inbox settings singleton should exist').toBeTruthy()
+  return body.settings as InboxSettings
+}
+
+async function postSchedule(
+  request: APIRequestContext,
+  token: string,
+  scheduleValue: string,
+  integrationId: string,
+  lockValue?: string,
+) {
+  return request.fetch(resolveApiUrl(SCHEDULES_API), {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${token}`,
+      'Content-Type': 'application/json',
+      ...(lockValue !== undefined ? { [OPTIMISTIC_LOCK_HEADER_NAME]: lockValue } : {}),
+    },
+    data: {
+      integrationId,
+      entityType: 'products',
+      direction: 'import',
+      scheduleType: 'cron',
+      scheduleValue,
+      timezone: 'UTC',
+      fullSync: false,
+      isEnabled: true,
+    },
+  })
+}
+
+test.describe('TC-LOCK-OSS-043: webhooks + inbox settings + data-sync schedule optimistic lock', () => {
+  test('WHK-01 stale webhook PUT is refused with a 409 conflict', async ({ page }) => {
+    const token = await getAuthToken(page.request, 'admin')
+    const stamp = Date.now()
+    let webhookId: string | null = null
+    try {
+      const webhook = await createWebhook(page.request, token, stamp)
+      webhookId = webhook.id
+      const staleUpdatedAt = webhook.updatedAt
+
+      // Advance updated_at out-of-band via a header-less PUT.
+      const bump = await apiRequest(page.request, 'PUT', `${WEBHOOKS_API}/${webhookId}`, {
+        token,
+        data: { name: `QA Lock 043 bumped ${stamp}` },
+      })
+      expect(bump.status(), 'out-of-band webhook PUT should succeed').toBeLessThan(300)
+
+      // Replay the now-stale write → 409.
+      const conflict = await putWithLock(
+        page.request,
+        token,
+        `${WEBHOOKS_API}/${webhookId}`,
+        { name: `QA Lock 043 stale ${stamp}` },
+        staleUpdatedAt,
+      )
+      await expectConflictBody(conflict)
+    } finally {
+      if (webhookId) await deleteWebhook(page.request, token, webhookId)
+    }
+  })
+
+  test('WHK-01 stale webhook DELETE is refused with a 409 conflict', async ({ page }) => {
+    const token = await getAuthToken(page.request, 'admin')
+    const stamp = Date.now()
+    let webhookId: string | null = null
+    try {
+      const webhook = await createWebhook(page.request, token, stamp)
+      webhookId = webhook.id
+      const staleUpdatedAt = webhook.updatedAt
+
+      const bump = await apiRequest(page.request, 'PUT', `${WEBHOOKS_API}/${webhookId}`, {
+        token,
+        data: { name: `QA Lock 043 bumped ${stamp}` },
+      })
+      expect(bump.status(), 'out-of-band webhook PUT should succeed').toBeLessThan(300)
+
+      const conflict = await page.request.fetch(resolveApiUrl(`${WEBHOOKS_API}/${webhookId}`), {
+        method: 'DELETE',
+        headers: {
+          Authorization: `Bearer ${token}`,
+          'Content-Type': 'application/json',
+          [OPTIMISTIC_LOCK_HEADER_NAME]: staleUpdatedAt,
+        },
+      })
+      await expectConflictBody(conflict)
+    } finally {
+      if (webhookId) await deleteWebhook(page.request, token, webhookId)
+    }
+  })
+
+  // WHK-01 (browser UI): now ACTIVE. The product fix is committed/verified — the webhooks
+  // server DELETE returns the structured 409 (proven by the active "WHK-01 stale webhook
+  // DELETE is refused with a 409" API test) and the list page sends the lock header
+  // (`buildOptimisticLockHeader(row.updatedAt)`) + routes the resulting 409 through
+  // surfaceRecordConflict. The RowActions menu opens on CLICK of the "Open actions" kebab and
+  // renders the items in a portal on document.body (role="menuitem"); the confirm dialog is a
+  // role="alertdialog" with a "Confirm" button. We drive that choreography robustly here:
+  // wait for the filtered list GET to settle, open the kebab, click Delete, confirm, then
+  // assert the unified conflict bar (never the success toast).
