@open-mercato/webhooks 0.6.5-develop.4544.1.71c003c861 → 0.6.5-develop.4559.1.839e136509

package/dist/modules/webhooks/__integration__/TC-WEBHOOK-010.spec.js

@@ -0,0 +1,64 @@
+import { expect, test } from "@playwright/test";
+import { getAuthToken } from "@open-mercato/core/helpers/integration/api";
+import {
+  buildMockInboundUrl,
+  createWebhookFixture,
+  deleteWebhookIfExists,
+  getDeliveryDetail,
+  sendTestDelivery
+} from "./helpers/fixtures.js";
+const EVENT_TYPE = "webhooks.test.detail";
+test.describe("TC-WEBHOOK-010: Delivery detail full payload and response body", () => {
+  test("should expose the complete payload and response details for a delivery", async ({ request }) => {
+    const token = await getAuthToken(request);
+    let webhookId = null;
+    try {
+      const created = await createWebhookFixture(request, token, {
+        name: `Webhook Detail ${Date.now()}`,
+        url: buildMockInboundUrl(),
+        subscribedEvents: ["catalog.product.created"],
+        customHeaders: { "x-mock-webhook-signature": "valid" }
+      });
+      webhookId = created.id;
+      const eventData = { sku: "TEST-123", nested: { value: 42 } };
+      const testResult = await sendTestDelivery(request, token, created.id, {
+        eventType: EVENT_TYPE,
+        payload: eventData
+      });
+      expect(testResult.delivery.status).toBe("delivered");
+      const deliveryId = testResult.delivery.id;
+      const detail = await getDeliveryDetail(request, token, deliveryId);
+      expect(detail.id).toBe(deliveryId);
+      expect(detail.webhookId).toBe(created.id);
+      expect(detail.eventType).toBe(EVENT_TYPE);
+      expect(detail.targetUrl).toBe(created.url);
+      expect(typeof detail.messageId).toBe("string");
+      expect(detail.messageId.length).toBeGreaterThan(0);
+      expect(detail.status).toBe("delivered");
+      expect(detail.responseStatus).toBe(200);
+      expect(detail.errorMessage).toBeNull();
+      expect(detail.payload).toMatchObject({
+        type: EVENT_TYPE,
+        data: { sku: "TEST-123", nested: { value: 42 } }
+      });
+      const envelopeTimestamp = detail.payload.timestamp;
+      expect(typeof envelopeTimestamp).toBe("string");
+      expect(Number.isNaN(Date.parse(envelopeTimestamp))).toBe(false);
+      expect(detail.responseBody).toBe(JSON.stringify({ ok: true }));
+      expect(detail.responseHeaders).not.toBeNull();
+      expect(detail.responseHeaders?.["content-type"]).toContain("application/json");
+      expect(detail.attemptNumber).toBeGreaterThanOrEqual(1);
+      expect(detail.maxAttempts).toBeGreaterThanOrEqual(1);
+      expect(typeof detail.durationMs).toBe("number");
+      expect(detail.durationMs).toBeGreaterThanOrEqual(0);
+      expect(detail.nextRetryAt).toBeNull();
+      for (const timestamp of [detail.createdAt, detail.enqueuedAt, detail.lastAttemptAt, detail.deliveredAt, detail.updatedAt]) {
+        expect(typeof timestamp).toBe("string");
+        expect(Number.isNaN(Date.parse(timestamp))).toBe(false);
+      }
+    } finally {
+      await deleteWebhookIfExists(request, token, webhookId);
+    }
+  });
+});
+//# sourceMappingURL=TC-WEBHOOK-010.spec.js.map

package/dist/modules/webhooks/__integration__/TC-WEBHOOK-010.spec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/webhooks/__integration__/TC-WEBHOOK-010.spec.ts"],
+  "sourcesContent": ["import { expect, test } from '@playwright/test';\nimport { getAuthToken } from '@open-mercato/core/helpers/integration/api';\nimport {\n  buildMockInboundUrl,\n  createWebhookFixture,\n  deleteWebhookIfExists,\n  getDeliveryDetail,\n  sendTestDelivery,\n} from './helpers/fixtures';\n\n/**\n * TC-WEBHOOK-010: Delivery detail response includes full payload and response body\n * Source: https://github.com/open-mercato/open-mercato/issues/2482\n *\n * The delivery detail endpoint must expose the complete sent payload and the full\n * response captured from the endpoint (status, body, headers) plus attempt/timing\n * metadata, so admins can debug a delivery end-to-end.\n */\nconst EVENT_TYPE = 'webhooks.test.detail';\n\ntest.describe('TC-WEBHOOK-010: Delivery detail full payload and response body', () => {\n  test('should expose the complete payload and response details for a delivery', async ({ request }) => {\n    const token = await getAuthToken(request);\n    let webhookId: string | null = null;\n\n    try {\n      const created = await createWebhookFixture(request, token, {\n        name: `Webhook Detail ${Date.now()}`,\n        url: buildMockInboundUrl(),\n        subscribedEvents: ['catalog.product.created'],\n        customHeaders: { 'x-mock-webhook-signature': 'valid' },\n      });\n      webhookId = created.id;\n\n      const eventData = { sku: 'TEST-123', nested: { value: 42 } };\n\n      const testResult = await sendTestDelivery(request, token, created.id, {\n        eventType: EVENT_TYPE,\n        payload: eventData,\n      });\n      expect(testResult.delivery.status).toBe('delivered');\n      const deliveryId = testResult.delivery.id;\n\n      const detail = await getDeliveryDetail(request, token, deliveryId);\n\n      // Identity + routing\n      expect(detail.id).toBe(deliveryId);\n      expect(detail.webhookId).toBe(created.id);\n      expect(detail.eventType).toBe(EVENT_TYPE);\n      expect(detail.targetUrl).toBe(created.url);\n      expect(typeof detail.messageId).toBe('string');\n      expect(detail.messageId.length).toBeGreaterThan(0);\n\n      // Outcome\n      expect(detail.status).toBe('delivered');\n      expect(detail.responseStatus).toBe(200);\n      expect(detail.errorMessage).toBeNull();\n\n      // The delivery body wraps the event data in the Standard-Webhooks envelope\n      // { type, timestamp, data }; the sent payload is preserved under `data`.\n      expect(detail.payload).toMatchObject({\n        type: EVENT_TYPE,\n        data: { sku: 'TEST-123', nested: { value: 42 } },\n      });\n      const envelopeTimestamp = (detail.payload as { timestamp?: unknown }).timestamp;\n      expect(typeof envelopeTimestamp).toBe('string');\n      expect(Number.isNaN(Date.parse(envelopeTimestamp as string))).toBe(false);\n\n      // Full captured response (the mock receiver replies { ok: true } as JSON)\n      expect(detail.responseBody).toBe(JSON.stringify({ ok: true }));\n      expect(detail.responseHeaders).not.toBeNull();\n      expect(detail.responseHeaders?.['content-type']).toContain('application/json');\n\n      // Attempt + timing metadata\n      expect(detail.attemptNumber).toBeGreaterThanOrEqual(1);\n      expect(detail.maxAttempts).toBeGreaterThanOrEqual(1);\n      expect(typeof detail.durationMs).toBe('number');\n      expect(detail.durationMs as number).toBeGreaterThanOrEqual(0);\n      expect(detail.nextRetryAt).toBeNull();\n\n      for (const timestamp of [detail.createdAt, detail.enqueuedAt, detail.lastAttemptAt, detail.deliveredAt, detail.updatedAt]) {\n        expect(typeof timestamp).toBe('string');\n        expect(Number.isNaN(Date.parse(timestamp as string))).toBe(false);\n      }\n    } finally {\n      await deleteWebhookIfExists(request, token, webhookId);\n    }\n  });\n});\n"],
