@open-mercato/webhooks 0.6.5-develop.4544.1.71c003c861 → 0.6.5-develop.4559.1.839e136509

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
-[build:webhooks] found 59 entry points
+[build:webhooks] found 66 entry points
 [build:webhooks] built successfully

package/dist/modules/webhooks/__integration__/TC-WEBHOOK-004.spec.js

@@ -0,0 +1,46 @@
+import { expect, test } from "@playwright/test";
+import { getAuthToken } from "@open-mercato/core/helpers/integration/api";
+import {
+  createWebhookFixture,
+  deleteWebhookIfExists,
+  getWebhookDetail,
+  rotateWebhookSecret
+} from "./helpers/fixtures.js";
+test.describe("TC-WEBHOOK-004: Secret rotation with previous secret retention", () => {
+  test("should rotate the signing secret, retain the previous one, and mask it on read", async ({ request }) => {
+    const token = await getAuthToken(request);
+    let webhookId = null;
+    try {
+      const created = await createWebhookFixture(request, token, {
+        name: `Webhook Rotate ${Date.now()}`,
+        url: "https://example.com/webhook-rotate",
+        subscribedEvents: ["sales.quote.created"]
+      });
+      webhookId = created.id;
+      expect(created.secret.startsWith("whsec_")).toBe(true);
+      const beforeRotation = await getWebhookDetail(request, token, created.id);
+      expect(beforeRotation.previousSecretSetAt).toBeNull();
+      const rotation = await rotateWebhookSecret(request, token, created.id);
+      expect(rotation.success).toBe(true);
+      expect(rotation.secret.startsWith("whsec_")).toBe(true);
+      expect(rotation.secret).not.toBe(created.secret);
+      expect(typeof rotation.previousSecretSetAt).toBe("string");
+      expect(Number.isNaN(Date.parse(rotation.previousSecretSetAt))).toBe(false);
+      const afterRotation = await getWebhookDetail(request, token, created.id);
+      expect(afterRotation.maskedSecret.startsWith("whsec_")).toBe(true);
+      expect(afterRotation.maskedSecret).not.toBe(rotation.secret);
+      expect(afterRotation.maskedSecret).not.toBe(created.secret);
+      expect(afterRotation.maskedSecret.length).toBeLessThan(rotation.secret.length);
+      expect(afterRotation.previousSecretSetAt).toBe(rotation.previousSecretSetAt);
+      const secondRotation = await rotateWebhookSecret(request, token, created.id);
+      expect(secondRotation.secret).not.toBe(rotation.secret);
+      expect(typeof secondRotation.previousSecretSetAt).toBe("string");
+      expect(Date.parse(secondRotation.previousSecretSetAt)).toBeGreaterThanOrEqual(
+        Date.parse(rotation.previousSecretSetAt)
+      );
+    } finally {
+      await deleteWebhookIfExists(request, token, webhookId);
+    }
+  });
+});
+//# sourceMappingURL=TC-WEBHOOK-004.spec.js.map

package/dist/modules/webhooks/__integration__/TC-WEBHOOK-004.spec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/webhooks/__integration__/TC-WEBHOOK-004.spec.ts"],
+  "sourcesContent": ["import { expect, test } from '@playwright/test';\nimport { getAuthToken } from '@open-mercato/core/helpers/integration/api';\nimport {\n  createWebhookFixture,\n  deleteWebhookIfExists,\n  getWebhookDetail,\n  rotateWebhookSecret,\n} from './helpers/fixtures';\n\n/**\n * TC-WEBHOOK-004: Secret rotation with previous secret retention\n * Source: https://github.com/open-mercato/open-mercato/issues/2482\n *\n * Verifies the security-critical rotate-secret flow: a new whsec_ secret is issued,\n * the previous secret is retained (so deliveries can dual-sign during rollout), and\n * the detail endpoint reflects the masked new secret plus the rotation timestamp.\n */\ntest.describe('TC-WEBHOOK-004: Secret rotation with previous secret retention', () => {\n  test('should rotate the signing secret, retain the previous one, and mask it on read', async ({ request }) => {\n    const token = await getAuthToken(request);\n    let webhookId: string | null = null;\n\n    try {\n      const created = await createWebhookFixture(request, token, {\n        name: `Webhook Rotate ${Date.now()}`,\n        url: 'https://example.com/webhook-rotate',\n        subscribedEvents: ['sales.quote.created'],\n      });\n      webhookId = created.id;\n      expect(created.secret.startsWith('whsec_')).toBe(true);\n\n      const beforeRotation = await getWebhookDetail(request, token, created.id);\n      expect(beforeRotation.previousSecretSetAt).toBeNull();\n\n      const rotation = await rotateWebhookSecret(request, token, created.id);\n      expect(rotation.success).toBe(true);\n      expect(rotation.secret.startsWith('whsec_')).toBe(true);\n      expect(rotation.secret).not.toBe(created.secret);\n      expect(typeof rotation.previousSecretSetAt).toBe('string');\n      expect(Number.isNaN(Date.parse(rotation.previousSecretSetAt as string))).toBe(false);\n\n      const afterRotation = await getWebhookDetail(request, token, created.id);\n      // The detail endpoint never exposes the raw secret \u2014 only a masked form that\n      // reveals the constant \"whsec_\" prefix (maskSecret => `${secret.slice(0, 6)}\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022`).\n      expect(afterRotation.maskedSecret.startsWith('whsec_')).toBe(true);\n      expect(afterRotation.maskedSecret).not.toBe(rotation.secret);\n      expect(afterRotation.maskedSecret).not.toBe(created.secret);\n      expect(afterRotation.maskedSecret.length).toBeLessThan(rotation.secret.length);\n      // previousSecretSetAt proves the prior secret is retained for dual-sign verification\n      // (delivery signing reads webhook.previousSecret; covered at unit level in lib/__tests__).\n      expect(afterRotation.previousSecretSetAt).toBe(rotation.previousSecretSetAt);\n\n      const secondRotation = await rotateWebhookSecret(request, token, created.id);\n      expect(secondRotation.secret).not.toBe(rotation.secret);\n      expect(typeof secondRotation.previousSecretSetAt).toBe('string');\n      expect(Date.parse(secondRotation.previousSecretSetAt as string)).toBeGreaterThanOrEqual(\n        Date.parse(rotation.previousSecretSetAt as string),\n      );\n    } finally {\n      await deleteWebhookIfExists(request, token, webhookId);\n    }\n  });\n});\n"],
+  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAUP,KAAK,SAAS,kEAAkE,MAAM;AACpF,OAAK,kFAAkF,OAAO,EAAE,QAAQ,MAAM;AAC5G,UAAM,QAAQ,MAAM,aAAa,OAAO;AACxC,QAAI,YAA2B;AAE/B,QAAI;AACF,YAAM,UAAU,MAAM,qBAAqB,SAAS,OAAO;AAAA,QACzD,MAAM,kBAAkB,KAAK,IAAI,CAAC;AAAA,QAClC,KAAK;AAAA,QACL,kBAAkB,CAAC,qBAAqB;AAAA,MAC1C,CAAC;AACD,kBAAY,QAAQ;AACpB,aAAO,QAAQ,OAAO,WAAW,QAAQ,CAAC,EAAE,KAAK,IAAI;AAErD,YAAM,iBAAiB,MAAM,iBAAiB,SAAS,OAAO,QAAQ,EAAE;AACxE,aAAO,eAAe,mBAAmB,EAAE,SAAS;AAEpD,YAAM,WAAW,MAAM,oBAAoB,SAAS,OAAO,QAAQ,EAAE;AACrE,aAAO,SAAS,OAAO,EAAE,KAAK,IAAI;AAClC,aAAO,SAAS,OAAO,WAAW,QAAQ,CAAC,EAAE,KAAK,IAAI;AACtD,aAAO,SAAS,MAAM,EAAE,IAAI,KAAK,QAAQ,MAAM;AAC/C,aAAO,OAAO,SAAS,mBAAmB,EAAE,KAAK,QAAQ;AACzD,aAAO,OAAO,MAAM,KAAK,MAAM,SAAS,mBAA6B,CAAC,CAAC,EAAE,KAAK,KAAK;AAEnF,YAAM,gBAAgB,MAAM,iBAAiB,SAAS,OAAO,QAAQ,EAAE;AAGvE,aAAO,cAAc,aAAa,WAAW,QAAQ,CAAC,EAAE,KAAK,IAAI;AACjE,aAAO,cAAc,YAAY,EAAE,IAAI,KAAK,SAAS,MAAM;AAC3D,aAAO,cAAc,YAAY,EAAE,IAAI,KAAK,QAAQ,MAAM;AAC1D,aAAO,cAAc,aAAa,MAAM,EAAE,aAAa,SAAS,OAAO,MAAM;AAG7E,aAAO,cAAc,mBAAmB,EAAE,KAAK,SAAS,mBAAmB;AAE3E,YAAM,iBAAiB,MAAM,oBAAoB,SAAS,OAAO,QAAQ,EAAE;AAC3E,aAAO,eAAe,MAAM,EAAE,IAAI,KAAK,SAAS,MAAM;AACtD,aAAO,OAAO,eAAe,mBAAmB,EAAE,KAAK,QAAQ;AAC/D,aAAO,KAAK,MAAM,eAAe,mBAA6B,CAAC,EAAE;AAAA,QAC/D,KAAK,MAAM,SAAS,mBAA6B;AAAA,MACnD;AAAA,IACF,UAAE;AACA,YAAM,sBAAsB,SAAS,OAAO,SAAS;AAAA,IACvD;AAAA,EACF,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/modules/webhooks/__integration__/TC-WEBHOOK-005.spec.js

@@ -0,0 +1,92 @@
+import { expect, test } from "@playwright/test";
+import { apiRequest, getAuthToken } from "@open-mercato/core/helpers/integration/api";
+import { getTokenScope } from "@open-mercato/core/helpers/integration/generalFixtures";
+import {
+  cleanupWebhooksUser,
+  createWebhookFixture,
+  deleteWebhookIfExists,
+  provisionWebhooksUser
