@orthacms/webhooks-server 0.5.0

package/dist/lib/domain/webhook-secret.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SECRET_PREFIX = void 0;
+exports.generateSecret = generateSecret;
+exports.secretHint = secretHint;
+const node_crypto_1 = require("node:crypto");
+/**
+ * The prefix every signing secret carries, so one found in a log or a config
+ * file is recognisable for what it is — and so a scanner can be taught to spot
+ * a leaked one.
+ */
+exports.SECRET_PREFIX = 'whsec_';
+/** How many characters of the secret the UI may show after mint. */
+const HINT_LENGTH = 4;
+/**
+ * Mints a signing secret.
+ *
+ * 32 bytes of `randomBytes` — the same order of entropy as the API tokens, and
+ * far more than an HMAC key needs. Base64url so it survives a shell, a YAML
+ * file and an environment variable without quoting.
+ */
+function generateSecret() {
+    const secret = `${exports.SECRET_PREFIX}${(0, node_crypto_1.randomBytes)(32).toString('base64url')}`;
+    return { secret, hint: secretHint(secret) };
+}
+/**
+ * The displayable tail of a secret.
+ *
+ * Four characters is enough to tell "the one I rotated to" from "the one I
+ * replaced" and far too little to shorten a brute force against a 256-bit key.
+ */
+function secretHint(secret) {
+    return secret.slice(-HINT_LENGTH);
+}

package/dist/lib/domain/webhook-views.d.ts

@@ -0,0 +1,85 @@
+import type { DeliveryStatus } from '@orthacms/webhooks-domain';
+/**
+ * The read shapes the application layer hands to the HTTP layer.
+ *
+ * They are what the API returns, so the one rule that matters here is what is
+ * **missing**: no `secret`. It is written on mint and on rotation, returned in
+ * that one response, and never present in a shape that a `GET` can reach.
+ */
+/** An endpoint as the list and detail routes return it. */
+export interface WebhookEndpointView {
+    id: string;
+    name: string;
+    url: string;
+    /** The trailing characters of the secret. Never the secret itself. */
+    secretHint: string;
+    enabled: boolean;
+    /** Empty means every kind. */
+    eventKinds: string[];
+    /** Empty means every type. */
+    contentTypes: string[];
+    allWorkspaces: boolean;
+    /** Empty when {@link allWorkspaces} is true. */
+    workspaceIds: string[];
+    headers: Record<string, string>;
+    /** Set when the endpoint switched itself off; null otherwise. */
+    disabledReason: string | null;
+    consecutiveFailures: number;
+    createdAt: string;
+    updatedAt: string;
+    /** The most recent delivery's outcome, for the list's status column. */
+    lastDelivery: WebhookLastDeliveryView | null;
+}
+/** The one-line delivery summary shown against an endpoint in the list. */
+export interface WebhookLastDeliveryView {
+    id: string;
+    status: DeliveryStatus;
+    eventKind: string;
+    statusCode: number | null;
+    createdAt: string;
+}
+/** A delivery as the log's list route returns it — no bodies. */
+export interface WebhookDeliveryView {
+    id: string;
+    endpointId: string;
+    eventId: string;
+    eventKind: string;
+    workspaceId: string | null;
+    contentType: string | null;
+    status: DeliveryStatus;
+    attempts: number;
+    nextAttemptAt: string | null;
+    statusCode: number | null;
+    error: string | null;
+    durationMs: number | null;
+    createdAt: string;
+    completedAt: string | null;
+}
+/** A delivery with its request and response bodies, for the detail panel. */
+export interface WebhookDeliveryDetailView extends WebhookDeliveryView {
+    /** The frozen envelope — exactly what was, or will be, posted. */
+    payload: unknown;
+    /** The first couple of kilobytes of the receiver's response. */
+    responseSnippet: string | null;
+}
+/** A page of deliveries. */
+export interface WebhookDeliveryPage {
+    items: WebhookDeliveryView[];
+    total: number;
+    page: number;
+    pageSize: number;
+    pageCount: number;
+}
+/** The result of "Send test" — reported synchronously, never queued. */
+export interface WebhookTestResult {
+    /** Whether the receiver answered 2xx. */
+    ok: boolean;
+    /** The HTTP status, or null when nothing answered. */
+    statusCode: number | null;
+    /** Why it failed, when it did. */
+    error: string | null;
+    durationMs: number;
+    /** The first couple of kilobytes of the response. */
+    responseSnippet: string | null;
+}
+//# sourceMappingURL=webhook-views.d.ts.map