+  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAUP,MAAM,aAAa;AAEnB,KAAK,SAAS,kEAAkE,MAAM;AACpF,OAAK,0EAA0E,OAAO,EAAE,QAAQ,MAAM;AACpG,UAAM,QAAQ,MAAM,aAAa,OAAO;AACxC,QAAI,YAA2B;AAE/B,QAAI;AACF,YAAM,UAAU,MAAM,qBAAqB,SAAS,OAAO;AAAA,QACzD,MAAM,kBAAkB,KAAK,IAAI,CAAC;AAAA,QAClC,KAAK,oBAAoB;AAAA,QACzB,kBAAkB,CAAC,yBAAyB;AAAA,QAC5C,eAAe,EAAE,4BAA4B,QAAQ;AAAA,MACvD,CAAC;AACD,kBAAY,QAAQ;AAEpB,YAAM,YAAY,EAAE,KAAK,YAAY,QAAQ,EAAE,OAAO,GAAG,EAAE;AAE3D,YAAM,aAAa,MAAM,iBAAiB,SAAS,OAAO,QAAQ,IAAI;AAAA,QACpE,WAAW;AAAA,QACX,SAAS;AAAA,MACX,CAAC;AACD,aAAO,WAAW,SAAS,MAAM,EAAE,KAAK,WAAW;AACnD,YAAM,aAAa,WAAW,SAAS;AAEvC,YAAM,SAAS,MAAM,kBAAkB,SAAS,OAAO,UAAU;AAGjE,aAAO,OAAO,EAAE,EAAE,KAAK,UAAU;AACjC,aAAO,OAAO,SAAS,EAAE,KAAK,QAAQ,EAAE;AACxC,aAAO,OAAO,SAAS,EAAE,KAAK,UAAU;AACxC,aAAO,OAAO,SAAS,EAAE,KAAK,QAAQ,GAAG;AACzC,aAAO,OAAO,OAAO,SAAS,EAAE,KAAK,QAAQ;AAC7C,aAAO,OAAO,UAAU,MAAM,EAAE,gBAAgB,CAAC;AAGjD,aAAO,OAAO,MAAM,EAAE,KAAK,WAAW;AACtC,aAAO,OAAO,cAAc,EAAE,KAAK,GAAG;AACtC,aAAO,OAAO,YAAY,EAAE,SAAS;AAIrC,aAAO,OAAO,OAAO,EAAE,cAAc;AAAA,QACnC,MAAM;AAAA,QACN,MAAM,EAAE,KAAK,YAAY,QAAQ,EAAE,OAAO,GAAG,EAAE;AAAA,MACjD,CAAC;AACD,YAAM,oBAAqB,OAAO,QAAoC;AACtE,aAAO,OAAO,iBAAiB,EAAE,KAAK,QAAQ;AAC9C,aAAO,OAAO,MAAM,KAAK,MAAM,iBAA2B,CAAC,CAAC,EAAE,KAAK,KAAK;AAGxE,aAAO,OAAO,YAAY,EAAE,KAAK,KAAK,UAAU,EAAE,IAAI,KAAK,CAAC,CAAC;AAC7D,aAAO,OAAO,eAAe,EAAE,IAAI,SAAS;AAC5C,aAAO,OAAO,kBAAkB,cAAc,CAAC,EAAE,UAAU,kBAAkB;AAG7E,aAAO,OAAO,aAAa,EAAE,uBAAuB,CAAC;AACrD,aAAO,OAAO,WAAW,EAAE,uBAAuB,CAAC;AACnD,aAAO,OAAO,OAAO,UAAU,EAAE,KAAK,QAAQ;AAC9C,aAAO,OAAO,UAAoB,EAAE,uBAAuB,CAAC;AAC5D,aAAO,OAAO,WAAW,EAAE,SAAS;AAEpC,iBAAW,aAAa,CAAC,OAAO,WAAW,OAAO,YAAY,OAAO,eAAe,OAAO,aAAa,OAAO,SAAS,GAAG;AACzH,eAAO,OAAO,SAAS,EAAE,KAAK,QAAQ;AACtC,eAAO,OAAO,MAAM,KAAK,MAAM,SAAmB,CAAC,CAAC,EAAE,KAAK,KAAK;AAAA,MAClE;AAAA,IACF,UAAE;AACA,YAAM,sBAAsB,SAAS,OAAO,SAAS;AAAA,IACvD;AAAA,EACF,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/modules/webhooks/__integration__/helpers/fixtures.js

@@ -1,6 +1,8 @@
 import { expect } from "@playwright/test";
-import { apiRequest } from "@open-mercato/core/helpers/integration/api";
+import { apiRequest, getAuthToken } from "@open-mercato/core/helpers/integration/api";
 import { expectId, readJsonSafe } from "@open-mercato/core/helpers/integration/generalFixtures";
+import { createUserFixture, deleteUserIfExists } from "@open-mercato/core/helpers/integration/authFixtures";
+import { deleteUserAclInDb, setUserAclInDb } from "@open-mercato/core/helpers/integration/dbFixtures";
 const BASE_URL = process.env.BASE_URL?.trim() || "http://localhost:3000";
 function buildMockInboundUrl(endpointId = "mock_inbound") {
   return `${BASE_URL}/api/webhooks/inbound/${endpointId}`;
@@ -96,8 +98,52 @@ async function deleteWebhookIfExists(request, token, webhookId) {
     return;
   }
 }
+async function rotateWebhookSecret(request, token, webhookId, path = `/api/webhooks/${webhookId}/rotate-secret`) {
+  const response = await apiRequest(request, "POST", path, { token });
+  expect(response.status()).toBe(200);
+  const body = await readJsonSafe(response);
+  if (!body) {
+    throw new Error(`Expected rotate-secret response for ${webhookId}`);
+  }
+  return body;
+}
+async function sendTestDelivery(request, token, webhookId, input = {}, path = `/api/webhooks/${webhookId}/test`) {
+  const response = await apiRequest(request, "POST", path, { token, data: input });
+  expect(response.status()).toBe(200);
+  const body = await readJsonSafe(response);
+  if (!body) {
+    throw new Error(`Expected test delivery response for ${webhookId}`);
+  }
+  return body;
+}
+async function provisionWebhooksUser(request, adminToken, input) {
+  const unique = `${Date.now()}${Math.floor(Math.random() * 1e6)}`;
+  const email = `qa-webhooks-${input.slug}-${unique}@acme.com`;
+  const password = "Valid1!Webhooks";
+  const userId = await createUserFixture(request, adminToken, {
+    email,
+    password,
+    organizationId: input.organizationId,
+    roles: [],
+    name: `QA Webhooks ${input.slug}`
+  });
+  await setUserAclInDb({
+    userId,
+    tenantId: input.tenantId,
+    features: input.features,
+    organizations: input.organizations ?? null
+  });
+  const token = await getAuthToken(request, email, password);
+  return { userId, email, password, token };
+}
+async function cleanupWebhooksUser(request, adminToken, user) {
+  if (!user) return;
+  await deleteUserAclInDb(user.userId).catch(() => void 0);
+  await deleteUserIfExists(request, adminToken, user.userId).catch(() => void 0);
+}
 export {
   buildMockInboundUrl,
+  cleanupWebhooksUser,
   createWebhookFixture,
   deleteWebhookIfExists,
   getDeliveryDetail,
@@ -105,6 +151,9 @@ export {
   listWebhookDeliveries,
   listWebhookEvents,
   listWebhooks,
+  provisionWebhooksUser,
+  rotateWebhookSecret,
+  sendTestDelivery,
   waitForDeliveryStatus
 };
 //# sourceMappingURL=fixtures.js.map

package/dist/modules/webhooks/__integration__/helpers/fixtures.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/webhooks/__integration__/helpers/fixtures.ts"],
-  "sourcesContent": ["import { expect, type APIRequestContext } from '@playwright/test';\nimport { apiRequest } from '@open-mercato/core/helpers/integration/api';\nimport { expectId, readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures';\n\nconst BASE_URL = process.env.BASE_URL?.trim() || 'http://localhost:3000';\n\nexport type WebhookCreateResponse = {\n  id: string;\n  name: string;\n  url: string;\n  secret: string;\n  subscribedEvents: string[];\n  isActive: boolean;\n};\n\nexport type WebhookDetailResponse = {\n  id: string;\n  name: string;\n  description: string | null;\n  url: string;\n  subscribedEvents: string[];\n  httpMethod: 'POST' | 'PUT' | 'PATCH';\n  isActive: boolean;\n  deliveryStrategy: string;\n  maxRetries: number;\n  consecutiveFailures: number;\n  lastSuccessAt: string | null;\n  lastFailureAt: string | null;\n  createdAt: string;\n  updatedAt: string;\n  customHeaders: Record<string, string> | null;\n  strategyConfig: Record<string, unknown> | null;\n  timeoutMs: number;\n  rateLimitPerMinute: number;\n  autoDisableThreshold: number;\n  integrationId: string | null;\n  maskedSecret: string;\n  