+  test('WHK-01 stale webhook DELETE in the list surfaces the conflict bar', async ({ page }) => {
+    const token = await getAuthToken(page.request, 'admin')
+    const stamp = Date.now()
+    const webhookName = `QA Lock 043 ${stamp}`
+    let webhookId: string | null = null
+    try {
+      const webhook = await createWebhook(page.request, token, stamp)
+      webhookId = webhook.id
+
+      await login(page, 'admin')
+      await page.goto('/backend/webhooks')
+      // Wait for the list GET to settle before interacting. The list reflects the
+      // freshly created fixture immediately (newest-first), so a unique name makes
+      // the row unambiguous.
+      await page
+        .waitForResponse(
+          (response) =>
+            response.url().includes('/api/webhooks') &&
+            response.request().method() === 'GET' &&
+            response.ok(),
+          { timeout: 20_000 },
+        )
+        .catch(() => undefined)
+
+      const row = page.getByRole('row', { name: new RegExp(`${webhookName}\\b`) }).first()
+      await expect(row, 'created webhook should appear in the list').toBeVisible({ timeout: 20_000 })
+
+      // Advance updated_at out-of-band → the in-page row token is now stale.
+      const bump = await apiRequest(page.request, 'PUT', `${WEBHOOKS_API}/${webhookId}`, {
+        token,
+        data: { name: `QA Lock 043 bumped ${stamp}` },
+      })
+      expect(bump.status(), 'out-of-band webhook PUT should succeed').toBeLessThan(300)
+
+      // Open the row's RowActions kebab (opens on click) and trigger Delete. The
+      // menu renders in a portal on document.body, so query it at the page level.
+      const kebab = row.getByRole('button', { name: /open actions/i })
+      await expect(kebab, 'row should expose an Open actions trigger').toBeVisible()
+      await kebab.click()
+      const deleteItem = page.getByRole('menuitem', { name: /^delete$/i })
+      await expect(deleteItem, 'delete menu item should be visible').toBeVisible({ timeout: 10_000 })
+      await deleteItem.click()
+
+      // Confirm the destructive alertdialog (the row still holds the stale
+      // updated_at captured at render time, so the DELETE 409s).
+      const dialog = page.getByRole('alertdialog')
+      await expect(dialog, 'confirm dialog should open').toBeVisible({ timeout: 10_000 })
+      await dialog.getByRole('button', { name: /^(confirm|delete)$/i }).click()
+
+      // The client must route the 409 to the unified conflict bar, never the
+      // success toast.
+      await expectConflictBanner(page)
+    } finally {
+      if (webhookId) await deleteWebhook(page.request, token, webhookId)
+    }
+  })
+
+  test('INB-01 stale inbox-settings PATCH is refused with a 409 conflict', async ({ page }) => {
+    const token = await getAuthToken(page.request, 'admin')
+    const before = await readInboxSettings(page.request, token)
+    const originalLanguage = before.workingLanguage
+    const staleUpdatedAt = before.updatedAt
+    const bumpLanguage = originalLanguage === 'de' ? 'en' : 'de'
+    const staleLanguage = originalLanguage === 'es' ? 'pl' : 'es'
+    try {
+      // Advance updated_at out-of-band via a header-less PATCH.
+      const bump = await patchInboxSettings(page.request, token, { workingLanguage: bumpLanguage })
+      expect(bump.status(), 'out-of-band inbox PATCH should succeed').toBeLessThan(300)
+
+      // Replay the now-stale write with the original expected-version → 409.