+} from "./helpers/fixtures.js";
+test.describe("TC-WEBHOOK-005: RBAC permission gates by feature flag", () => {
+  test("should gate each webhooks surface behind its declared feature", async ({ request }) => {
+    const adminToken = await getAuthToken(request);
+    const scope = getTokenScope(adminToken);
+    let webhookId = null;
+    let viewer = null;
+    let noAccess = null;
+    try {
+      viewer = await provisionWebhooksUser(request, adminToken, {
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        features: ["webhooks.view"],
+        slug: "viewer"
+      });
+      noAccess = await provisionWebhooksUser(request, adminToken, {
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        features: [],
+        slug: "noaccess"
+      });
+      const created = await createWebhookFixture(request, adminToken, {
+        name: `Webhook RBAC ${Date.now()}`,
+        url: "https://example.com/webhook-rbac",
+        subscribedEvents: ["catalog.product.created"],
+        customHeaders: { "x-mock-webhook-signature": "valid" }
+      });
+      webhookId = created.id;
+      const adminList = await apiRequest(request, "GET", "/api/webhooks", { token: adminToken });
+      expect(adminList.status()).toBe(200);
+      const adminDetail = await apiRequest(request, "GET", `/api/webhooks/${created.id}`, { token: adminToken });
+      expect(adminDetail.status()).toBe(200);
+      const viewerList = await apiRequest(request, "GET", "/api/webhooks", { token: viewer.token });
+      expect(viewerList.status()).toBe(200);
+      const viewerDetail = await apiRequest(request, "GET", `/api/webhooks/${created.id}`, { token: viewer.token });
+      expect(viewerDetail.status()).toBe(200);
+      const noAccessList = await apiRequest(request, "GET", "/api/webhooks", { token: noAccess.token });
+      expect([401, 403]).toContain(noAccessList.status());
+      const noAccessDetail = await apiRequest(request, "GET", `/api/webhooks/${created.id}`, { token: noAccess.token });
+      expect([401, 403]).toContain(noAccessDetail.status());
+      const viewerCreate = await apiRequest(request, "POST", "/api/webhooks", {
+        token: viewer.token,
+        data: {
+          name: `Webhook RBAC Denied ${Date.now()}`,
+          url: "https://example.com/webhook-denied",
+          subscribedEvents: ["catalog.product.created"]
+        }
+      });
+      expect([401, 403]).toContain(viewerCreate.status());
+      const viewerUpdate = await apiRequest(request, "PUT", `/api/webhooks/${created.id}`, {
+        token: viewer.token,
+        data: { name: `Webhook RBAC Hijack ${Date.now()}` }
+      });
+      expect([401, 403]).toContain(viewerUpdate.status());
+      const viewerDelete = await apiRequest(request, "DELETE", `/api/webhooks/${created.id}`, { token: viewer.token });
+      expect([401, 403]).toContain(viewerDelete.status());
+      const viewerRotate = await apiRequest(request, "POST", `/api/webhooks/${created.id}/rotate-secret`, {
+        token: viewer.token
+      });
+      expect([401, 403]).toContain(viewerRotate.status());
+      const viewerTest = await apiRequest(request, "POST", `/api/webhooks/${created.id}/test`, {
+        token: viewer.token,
+        data: { eventType: "catalog.product.created" }
+      });
+      expect([401, 403]).toContain(viewerTest.status());
+      const stillThere = await apiRequest(request, "GET", `/api/webhooks/${created.id}`, { token: adminToken });
+      expect(stillThere.status()).toBe(200);
+      const adminRotate = await apiRequest(request, "POST", `/api/webhooks/${created.id}/rotate-secret`, {
+        token: adminToken
+      });
+      expect(adminRotate.status()).toBe(200);
+      const adminTest = await apiRequest(request, "POST", `/api/webhooks/${created.id}/test`, {
+        token: adminToken,
+        data: { eventType: "catalog.product.created" }
+      });
+      expect(adminTest.status()).toBe(200);
+    } finally {
+      await deleteWebhookIfExists(request, adminToken, webhookId);
+      await cleanupWebhooksUser(request, adminToken, viewer);
+      await cleanupWebhooksUser(request, adminToken, noAccess);
+    }
+  });
+});
+//# sourceMappingURL=TC-WEBHOOK-005.spec.js.map

package/dist/modules/webhooks/__integration__/TC-WEBHOOK-005.spec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/webhooks/__integration__/TC-WEBHOOK-005.spec.ts"],
+  "sourcesContent": ["import { expect, test } from '@playwright/test';\nimport { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api';\nimport { getTokenScope } from '@open-mercato/core/helpers/integration/generalFixtures';\nimport {\n  cleanupWebhooksUser,\n  createWebhookFixture,\n  deleteWebhookIfExists,\n  provisionWebhooksUser,\n  type ProvisionedWebhooksUser,\n} from './helpers/fixtures';\n\n/**\n * TC-WEBHOOK-005: RBAC permission gates \u2014 unauthorized access by feature flag\n * Source: https://github.com/open-mercato/open-mercato/issues/2482\n *\n * Verifies every webhooks API surface is gated by its declared feature:\n *   webhooks.view    \u2192 GET list + GET detail + deliveries\n *   webhooks.manage  \u2192 POST + PUT + DELETE\n *   webhooks.secrets \u2192 POST rotate-secret\n *   webhooks.test    \u2192 POST test\n * A viewer holding only webhooks.view passes reads but is denied every write/secret/test\n * surface; a user holding no webhooks features is denied reads. Admin (webhooks.*) proves\n * the positive paths. Denials accept 401 or 403 per the issue's acceptance criteria.\n */\ntest.describe('TC-WEBHOOK-005: RBAC permission gates by feature flag', () => {\n  test('should gate each webhooks surface behind its declared feature', async ({ request }) => {\n    const adminToken = await getAuthToken(request);\n    const scope = getTokenScope(adminToken);\n\n    let webhookId: string | null = null;\n    let viewer: ProvisionedWebhooksUser | null = null;\n    let noAccess: ProvisionedWebhooksUser | null = null;\n\n    try {\n      viewer = await provisionWebhooksUser(request, adminToken, {\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        features: ['webhooks.view'],\n        slug: 'viewer',\n      });\n      noAccess = await provisionWebhooksUser(request, adminToken, {\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        features: [],\n        slug: 'noaccess',\n      });\n\n      // --- Positive: admin (webhooks.*) can exercise every surface ---\n      const created = await createWebhookFixture(request, adminToken, {\n        name: `Webhook RBAC ${Date.now()}`,\n        url: 'https://example.com/webhook-rbac',\n        subscribedEvents: ['catalog.product.created'],\n        customHeaders: { 'x-mock-webhook-signature': 'valid' },\n      });\n      webhookId = created.id;\n\n      const adminList = await apiRequest(request, 'GET', '/api/webhooks', { token: adminToken });\n      expect(adminList.status()).toBe(200);\n      const adminDetail = await apiRequest(request, 'GET', `/api/webhooks/${created.id}`, { token: adminToken });\n      expect(adminDetail.status()).toBe(200);\n\n      // --- webhooks.view gate ---\n      const viewerList = await apiRequest(request, 'GET', '/api/webhooks', { token: viewer.token });\n      expect(viewerList.status()).toBe(200);\n      const viewerDetail = await apiRequest(request, 'GET', `/api/webhooks/${created.id}`, { token: viewer.token });\n      expect(viewerDetail.status()).toBe(200);\n\n      const noAccessList = await apiRequest(request, 'GET', '/api/webhooks', { token: noAccess.token });\n      expect([401, 403]).toContain(noAccessList.status());\n      const noAccessDetail = await apiRequest(request, 'GET', `/api/webhooks/${created.id}`, { token: noAccess.token });\n      expect([401, 403]).toContain(noAccessDetail.status());\n\n      // --- webhooks.manage gate (viewer lacks manage) ---\n      const viewerCreate = await apiRequest(request, 'POST', '/api/webhooks', {\n        token: viewer.token,\n        data: {\n          name: `Webhook RBAC Denied ${Date.now()}`,\n          