previousSecretSetAt: string | null;\n};\n\nexport type WebhookDeliveryDetailResponse = {\n  id: string;\n  webhookId: string;\n  eventType: string;\n  messageId: string;\n  status: string;\n  responseStatus: number | null;\n  errorMessage: string | null;\n  attemptNumber: number;\n  maxAttempts: number;\n  targetUrl: string;\n  durationMs: number | null;\n  enqueuedAt: string;\n  lastAttemptAt: string | null;\n  deliveredAt: string | null;\n  createdAt: string;\n  payload: Record<string, unknown>;\n  responseBody: string | null;\n  responseHeaders: Record<string, string> | null;\n  nextRetryAt: string | null;\n  updatedAt: string;\n};\n\ntype DeliveryListResponse = {\n  items: Array<{\n    id: string;\n    webhookId: string;\n    webhookName: string | null;\n    eventType: string;\n    messageId: string;\n    status: string;\n    responseStatus: number | null;\n    errorMessage: string | null;\n    attemptNumber: number;\n    maxAttempts: number;\n    targetUrl: string;\n    durationMs: number | null;\n    enqueuedAt: string;\n    lastAttemptAt: string | null;\n    deliveredAt: string | null;\n    createdAt: string;\n  }>;\n  total: number;\n  page: number;\n  pageSize: number;\n  totalPages: number;\n};\n\ntype EventsResponse = {\n  data: Array<{\n    id: string;\n    label: string;\n    module?: string;\n    category?: string;\n    description?: string;\n  }>;\n  total: number;\n};\n\nexport function buildMockInboundUrl(endpointId = 'mock_inbound'): string {\n  return `${BASE_URL}/api/webhooks/inbound/${endpointId}`;\n}\n\nexport async function createWebhookFixture(\n  request: APIRequestContext,\n  token: string,\n  overrides: Partial<{\n    name: string;\n    description: string | null;\n    url: string;\n    subscribedEvents: string[];\n    httpMethod: 'POST' | 'PUT' | 'PATCH';\n    maxRetries: number;\n    timeoutMs: number;\n    rateLimitPerMinute: number;\n    autoDisableThreshold: number;\n    customHeaders: Record<string, string> | null;\n  }> = {},\n): Promise<WebhookCreateResponse> {\n  const response = await apiRequest(request, 'POST', '/api/webhooks', {\n    token,\n    data: {\n      name: overrides.name ?? `Webhook ${Date.now()}`,\n      description: overrides.description ?? 'Integration test webhook',\n      url: overrides.url ?? buildMockInboundUrl(),\n      subscribedEvents: overrides.subscribedEvents ?? ['catalog.product.created'],\n      httpMethod: overrides.httpMethod ?? 'POST',\n      maxRetries: overrides.maxRetries ?? 3,\n      timeoutMs: overrides.timeoutMs ?? 5_000,\n      rateLimitPerMinute: overrides.rateLimitPerMinute ?? 0,\n      autoDisableThreshold: overrides.autoDisableThreshold ?? 5,\n      customHeaders: overrides.customHeaders ?? null,\n    },\n  });\n\n  expect(response.status()).toBe(201);\n  const body = await readJsonSafe<WebhookCreateResponse>(response);\n  if (!body) {\n    throw new Error('Expected webhook create response body');\n  }\n\n  expectId(body.id, 'Expected webhook id');\n  expect(typeof body.secret).toBe('string');\n  expect(body.secret.startsWith('whsec_')).toBe(true);\n\n  return body;\n}\n\nexport async function getWebhookDetail(\n  request: APIRequestContext,\n  token: string,\n  webhookId: string,\n  path = `/api/webhooks/${webhookId}`,\n): Promise<WebhookDetailResponse> {\n  const response = await apiRequest(request, 'GET', path, { token });\n  expect(response.status()).toBe(200);\n  const body = await readJsonSafe<WebhookDetailResponse>(response);\n  if (!body) {\n    throw new Error(`Expected webhook detail response for ${webhookId}`);\n  }\n  return body;\n}\n\nexport async function listWebhooks(\n  request: APIRequestContext,\n  token: string,\n  path = '/api/webhooks',\n): Promise<{ items: Array<{ id: string; name: string; url: string }>; total: number }> {\n  const response = await apiRequest(request, 'GET', path, { token });\n  expect(response.status()).toBe(200);\n  const body = await readJsonSafe<{ items: Array<{ id: string; name: string; url: string }>; total: number }>(response);\n  if (!body) {\n    throw new Error('Expected webhook list response');\n  }\n  return body;\n}\n\nexport async function listWebhookEvents(request: APIRequestContext, token: string): Promise<EventsResponse> {\n  const response = await apiRequest(request, 'GET', '/api/webhooks/events', { token });\n  expect(response.status()).toBe(200);\n  const body = await readJsonSafe<EventsResponse>(response);\n  if (!body) {\n    throw new Error('Expected webhook events response');\n  }\n  return body;\n}\n\nexport async function getDeliveryDetail(\n  request: APIRequestContext,\n  token: string,\n  deliveryId: string,\n  path = `/api/webhooks/deliveries/${deliveryId}`,\n): Promise<WebhookDeliveryDetailResponse> {\n  const response = await apiRequest(request, 'GET', path, { token });\n  expect(response.status()).toBe(200);\n  const body = await readJsonSafe<WebhookDeliveryDetailResponse>(response);\n  if (!body) {\n    throw new Error(`Expected webhook delivery detail for ${deliveryId}`);\n  }\n  return body;\n}\n\nexport async function listWebhookDeliveries(\n  request: APIRequestContext,\n  token: string,\n  webhookId: string,\n  path = `/api/webhooks/deliveries?webhookId=${encodeURIComponent(webhookId)}`,\n): Promise<DeliveryListResponse> {\n  const response = await apiRequest(request, 'GET', path, { token });\n  expect(response.status()).toBe(200);\n  const body = await readJsonSafe<DeliveryListResponse>(response);\n  if (!body) {\n    throw new Error(`Expected webhook deliveries for ${webhookId}`);\n  }\n  return body;\n}\n\nexport async function waitForDeliveryStatus(\n  request: APIRequestContext,\n  token: string,\n  deliveryId: string,\n  expectedStatus: string,\n): Promise<WebhookDeliveryDetailResponse> {\n  for (let attempt = 0; attempt < 30; attempt += 1) {\n    const detail = await getDeliveryDetail(request, token, deliveryId);\n    if (detail.status === expectedStatus) {\n      return detail;\n    }\n    await new Promise((resolve) => setTimeout(resolve, 200));\n  }\n\n  throw new Error(`Timed out waiting for delivery ${deliveryId} to reach status ${expectedStatus}`);\n}\n\nexport async function deleteWebhookIfExists(\n  request: APIRequestContext,\n  token: string | null,\n  webhookId: string | null,\n): Promise<void> {\n  if (!token || !webhookId) {\n    return;\n  }\n\n  try {\n    await apiRequest(request, 'DELETE', `/api/webhooks/${webhookId}`, { token });\n  } catch {\n    