package/dist/lib/domain/webhook-views.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-views.d.ts","sourceRoot":"","sources":["../../../src/lib/domain/webhook-views.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE;;;;;;GAMG;AAEH,2DAA2D;AAC3D,MAAM,WAAW,mBAAmB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,8BAA8B;IAC9B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,8BAA8B;IAC9B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,gDAAgD;IAChD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,iEAAiE;IACjE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,YAAY,EAAE,uBAAuB,GAAG,IAAI,CAAC;CAChD;AAED,2EAA2E;AAC3E,MAAM,WAAW,uBAAuB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,cAAc,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,iEAAiE;AACjE,MAAM,WAAW,mBAAmB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,6EAA6E;AAC7E,MAAM,WAAW,yBAA0B,SAAQ,mBAAmB;IAClE,kEAAkE;IAClE,OAAO,EAAE,OAAO,CAAC;IACjB,gEAAgE;IAChE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,4BAA4B;AAC5B,MAAM,WAAW,mBAAmB;IAChC,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,wEAAwE;AACxE,MAAM,WAAW,iBAAiB;IAC9B,yCAAyC;IACzC,EAAE,EAAE,OAAO,CAAC;IACZ,sDAAsD;IACtD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kCAAkC;IAClC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC"}

package/dist/lib/domain/webhook-views.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/lib/http/controllers/webhook-deliveries.controller.d.ts

@@ -0,0 +1,28 @@
+import { WebhookEndpointsService } from '../../application/webhook-endpoints.service';
+import { ListDeliveriesQueryDto } from '../../application/dto/list-deliveries-query.dto';
+import type { WebhookDeliveryDetailView, WebhookDeliveryPage, WebhookDeliveryView } from '../../domain/webhook-views';
+/**
+ * The delivery log: `/api/webhooks/:id/deliveries`.
+ *
+ * Every route is scoped to the endpoint in the path, so a delivery id belonging
+ * to another endpoint reads as "not found" rather than resolving — the log is
+ * not a way to enumerate ids across endpoints.
+ */
+export declare class WebhookDeliveriesController {
+    private readonly endpoints;
+    constructor(endpoints: WebhookEndpointsService);
+    /** One page of the endpoint's log, newest first. */
+    list(endpointId: string, query: ListDeliveriesQueryDto): Promise<WebhookDeliveryPage>;
+    /** One delivery, with the body that was sent and the response. */
+    get(endpointId: string, deliveryId: string): Promise<WebhookDeliveryDetailView>;
+    /**
+     * Queues the same event again.
+     *
+     * Needs `webhooks:manage`, not `webhooks:read`: it causes an outgoing
+     * request to someone else's system, which is a write however it is spelled.
+     */
+    redeliver(endpointId: string, deliveryId: string): Promise<WebhookDeliveryView>;
+    /** Maps this plugin's not-found errors onto 404. */
+    private run;
+}
+//# sourceMappingURL=webhook-deliveries.controller.d.ts.map

package/dist/lib/http/controllers/webhook-deliveries.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-deliveries.controller.d.ts","sourceRoot":"","sources":["../../../../src/lib/http/controllers/webhook-deliveries.controller.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AAKzF,OAAO,KAAK,EACR,yBAAyB,EACzB,mBAAmB,EACnB,mBAAmB,EACtB,MAAM,4BAA4B,CAAC;AAKpC;;;;;;GAMG;AACH,qBAGa,2BAA2B;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,uBAAuB;IAE/D,oDAAoD;IAS9C,IAAI,CACsB,UAAU,EAAE,MAAM,EACrC,KAAK,EAAE,sBAAsB,GACvC,OAAO,CAAC,mBAAmB,CAAC;IAW/B,kEAAkE;IAS5D,GAAG,CACuB,UAAU,EAAE,MAAM,EACV,UAAU,EAAE,MAAM,GACvD,OAAO,CAAC,yBAAyB,CAAC;IAMrC;;;;;OAKG;IAUG,SAAS,CACiB,UAAU,EAAE,MAAM,EACV,UAAU,EAAE,MAAM,GACvD,OAAO,CAAC,mBAAmB,CAAC;IAI/B,oDAAoD;YACtC,GAAG;CAapB"}