url: 'https://example.com/webhook-denied',\n          subscribedEvents: ['catalog.product.created'],\n        },\n      });\n      expect([401, 403]).toContain(viewerCreate.status());\n\n      const viewerUpdate = await apiRequest(request, 'PUT', `/api/webhooks/${created.id}`, {\n        token: viewer.token,\n        data: { name: `Webhook RBAC Hijack ${Date.now()}` },\n      });\n      expect([401, 403]).toContain(viewerUpdate.status());\n\n      const viewerDelete = await apiRequest(request, 'DELETE', `/api/webhooks/${created.id}`, { token: viewer.token });\n      expect([401, 403]).toContain(viewerDelete.status());\n\n      // --- webhooks.secrets gate (viewer lacks secrets) ---\n      const viewerRotate = await apiRequest(request, 'POST', `/api/webhooks/${created.id}/rotate-secret`, {\n        token: viewer.token,\n      });\n      expect([401, 403]).toContain(viewerRotate.status());\n\n      // --- webhooks.test gate (viewer lacks test) ---\n      const viewerTest = await apiRequest(request, 'POST', `/api/webhooks/${created.id}/test`, {\n        token: viewer.token,\n        data: { eventType: 'catalog.product.created' },\n      });\n      expect([401, 403]).toContain(viewerTest.status());\n\n      // The webhook must still exist \u2014 none of the denied writes mutated it.\n      const stillThere = await apiRequest(request, 'GET', `/api/webhooks/${created.id}`, { token: adminToken });\n      expect(stillThere.status()).toBe(200);\n\n      // --- Positive secrets + test paths (admin holds both features) ---\n      const adminRotate = await apiRequest(request, 'POST', `/api/webhooks/${created.id}/rotate-secret`, {\n        token: adminToken,\n      });\n      expect(adminRotate.status()).toBe(200);\n      const adminTest = await apiRequest(request, 'POST', `/api/webhooks/${created.id}/test`, {\n        token: adminToken,\n        data: { eventType: 'catalog.product.created' },\n      });\n      expect(adminTest.status()).toBe(200);\n    } finally {\n      await deleteWebhookIfExists(request, adminToken, webhookId);\n      await cleanupWebhooksUser(request, adminToken, viewer);\n      await cleanupWebhooksUser(request, adminToken, noAccess);\n    }\n  });\n});\n"],
+  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,YAAY,oBAAoB;AACzC,SAAS,qBAAqB;AAC9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAeP,KAAK,SAAS,yDAAyD,MAAM;AAC3E,OAAK,iEAAiE,OAAO,EAAE,QAAQ,MAAM;AAC3F,UAAM,aAAa,MAAM,aAAa,OAAO;AAC7C,UAAM,QAAQ,cAAc,UAAU;AAEtC,QAAI,YAA2B;AAC/B,QAAI,SAAyC;AAC7C,QAAI,WAA2C;AAE/C,QAAI;AACF,eAAS,MAAM,sBAAsB,SAAS,YAAY;AAAA,QACxD,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,UAAU,CAAC,eAAe;AAAA,QAC1B,MAAM;AAAA,MACR,CAAC;AACD,iBAAW,MAAM,sBAAsB,SAAS,YAAY;AAAA,QAC1D,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,UAAU,CAAC;AAAA,QACX,MAAM;AAAA,MACR,CAAC;AAGD,YAAM,UAAU,MAAM,qBAAqB,SAAS,YAAY;AAAA,QAC9D,MAAM,gBAAgB,KAAK,IAAI,CAAC;AAAA,QAChC,KAAK;AAAA,QACL,kBAAkB,CAAC,yBAAyB;AAAA,QAC5C,eAAe,EAAE,4BAA4B,QAAQ;AAAA,MACvD,CAAC;AACD,kBAAY,QAAQ;AAEpB,YAAM,YAAY,MAAM,WAAW,SAAS,OAAO,iBAAiB,EAAE,OAAO,WAAW,CAAC;AACzF,aAAO,UAAU,OAAO,CAAC,EAAE,KAAK,GAAG;AACnC,YAAM,cAAc,MAAM,WAAW,SAAS,OAAO,iBAAiB,QAAQ,EAAE,IAAI,EAAE,OAAO,WAAW,CAAC;AACzG,aAAO,YAAY,OAAO,CAAC,EAAE,KAAK,GAAG;AAGrC,YAAM,aAAa,MAAM,WAAW,SAAS,OAAO,iBAAiB,EAAE,OAAO,OAAO,MAAM,CAAC;AAC5F,aAAO,WAAW,OAAO,CAAC,EAAE,KAAK,GAAG;AACpC,YAAM,eAAe,MAAM,WAAW,SAAS,OAAO,iBAAiB,QAAQ,EAAE,IAAI,EAAE,OAAO,OAAO,MAAM,CAAC;AAC5G,aAAO,aAAa,OAAO,CAAC,EAAE,KAAK,GAAG;AAEtC,YAAM,eAAe,MAAM,WAAW,SAAS,OAAO,iBAAiB,EAAE,OAAO,SAAS,MAAM,CAAC;AAChG,aAAO,CAAC,KAAK,GAAG,CAAC,EAAE,UAAU,aAAa,OAAO,CAAC;AAClD,YAAM,iBAAiB,MAAM,WAAW,SAAS,OAAO,iBAAiB,QAAQ,EAAE,IAAI,EAAE,OAAO,SAAS,MAAM,CAAC;AAChH,aAAO,CAAC,KAAK,GAAG,CAAC,EAAE,UAAU,eAAe,OAAO,CAAC;AAGpD,YAAM,eAAe,MAAM,WAAW,SAAS,QAAQ,iBAAiB;AAAA,QACtE,OAAO,OAAO;AAAA,QACd,MAAM;AAAA,UACJ,MAAM,uBAAuB,KAAK,IAAI,CAAC;AAAA,UACvC,KAAK;AAAA,UACL,kBAAkB,CAAC,yBAAyB;AAAA,QAC9C;AAAA,MACF,CAAC;AACD,aAAO,CAAC,KAAK,GAAG,CAAC,EAAE,UAAU,aAAa,OAAO,CAAC;AAElD,YAAM,eAAe,MAAM,WAAW,SAAS,OAAO,iBAAiB,QAAQ,EAAE,IAAI;AAAA,QACnF,OAAO,OAAO;AAAA,QACd,MAAM,EAAE,MAAM,uBAAuB,KAAK,IAAI,CAAC,GAAG;AAAA,MACpD,CAAC;AACD,aAAO,CAAC,KAAK,GAAG,CAAC,EAAE,UAAU,aAAa,OAAO,CAAC;AAElD,YAAM,eAAe,MAAM,WAAW,SAAS,UAAU,iBAAiB,QAAQ,EAAE,IAAI,EAAE,OAAO,OAAO,MAAM,CAAC;AAC/G,aAAO,CAAC,KAAK,GAAG,CAAC,EAAE,UAAU,aAAa,OAAO,CAAC;AAGlD,YAAM,eAAe,MAAM,WAAW,SAAS,QAAQ,iBAAiB,QAAQ,EAAE,kBAAkB;AAAA,QAClG,OAAO,OAAO;AAAA,MAChB,CAAC;AACD,aAAO,CAAC,KAAK,GAAG,CAAC,EAAE,UAAU,aAAa,OAAO,CAAC;AAGlD,YAAM,aAAa,MAAM,WAAW,SAAS,QAAQ,iBAAiB,QAAQ,EAAE,SAAS;AAAA,QACvF,OAAO,OAAO;AAAA,QACd,MAAM,EAAE,WAAW,0BAA0B;AAAA,MAC/C,CAAC;AACD,aAAO,CAAC,KAAK,GAAG,CAAC,EAAE,UAAU,WAAW,OAAO,CAAC;AAGhD,YAAM,aAAa,MAAM,WAAW,SAAS,OAAO,iBAAiB,QAAQ,EAAE,IAAI,EAAE,OAAO,WAAW,CAAC;AACxG,aAAO,WAAW,OAAO,CAAC,EAAE,KAAK,GAAG;AAGpC,YAAM,cAAc,MAAM,WAAW,SAAS,QAAQ,iBAAiB,QAAQ,EAAE,kBAAkB;AAAA,QACjG,OAAO;AAAA,MACT,CAAC;AACD,aAAO,YAAY,OAAO,CAAC,EAAE,KAAK,GAAG;AACrC,YAAM,YAAY,MAAM,WAAW,SAAS,QAAQ,iBAAiB,QAAQ,EAAE,SAAS;AAAA,QACtF,OAAO;AAAA,QACP,MAAM,EAAE,WAAW,0BAA0B;AAAA,MAC/C,CAAC;AACD,aAAO,UAAU,OAAO,CAAC,EAAE,KAAK,GAAG;AAAA,IACrC,UAAE;AACA,YAAM,sBAAsB,SAAS,YAAY,SAAS;AAC1D,YAAM,oBAAoB,SAAS,YAAY,MAAM;AACrD,YAAM,oBAAoB,SAAS,YAAY,QAAQ;AAAA,IACzD;AAAA,EACF,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/modules/webhooks/__integration__/TC-WEBHOOK-006.spec.js

@@ -0,0 +1,61 @@
+import { expect, test } from "@playwright/test";
+import { apiRequest, getAuthToken } from "@open-mercato/core/helpers/integration/api";
+import {
+  buildMockInboundUrl,
+  createWebhookFixture,
+  deleteWebhookIfExists,
+  listWebhookDeliveries,
+  sendTestDelivery
+} from "./helpers/fixtures.js";
+test.describe("TC-WEBHOOK-006: Webhook deactivation blocks delivery", () => {
+  test("should deliver while active, block while inactive, and resume after re-activation", async ({ request }) => {
+    const token = await getAuthToken(request);
+    let webhookId = null;
+    try {
+      const created = await createWebhookFixture(request, token, {
+        name: `Webhook Deactivation ${Date.now()}`,
+        url: buildMockInboundUrl(),
+        subscribedEvents: ["catalog.product.created"],
+        customHeaders: { "x-mock-webhook-signature": "valid" }
+      });
+      webhookId = created.id;
+      const activeDelivery = await sendTestDelivery(request, token, created.id, {
+        eventType: "catalog.product.created"
+      });
+      expect(activeDelivery.delivery.status).toBe("delivered");
+      expect(activeDelivery.delivery.responseStatus).toBe(200);
+      const deactivate = await apiRequest(request, "PUT", `/api/webhooks/${created.id}`, {
+        token,
+        data: { isActive: false }
+      });
+      expect(deactivate.status()).toBe(200);
+      const blockedDelivery = await sendTestDelivery(request, token, created.id, {
+        eventType: "catalog.product.created"
+      });
+      expect(blockedDelivery.delivery.status).toBe("expired");
+      expect(blockedDelivery.delivery.errorMessage).toBe("Webhook is inactive");
+      expect(blockedDelivery.delivery.responseStatus).toBeNull();
+      const expiredDeliveries = await listWebhookDeliveries(
+        request,
+        token,
+        created.id,
+        `/api/webhooks/deliveries?webhookId=${encodeURIComponent(created.id)}&status=expired`
+      );
+      expect(expiredDeliveries.items.some((item) => item.id === blockedDelivery.delivery.id)).toBe(true);
+      expect(expiredDeliveries.items.every((item) => item.status === "expired")).toBe(true);
+      const reactivate = await apiRequest(request, "PUT", `/api/webhooks/${created.id}`, {
+        token,
+        data: { isActive: true }
+      });
+      expect(reactivate.status()).toBe(200);
+      const resumedDelivery = await sendTestDelivery(request, token, created.id, {
+        eventType: "catalog.product.created"
+      });
+      expect(resumedDelivery.delivery.status).toBe("delivered");
+      expect(resumedDelivery.delivery.responseStatus).toBe(200);
+    } finally {
+      await deleteWebhookIfExists(request, token, webhookId);