return;\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,cAAsC;AAC/C,SAAS,kBAAkB;AAC3B,SAAS,UAAU,oBAAoB;AAEvC,MAAM,WAAW,QAAQ,IAAI,UAAU,KAAK,KAAK;AA+F1C,SAAS,oBAAoB,aAAa,gBAAwB;AACvE,SAAO,GAAG,QAAQ,yBAAyB,UAAU;AACvD;AAEA,eAAsB,qBACpB,SACA,OACA,YAWK,CAAC,GAC0B;AAChC,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,iBAAiB;AAAA,IAClE;AAAA,IACA,MAAM;AAAA,MACJ,MAAM,UAAU,QAAQ,WAAW,KAAK,IAAI,CAAC;AAAA,MAC7C,aAAa,UAAU,eAAe;AAAA,MACtC,KAAK,UAAU,OAAO,oBAAoB;AAAA,MAC1C,kBAAkB,UAAU,oBAAoB,CAAC,yBAAyB;AAAA,MAC1E,YAAY,UAAU,cAAc;AAAA,MACpC,YAAY,UAAU,cAAc;AAAA,MACpC,WAAW,UAAU,aAAa;AAAA,MAClC,oBAAoB,UAAU,sBAAsB;AAAA,MACpD,sBAAsB,UAAU,wBAAwB;AAAA,MACxD,eAAe,UAAU,iBAAiB;AAAA,IAC5C;AAAA,EACF,CAAC;AAED,SAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,QAAM,OAAO,MAAM,aAAoC,QAAQ;AAC/D,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AAEA,WAAS,KAAK,IAAI,qBAAqB;AACvC,SAAO,OAAO,KAAK,MAAM,EAAE,KAAK,QAAQ;AACxC,SAAO,KAAK,OAAO,WAAW,QAAQ,CAAC,EAAE,KAAK,IAAI;AAElD,SAAO;AACT;AAEA,eAAsB,iBACpB,SACA,OACA,WACA,OAAO,iBAAiB,SAAS,IACD;AAChC,QAAM,WAAW,MAAM,WAAW,SAAS,OAAO,MAAM,EAAE,MAAM,CAAC;AACjE,SAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,QAAM,OAAO,MAAM,aAAoC,QAAQ;AAC/D,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,wCAAwC,SAAS,EAAE;AAAA,EACrE;AACA,SAAO;AACT;AAEA,eAAsB,aACpB,SACA,OACA,OAAO,iBAC8E;AACrF,QAAM,WAAW,MAAM,WAAW,SAAS,OAAO,MAAM,EAAE,MAAM,CAAC;AACjE,SAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,QAAM,OAAO,MAAM,aAAyF,QAAQ;AACpH,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,gCAAgC;AAAA,EAClD;AACA,SAAO;AACT;AAEA,eAAsB,kBAAkB,SAA4B,OAAwC;AAC1G,QAAM,WAAW,MAAM,WAAW,SAAS,OAAO,wBAAwB,EAAE,MAAM,CAAC;AACnF,SAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,QAAM,OAAO,MAAM,aAA6B,QAAQ;AACxD,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,kCAAkC;AAAA,EACpD;AACA,SAAO;AACT;AAEA,eAAsB,kBACpB,SACA,OACA,YACA,OAAO,4BAA4B,UAAU,IACL;AACxC,QAAM,WAAW,MAAM,WAAW,SAAS,OAAO,MAAM,EAAE,MAAM,CAAC;AACjE,SAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,QAAM,OAAO,MAAM,aAA4C,QAAQ;AACvE,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,wCAAwC,UAAU,EAAE;AAAA,EACtE;AACA,SAAO;AACT;AAEA,eAAsB,sBACpB,SACA,OACA,WACA,OAAO,sCAAsC,mBAAmB,SAAS,CAAC,IAC3C;AAC/B,QAAM,WAAW,MAAM,WAAW,SAAS,OAAO,MAAM,EAAE,MAAM,CAAC;AACjE,SAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,QAAM,OAAO,MAAM,aAAmC,QAAQ;AAC9D,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,mCAAmC,SAAS,EAAE;AAAA,EAChE;AACA,SAAO;AACT;AAEA,eAAsB,sBACpB,SACA,OACA,YACA,gBACwC;AACxC,WAAS,UAAU,GAAG,UAAU,IAAI,WAAW,GAAG;AAChD,UAAM,SAAS,MAAM,kBAAkB,SAAS,OAAO,UAAU;AACjE,QAAI,OAAO,WAAW,gBAAgB;AACpC,aAAO;AAAA,IACT;AACA,UAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,GAAG,CAAC;AAAA,EACzD;AAEA,QAAM,IAAI,MAAM,kCAAkC,UAAU,oBAAoB,cAAc,EAAE;AAClG;AAEA,eAAsB,sBACpB,SACA,OACA,WACe;AACf,MAAI,CAAC,SAAS,CAAC,WAAW;AACxB;AAAA,EACF;AAEA,MAAI;AACF,UAAM,WAAW,SAAS,UAAU,iBAAiB,SAAS,IAAI,EAAE,MAAM,CAAC;AAAA,EAC7E,QAAQ;AACN;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { expect, type APIRequestContext } from '@playwright/test';\nimport { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api';\nimport { expectId, readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures';\nimport { createUserFixture, deleteUserIfExists } from '@open-mercato/core/helpers/integration/authFixtures';\nimport { deleteUserAclInDb, setUserAclInDb } from '@open-mercato/core/helpers/integration/dbFixtures';\n\nconst BASE_URL = process.env.BASE_URL?.trim() || 'http://localhost:3000';\n\nexport type WebhookCreateResponse = {\n  id: string;\n  name: string;\n  url: string;\n  secret: string;\n  subscribedEvents: string[];\n  isActive: boolean;\n};\n\nexport type WebhookDetailResponse = {\n  id: string;\n  name: string;\n  description: string | null;\n  url: string;\n  subscribedEvents: string[];\n  httpMethod: 'POST' | 'PUT' | 'PATCH';\n  isActive: boolean;\n  deliveryStrategy: string;\n  maxRetries: number;\n  consecutiveFailures: number;\n  lastSuccessAt: string | null;\n  lastFailureAt: string | null;\n  createdAt: string;\n  updatedAt: string;\n  customHeaders: Record<string, string> | null;\n  strategyConfig: Record<string, unknown> | null;\n  timeoutMs: number;\n  rateLimitPerMinute: number;\n  autoDisableThreshold: number;\n  integrationId: string | null;\n  maskedSecret: string;\n  previousSecretSetAt: string | null;\n};\n\nexport type WebhookDeliveryDetailResponse = {\n  id: string;\n  webhookId: string;\n  eventType: string;\n  messageId: string;\n  status: string;\n  responseStatus: number | null;\n  errorMessage: string | null;\n  attemptNumber: number;\n  maxAttempts: number;\n  targetUrl: string;\n  durationMs: number | null;\n  enqueuedAt: string;\n  lastAttemptAt: string | null;\n  deliveredAt: string | null;\n  createdAt: string;\n  payload: Record<string, unknown>;\n  responseBody: string | null;\n  responseHeaders: Record<string, string> | null;\n  nextRetryAt: string | null;\n  updatedAt: string;\n};\n\ntype DeliveryListResponse = {\n  items: Array<{\n    id: string;\n    webhookId: string;\n    webhookName: string | null;\n    eventType: string;\n    messageId: string;\n    status: string;\n    responseStatus: number | null;\n    errorMessage: string | null;\n    attemptNumber: number;\n    maxAttempts: number;\n    targetUrl: string;\n    durationMs: number | null;\n    enqueuedAt: string;\n    lastAttemptAt: string | null;\n    deliveredAt: string | null;\n    createdAt: string;\n  }>;\n  total: number;\n  page: number;\n  pageSize: number;\n  totalPages: number;\n};\n\ntype EventsResponse = {\n  data: Array<{\n    id: string;\n    label: string;\n    module?: string;\n    category?: string;\n    description?: string;\n  }>;\n  total: number;\n};\n\nexport function buildMockInboundUrl(endpointId = 'mock_inbound'): string {\n  return `${BASE_URL}/api/webhooks/inbound/${endpointId}`;\n}\n\nexport async function createWebhookFixture(\n  request: APIRequestContext,\n  token: string,\n  overrides: Partial<{\n    name: string;\n    description: string | null;\n    url: string;\n    subscribedEvents: string[];\n    httpMethod: 'POST' | 'PUT' | 'PATCH';\n    maxRetries: number;\n    timeoutMs: number;\n    rateLimitPerMinute: number;\n    autoDisableThreshold: number;\n    customHeaders: Record<string, string> | null;\n  }> = {},\n): Promise<WebhookCreateResponse> {\n  const response = await apiRequest(request, 'POST', '/api/webhooks', {\n    token,\n    data: {\n      name: overrides.name ?? `Webhook ${Date.now()}`,\n      description: overrides.description ?? 'Integration test webhook',\n      url: overrides.url ?? buildMockInboundUrl(),\n      subscribedEvents: overrides.subscribedEvents ?? ['catalog.product.created'],\n      httpMethod: overrides.httpMethod ?? 'POST',\n      maxRetries: overrides.maxRetries ?? 3,\n      timeoutMs: overrides.timeoutMs ?? 5_000,\n      rateLimitPerMinute: overrides.rateLimitPerMinute ?? 