+      const conflict = await patchInboxSettings(
+        page.request,
+        token,
+        { workingLanguage: staleLanguage },
+        staleUpdatedAt,
+      )
+      await expectConflictBody(conflict)
+    } finally {
+      // Restore the original working language with a fresh lock token.
+      const current = await readInboxSettings(page.request, token).catch(() => null)
+      if (current) {
+        await patchInboxSettings(
+          page.request,
+          token,
+          { workingLanguage: originalLanguage },
+          current.updatedAt,
+        ).catch(() => undefined)
+      }
+    }
+  })
+
+  test('SYNC-01 stale data-sync schedule save is refused with a 409 conflict', async ({ page }) => {
+    const token = await getAuthToken(page.request, 'admin')
+    const stamp = Date.now()
+    const integrationId = `qa-lock-043-${stamp}`
+    let scheduleId: string | null = null
+    try {
+      const created = await postSchedule(page.request, token, '0 * * * *', integrationId)
+      expect(created.status(), 'POST schedule should be 201').toBe(201)
+      const createdBody = (await created.json()) as { id?: string; updatedAt?: string }
+      scheduleId = createdBody.id ?? null
+      const staleUpdatedAt = createdBody.updatedAt
+      expect(typeof scheduleId, 'schedule creation should return an id').toBe('string')
+      expect(typeof staleUpdatedAt, 'schedule should expose updatedAt').toBe('string')
+
+      // Advance updated_at out-of-band via the header-less [id] PUT route.
+      const bump = await apiRequest(page.request, 'PUT', `${SCHEDULES_API}/${scheduleId}`, {
+        token,
+        data: { scheduleValue: '5 * * * *' },
+      })
+      expect(bump.status(), 'out-of-band schedule PUT should succeed').toBeLessThan(300)
+
+      // Replay the save for the same (integrationId, entityType, direction) key
+      // with the now-stale expected-version → 409.
+      const conflict = await postSchedule(
+        page.request,
+        token,
+        '9 * * * *',
+        integrationId,
+        staleUpdatedAt as string,
+      )
+      await expectConflictBody(conflict)
+    } finally {
+      if (scheduleId) {
+        await apiRequest(page.request, 'DELETE', `${SCHEDULES_API}/${scheduleId}`, { token }).catch(
+          () => undefined,
+        )
+      }
+    }
+  })
+})

package/src/modules/webhooks/__integration__/TC-WEBHOOK-004.spec.ts

@@ -0,0 +1,63 @@
+import { expect, test } from '@playwright/test';
+import { getAuthToken } from '@open-mercato/core/helpers/integration/api';
+import {
+  createWebhookFixture,
+  deleteWebhookIfExists,
+  getWebhookDetail,
+  rotateWebhookSecret,
+} from './helpers/fixtures';
+
+/**
+ * TC-WEBHOOK-004: Secret rotation with previous secret retention
+ * Source: https://github.com/open-mercato/open-mercato/issues/2482
+ *
+ * Verifies the security-critical rotate-secret flow: a new whsec_ secret is issued,
+ * the previous secret is retained (so deliveries can dual-sign during rollout), and
+ * the detail endpoint reflects the masked new secret plus the rotation timestamp.
+ */
+test.describe('TC-WEBHOOK-004: Secret rotation with previous secret retention', () => {
+  test('should rotate the signing secret, retain the previous one, and mask it on read', async ({ request }) => {
+    const token = await getAuthToken(request);
+    let webhookId: string | null = null;
+
+    try {
+      const created = await createWebhookFixture(request, token, {
+        name: `Webhook Rotate ${Date.now()}`,
+        url: 'https://example.com/webhook-rotate',
+        subscribedEvents: ['sales.quote.created'],
+      });
+      webhookId = created.id;
+      expect(created.secret.startsWith('whsec_')).toBe(true);
+
+      const beforeRotation = await getWebhookDetail(request, token, created.id);
+      expect(beforeRotation.previousSecretSetAt).toBeNull();
+
+      const rotation = await rotateWebhookSecret(request, token, created.id);
+      expect(rotation.success).toBe(true);
+      expect(rotation.secret.startsWith('whsec_')).toBe(true);
+      expect(rotation.secret).not.toBe(created.secret);
+      expect(typeof rotation.previousSecretSetAt).toBe('string');
+      expect(Number.isNaN(Date.parse(rotation.previousSecretSetAt as string))).toBe(false);
+
+      const afterRotation = await getWebhookDetail(request, token, created.id);
+      // The detail endpoint never exposes the raw secret — only a masked form that
+      // reveals the constant "whsec_" prefix (maskSecret => `${secret.slice(0, 6)}••••••••`).