+    }
+  });
+});
+//# sourceMappingURL=TC-WEBHOOK-006.spec.js.map

package/dist/modules/webhooks/__integration__/TC-WEBHOOK-006.spec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/webhooks/__integration__/TC-WEBHOOK-006.spec.ts"],
+  "sourcesContent": ["import { expect, test } from '@playwright/test';\nimport { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api';\nimport {\n  buildMockInboundUrl,\n  createWebhookFixture,\n  deleteWebhookIfExists,\n  listWebhookDeliveries,\n  sendTestDelivery,\n} from './helpers/fixtures';\n\n/**\n * TC-WEBHOOK-006: Webhook deactivation blocks delivery\n * Source: https://github.com/open-mercato/open-mercato/issues/2482\n *\n * The isActive flag must prevent delivery. The synchronous test route still records a\n * delivery attempt, but the delivery engine short-circuits inactive webhooks: the\n * delivery is marked `expired` with \"Webhook is inactive\" and no HTTP request is made\n * (responseStatus stays null). Re-activating restores successful delivery.\n */\ntest.describe('TC-WEBHOOK-006: Webhook deactivation blocks delivery', () => {\n  test('should deliver while active, block while inactive, and resume after re-activation', async ({ request }) => {\n    const token = await getAuthToken(request);\n    let webhookId: string | null = null;\n\n    try {\n      const created = await createWebhookFixture(request, token, {\n        name: `Webhook Deactivation ${Date.now()}`,\n        url: buildMockInboundUrl(),\n        subscribedEvents: ['catalog.product.created'],\n        customHeaders: { 'x-mock-webhook-signature': 'valid' },\n      });\n      webhookId = created.id;\n\n      // 1) Active webhook delivers successfully.\n      const activeDelivery = await sendTestDelivery(request, token, created.id, {\n        eventType: 'catalog.product.created',\n      });\n      expect(activeDelivery.delivery.status).toBe('delivered');\n      expect(activeDelivery.delivery.responseStatus).toBe(200);\n\n      // 2) Deactivate.\n      const deactivate = await apiRequest(request, 'PUT', `/api/webhooks/${created.id}`, {\n        token,\n        data: { isActive: false },\n      });\n      expect(deactivate.status()).toBe(200);\n\n      // 3) Inactive webhook does not reach the endpoint \u2014 delivery is expired, no HTTP attempt.\n      const blockedDelivery = await sendTestDelivery(request, token, created.id, {\n        eventType: 'catalog.product.created',\n      });\n      expect(blockedDelivery.delivery.status).toBe('expired');\n      expect(blockedDelivery.delivery.errorMessage).toBe('Webhook is inactive');\n      expect(blockedDelivery.delivery.responseStatus).toBeNull();\n\n      // The blocked attempt is visible in the delivery log with a non-delivered status.\n      const expiredDeliveries = await listWebhookDeliveries(\n        request,\n        token,\n        created.id,\n        `/api/webhooks/deliveries?webhookId=${encodeURIComponent(created.id)}&status=expired`,\n      );\n      expect(expiredDeliveries.items.some((item) => item.id === blockedDelivery.delivery.id)).toBe(true);\n      expect(expiredDeliveries.items.every((item) => item.status === 'expired')).toBe(true);\n\n      // 4) Re-activate and confirm delivery resumes.\n      const reactivate = await apiRequest(request, 'PUT', `/api/webhooks/${created.id}`, {\n        token,\n        data: { isActive: true },\n      });\n      expect(reactivate.status()).toBe(200);\n\n      const resumedDelivery = await sendTestDelivery(request, token, created.id, {\n        eventType: 'catalog.product.created',\n      });\n      expect(resumedDelivery.delivery.status).toBe('delivered');\n      expect(resumedDelivery.delivery.responseStatus).toBe(200);\n    } finally {\n      await deleteWebhookIfExists(request, token, webhookId);\n    }\n  });\n});\n"],
+  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,YAAY,oBAAoB;AACzC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAWP,KAAK,SAAS,wDAAwD,MAAM;AAC1E,OAAK,qFAAqF,OAAO,EAAE,QAAQ,MAAM;AAC/G,UAAM,QAAQ,MAAM,aAAa,OAAO;AACxC,QAAI,YAA2B;AAE/B,QAAI;AACF,YAAM,UAAU,MAAM,qBAAqB,SAAS,OAAO;AAAA,QACzD,MAAM,wBAAwB,KAAK,IAAI,CAAC;AAAA,QACxC,KAAK,oBAAoB;AAAA,QACzB,kBAAkB,CAAC,yBAAyB;AAAA,QAC5C,eAAe,EAAE,4BAA4B,QAAQ;AAAA,MACvD,CAAC;AACD,kBAAY,QAAQ;AAGpB,YAAM,iBAAiB,MAAM,iBAAiB,SAAS,OAAO,QAAQ,IAAI;AAAA,QACxE,WAAW;AAAA,MACb,CAAC;AACD,aAAO,eAAe,SAAS,MAAM,EAAE,KAAK,WAAW;AACvD,aAAO,eAAe,SAAS,cAAc,EAAE,KAAK,GAAG;AAGvD,YAAM,aAAa,MAAM,WAAW,SAAS,OAAO,iBAAiB,QAAQ,EAAE,IAAI;AAAA,QACjF;AAAA,QACA,MAAM,EAAE,UAAU,MAAM;AAAA,MAC1B,CAAC;AACD,aAAO,WAAW,OAAO,CAAC,EAAE,KAAK,GAAG;AAGpC,YAAM,kBAAkB,MAAM,iBAAiB,SAAS,OAAO,QAAQ,IAAI;AAAA,QACzE,WAAW;AAAA,MACb,CAAC;AACD,aAAO,gBAAgB,SAAS,MAAM,EAAE,KAAK,SAAS;AACtD,aAAO,gBAAgB,SAAS,YAAY,EAAE,KAAK,qBAAqB;AACxE,aAAO,gBAAgB,SAAS,cAAc,EAAE,SAAS;AAGzD,YAAM,oBAAoB,MAAM;AAAA,QAC9B;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR,sCAAsC,mBAAmB,QAAQ,EAAE,CAAC;AAAA,MACtE;AACA,aAAO,kBAAkB,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,gBAAgB,SAAS,EAAE,CAAC,EAAE,KAAK,IAAI;AACjG,aAAO,kBAAkB,MAAM,MAAM,CAAC,SAAS,KAAK,WAAW,SAAS,CAAC,EAAE,KAAK,IAAI;AAGpF,YAAM,aAAa,MAAM,WAAW,SAAS,OAAO,iBAAiB,QAAQ,EAAE,IAAI;AAAA,QACjF;AAAA,QACA,MAAM,EAAE,UAAU,KAAK;AAAA,MACzB,CAAC;AACD,aAAO,WAAW,OAAO,CAAC,EAAE,KAAK,GAAG;AAEpC,YAAM,kBAAkB,MAAM,iBAAiB,SAAS,OAAO,QAAQ,IAAI;AAAA,QACzE,WAAW;AAAA,MACb,CAAC;AACD,aAAO,gBAAgB,SAAS,MAAM,EAAE,KAAK,WAAW;AACxD,aAAO,gBAAgB,SAAS,cAAc,EAAE,KAAK,GAAG;AAAA,IAC1D,UAAE;AACA,YAAM,sBAAsB,SAAS,OAAO,SAAS;AAAA,IACvD;AAAA,EACF,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/modules/webhooks/__integration__/TC-WEBHOOK-007.spec.js

@@ -0,0 +1,76 @@
+import { expect, test } from "@playwright/test";
+import { apiRequest, getAuthToken } from "@open-mercato/core/helpers/integration/api";
+import { getTokenScope } from "@open-mercato/core/helpers/integration/generalFixtures";
+import { createOrganizationInDb, deleteOrganizationInDb } from "@open-mercato/core/helpers/integration/dbFixtures";
+import {
+  cleanupWebhooksUser,
+  createWebhookFixture,
+  deleteWebhookIfExists,
+  listWebhooks,
+  provisionWebhooksUser
+} from "./helpers/fixtures.js";
+const MANAGE_FEATURES = ["webhooks.view", "webhooks.manage"];
+test.describe("TC-WEBHOOK-007: Tenant/organization scoping isolation", () => {
+  test("should isolate webhooks between organizations within the same tenant", async ({ request }) => {
+    const adminToken = await getAuthToken(request);
+    const { tenantId, organizationId: orgA } = getTokenScope(adminToken);
+    let orgB = null;
+    let userA = null;
+    let userB = null;
+    let webhookA = null;
+    let webhookB = null;
+    try {
+      orgB = await createOrganizationInDb({ name: `TC-WEBHOOK-007 Org B ${Date.now()}`, tenantId });
+      userA = await provisionWebhooksUser(request, adminToken, {
+        tenantId,
+        organizationId: orgA,
+        features: MANAGE_FEATURES,
+        organizations: [orgA],
+        slug: "org-a"
+      });
+      userB = await provisionWebhooksUser(request, adminToken, {
+        tenantId,
+        organizationId: orgB,
+        features: MANAGE_FEATURES,
+        organizations: [orgB],
+        slug: "org-b"
+      });
+      webhookA = await createWebhookFixture(request, userA.token, {
+        name: `TC-WEBHOOK-007 A ${Date.now()}`,
+        url: "https://example.com/webhook-org-a",
+        subscribedEvents: ["catalog.product.created"]
+      });
+      webhookB = await createWebhookFixture(request, userB.token, {
+        name: `TC-WEBHOOK-007 B ${Date.now()}`,
+        url: "https://example.com/webhook-org-b",
+        subscribedEvents: ["catalog.product.created"]
+      });
+      const listA = await listWebhooks(request, userA.token);
+      expect(listA.items.some((item) => item.id === webhookA.id)).toBe(true);
+      expect(listA.items.some((item) => item.id === webhookB.id)).toBe(false);
+      const listB = await listWebhooks(request, userB.token);
+      expect(listB.items.some((item) => item.id === webhookB.id)).toBe(true);