0,\n      autoDisableThreshold: overrides.autoDisableThreshold ?? 5,\n      customHeaders: overrides.customHeaders ?? null,\n    },\n  });\n\n  expect(response.status()).toBe(201);\n  const body = await readJsonSafe<WebhookCreateResponse>(response);\n  if (!body) {\n    throw new Error('Expected webhook create response body');\n  }\n\n  expectId(body.id, 'Expected webhook id');\n  expect(typeof body.secret).toBe('string');\n  expect(body.secret.startsWith('whsec_')).toBe(true);\n\n  return body;\n}\n\nexport async function getWebhookDetail(\n  request: APIRequestContext,\n  token: string,\n  webhookId: string,\n  path = `/api/webhooks/${webhookId}`,\n): Promise<WebhookDetailResponse> {\n  const response = await apiRequest(request, 'GET', path, { token });\n  expect(response.status()).toBe(200);\n  const body = await readJsonSafe<WebhookDetailResponse>(response);\n  if (!body) {\n    throw new Error(`Expected webhook detail response for ${webhookId}`);\n  }\n  return body;\n}\n\nexport async function listWebhooks(\n  request: APIRequestContext,\n  token: string,\n  path = '/api/webhooks',\n): Promise<{ items: Array<{ id: string; name: string; url: string }>; total: number }> {\n  const response = await apiRequest(request, 'GET', path, { token });\n  expect(response.status()).toBe(200);\n  const body = await readJsonSafe<{ items: Array<{ id: string; name: string; url: string }>; total: number }>(response);\n  if (!body) {\n    throw new Error('Expected webhook list response');\n  }\n  return body;\n}\n\nexport async function listWebhookEvents(request: APIRequestContext, token: string): Promise<EventsResponse> {\n  const response = await apiRequest(request, 'GET', '/api/webhooks/events', { token });\n  expect(response.status()).toBe(200);\n  const body = await readJsonSafe<EventsResponse>(response);\n  if (!body) {\n    throw new Error('Expected webhook events response');\n  }\n  return body;\n}\n\nexport async function getDeliveryDetail(\n  request: APIRequestContext,\n  token: string,\n  deliveryId: string,\n  path = `/api/webhooks/deliveries/${deliveryId}`,\n): Promise<WebhookDeliveryDetailResponse> {\n  const response = await apiRequest(request, 'GET', path, { token });\n  expect(response.status()).toBe(200);\n  const body = await readJsonSafe<WebhookDeliveryDetailResponse>(response);\n  if (!body) {\n    throw new Error(`Expected webhook delivery detail for ${deliveryId}`);\n  }\n  return body;\n}\n\nexport async function listWebhookDeliveries(\n  request: APIRequestContext,\n  token: string,\n  webhookId: string,\n  path = `/api/webhooks/deliveries?webhookId=${encodeURIComponent(webhookId)}`,\n): Promise<DeliveryListResponse> {\n  const response = await apiRequest(request, 'GET', path, { token });\n  expect(response.status()).toBe(200);\n  const body = await readJsonSafe<DeliveryListResponse>(response);\n  if (!body) {\n    throw new Error(`Expected webhook deliveries for ${webhookId}`);\n  }\n  return body;\n}\n\nexport async function waitForDeliveryStatus(\n  request: APIRequestContext,\n  token: string,\n  deliveryId: string,\n  expectedStatus: string,\n): Promise<WebhookDeliveryDetailResponse> {\n  for (let attempt = 0; attempt < 30; attempt += 1) {\n    const detail = await getDeliveryDetail(request, token, deliveryId);\n    if (detail.status === expectedStatus) {\n      return detail;\n    }\n    await new Promise((resolve) => setTimeout(resolve, 200));\n  }\n\n  throw new Error(`Timed out waiting for delivery ${deliveryId} to reach status ${expectedStatus}`);\n}\n\nexport async function deleteWebhookIfExists(\n  request: APIRequestContext,\n  token: string | null,\n  webhookId: string | null,\n): Promise<void> {\n  if (!token || !webhookId) {\n    return;\n  }\n\n  try {\n    await apiRequest(request, 'DELETE', `/api/webhooks/${webhookId}`, { token });\n  } catch {\n    return;\n  }\n}\n\nexport type WebhookRotateSecretResponse = {\n  success: true;\n  secret: string;\n  previousSecretSetAt: string | null;\n};\n\nexport async function rotateWebhookSecret(\n  request: APIRequestContext,\n  token: string,\n  webhookId: string,\n  path = `/api/webhooks/${webhookId}/rotate-secret`,\n): Promise<WebhookRotateSecretResponse> {\n  const response = await apiRequest(request, 'POST', path, { token });\n  expect(response.status()).toBe(200);\n  const body = await readJsonSafe<WebhookRotateSecretResponse>(response);\n  if (!body) {\n    throw new Error(`Expected rotate-secret response for ${webhookId}`);\n  }\n  return body;\n}\n\nexport type WebhookTestDeliveryResponse = {\n  success: true;\n  delivery: WebhookDeliveryDetailResponse;\n};\n\nexport async function sendTestDelivery(\n  request: APIRequestContext,\n  token: string,\n  webhookId: string,\n  input: { eventType?: string; payload?: Record<string, unknown> } = {},\n  path = `/api/webhooks/${webhookId}/test`,\n): Promise<WebhookTestDeliveryResponse> {\n  const response = await apiRequest(request, 'POST', path, { token, data: input });\n  expect(response.status()).toBe(200);\n  const body = await readJsonSafe<WebhookTestDeliveryResponse>(response);\n  if (!body) {\n    throw new Error(`Expected test delivery response for ${webhookId}`);\n  }\n  return body;\n}\n\nexport type ProvisionedWebhooksUser = {\n  userId: string;\n  email: string;\n  password: string;\n  token: string;\n};\n\n/**\n * Creates a self-contained, role-less user and grants it an exact webhooks feature\n * set (and optional organization-visibility list) through a per-user ACL row, then\n * logs it in. The DB ACL path mirrors the org-scope fixtures: granting features via\n * the ACL API requires a super-admin actor, while `setUserAclInDb` keeps the spec\n * self-contained and deterministic. Login happens AFTER the ACL is written so the\n * fresh session resolves the new grants.\n */\nexport async function provisionWebhooksUser(\n  request: APIRequestContext,\n  adminToken: string,\n  input: {\n    tenantId: string;\n    organizationId: string;\n    features: string[];\n    organizations?: string[] | null;\n    slug: string;\n  },\n): Promise<ProvisionedWebhooksUser> {\n  const unique = `${Date.now()}${Math.floor(Math.random() * 1_000_000)}`;\n  const email = `qa-webhooks-${input.slug}-${unique}@acme.com`;\n  const password = 'Valid1!Webhooks';\n  const userId = await createUserFixture(request, adminToken, {\n    email,\n    password,\n    organizationId: input.organizationId,\n    roles: [],\n    name: `QA Webhooks ${input.slug}`,\n  });\n  await setUserAclInDb({\n    userId,\n    tenantId: input.tenantId,\n    features: input.features,\n    organizations: input.organizations ?? null,\n  });\n  const token = await getAuthToken(request, email, password);\n  return { userId, email, password, token };\n}\n\nexport async function cleanupWebhooksUser(\n  request: APIRequestContext,\n  adminToken: string | null,\n  user: ProvisionedWebhooksUser | null,\n): Promise<void> {\n  if (!user) return;\n  await deleteUserAclInDb(user.userId).catch(() => undefined);\n  await deleteUserIfExists(request, adminToken, user.userId).catch(() => undefined);\n}\n"],