+      expect(afterRotation.maskedSecret.startsWith('whsec_')).toBe(true);
+      expect(afterRotation.maskedSecret).not.toBe(rotation.secret);
+      expect(afterRotation.maskedSecret).not.toBe(created.secret);
+      expect(afterRotation.maskedSecret.length).toBeLessThan(rotation.secret.length);
+      // previousSecretSetAt proves the prior secret is retained for dual-sign verification
+      // (delivery signing reads webhook.previousSecret; covered at unit level in lib/__tests__).
+      expect(afterRotation.previousSecretSetAt).toBe(rotation.previousSecretSetAt);
+
+      const secondRotation = await rotateWebhookSecret(request, token, created.id);
+      expect(secondRotation.secret).not.toBe(rotation.secret);
+      expect(typeof secondRotation.previousSecretSetAt).toBe('string');
+      expect(Date.parse(secondRotation.previousSecretSetAt as string)).toBeGreaterThanOrEqual(
+        Date.parse(rotation.previousSecretSetAt as string),
+      );
+    } finally {
+      await deleteWebhookIfExists(request, token, webhookId);
+    }
+  });
+});

package/src/modules/webhooks/__integration__/TC-WEBHOOK-005.spec.ts

@@ -0,0 +1,126 @@
+import { expect, test } from '@playwright/test';
+import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api';
+import { getTokenScope } from '@open-mercato/core/helpers/integration/generalFixtures';
+import {
+  cleanupWebhooksUser,
+  createWebhookFixture,
+  deleteWebhookIfExists,
+  provisionWebhooksUser,
+  type ProvisionedWebhooksUser,
+} from './helpers/fixtures';
+
+/**
+ * TC-WEBHOOK-005: RBAC permission gates — unauthorized access by feature flag
+ * Source: https://github.com/open-mercato/open-mercato/issues/2482
+ *
+ * Verifies every webhooks API surface is gated by its declared feature:
+ *   webhooks.view    → GET list + GET detail + deliveries
+ *   webhooks.manage  → POST + PUT + DELETE
+ *   webhooks.secrets → POST rotate-secret
+ *   webhooks.test    → POST test
+ * A viewer holding only webhooks.view passes reads but is denied every write/secret/test
+ * surface; a user holding no webhooks features is denied reads. Admin (webhooks.*) proves
+ * the positive paths. Denials accept 401 or 403 per the issue's acceptance criteria.
