@openwop/openwop-conformance 1.68.0 → 1.68.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openwop/openwop-conformance",
-  "version": "1.68.0",
+  "version": "1.68.1",
   "description": "Production-ready black-box conformance suite for OpenWOP v1.0 compliant servers.",
   "repository": {
     "type": "git",

package/src/lib/webhook-receiver.ts

@@ -135,3 +135,26 @@ export function signPayload(
     algorithmHeader: 'v1',
   };
 }
+
+/**
+ * Discover a tenant the calling bearer provably OWNS, by creating a probe run
+ * and reading `owner.tenantId` off its snapshot (RFC 0048). A host that scopes
+ * webhook subscriptions by tenant membership (RFC 0093) 403s a `tenantId` the
+ * bearer is not a member of — so a hard-coded tenant is wrong; the only portable
+ * owned tenant is the one on a run the bearer just created. Returns `undefined`
+ * for a single-tenant host (which omits `owner.tenantId`) or when no probe
+ * fixture is available — callers then omit `tenantId`, which single-tenant hosts
+ * accept. (RFC 0093 / webhooks.md §Register; suite defect fixed 2026-08-09.)
+ */
+export async function discoverOwnedTenant(
+  driver: { post: (p: string, b: unknown) => Promise<{ status: number; json: unknown }>; get: (p: string) => Promise<{ status: number; json: unknown }> },
+  probeWorkflowId = 'conformance-noop',
+): Promise<string | undefined> {
+  const create = await driver.post('/v1/runs', { workflowId: probeWorkflowId });
+  if (create.status !== 201) return undefined;
+  const runId = (create.json as { runId?: string } | null)?.runId;
+  if (typeof runId !== 'string') return undefined;
+  const snap = await driver.get(`/v1/runs/${encodeURIComponent(runId)}`);
+  const owner = (snap.json as { owner?: { tenantId?: unknown } } | null)?.owner;
+  return typeof owner?.tenantId === 'string' ? owner.tenantId : undefined;
+}

package/src/scenarios/webhook-negative.test.ts

@@ -22,6 +22,7 @@
 
 import { describe, it, expect } from 'vitest';
 import { driver } from '../lib/driver.js';
+import { discoverOwnedTenant } from '../lib/webhook-receiver.js';
 
 async function isWebhookSupported(): Promise<boolean> {
   const disco = await driver.get('/.well-known/openwop');
@@ -40,10 +41,11 @@ describe('webhook-negative: SSRF guard rejects private destinations', () => {
     // Spec-complete except for the private URL, so validation passes and the
     // request reaches the SSRF guard. `{ url }` alone 400s `validation_error`
     // (missing `events`) before the guard runs. (Suite defect, fixed 2026-08-09.)
+    const ownedTenant = await discoverOwnedTenant(driver);
     const reg = await driver.post('/v1/webhooks', {
       url: 'http://127.0.0.1:65535/',
       events: ['run.completed'],
-      tenantId: 'conformance-tenant',
+      ...(ownedTenant ? { tenantId: ownedTenant } : {}),
     });
     if (reg.status === 201) {
       // Host accepted — SSRF guard not implemented or bypassed.

package/src/scenarios/webhook-signed-delivery.test.ts

@@ -29,6 +29,7 @@ import { createServer, type IncomingMessage, type Server, type ServerResponse }
 import { driver } from '../lib/driver.js';
 import { pollUntilTerminal } from '../lib/polling.js';
 import { isFixtureAdvertised } from '../lib/fixtures.js';
+import { discoverOwnedTenant } from '../lib/webhook-receiver.js';
 
 interface DeliveredRequest {
   readonly headers: Record<string, string>;
@@ -93,10 +94,14 @@ describe('webhook-signed-delivery: end-to-end HMAC v1', () => {
     // The pre-fix `{ url }`-only body 400s on validation before delivery can occur.
     // (Suite defect, fixed 2026-08-09.) The delivered run's tenant must match this
     // subscription's tenantId — verified end-to-end against the openwop-app host.
+    // Derive a tenant the bearer OWNS from a probe run's snapshot — a hard-coded
+    // tenantId is 403'd by a host that scopes subscriptions by membership
+    // (RFC 0093). Single-tenant hosts return undefined ⇒ omit tenantId.
+    const ownedTenant = await discoverOwnedTenant(driver);
     const reg = await driver.post('/v1/webhooks', {
       url: receiver.url,
       events: ['run.completed'],
-      tenantId: 'conformance-tenant',
+      ...(ownedTenant ? { tenantId: ownedTenant } : {}),
     });
 
     // SSRF guard skip: if the host rejects loopback destinations,