+  "mappings": "AAAA,SAAS,cAAsC;AAC/C,SAAS,YAAY,oBAAoB;AACzC,SAAS,UAAU,oBAAoB;AACvC,SAAS,mBAAmB,0BAA0B;AACtD,SAAS,mBAAmB,sBAAsB;AAElD,MAAM,WAAW,QAAQ,IAAI,UAAU,KAAK,KAAK;AA+F1C,SAAS,oBAAoB,aAAa,gBAAwB;AACvE,SAAO,GAAG,QAAQ,yBAAyB,UAAU;AACvD;AAEA,eAAsB,qBACpB,SACA,OACA,YAWK,CAAC,GAC0B;AAChC,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,iBAAiB;AAAA,IAClE;AAAA,IACA,MAAM;AAAA,MACJ,MAAM,UAAU,QAAQ,WAAW,KAAK,IAAI,CAAC;AAAA,MAC7C,aAAa,UAAU,eAAe;AAAA,MACtC,KAAK,UAAU,OAAO,oBAAoB;AAAA,MAC1C,kBAAkB,UAAU,oBAAoB,CAAC,yBAAyB;AAAA,MAC1E,YAAY,UAAU,cAAc;AAAA,MACpC,YAAY,UAAU,cAAc;AAAA,MACpC,WAAW,UAAU,aAAa;AAAA,MAClC,oBAAoB,UAAU,sBAAsB;AAAA,MACpD,sBAAsB,UAAU,wBAAwB;AAAA,MACxD,eAAe,UAAU,iBAAiB;AAAA,IAC5C;AAAA,EACF,CAAC;AAED,SAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,QAAM,OAAO,MAAM,aAAoC,QAAQ;AAC/D,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AAEA,WAAS,KAAK,IAAI,qBAAqB;AACvC,SAAO,OAAO,KAAK,MAAM,EAAE,KAAK,QAAQ;AACxC,SAAO,KAAK,OAAO,WAAW,QAAQ,CAAC,EAAE,KAAK,IAAI;AAElD,SAAO;AACT;AAEA,eAAsB,iBACpB,SACA,OACA,WACA,OAAO,iBAAiB,SAAS,IACD;AAChC,QAAM,WAAW,MAAM,WAAW,SAAS,OAAO,MAAM,EAAE,MAAM,CAAC;AACjE,SAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,QAAM,OAAO,MAAM,aAAoC,QAAQ;AAC/D,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,wCAAwC,SAAS,EAAE;AAAA,EACrE;AACA,SAAO;AACT;AAEA,eAAsB,aACpB,SACA,OACA,OAAO,iBAC8E;AACrF,QAAM,WAAW,MAAM,WAAW,SAAS,OAAO,MAAM,EAAE,MAAM,CAAC;AACjE,SAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,QAAM,OAAO,MAAM,aAAyF,QAAQ;AACpH,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,gCAAgC;AAAA,EAClD;AACA,SAAO;AACT;AAEA,eAAsB,kBAAkB,SAA4B,OAAwC;AAC1G,QAAM,WAAW,MAAM,WAAW,SAAS,OAAO,wBAAwB,EAAE,MAAM,CAAC;AACnF,SAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,QAAM,OAAO,MAAM,aAA6B,QAAQ;AACxD,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,kCAAkC;AAAA,EACpD;AACA,SAAO;AACT;AAEA,eAAsB,kBACpB,SACA,OACA,YACA,OAAO,4BAA4B,UAAU,IACL;AACxC,QAAM,WAAW,MAAM,WAAW,SAAS,OAAO,MAAM,EAAE,MAAM,CAAC;AACjE,SAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,QAAM,OAAO,MAAM,aAA4C,QAAQ;AACvE,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,wCAAwC,UAAU,EAAE;AAAA,EACtE;AACA,SAAO;AACT;AAEA,eAAsB,sBACpB,SACA,OACA,WACA,OAAO,sCAAsC,mBAAmB,SAAS,CAAC,IAC3C;AAC/B,QAAM,WAAW,MAAM,WAAW,SAAS,OAAO,MAAM,EAAE,MAAM,CAAC;AACjE,SAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,QAAM,OAAO,MAAM,aAAmC,QAAQ;AAC9D,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,mCAAmC,SAAS,EAAE;AAAA,EAChE;AACA,SAAO;AACT;AAEA,eAAsB,sBACpB,SACA,OACA,YACA,gBACwC;AACxC,WAAS,UAAU,GAAG,UAAU,IAAI,WAAW,GAAG;AAChD,UAAM,SAAS,MAAM,kBAAkB,SAAS,OAAO,UAAU;AACjE,QAAI,OAAO,WAAW,gBAAgB;AACpC,aAAO;AAAA,IACT;AACA,UAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,GAAG,CAAC;AAAA,EACzD;AAEA,QAAM,IAAI,MAAM,kCAAkC,UAAU,oBAAoB,cAAc,EAAE;AAClG;AAEA,eAAsB,sBACpB,SACA,OACA,WACe;AACf,MAAI,CAAC,SAAS,CAAC,WAAW;AACxB;AAAA,EACF;AAEA,MAAI;AACF,UAAM,WAAW,SAAS,UAAU,iBAAiB,SAAS,IAAI,EAAE,MAAM,CAAC;AAAA,EAC7E,QAAQ;AACN;AAAA,EACF;AACF;AAQA,eAAsB,oBACpB,SACA,OACA,WACA,OAAO,iBAAiB,SAAS,kBACK;AACtC,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,MAAM,EAAE,MAAM,CAAC;AAClE,SAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,QAAM,OAAO,MAAM,aAA0C,QAAQ;AACrE,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,uCAAuC,SAAS,EAAE;AAAA,EACpE;AACA,SAAO;AACT;AAOA,eAAsB,iBACpB,SACA,OACA,WACA,QAAmE,CAAC,GACpE,OAAO,iBAAiB,SAAS,SACK;AACtC,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,MAAM,EAAE,OAAO,MAAM,MAAM,CAAC;AAC/E,SAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,QAAM,OAAO,MAAM,aAA0C,QAAQ;AACrE,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,uCAAuC,SAAS,EAAE;AAAA,EACpE;AACA,SAAO;AACT;AAiBA,eAAsB,sBACpB,SACA,YACA,OAOkC;AAClC,QAAM,SAAS,GAAG,KAAK,IAAI,CAAC,GAAG,KAAK,MAAM,KAAK,OAAO,IAAI,GAAS,CAAC;AACpE,QAAM,QAAQ,eAAe,MAAM,IAAI,IAAI,MAAM;AACjD,QAAM,WAAW;AACjB,QAAM,SAAS,MAAM,kBAAkB,SAAS,YAAY;AAAA,IAC1D;AAAA,IACA;AAAA,IACA,gBAAgB,MAAM;AAAA,IACtB,OAAO,CAAC;AAAA,IACR,MAAM,eAAe,MAAM,IAAI;AAAA,EACjC,CAAC;AACD,QAAM,eAAe;AAAA,IACnB;AAAA,IACA,UAAU,MAAM;AAAA,IAChB,UAAU,MAAM;AAAA,IAChB,eAAe,MAAM,iBAAiB;AAAA,EACxC,CAAC;AACD,QAAM,QAAQ,MAAM,aAAa,SAAS,OAAO,QAAQ;AACzD,SAAO,EAAE,QAAQ,OAAO,UAAU,MAAM;AAC1C;AAEA,eAAsB,oBACpB,SACA,YACA,MACe;AACf,MAAI,CAAC,KAAM;AACX,QAAM,kBAAkB,KAAK,MAAM,EAAE,MAAM,MAAM,MAAS;AAC1D,QAAM,mBAAmB,SAAS,YAAY,KAAK,MAAM,EAAE,MAAM,MAAM,MAAS;AAClF;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/webhooks",
-  "version": "0.6.5-develop.4544.1.71c003c861",
+  "version": "0.6.5-develop.4559.1.839e136509",
   "description": "Webhooks module for Open Mercato — Standard Webhooks compliant outbound/inbound delivery",
   "type": "module",
   "main": "./dist/index.js",
@@ -69,19 +69,19 @@
     }
   },
   "dependencies": {
-    "@open-mercato/core": "0.6.5-develop.4544.1.71c003c861",
-    "@open-mercato/queue": "0.6.5-develop.4544.1.71c003c861",
-    "@open-mercato/ui": "0.6.5-develop.4544.1.71c003c861",
+    "@open-mercato/core": "0.6.5-develop.4559.1.839e136509",
+    "@open-mercato/queue": "0.6.5-develop.4559.1.839e136509",
+    "@open-mercato/ui": "0.6.5-develop.4559.1.839e136509",
     "svix": "^1.95.1"
   },
   "peerDependencies": {
     "@mikro-orm/postgresql": "^7.0.14",
-    "@open-mercato/shared": "0.6.5-develop.4544.1.71c003c861",
+    "@open-mercato/shared": "0.6.5-develop.4559.1.839e136509",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.6.5-develop.4544.1.71c003c861",
+    "@open-mercato/shared": "0.6.5-develop.4559.1.839e136509",
     "@types/jest": "^30.0.0",
     "@types/react": "^19.2.16",
     "@types/react-dom": "^19.2.3",

package/src/modules/webhooks/__integration__/TC-WEBHOOK-004.spec.ts

@@ -0,0 +1,63 @@
+import { expect, test } from '@playwright/test';
+import { getAuthToken } from '@open-mercato/core/helpers/integration/api';
+import {
+  createWebhookFixture,
+  deleteWebhookIfExists,
+  getWebhookDetail,
+  rotateWebhookSecret,
+} from './helpers/fixtures';
+
+/**
+ * TC-WEBHOOK-004: Secret rotation with previous secret retention
+ * Source: https://github.com/open-mercato/open-mercato/issues/2482
+ *
+ * Verifies the security-critical rotate-secret flow: a new whsec_ secret is issued,
+ * the previous secret is retained (so deliveries can dual-sign during rollout), and
+ * the detail endpoint reflects the masked new secret plus the rotation timestamp.