+      expect(listB.items.some((item) => item.id === webhookA.id)).toBe(false);
+      const crossGet = await apiRequest(request, "GET", `/api/webhooks/${webhookB.id}`, { token: userA.token });
+      expect(crossGet.status()).toBe(404);
+      const crossUpdate = await apiRequest(request, "PUT", `/api/webhooks/${webhookB.id}`, {
+        token: userA.token,
+        data: { name: `TC-WEBHOOK-007 cross-org hijack ${Date.now()}` }
+      });
+      expect(crossUpdate.status()).toBe(404);
+      const crossDelete = await apiRequest(request, "DELETE", `/api/webhooks/${webhookB.id}`, { token: userA.token });
+      expect(crossDelete.status()).toBe(404);
+      const crossGetReverse = await apiRequest(request, "GET", `/api/webhooks/${webhookA.id}`, { token: userB.token });
+      expect(crossGetReverse.status()).toBe(404);
+      const ownGet = await apiRequest(request, "GET", `/api/webhooks/${webhookA.id}`, { token: userA.token });
+      expect(ownGet.status()).toBe(200);
+    } finally {
+      await deleteWebhookIfExists(request, userA?.token ?? null, webhookA?.id ?? null);
+      await deleteWebhookIfExists(request, userB?.token ?? null, webhookB?.id ?? null);
+      await cleanupWebhooksUser(request, adminToken, userA);
+      await cleanupWebhooksUser(request, adminToken, userB);
+      await deleteOrganizationInDb(orgB);
+    }
+  });
+});
+//# sourceMappingURL=TC-WEBHOOK-007.spec.js.map

package/dist/modules/webhooks/__integration__/TC-WEBHOOK-007.spec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/webhooks/__integration__/TC-WEBHOOK-007.spec.ts"],
+  "sourcesContent": ["import { expect, test } from '@playwright/test';\nimport { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api';\nimport { getTokenScope } from '@open-mercato/core/helpers/integration/generalFixtures';\nimport { createOrganizationInDb, deleteOrganizationInDb } from '@open-mercato/core/helpers/integration/dbFixtures';\nimport {\n  cleanupWebhooksUser,\n  createWebhookFixture,\n  deleteWebhookIfExists,\n  listWebhooks,\n  provisionWebhooksUser,\n  type ProvisionedWebhooksUser,\n  type WebhookCreateResponse,\n} from './helpers/fixtures';\n\n/**\n * TC-WEBHOOK-007: Tenant/organization scoping isolation\n * Source: https://github.com/open-mercato/open-mercato/issues/2482\n *\n * Webhooks are scoped by tenantId + organizationId. Within one tenant, two\n * organization-restricted users must not see or mutate each other's webhooks:\n * the list excludes out-of-scope rows and detail/update/delete on a foreign\n * webhook returns 404 (existence is not revealed across the org boundary).\n */\nconst MANAGE_FEATURES = ['webhooks.view', 'webhooks.manage'];\n\ntest.describe('TC-WEBHOOK-007: Tenant/organization scoping isolation', () => {\n  test('should isolate webhooks between organizations within the same tenant', async ({ request }) => {\n    const adminToken = await getAuthToken(request);\n    const { tenantId, organizationId: orgA } = getTokenScope(adminToken);\n\n    let orgB: string | null = null;\n    let userA: ProvisionedWebhooksUser | null = null;\n    let userB: ProvisionedWebhooksUser | null = null;\n    let webhookA: WebhookCreateResponse | null = null;\n    let webhookB: WebhookCreateResponse | null = null;\n\n    try {\n      orgB = await createOrganizationInDb({ name: `TC-WEBHOOK-007 Org B ${Date.now()}`, tenantId });\n\n      userA = await provisionWebhooksUser(request, adminToken, {\n        tenantId,\n        organizationId: orgA,\n        features: MANAGE_FEATURES,\n        organizations: [orgA],\n        slug: 'org-a',\n      });\n      userB = await provisionWebhooksUser(request, adminToken, {\n        tenantId,\n        organizationId: orgB,\n        features: MANAGE_FEATURES,\n        organizations: [orgB],\n        slug: 'org-b',\n      });\n\n      webhookA = await createWebhookFixture(request, userA.token, {\n        name: `TC-WEBHOOK-007 A ${Date.now()}`,\n        url: 'https://example.com/webhook-org-a',\n        subscribedEvents: ['catalog.product.created'],\n      });\n      webhookB = await createWebhookFixture(request, userB.token, {\n        name: `TC-WEBHOOK-007 B ${Date.now()}`,\n        url: 'https://example.com/webhook-org-b',\n        subscribedEvents: ['catalog.product.created'],\n      });\n\n      // Lists are scoped: each user sees only their own organization's webhook.\n      const listA = await listWebhooks(request, userA.token);\n      expect(listA.items.some((item) => item.id === webhookA!.id)).toBe(true);\n      expect(listA.items.some((item) => item.id === webhookB!.id)).toBe(false);\n\n      const listB = await listWebhooks(request, userB.token);\n      expect(listB.items.some((item) => item.id === webhookB!.id)).toBe(true);\n      expect(listB.items.some((item) => item.id === webhookA!.id)).toBe(false);\n\n      // Cross-org reads/writes are not found.\n      const crossGet = await apiRequest(request, 'GET', `/api/webhooks/${webhookB.id}`, { token: userA.token });\n      expect(crossGet.status()).toBe(404);\n\n      const crossUpdate = await apiRequest(request, 'PUT', `/api/webhooks/${webhookB.id}`, {\n        token: userA.token,\n        data: { name: `TC-WEBHOOK-007 cross-org hijack ${Date.now()}` },\n      });\n      expect(crossUpdate.status()).toBe(404);\n\n      const crossDelete = await apiRequest(request, 'DELETE', `/api/webhooks/${webhookB.id}`, { token: userA.token });\n      expect(crossDelete.status()).toBe(404);\n\n      const crossGetReverse = await apiRequest(request, 'GET', `/api/webhooks/${webhookA.id}`, { token: userB.token });\n      expect(crossGetReverse.status()).toBe(404);\n\n      // In-scope access still works after the cross-org attempts.\n      const ownGet = await apiRequest(request, 'GET', `/api/webhooks/${webhookA.id}`, { token: userA.token });\n      expect(ownGet.status()).toBe(200);\n    } finally {\n      await deleteWebhookIfExists(request, userA?.token ?? null, webhookA?.id ?? null);\n      await deleteWebhookIfExists(request, userB?.token ?? null, webhookB?.id ?? null);\n      await cleanupWebhooksUser(request, adminToken, userA);\n      await cleanupWebhooksUser(request, adminToken, userB);\n      await deleteOrganizationInDb(orgB);\n    }\n  });\n});\n"],
+  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,YAAY,oBAAoB;AACzC,SAAS,qBAAqB;AAC9B,SAAS,wBAAwB,8BAA8B;AAC/D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AAWP,MAAM,kBAAkB,CAAC,iBAAiB,iBAAiB;AAE3D,KAAK,SAAS,yDAAyD,MAAM;AAC3E,OAAK,wEAAwE,OAAO,EAAE,QAAQ,MAAM;AAClG,UAAM,aAAa,MAAM,aAAa,OAAO;AAC7C,UAAM,EAAE,UAAU,gBAAgB,KAAK,IAAI,cAAc,UAAU;AAEnE,QAAI,OAAsB;AAC1B,QAAI,QAAwC;AAC5C,QAAI,QAAwC;AAC5C,QAAI,WAAyC;AAC7C,QAAI,WAAyC;AAE7C,QAAI;AACF,aAAO,MAAM,uBAAuB,EAAE,MAAM,wBAAwB,KAAK,IAAI,CAAC,IAAI,SAAS,CAAC;AAE5F,cAAQ,MAAM,sBAAsB,SAAS,YAAY;AAAA,QACvD;AAAA,QACA,gBAAgB;AAAA,QAChB,UAAU;AAAA,QACV,eAAe,CAAC,IAAI;AAAA,QACpB,MAAM;AAAA,MACR,CAAC;AACD,cAAQ,MAAM,sBAAsB,SAAS,YAAY;AAAA,QACvD;AAAA,QACA,gBAAgB;AAAA,QAChB,UAAU;AAAA,QACV,eAAe,CAAC,IAAI;AAAA,QACpB,MAAM;AAAA,MACR,CAAC;AAED,iBAAW,MAAM,qBAAqB,SAAS,MAAM,OAAO;AAAA,QAC1D,MAAM,oBAAoB,KAAK,IAAI,CAAC;AAAA,QACpC,KAAK;AAAA,QACL,kBAAkB,CAAC,yBAAyB;AAAA,MAC9C,CAAC;AACD,iBAAW,MAAM,qBAAqB,SAAS,MAAM,OAAO;AAAA,QAC1D,MAAM,oBAAoB,KAAK,IAAI,CAAC;AAAA,QACpC,KAAK;AAAA,QACL,kBAAkB,CAAC,yBAAyB;AAAA,MAC9C,CAAC;AAGD,YAAM,QAAQ,MAAM,aAAa,SAAS,MAAM,KAAK;AACrD,aAAO,MAAM,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,SAAU,EAAE,CAAC,EAAE,KAAK,IAAI;AACtE,aAAO,MAAM,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,SAAU,EAAE,CAAC,EAAE,KAAK,KAAK;AAEvE,YAAM,QAAQ,MAAM,aAAa,SAAS,MAAM,KAAK;AACrD,aAAO,MAAM,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,SAAU,EAAE,CAAC,EAAE,KAAK,IAAI;AACtE,aAAO,MAAM,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,SAAU,EAAE,CAAC,EAAE,KAAK,KAAK;AAGvE,YAAM,WAAW,MAAM,WAAW,SAAS,OAAO,iBAAiB,SAAS,EAAE,IAAI,EAAE,OAAO,MAAM,MAAM,CAAC;AACxG,aAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAElC,YAAM,cAAc,MAAM,WAAW,SAAS,OAAO,iBAAiB,SAAS,EAAE,IAAI;AAAA,QACnF,OAAO,MAAM;AAAA,QACb,MAAM,EAAE,MAAM,mCAAmC,KAAK,IAAI,CAAC,GAAG;AAAA,MAChE,CAAC;AACD,aAAO,YAAY,OAAO,CAAC,EAAE,KAAK,GAAG;AAErC,YAAM,cAAc,MAAM,WAAW,SAAS,UAAU,iBAAiB,SAAS,EAAE,IAAI,EAAE,OAAO,MAAM,MAAM,CAAC;AAC9G,aAAO,YAAY,OAAO,CAAC,EAAE,KAAK,GAAG;AAErC,YAAM,kBAAkB,MAAM,WAAW,SAAS,OAAO,iBAAiB,SAAS,EAAE,IAAI,EAAE,OAAO,MAAM,MAAM,CAAC;AAC/G,aAAO,gBAAgB,OAAO,CAAC,EAAE,KAAK,GAAG;AAGzC,YAAM,SAAS,MAAM,WAAW,SAAS,OAAO,iBAAiB,SAAS,EAAE,IAAI,EAAE,OAAO,MAAM,MAAM,CAAC;AACtG,aAAO,OAAO,OAAO,CAAC,EAAE,KAAK,GAAG;AAAA,IAClC,UAAE;AACA,YAAM,sBAAsB,SAAS,OAAO,SAAS,MAAM,UAAU,MAAM,IAAI;AAC/E,YAAM,sBAAsB,SAAS,OAAO,SAAS,MAAM,UAAU,MAAM,IAAI;AAC/E,YAAM,oBAAoB,SAAS,YAAY,KAAK;AACpD,YAAM,oBAAoB,SAAS,YAAY,KAAK;AACpD,YAAM,uBAAuB,IAAI;AAAA,IACnC;AAAA,EACF,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/modules/webhooks/__integration__/TC-WEBHOOK-008.spec.js