+ */
+test.describe('TC-WEBHOOK-005: RBAC permission gates by feature flag', () => {
+  test('should gate each webhooks surface behind its declared feature', async ({ request }) => {
+    const adminToken = await getAuthToken(request);
+    const scope = getTokenScope(adminToken);
+
+    let webhookId: string | null = null;
+    let viewer: ProvisionedWebhooksUser | null = null;
+    let noAccess: ProvisionedWebhooksUser | null = null;
+
+    try {
+      viewer = await provisionWebhooksUser(request, adminToken, {
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        features: ['webhooks.view'],
+        slug: 'viewer',
+      });
+      noAccess = await provisionWebhooksUser(request, adminToken, {
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        features: [],
+        slug: 'noaccess',
+      });
+
+      // --- Positive: admin (webhooks.*) can exercise every surface ---
+      const created = await createWebhookFixture(request, adminToken, {
+        name: `Webhook RBAC ${Date.now()}`,
+        url: 'https://example.com/webhook-rbac',
+        subscribedEvents: ['catalog.product.created'],
+        customHeaders: { 'x-mock-webhook-signature': 'valid' },
+      });
+      webhookId = created.id;
+
+      const adminList = await apiRequest(request, 'GET', '/api/webhooks', { token: adminToken });
+      expect(adminList.status()).toBe(200);
+      const adminDetail = await apiRequest(request, 'GET', `/api/webhooks/${created.id}`, { token: adminToken });
+      expect(adminDetail.status()).toBe(200);
+
+      // --- webhooks.view gate ---
+      const viewerList = await apiRequest(request, 'GET', '/api/webhooks', { token: viewer.token });
+      expect(viewerList.status()).toBe(200);
+      const viewerDetail = await apiRequest(request, 'GET', `/api/webhooks/${created.id}`, { token: viewer.token });
+      expect(viewerDetail.status()).toBe(200);
+
+      const noAccessList = await apiRequest(request, 'GET', '/api/webhooks', { token: noAccess.token });
+      expect([401, 403]).toContain(noAccessList.status());
+      const noAccessDetail = await apiRequest(request, 'GET', `/api/webhooks/${created.id}`, { token: noAccess.token });
+      expect([401, 403]).toContain(noAccessDetail.status());
+
+      // --- webhooks.manage gate (viewer lacks manage) ---
+      const viewerCreate = await apiRequest(request, 'POST', '/api/webhooks', {
+        token: viewer.token,
+        data: {
+          name: `Webhook RBAC Denied ${Date.now()}`,
+          url: 'https://example.com/webhook-denied',
+          subscribedEvents: ['catalog.product.created'],
+        },
+      });
+      expect([401, 403]).toContain(viewerCreate.status());
+
+      const viewerUpdate = await apiRequest(request, 'PUT', `/api/webhooks/${created.id}`, {
+        token: viewer.token,
+        data: { name: `Webhook RBAC Hijack ${Date.now()}` },
+      });
+      expect([401, 403]).toContain(viewerUpdate.status());
+
+      const viewerDelete = await apiRequest(request, 'DELETE', `/api/webhooks/${created.id}`, { token: viewer.token });
+      expect([401, 403]).toContain(viewerDelete.status());
+
+      // --- webhooks.secrets gate (viewer lacks secrets) ---
+      const viewerRotate = await apiRequest(request, 'POST', `/api/webhooks/${created.id}/rotate-secret`, {
+        token: viewer.token,
+      });
+      expect([401, 403]).toContain(viewerRotate.status());
+
+      // --- webhooks.test gate (viewer lacks test) ---
+      const viewerTest = await apiRequest(request, 'POST', `/api/webhooks/${created.id}/test`, {
+        token: viewer.token,
+        data: { eventType: 'catalog.product.created' },
+      });
+      expect([401, 403]).toContain(viewerTest.status());
+
+      // The webhook must still exist — none of the denied writes mutated it.