+ */
+test.describe('TC-WEBHOOK-004: Secret rotation with previous secret retention', () => {
+  test('should rotate the signing secret, retain the previous one, and mask it on read', async ({ request }) => {
+    const token = await getAuthToken(request);
+    let webhookId: string | null = null;
+
+    try {
+      const created = await createWebhookFixture(request, token, {
+        name: `Webhook Rotate ${Date.now()}`,
+        url: 'https://example.com/webhook-rotate',
+        subscribedEvents: ['sales.quote.created'],
+      });
+      webhookId = created.id;
+      expect(created.secret.startsWith('whsec_')).toBe(true);
+
+      const beforeRotation = await getWebhookDetail(request, token, created.id);
+      expect(beforeRotation.previousSecretSetAt).toBeNull();
+
+      const rotation = await rotateWebhookSecret(request, token, created.id);
+      expect(rotation.success).toBe(true);
+      expect(rotation.secret.startsWith('whsec_')).toBe(true);
+      expect(rotation.secret).not.toBe(created.secret);
+      expect(typeof rotation.previousSecretSetAt).toBe('string');
+      expect(Number.isNaN(Date.parse(rotation.previousSecretSetAt as string))).toBe(false);
+
+      const afterRotation = await getWebhookDetail(request, token, created.id);
+      // The detail endpoint never exposes the raw secret — only a masked form that
+      // reveals the constant "whsec_" prefix (maskSecret => `${secret.slice(0, 6)}••••••••`).
+      expect(afterRotation.maskedSecret.startsWith('whsec_')).toBe(true);
+      expect(afterRotation.maskedSecret).not.toBe(rotation.secret);
+      expect(afterRotation.maskedSecret).not.toBe(created.secret);
+      expect(afterRotation.maskedSecret.length).toBeLessThan(rotation.secret.length);
+      // previousSecretSetAt proves the prior secret is retained for dual-sign verification
+      // (delivery signing reads webhook.previousSecret; covered at unit level in lib/__tests__).
+      expect(afterRotation.previousSecretSetAt).toBe(rotation.previousSecretSetAt);
+
+      const secondRotation = await rotateWebhookSecret(request, token, created.id);
+      expect(secondRotation.secret).not.toBe(rotation.secret);
+      expect(typeof secondRotation.previousSecretSetAt).toBe('string');
+      expect(Date.parse(secondRotation.previousSecretSetAt as string)).toBeGreaterThanOrEqual(
+        Date.parse(rotation.previousSecretSetAt as string),
+      );
+    } finally {
+      await deleteWebhookIfExists(request, token, webhookId);
+    }
+  });
+});

package/src/modules/webhooks/__integration__/TC-WEBHOOK-005.spec.ts

@@ -0,0 +1,126 @@
+import { expect, test } from '@playwright/test';
+import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api';
+import { getTokenScope } from '@open-mercato/core/helpers/integration/generalFixtures';
+import {
+  cleanupWebhooksUser,
+  createWebhookFixture,
+  deleteWebhookIfExists,
+  provisionWebhooksUser,
+  type ProvisionedWebhooksUser,
+} from './helpers/fixtures';
+
+/**
+ * TC-WEBHOOK-005: RBAC permission gates — unauthorized access by feature flag
+ * Source: https://github.com/open-mercato/open-mercato/issues/2482
+ *
+ * Verifies every webhooks API surface is gated by its declared feature:
+ *   webhooks.view    → GET list + GET detail + deliveries
+ *   webhooks.manage  → POST + PUT + DELETE
+ *   webhooks.secrets → POST rotate-secret
+ *   webhooks.test    → POST test
+ * A viewer holding only webhooks.view passes reads but is denied every write/secret/test
+ * surface; a user holding no webhooks features is denied reads. Admin (webhooks.*) proves
+ * the positive paths. Denials accept 401 or 403 per the issue's acceptance criteria.
+ */
+test.describe('TC-WEBHOOK-005: RBAC permission gates by feature flag', () => {
+  test('should gate each webhooks surface behind its declared feature', async ({ request }) => {
+    const adminToken = await getAuthToken(request);
+    const scope = getTokenScope(adminToken);
+
+    let webhookId: string | null = null;
+    let viewer: ProvisionedWebhooksUser | null = null;
+    let noAccess: ProvisionedWebhooksUser | null = null;
+
+    try {
+      viewer = await provisionWebhooksUser(request, adminToken, {
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        features: ['webhooks.view'],
+        slug: 'viewer',
+      });
+      noAccess = await provisionWebhooksUser(request, adminToken, {
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        features: [],
+        slug: 'noaccess',
+      });
+
+      // --- Positive: admin (webhooks.*) can exercise every surface ---
+      const created = await createWebhookFixture(request, adminToken, {
+        name: `Webhook RBAC ${Date.now()}`,
+        url: 'https://example.com/webhook-rbac',
+        subscribedEvents: ['catalog.product.created'],
+        customHeaders: { 'x-mock-webhook-signature': 'valid' },
+      });
+      webhookId = created.id;
+
+      const adminList = await apiRequest(request, 'GET', '/api/webhooks', { token: adminToken });
+      expect(adminList.status()).toBe(200);
+      const adminDetail = await apiRequest(request, 'GET', `/api/webhooks/${created.id}`, { token: adminToken });
+      expect(adminDetail.status()).toBe(200);
+
+      // --- webhooks.view gate ---
+      const viewerList = await apiRequest(request, 'GET', '/api/webhooks', { token: viewer.token });
+      expect(viewerList.status()).toBe(200);
+      const viewerDetail = await apiRequest(request, 'GET', `/api/webhooks/${created.id}`, { token: viewer.token });
+      expect(viewerDetail.status()).toBe(200);
+
+      const noAccessList = await apiRequest(request, 'GET', '/api/webhooks', { token: noAccess.token });
+      expect([401, 403]).toContain(noAccessList.status());
+      const noAccessDetail = await apiRequest(request, 'GET', `/api/webhooks/${created.id}`, { token: noAccess.token });
+      expect([401, 403]).toContain(noAccessDetail.status());
+
+      // --- webhooks.manage gate (viewer lacks manage) ---
+      const viewerCreate = await apiRequest(request, 'POST', '/api/webhooks', {
+        token: viewer.token,
+        data: {
+          name: `Webhook RBAC Denied ${Date.now()}`,
+          url: 'https://example.com/webhook-denied',
+          subscribedEvents: ['catalog.product.created'],
+        },
+      });
+      expect([401, 403]).toContain(viewerCreate.status());
+
+      const viewerUpdate = await apiRequest(request, 'PUT', `/api/webhooks/${created.id}`, {
+        token: viewer.token,
+        data: { name: `Webhook RBAC Hijack ${Date.now()}` },
+      });
+      expect([401, 403]).toContain(viewerUpdate.status());
+
+      const viewerDelete = await apiRequest(request, 'DELETE', `/api/webhooks/${created.id}`, { token: viewer.token });
+      expect([401, 403]).toContain(viewerDelete.status());
+
+      // --- webhooks.secrets gate (viewer lacks secrets) ---
+      const viewerRotate = await apiRequest(request, 'POST', `/api/webhooks/${created.id}/rotate-secret`, {
+        token: viewer.token,
+      });
+      expect([401, 403]).toContain(viewerRotate.status());
+
+      // --- webhooks.test gate (viewer lacks test) ---
+      const viewerTest = await apiRequest(request, 'POST', `/api/webhooks/${created.id}/test`, {
+        token: viewer.token,
+        data: { eventType: 'catalog.product.created' },
+      });
+      expect([401, 403]).toContain(viewerTest.status());
+
+      // The webhook must still exist — none of the denied writes mutated it.
+      const stillThere = await apiRequest(request, 'GET', `/api/webhooks/${created.id}`, { token: adminToken });
+      expect(stillThere.status()).toBe(200);
+
+      // --- Positive secrets + test paths (admin holds both features) ---
+      const adminRotate = await apiRequest(request, 'POST', `/api/webhooks/${created.id}/rotate-secret`, {
+        token: adminToken,
+      });
+      expect(adminRotate.status()).toBe(200);
+      const adminTest = await apiRequest(request, 'POST', `/api/webhooks/${created.id}/test`, {
+        token: adminToken,
+        data: { eventType: 'catalog.product.created' },
+      });
+      expect(adminTest.status()).toBe(200);
+    } finally {
+      await deleteWebhookIfExists(request, adminToken, webhookId);
+      await cleanupWebhooksUser(request, adminToken, viewer);
+      await cleanupWebhooksUser(request, adminToken, noAccess);
+    }
+  });
+});

package/src/modules/webhooks/__integration__/TC-WEBHOOK-006.spec.ts

@@ -0,0 +1,82 @@
+import { expect, test } from '@playwright/test';
+import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api';
+import {
+  buildMockInboundUrl,
+  createWebhookFixture,
+  deleteWebhookIfExists,
+  listWebhookDeliveries,
+  sendTestDelivery,
+} from './helpers/fixtures';
+
+/**
+ * TC-WEBHOOK-006: Webhook deactivation blocks delivery
+ * Source: https://github.com/open-mercato/open-mercato/issues/2482
+ *
+ * The isActive flag must prevent delivery. The synchronous test route still records a
+ * delivery attempt, but the delivery engine short-circuits inactive webhooks: the
+ * delivery is marked `expired` with "Webhook is inactive" and no HTTP request is made
+ * (responseStatus stays null). Re-activating restores successful delivery.