@@ -0,0 +1,81 @@
+import { expect, test } from "@playwright/test";
+import { apiRequest, getAuthToken } from "@open-mercato/core/helpers/integration/api";
+import {
+  buildMockInboundUrl,
+  createWebhookFixture,
+  deleteWebhookIfExists,
+  listWebhookDeliveries,
+  sendTestDelivery
+} from "./helpers/fixtures.js";
+const EVENT_CREATED = "catalog.product.created";
+const EVENT_UPDATED = "catalog.product.updated";
+function deliveriesPath(webhookId, extra = {}) {
+  const params = new URLSearchParams({ webhookId, ...extra });
+  return `/api/webhooks/deliveries?${params.toString()}`;
+}
+test.describe("TC-WEBHOOK-008: Delivery list filtering by status and event type", () => {
+  test("should filter delivery logs by status, event type, and their combination", async ({ request }) => {
+    const token = await getAuthToken(request);
+    let webhookId = null;
+    try {
+      const created = await createWebhookFixture(request, token, {
+        name: `Webhook Filter ${Date.now()}`,
+        url: buildMockInboundUrl(),
+        subscribedEvents: [EVENT_CREATED, EVENT_UPDATED],
+        customHeaders: { "x-mock-webhook-signature": "valid" }
+      });
+      webhookId = created.id;
+      const deliveredCreated = await sendTestDelivery(request, token, created.id, { eventType: EVENT_CREATED });
+      expect(deliveredCreated.delivery.status).toBe("delivered");
+      const deliveredUpdated = await sendTestDelivery(request, token, created.id, { eventType: EVENT_UPDATED });
+      expect(deliveredUpdated.delivery.status).toBe("delivered");
+      const invalidate = await apiRequest(request, "PUT", `/api/webhooks/${created.id}`, {
+        token,
+        data: { customHeaders: { "x-mock-webhook-signature": "invalid" } }
+      });
+      expect(invalidate.status()).toBe(200);
+      const expiredCreated = await sendTestDelivery(request, token, created.id, { eventType: EVENT_CREATED });
+      expect(expiredCreated.delivery.status).toBe("expired");
+      const d1 = deliveredCreated.delivery.id;
+      const d2 = deliveredUpdated.delivery.id;
+      const d3 = expiredCreated.delivery.id;
+      const all = await listWebhookDeliveries(request, token, created.id, deliveriesPath(created.id));
+      expect(all.total).toBeGreaterThanOrEqual(3);
+      for (const id of [d1, d2, d3]) {
+        expect(all.items.some((item) => item.id === id)).toBe(true);
+      }
+      const delivered = await listWebhookDeliveries(request, token, created.id, deliveriesPath(created.id, { status: "delivered" }));
+      expect(delivered.items.every((item) => item.status === "delivered")).toBe(true);
+      expect(delivered.items.some((item) => item.id === d1)).toBe(true);
+      expect(delivered.items.some((item) => item.id === d2)).toBe(true);
+      expect(delivered.items.some((item) => item.id === d3)).toBe(false);
+      const expired = await listWebhookDeliveries(request, token, created.id, deliveriesPath(created.id, { status: "expired" }));
+      expect(expired.items.every((item) => item.status === "expired")).toBe(true);
+      expect(expired.items.some((item) => item.id === d3)).toBe(true);
+      expect(expired.items.some((item) => item.id === d1)).toBe(false);
+      const createdEvents = await listWebhookDeliveries(request, token, created.id, deliveriesPath(created.id, { eventType: EVENT_CREATED }));
+      expect(createdEvents.items.every((item) => item.eventType === EVENT_CREATED)).toBe(true);
+      expect(createdEvents.items.some((item) => item.id === d1)).toBe(true);
+      expect(createdEvents.items.some((item) => item.id === d3)).toBe(true);
+      expect(createdEvents.items.some((item) => item.id === d2)).toBe(false);
+      const combined = await listWebhookDeliveries(
+        request,
+        token,
+        created.id,
+        deliveriesPath(created.id, { status: "delivered", eventType: EVENT_CREATED })
+      );
+      expect(combined.items.every((item) => item.status === "delivered" && item.eventType === EVENT_CREATED)).toBe(true);
+      expect(combined.items.some((item) => item.id === d1)).toBe(true);
+      expect(combined.items.some((item) => item.id === d2)).toBe(false);
+      expect(combined.items.some((item) => item.id === d3)).toBe(false);
+      const empty = await listWebhookDeliveries(request, token, created.id, deliveriesPath(created.id, { status: "pending" }));
+      expect(empty.items).toEqual([]);
+      expect(empty.total).toBe(0);
+      expect(empty.page).toBe(1);
+      expect(empty.totalPages).toBe(0);
+    } finally {
+      await deleteWebhookIfExists(request, token, webhookId);
+    }
+  });
+});
+//# sourceMappingURL=TC-WEBHOOK-008.spec.js.map

package/dist/modules/webhooks/__integration__/TC-WEBHOOK-008.spec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/webhooks/__integration__/TC-WEBHOOK-008.spec.ts"],
+  "sourcesContent": ["import { expect, test } from '@playwright/test';\nimport { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api';\nimport {\n  buildMockInboundUrl,\n  createWebhookFixture,\n  deleteWebhookIfExists,\n  listWebhookDeliveries,\n  sendTestDelivery,\n} from './helpers/fixtures';\n\n/**\n * TC-WEBHOOK-008: Delivery list filtering by status and event type\n * Source: https://github.com/open-mercato/open-mercato/issues/2482\n *\n * GET /api/webhooks/deliveries supports webhookId, status, and eventType filters.\n * Seeds three deliveries on one webhook \u2014 delivered(created), delivered(updated),\n * expired(created) \u2014 then verifies each filter and their intersection.\n */\nconst EVENT_CREATED = 'catalog.product.created';\nconst EVENT_UPDATED = 'catalog.product.updated';\n\nfunction deliveriesPath(webhookId: string, extra: Record<string, string> = {}): string {\n  const params = new URLSearchParams({ webhookId, ...extra });\n  return `/api/webhooks/deliveries?${params.toString()}`;\n}\n\ntest.describe('TC-WEBHOOK-008: Delivery list filtering by status and event type', () => {\n  test('should filter delivery logs by status, event type, and their combination', async ({ request }) => {\n    const token = await getAuthToken(request);\n    let webhookId: string | null = null;\n\n    try {\n      const created = await createWebhookFixture(request, token, {\n        name: `Webhook Filter ${Date.now()}`,\n        url: buildMockInboundUrl(),\n        subscribedEvents: [EVENT_CREATED, EVENT_UPDATED],\n        customHeaders: { 'x-mock-webhook-signature': 'valid' },\n      });\n      webhookId = created.id;\n\n      const deliveredCreated = await sendTestDelivery(request, token, created.id, { eventType: EVENT_CREATED });\n      expect(deliveredCreated.delivery.status).toBe('delivered');\n      const deliveredUpdated = await sendTestDelivery(request, token, created.id, { eventType: EVENT_UPDATED });\n      expect(deliveredUpdated.delivery.status).toBe('delivered');\n\n      // Flip the mock signature to invalid so the next attempt fails terminally (expired).