+      const stillThere = await apiRequest(request, 'GET', `/api/webhooks/${created.id}`, { token: adminToken });
+      expect(stillThere.status()).toBe(200);
+
+      // --- Positive secrets + test paths (admin holds both features) ---
+      const adminRotate = await apiRequest(request, 'POST', `/api/webhooks/${created.id}/rotate-secret`, {
+        token: adminToken,
+      });
+      expect(adminRotate.status()).toBe(200);
+      const adminTest = await apiRequest(request, 'POST', `/api/webhooks/${created.id}/test`, {
+        token: adminToken,
+        data: { eventType: 'catalog.product.created' },
+      });
+      expect(adminTest.status()).toBe(200);
+    } finally {
+      await deleteWebhookIfExists(request, adminToken, webhookId);
+      await cleanupWebhooksUser(request, adminToken, viewer);
+      await cleanupWebhooksUser(request, adminToken, noAccess);
+    }
+  });
+});

package/src/modules/webhooks/__integration__/TC-WEBHOOK-006.spec.ts

@@ -0,0 +1,82 @@
+import { expect, test } from '@playwright/test';
+import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api';
+import {
+  buildMockInboundUrl,
+  createWebhookFixture,
+  deleteWebhookIfExists,
+  listWebhookDeliveries,
+  sendTestDelivery,
+} from './helpers/fixtures';
+
+/**
+ * TC-WEBHOOK-006: Webhook deactivation blocks delivery
+ * Source: https://github.com/open-mercato/open-mercato/issues/2482
+ *
+ * The isActive flag must prevent delivery. The synchronous test route still records a
+ * delivery attempt, but the delivery engine short-circuits inactive webhooks: the
+ * delivery is marked `expired` with "Webhook is inactive" and no HTTP request is made
+ * (responseStatus stays null). Re-activating restores successful delivery.
+ */
+test.describe('TC-WEBHOOK-006: Webhook deactivation blocks delivery', () => {
+  test('should deliver while active, block while inactive, and resume after re-activation', async ({ request }) => {
+    const token = await getAuthToken(request);
+    let webhookId: string | null = null;
+
+    try {
+      const created = await createWebhookFixture(request, token, {
+        name: `Webhook Deactivation ${Date.now()}`,
+        url: buildMockInboundUrl(),
+        subscribedEvents: ['catalog.product.created'],
+        customHeaders: { 'x-mock-webhook-signature': 'valid' },
+      });
+      webhookId = created.id;
+
+      // 1) Active webhook delivers successfully.
+      const activeDelivery = await sendTestDelivery(request, token, created.id, {
+        eventType: 'catalog.product.created',
+      });
+      expect(activeDelivery.delivery.status).toBe('delivered');
+      expect(activeDelivery.delivery.responseStatus).toBe(200);
+
+      // 2) Deactivate.
+      const deactivate = await apiRequest(request, 'PUT', `/api/webhooks/${created.id}`, {
+        token,
+        data: { isActive: false },
+      });
+      expect(deactivate.status()).toBe(200);
+
+      // 3) Inactive webhook does not reach the endpoint — delivery is expired, no HTTP attempt.
+      const blockedDelivery = await sendTestDelivery(request, token, created.id, {
+        eventType: 'catalog.product.created',
+      });
+      expect(blockedDelivery.delivery.status).toBe('expired');
+      expect(blockedDelivery.delivery.errorMessage).toBe('Webhook is inactive');
+      expect(blockedDelivery.delivery.responseStatus).toBeNull();
+
+      // The blocked attempt is visible in the delivery log with a non-delivered status.
+      const expiredDeliveries = await listWebhookDeliveries(
+        request,
+        token,
+        created.id,
+        `/api/webhooks/deliveries?webhookId=${encodeURIComponent(created.id)}&status=expired`,
+      );
+      expect(expiredDeliveries.items.some((item) => item.id === blockedDelivery.delivery.id)).toBe(true);
+      expect(expiredDeliveries.items.every((item) => item.status === 'expired')).toBe(true);
+
+      // 4) Re-activate and confirm delivery resumes.
+      const reactivate = await apiRequest(request, 'PUT', `/api/webhooks/${created.id}`, {
+        token,
+        data: { isActive: true },
+      });
+      expect(reactivate.status()).toBe(200);
+
+      const resumedDelivery = await sendTestDelivery(request, token, created.id, {
+        eventType: 'catalog.product.created',
+      });
+      expect(resumedDelivery.delivery.status).toBe('delivered');
+      expect(resumedDelivery.delivery.responseStatus).toBe(200);
+    } finally {
+      await deleteWebhookIfExists(request, token, webhookId);
+    }
+  });
+});