+ */
+test.describe('TC-WEBHOOK-006: Webhook deactivation blocks delivery', () => {
+  test('should deliver while active, block while inactive, and resume after re-activation', async ({ request }) => {
+    const token = await getAuthToken(request);
+    let webhookId: string | null = null;
+
+    try {
+      const created = await createWebhookFixture(request, token, {
+        name: `Webhook Deactivation ${Date.now()}`,
+        url: buildMockInboundUrl(),
+        subscribedEvents: ['catalog.product.created'],
+        customHeaders: { 'x-mock-webhook-signature': 'valid' },
+      });
+      webhookId = created.id;
+
+      // 1) Active webhook delivers successfully.
+      const activeDelivery = await sendTestDelivery(request, token, created.id, {
+        eventType: 'catalog.product.created',
+      });
+      expect(activeDelivery.delivery.status).toBe('delivered');
+      expect(activeDelivery.delivery.responseStatus).toBe(200);
+
+      // 2) Deactivate.
+      const deactivate = await apiRequest(request, 'PUT', `/api/webhooks/${created.id}`, {
+        token,
+        data: { isActive: false },
+      });
+      expect(deactivate.status()).toBe(200);
+
+      // 3) Inactive webhook does not reach the endpoint — delivery is expired, no HTTP attempt.
+      const blockedDelivery = await sendTestDelivery(request, token, created.id, {
+        eventType: 'catalog.product.created',
+      });
+      expect(blockedDelivery.delivery.status).toBe('expired');
+      expect(blockedDelivery.delivery.errorMessage).toBe('Webhook is inactive');
+      expect(blockedDelivery.delivery.responseStatus).toBeNull();
+
+      // The blocked attempt is visible in the delivery log with a non-delivered status.
+      const expiredDeliveries = await listWebhookDeliveries(
+        request,
+        token,
+        created.id,
+        `/api/webhooks/deliveries?webhookId=${encodeURIComponent(created.id)}&status=expired`,
+      );
+      expect(expiredDeliveries.items.some((item) => item.id === blockedDelivery.delivery.id)).toBe(true);
+      expect(expiredDeliveries.items.every((item) => item.status === 'expired')).toBe(true);
+
+      // 4) Re-activate and confirm delivery resumes.
+      const reactivate = await apiRequest(request, 'PUT', `/api/webhooks/${created.id}`, {
+        token,
+        data: { isActive: true },
+      });
+      expect(reactivate.status()).toBe(200);
+
+      const resumedDelivery = await sendTestDelivery(request, token, created.id, {
+        eventType: 'catalog.product.created',
+      });
+      expect(resumedDelivery.delivery.status).toBe('delivered');
+      expect(resumedDelivery.delivery.responseStatus).toBe(200);
+    } finally {
+      await deleteWebhookIfExists(request, token, webhookId);
+    }
+  });
+});

package/src/modules/webhooks/__integration__/TC-WEBHOOK-007.spec.ts

@@ -0,0 +1,102 @@
+import { expect, test } from '@playwright/test';
+import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api';
+import { getTokenScope } from '@open-mercato/core/helpers/integration/generalFixtures';
+import { createOrganizationInDb, deleteOrganizationInDb } from '@open-mercato/core/helpers/integration/dbFixtures';
+import {
+  cleanupWebhooksUser,
+  createWebhookFixture,
+  deleteWebhookIfExists,
+  listWebhooks,
+  provisionWebhooksUser,
+  type ProvisionedWebhooksUser,
+  type WebhookCreateResponse,
+} from './helpers/fixtures';
+
+/**
+ * TC-WEBHOOK-007: Tenant/organization scoping isolation
+ * Source: https://github.com/open-mercato/open-mercato/issues/2482
+ *
+ * Webhooks are scoped by tenantId + organizationId. Within one tenant, two
+ * organization-restricted users must not see or mutate each other's webhooks:
+ * the list excludes out-of-scope rows and detail/update/delete on a foreign
+ * webhook returns 404 (existence is not revealed across the org boundary).
+ */
+const MANAGE_FEATURES = ['webhooks.view', 'webhooks.manage'];
+
+test.describe('TC-WEBHOOK-007: Tenant/organization scoping isolation', () => {
+  test('should isolate webhooks between organizations within the same tenant', async ({ request }) => {
+    const adminToken = await getAuthToken(request);
+    const { tenantId, organizationId: orgA } = getTokenScope(adminToken);
+
+    let orgB: string | null = null;
+    let userA: ProvisionedWebhooksUser | null = null;
+    let userB: ProvisionedWebhooksUser | null = null;
+    let webhookA: WebhookCreateResponse | null = null;
+    let webhookB: WebhookCreateResponse | null = null;
+
+    try {
+      orgB = await createOrganizationInDb({ name: `TC-WEBHOOK-007 Org B ${Date.now()}`, tenantId });
+
+      userA = await provisionWebhooksUser(request, adminToken, {
+        tenantId,
+        organizationId: orgA,
+        features: MANAGE_FEATURES,
+        organizations: [orgA],
+        slug: 'org-a',
+      });
+      userB = await provisionWebhooksUser(request, adminToken, {
+        tenantId,
+        organizationId: orgB,
+        features: MANAGE_FEATURES,
+        organizations: [orgB],
+        slug: 'org-b',
+      });
+
+      webhookA = await createWebhookFixture(request, userA.token, {
+        name: `TC-WEBHOOK-007 A ${Date.now()}`,
+        url: 'https://example.com/webhook-org-a',
+        subscribedEvents: ['catalog.product.created'],
+      });
+      webhookB = await createWebhookFixture(request, userB.token, {
+        name: `TC-WEBHOOK-007 B ${Date.now()}`,
+        url: 'https://example.com/webhook-org-b',
+        subscribedEvents: ['catalog.product.created'],
+      });
+
+      // Lists are scoped: each user sees only their own organization's webhook.
+      const listA = await listWebhooks(request, userA.token);
+      expect(listA.items.some((item) => item.id === webhookA!.id)).toBe(true);
+      expect(listA.items.some((item) => item.id === webhookB!.id)).toBe(false);
+
+      const listB = await listWebhooks(request, userB.token);
+      expect(listB.items.some((item) => item.id === webhookB!.id)).toBe(true);
+      expect(listB.items.some((item) => item.id === webhookA!.id)).toBe(false);
+
+      // Cross-org reads/writes are not found.
+      const crossGet = await apiRequest(request, 'GET', `/api/webhooks/${webhookB.id}`, { token: userA.token });
+      expect(crossGet.status()).toBe(404);
+
+      const crossUpdate = await apiRequest(request, 'PUT', `/api/webhooks/${webhookB.id}`, {
+        token: userA.token,
+        data: { name: `TC-WEBHOOK-007 cross-org hijack ${Date.now()}` },
+      });
+      expect(crossUpdate.status()).toBe(404);
+
+      const crossDelete = await apiRequest(request, 'DELETE', `/api/webhooks/${webhookB.id}`, { token: userA.token });
+      expect(crossDelete.status()).toBe(404);
+
+      const crossGetReverse = await apiRequest(request, 'GET', `/api/webhooks/${webhookA.id}`, { token: userB.token });
+      expect(crossGetReverse.status()).toBe(404);
+
+      // In-scope access still works after the cross-org attempts.
+      const ownGet = await apiRequest(request, 'GET', `/api/webhooks/${webhookA.id}`, { token: userA.token });
+      expect(ownGet.status()).toBe(200);
+    } finally {
+      await deleteWebhookIfExists(request, userA?.token ?? null, webhookA?.id ?? null);
+      await deleteWebhookIfExists(request, userB?.token ?? null, webhookB?.id ?? null);
+      await cleanupWebhooksUser(request, adminToken, userA);
+      await cleanupWebhooksUser(request, adminToken, userB);
+      await deleteOrganizationInDb(orgB);
+    }
+  });
+});