\n      const invalidate = await apiRequest(request, 'PUT', `/api/webhooks/${created.id}`, {\n        token,\n        data: { customHeaders: { 'x-mock-webhook-signature': 'invalid' } },\n      });\n      expect(invalidate.status()).toBe(200);\n\n      const expiredCreated = await sendTestDelivery(request, token, created.id, { eventType: EVENT_CREATED });\n      expect(expiredCreated.delivery.status).toBe('expired');\n\n      const d1 = deliveredCreated.delivery.id;\n      const d2 = deliveredUpdated.delivery.id;\n      const d3 = expiredCreated.delivery.id;\n\n      // Unfiltered (by webhook): all three present.\n      const all = await listWebhookDeliveries(request, token, created.id, deliveriesPath(created.id));\n      expect(all.total).toBeGreaterThanOrEqual(3);\n      for (const id of [d1, d2, d3]) {\n        expect(all.items.some((item) => item.id === id)).toBe(true);\n      }\n\n      // status=delivered \u2192 d1, d2 only.\n      const delivered = await listWebhookDeliveries(request, token, created.id, deliveriesPath(created.id, { status: 'delivered' }));\n      expect(delivered.items.every((item) => item.status === 'delivered')).toBe(true);\n      expect(delivered.items.some((item) => item.id === d1)).toBe(true);\n      expect(delivered.items.some((item) => item.id === d2)).toBe(true);\n      expect(delivered.items.some((item) => item.id === d3)).toBe(false);\n\n      // status=expired \u2192 d3 only.\n      const expired = await listWebhookDeliveries(request, token, created.id, deliveriesPath(created.id, { status: 'expired' }));\n      expect(expired.items.every((item) => item.status === 'expired')).toBe(true);\n      expect(expired.items.some((item) => item.id === d3)).toBe(true);\n      expect(expired.items.some((item) => item.id === d1)).toBe(false);\n\n      // eventType=created \u2192 d1, d3 only.\n      const createdEvents = await listWebhookDeliveries(request, token, created.id, deliveriesPath(created.id, { eventType: EVENT_CREATED }));\n      expect(createdEvents.items.every((item) => item.eventType === EVENT_CREATED)).toBe(true);\n      expect(createdEvents.items.some((item) => item.id === d1)).toBe(true);\n      expect(createdEvents.items.some((item) => item.id === d3)).toBe(true);\n      expect(createdEvents.items.some((item) => item.id === d2)).toBe(false);\n\n      // Combined status=delivered & eventType=created \u2192 d1 only.\n      const combined = await listWebhookDeliveries(\n        request,\n        token,\n        created.id,\n        deliveriesPath(created.id, { status: 'delivered', eventType: EVENT_CREATED }),\n      );\n      expect(combined.items.every((item) => item.status === 'delivered' && item.eventType === EVENT_CREATED)).toBe(true);\n      expect(combined.items.some((item) => item.id === d1)).toBe(true);\n      expect(combined.items.some((item) => item.id === d2)).toBe(false);\n      expect(combined.items.some((item) => item.id === d3)).toBe(false);\n\n      // Non-matching filter \u2192 empty result set with pagination metadata.\n      const empty = await listWebhookDeliveries(request, token, created.id, deliveriesPath(created.id, { status: 'pending' }));\n      expect(empty.items).toEqual([]);\n      expect(empty.total).toBe(0);\n      expect(empty.page).toBe(1);\n      expect(empty.totalPages).toBe(0);\n    } finally {\n      await deleteWebhookIfExists(request, token, webhookId);\n    }\n  });\n});\n"],
+  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,YAAY,oBAAoB;AACzC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAUP,MAAM,gBAAgB;AACtB,MAAM,gBAAgB;AAEtB,SAAS,eAAe,WAAmB,QAAgC,CAAC,GAAW;AACrF,QAAM,SAAS,IAAI,gBAAgB,EAAE,WAAW,GAAG,MAAM,CAAC;AAC1D,SAAO,4BAA4B,OAAO,SAAS,CAAC;AACtD;AAEA,KAAK,SAAS,oEAAoE,MAAM;AACtF,OAAK,4EAA4E,OAAO,EAAE,QAAQ,MAAM;AACtG,UAAM,QAAQ,MAAM,aAAa,OAAO;AACxC,QAAI,YAA2B;AAE/B,QAAI;AACF,YAAM,UAAU,MAAM,qBAAqB,SAAS,OAAO;AAAA,QACzD,MAAM,kBAAkB,KAAK,IAAI,CAAC;AAAA,QAClC,KAAK,oBAAoB;AAAA,QACzB,kBAAkB,CAAC,eAAe,aAAa;AAAA,QAC/C,eAAe,EAAE,4BAA4B,QAAQ;AAAA,MACvD,CAAC;AACD,kBAAY,QAAQ;AAEpB,YAAM,mBAAmB,MAAM,iBAAiB,SAAS,OAAO,QAAQ,IAAI,EAAE,WAAW,cAAc,CAAC;AACxG,aAAO,iBAAiB,SAAS,MAAM,EAAE,KAAK,WAAW;AACzD,YAAM,mBAAmB,MAAM,iBAAiB,SAAS,OAAO,QAAQ,IAAI,EAAE,WAAW,cAAc,CAAC;AACxG,aAAO,iBAAiB,SAAS,MAAM,EAAE,KAAK,WAAW;AAGzD,YAAM,aAAa,MAAM,WAAW,SAAS,OAAO,iBAAiB,QAAQ,EAAE,IAAI;AAAA,QACjF;AAAA,QACA,MAAM,EAAE,eAAe,EAAE,4BAA4B,UAAU,EAAE;AAAA,MACnE,CAAC;AACD,aAAO,WAAW,OAAO,CAAC,EAAE,KAAK,GAAG;AAEpC,YAAM,iBAAiB,MAAM,iBAAiB,SAAS,OAAO,QAAQ,IAAI,EAAE,WAAW,cAAc,CAAC;AACtG,aAAO,eAAe,SAAS,MAAM,EAAE,KAAK,SAAS;AAErD,YAAM,KAAK,iBAAiB,SAAS;AACrC,YAAM,KAAK,iBAAiB,SAAS;AACrC,YAAM,KAAK,eAAe,SAAS;AAGnC,YAAM,MAAM,MAAM,sBAAsB,SAAS,OAAO,QAAQ,IAAI,eAAe,QAAQ,EAAE,CAAC;AAC9F,aAAO,IAAI,KAAK,EAAE,uBAAuB,CAAC;AAC1C,iBAAW,MAAM,CAAC,IAAI,IAAI,EAAE,GAAG;AAC7B,eAAO,IAAI,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC,EAAE,KAAK,IAAI;AAAA,MAC5D;AAGA,YAAM,YAAY,MAAM,sBAAsB,SAAS,OAAO,QAAQ,IAAI,eAAe,QAAQ,IAAI,EAAE,QAAQ,YAAY,CAAC,CAAC;AAC7H,aAAO,UAAU,MAAM,MAAM,CAAC,SAAS,KAAK,WAAW,WAAW,CAAC,EAAE,KAAK,IAAI;AAC9E,aAAO,UAAU,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC,EAAE,KAAK,IAAI;AAChE,aAAO,UAAU,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC,EAAE,KAAK,IAAI;AAChE,aAAO,UAAU,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC,EAAE,KAAK,KAAK;AAGjE,YAAM,UAAU,MAAM,sBAAsB,SAAS,OAAO,QAAQ,IAAI,eAAe,QAAQ,IAAI,EAAE,QAAQ,UAAU,CAAC,CAAC;AACzH,aAAO,QAAQ,MAAM,MAAM,CAAC,SAAS,KAAK,WAAW,SAAS,CAAC,EAAE,KAAK,IAAI;AAC1E,aAAO,QAAQ,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC,EAAE,KAAK,IAAI;AAC9D,aAAO,QAAQ,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC,EAAE,KAAK,KAAK;AAG/D,YAAM,gBAAgB,MAAM,sBAAsB,SAAS,OAAO,QAAQ,IAAI,eAAe,QAAQ,IAAI,EAAE,WAAW,cAAc,CAAC,CAAC;AACtI,aAAO,cAAc,MAAM,MAAM,CAAC,SAAS,KAAK,cAAc,aAAa,CAAC,EAAE,KAAK,IAAI;AACvF,aAAO,cAAc,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC,EAAE,KAAK,IAAI;AACpE,aAAO,cAAc,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC,EAAE,KAAK,IAAI;AACpE,aAAO,cAAc,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC,EAAE,KAAK,KAAK;AAGrE,YAAM,WAAW,MAAM;AAAA,QACrB;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR,eAAe,QAAQ,IAAI,EAAE,QAAQ,aAAa,WAAW,cAAc,CAAC;AAAA,MAC9E;AACA,aAAO,SAAS,MAAM,MAAM,CAAC,SAAS,KAAK,WAAW,eAAe,KAAK,cAAc,aAAa,CAAC,EAAE,KAAK,IAAI;AACjH,aAAO,SAAS,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC,EAAE,KAAK,IAAI;AAC/D,aAAO,SAAS,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC,EAAE,KAAK,KAAK;AAChE,aAAO,SAAS,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC,EAAE,KAAK,KAAK;AAGhE,YAAM,QAAQ,MAAM,sBAAsB,SAAS,OAAO,QAAQ,IAAI,eAAe,QAAQ,IAAI,EAAE,QAAQ,UAAU,CAAC,CAAC;AACvH,aAAO,MAAM,KAAK,EAAE,QAAQ,CAAC,CAAC;AAC9B,aAAO,MAAM,KAAK,EAAE,KAAK,CAAC;AAC1B,aAAO,MAAM,IAAI,EAAE,KAAK,CAAC;AACzB,aAAO,MAAM,UAAU,EAAE,KAAK,CAAC;AAAA,IACjC,UAAE;AACA,YAAM,sBAAsB,SAAS,OAAO,SAAS;AAAA,IACvD;AAAA,EACF,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/modules/webhooks/__integration__/TC-WEBHOOK-009.spec.js

@@ -0,0 +1,69 @@
+import { expect, test } from "@playwright/test";
+import { apiRequest, getAuthToken } from "@open-mercato/core/helpers/integration/api";
+import { readJsonSafe } from "@open-mercato/core/helpers/integration/generalFixtures";
+import { createWebhookFixture, deleteWebhookIfExists } from "./helpers/fixtures.js";
+const PRIVATE_URLS_ALLOWED = ["1", "true", "yes", "on"].includes(
+  (process.env.OM_WEBHOOKS_ALLOW_PRIVATE_URLS ?? "").trim().toLowerCase()
+);
+const ALWAYS_UNSAFE_URLS = [
+  "ftp://example.com/webhook",
+  "file:///etc/passwd",
+  "http://user:pass@example.com/webhook",
+  "not-a-valid-url"
+];
+const PRIVATE_HOST_URLS = [
+  "http://127.0.0.1:9001/webhook",
+  "http://10.0.0.1/webhook",
+  "http://[::1]:9001/webhook"
+];
+function createBody(url) {
+  return {
+    name: `Webhook URL Safety ${Date.now()}`,
+    url,
+    subscribedEvents: ["catalog.product.created"]
+  };
+}
+test.describe("TC-WEBHOOK-009: Invalid and unsafe URL rejection", () => {
+  test("should reject unsafe webhook URLs on create and update and accept valid external URLs", async ({ request }) => {
+    const token = await getAuthToken(request);
+    let webhookId = null;
+    const strayPrivateWebhookIds = [];
+    try {
+      for (const url of ALWAYS_UNSAFE_URLS) {
+        const response = await apiRequest(request, "POST", "/api/webhooks", { token, data: createBody(url) });
+        expect(response.status(), `POST should reject unsafe url ${url}`).toBe(400);
+      }
+      const created = await createWebhookFixture(request, token, {
+        name: `Webhook URL Safety Valid ${Date.now()}`,
+        url: "https://example.com/webhook-url-safety",
+        subscribedEvents: ["catalog.product.created"]
+      });
+      webhookId = created.id;
+      for (const url of ALWAYS_UNSAFE_URLS) {
+        const response = await apiRequest(request, "PUT", `/api/webhooks/${created.id}`, { token, data: { url } });
+        expect(response.status(), `PUT should reject unsafe url ${url}`).toBe(400);
+      }
+      const validUpdate = await apiRequest(request, "PUT", `/api/webhooks/${created.id}`, {
+        token,
+        data: { url: "https://example.org/webhook-url-safety-updated" }
+      });
+      expect(validUpdate.status()).toBe(200);
+      for (const url of PRIVATE_HOST_URLS) {
+        const response = await apiRequest(request, "POST", "/api/webhooks", { token, data: createBody(url) });
+        if (PRIVATE_URLS_ALLOWED) {
+          expect(response.status(), `POST should accept private url ${url} when allowed`).toBe(201);
+          const body = await readJsonSafe(response);
+          if (body?.id) strayPrivateWebhookIds.push(body.id);
+        } else {
+          expect(response.status(), `POST should reject private url ${url} when not allowed`).toBe(400);
+        }
+      }
+    } finally {
+      await deleteWebhookIfExists(request, token, webhookId);
+      for (const id of strayPrivateWebhookIds) {
+        await deleteWebhookIfExists(request, token, id);
+      }
+    }
+  });
+});
+//# sourceMappingURL=TC-WEBHOOK-009.spec.js.map

package/dist/modules/webhooks/__integration__/TC-WEBHOOK-009.spec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/webhooks/__integration__/TC-WEBHOOK-009.spec.ts"],
+  "sourcesContent": ["import { expect, test } from '@playwright/test';\nimport { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api';\nimport { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures';\nimport { createWebhookFixture, deleteWebhookIfExists } from './helpers/fixtures';\n\n/**\n * TC-WEBHOOK-009: Invalid and unsafe URL rejection\n * Source: https://github.com/open-mercato/open-mercato/issues/2482\n *\n * Webhook URLs go through the shared outbound-URL safety check. Forbidden schemes,\n * embedded credentials, and malformed URLs are rejected with 400 on both create and\n * update regardless of configuration. Private/loopback hosts are rejected unless the\n * deployment opts in via OM_WEBHOOKS_ALLOW_PRIVATE_URLS (the integration env enables\n * it so the loopback mock receiver works) \u2014 this spec asserts whichever behavior the\n * active flag dictates. Exhaustive private-IP coverage lives in the unit suites\n * (data/__tests__/validators.test.ts, lib/__tests__/url-safety.test.ts).\n */\nconst PRIVATE_URLS_ALLOWED = ['1', 'true', 'yes', 'on'].includes(\n  (process.env.OM_WEBHOOKS_ALLOW_PRIVATE_URLS ?? '').trim().toLowerCase(),\n);\n\nconst ALWAYS_UNSAFE_URLS = [\n  'ftp://example.com/webhook',\n  'file:///etc/passwd',\n  'http://user:pass@example.com/webhook',\n  'not-a-valid-url',\n];\n\nconst PRIVATE_HOST_URLS = [\n  'http://127.0.0.1:9001/webhook',\n  'http://10.0.0.1/webhook',\n  'http://[::1]:9001/webhook',\n];\n\nfunction createBody(url: string) {\n  return {\n    name: `Webhook URL Safety ${Date.now()}`,\n    url,\n    subscribedEvents: ['catalog.product.created'],\n  };\n}\n\ntest.describe('TC-WEBHOOK-009: Invalid and unsafe URL rejection', () => {\n  test('should reject unsafe webhook URLs on create and update and accept valid external URLs', async ({ request }) => {\n    const token = await getAuthToken(request);\n    let webhookId: string | null = null;\n    const strayPrivateWebhookIds: string[] = [];\n\n    try {\n      // Always-unsafe URLs are rejected at create regardless of the private-URL flag.\n      for (const url of ALWAYS_UNSAFE_URLS) {\n        const response = await apiRequest(request, 'POST', '/api/webhooks', { token, data: createBody(url) });\n        expect(response.status(), `POST should reject unsafe url ${url}`).toBe(400);\n      }\n\n      // A valid external https URL is accepted.\n      const created = await createWebhookFixture(request, token, {\n        name: `Webhook URL Safety Valid ${Date.now()}`,\n        url: 'https://example.com/webhook-url-safety',\n        subscribedEvents: ['catalog.product.created'],\n      });\n      webhookId = created.id;\n\n      // Updating an existing webhook to an unsafe URL is rejected; the record is unchanged.\n      for (const url of ALWAYS_UNSAFE_URLS) {\n        const response = await apiRequest(request, 'PUT', `/api/webhooks/${created.id}`, { token, data: { url } });\n        expect(response.status(), `PUT should reject unsafe url ${url}`).toBe(400);\n      }\n\n      // Updating to another valid external URL succeeds.\n      const validUpdate = await apiRequest(request, 'PUT', `/api/webhooks/${created.id}`, {\n        token,\n        data: { url: 'https://example.org/webhook-url-safety-updated' },\n      });\n      expect(validUpdate.status()).toBe(200);\n\n      // Private/loopback hosts: behavior depends on the deployment flag.\n      for (const url of PRIVATE_HOST_URLS) {\n        const response = await apiRequest(request, 'POST', '/api/webhooks', { token, data: createBody(url) });\n        if (PRIVATE_URLS_ALLOWED) {\n          expect(response.status(), `POST should accept private url ${url} when allowed`).toBe(201);\n          const body = await readJsonSafe<{ id?: string }>(response);\n          if (body?.id) strayPrivateWebhookIds.push(body.id);\n        } else {\n          expect(response.status(), `POST should reject private url ${url} when not allowed`).toBe(400);\n        }\n      }\n    } finally {\n      await deleteWebhookIfExists(request, token, webhookId);\n      for (const id of strayPrivateWebhookIds) {\n        await deleteWebhookIfExists(request, token, id);\n      }\n    }\n  });\n});\n"],
+  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,YAAY,oBAAoB;AACzC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB,6BAA6B;AAc5D,MAAM,uBAAuB,CAAC,KAAK,QAAQ,OAAO,IAAI,EAAE;AAAA,GACrD,QAAQ,IAAI,kCAAkC,IAAI,KAAK,EAAE,YAAY;AACxE;AAEA,MAAM,qBAAqB;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,MAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,WAAW,KAAa;AAC/B,SAAO;AAAA,IACL,MAAM,sBAAsB,KAAK,IAAI,CAAC;AAAA,IACtC;AAAA,IACA,kBAAkB,CAAC,yBAAyB;AAAA,EAC9C;AACF;AAEA,KAAK,SAAS,oDAAoD,MAAM;AACtE,OAAK,yFAAyF,OAAO,EAAE,QAAQ,MAAM;AACnH,UAAM,QAAQ,MAAM,aAAa,OAAO;AACxC,QAAI,YAA2B;AAC/B,UAAM,yBAAmC,CAAC;AAE1C,QAAI;AAEF,iBAAW,OAAO,oBAAoB;AACpC,cAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,iBAAiB,EAAE,OAAO,MAAM,WAAW,GAAG,EAAE,CAAC;AACpG,eAAO,SAAS,OAAO,GAAG,iCAAiC,GAAG,EAAE,EAAE,KAAK,GAAG;AAAA,MAC5E;AAGA,YAAM,UAAU,MAAM,qBAAqB,SAAS,OAAO;AAAA,QACzD,MAAM,4BAA4B,KAAK,IAAI,CAAC;AAAA,QAC5C,KAAK;AAAA,QACL,kBAAkB,CAAC,yBAAyB;AAAA,MAC9C,CAAC;AACD,kBAAY,QAAQ;AAGpB,iBAAW,OAAO,oBAAoB;AACpC,cAAM,WAAW,MAAM,WAAW,SAAS,OAAO,iBAAiB,QAAQ,EAAE,IAAI,EAAE,OAAO,MAAM,EAAE,IAAI,EAAE,CAAC;AACzG,eAAO,SAAS,OAAO,GAAG,gCAAgC,GAAG,EAAE,EAAE,KAAK,GAAG;AAAA,MAC3E;AAGA,YAAM,cAAc,MAAM,WAAW,SAAS,OAAO,iBAAiB,QAAQ,EAAE,IAAI;AAAA,QAClF;AAAA,QACA,MAAM,EAAE,KAAK,iDAAiD;AAAA,MAChE,CAAC;AACD,aAAO,YAAY,OAAO,CAAC,EAAE,KAAK,GAAG;AAGrC,iBAAW,OAAO,mBAAmB;AACnC,cAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,iBAAiB,EAAE,OAAO,MAAM,WAAW,GAAG,EAAE,CAAC;AACpG,YAAI,sBAAsB;AACxB,iBAAO,SAAS,OAAO,GAAG,kCAAkC,GAAG,eAAe,EAAE,KAAK,GAAG;AACxF,gBAAM,OAAO,MAAM,aAA8B,QAAQ;AACzD,cAAI,MAAM,GAAI,wBAAuB,KAAK,KAAK,EAAE;AAAA,QACnD,OAAO;AACL,iBAAO,SAAS,OAAO,GAAG,kCAAkC,GAAG,mBAAmB,EAAE,KAAK,GAAG;AAAA,QAC9F;AAAA,MACF;AAAA,IACF,UAAE;AACA,YAAM,sBAAsB,SAAS,OAAO,SAAS;AACrD,iBAAW,MAAM,wBAAwB;AACvC,cAAM,sBAAsB,SAAS,OAAO,EAAE;AAAA,MAChD;AAAA,IACF;AAAA,EACF,CAAC;AACH,CAAC;",
+  "names": []
+}