package/dist/lib/http/controllers/webhook-deliveries.controller.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebhookDeliveriesController = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const identity_server_1 = require("@orthacms/identity-server");
+const webhook_endpoints_service_1 = require("../../application/webhook-endpoints.service");
+const list_deliveries_query_dto_1 = require("../../application/dto/list-deliveries-query.dto");
+const errors_1 = require("../../domain/errors");
+/** Default rows per page when the caller does not say. */
+const DEFAULT_PAGE_SIZE = 25;
+/**
+ * The delivery log: `/api/webhooks/:id/deliveries`.
+ *
+ * Every route is scoped to the endpoint in the path, so a delivery id belonging
+ * to another endpoint reads as "not found" rather than resolving — the log is
+ * not a way to enumerate ids across endpoints.
+ */
+let WebhookDeliveriesController = class WebhookDeliveriesController {
+    endpoints;
+    constructor(endpoints) {
+        this.endpoints = endpoints;
+    }
+    /** One page of the endpoint's log, newest first. */
+    async list(endpointId, query) {
+        return this.run(() => this.endpoints.listDeliveries(endpointId, {
+            status: query.status,
+            eventKind: query.eventKind,
+            page: query.page ?? 1,
+            pageSize: query.pageSize ?? DEFAULT_PAGE_SIZE
+        }));
+    }
+    /** One delivery, with the body that was sent and the response. */
+    async get(endpointId, deliveryId) {
+        return this.run(() => this.endpoints.getDelivery(endpointId, deliveryId));
+    }
+    /**
+     * Queues the same event again.
+     *
+     * Needs `webhooks:manage`, not `webhooks:read`: it causes an outgoing
+     * request to someone else's system, which is a write however it is spelled.
+     */
+    async redeliver(endpointId, deliveryId) {
+        return this.run(() => this.endpoints.redeliver(endpointId, deliveryId));
+    }
+    /** Maps this plugin's not-found errors onto 404. */
+    async run(operation) {
+        try {
+            return await operation();
+        }
+        catch (error) {
+            if (error instanceof errors_1.WebhookEndpointNotFoundError ||
+                error instanceof errors_1.WebhookDeliveryNotFoundError) {
+                throw new common_1.NotFoundException(error.message);
+            }
+            throw error;
+        }
+    }
+};
+exports.WebhookDeliveriesController = WebhookDeliveriesController;
+tslib_1.__decorate([
+    (0, swagger_1.ApiOperation)({
+        summary: 'List webhook deliveries',
+        description: 'One page of the endpoint’s delivery log, newest first, ' +
+            'optionally filtered by state or event kind.'
+    }),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.WEBHOOKS_READ),
+    (0, common_1.Get)(),
+    tslib_1.__param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    tslib_1.__param(1, (0, common_1.Query)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, list_deliveries_query_dto_1.ListDeliveriesQueryDto]),
+    tslib_1.__metadata("design:returntype", Promise)
+], WebhookDeliveriesController.prototype, "list", null);
+tslib_1.__decorate([
+    (0, swagger_1.ApiOperation)({
+        summary: 'Get a webhook delivery',
+        description: 'The delivery with its frozen request body and the first couple ' +
+            'of kilobytes of the response.'
+    }),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.WEBHOOKS_READ),
+    (0, common_1.Get)(':deliveryId'),
+    tslib_1.__param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    tslib_1.__param(1, (0, common_1.Param)('deliveryId', common_1.ParseUUIDPipe)),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], WebhookDeliveriesController.prototype, "get", null);
+tslib_1.__decorate([
+    (0, swagger_1.ApiOperation)({
+        summary: 'Send a delivery again',
+        description: 'Queues a fresh delivery with the same body and the same event ' +
+            'id, so a receiver that deduplicates still recognises the repeat.'
+    }),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.WEBHOOKS_MANAGE),
+    (0, common_1.UseGuards)(identity_server_1.OriginGuard),
+    (0, common_1.Post)(':deliveryId/redeliver'),
+    tslib_1.__param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    tslib_1.__param(1, (0, common_1.Param)('deliveryId', common_1.ParseUUIDPipe)),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], WebhookDeliveriesController.prototype, "redeliver", null);
+exports.WebhookDeliveriesController = WebhookDeliveriesController = tslib_1.__decorate([
+    (0, swagger_1.ApiTags)('webhooks'),
+    (0, common_1.UseGuards)(identity_server_1.PermissionsGuard),
+    (0, common_1.Controller)('webhooks/:id/deliveries'),
+    tslib_1.__metadata("design:paramtypes", [webhook_endpoints_service_1.WebhookEndpointsService])
+], WebhookDeliveriesController);

package/dist/lib/http/controllers/webhook-endpoints.controller.d.ts

@@ -0,0 +1,61 @@
+import { type PublicUser } from '@orthacms/identity-server';
+import { WebhookEndpointsService } from '../../application/webhook-endpoints.service';
+import { SaveWebhookEndpointDto } from '../../application/dto/save-webhook-endpoint.dto';
+import type { WebhookEndpointView, WebhookTestResult } from '../../domain/webhook-views';
+/** An endpoint, plus the secret — the create and rotate responses only. */
+interface EndpointWithSecretResponse {
+    endpoint: WebhookEndpointView;
+    secret: string;
+}
+/**
+ * The endpoint surface: `/api/webhooks`.
+ *
+ * Global rather than workspace-scoped, so there is no `WorkspaceGuard` here:
+ * an endpoint spans whichever workspaces it names, and which systems this
+ * installation notifies is a deployment decision. Both permissions are
+ * admin-only for the same reason — the rows hold a signing secret and reach
+ * across every workspace.
+ *
+ * `OriginGuard` is applied per write route, matching content's and alarms'
+ * controllers: these are cookie-authenticated and therefore CSRF-able, while
+ * the reads change nothing.
+ */
+export declare class WebhookEndpointsController {
+    private readonly endpoints;
+    constructor(endpoints: WebhookEndpointsService);
+    /** Every endpoint, newest first, each with its last delivery. */
+    list(): Promise<WebhookEndpointView[]>;
+    /** One endpoint. */
+    get(id: string): Promise<WebhookEndpointView>;
+    /**
+     * Creates an endpoint and mints its signing secret.
+     *
+     * **This is the only response that ever contains the secret.** Every other
+     * route returns `secretHint` instead, so a secret cannot be recovered by
+     * anyone who missed it — including whoever created it.
+     */
+    create(body: SaveWebhookEndpointDto, user: PublicUser): Promise<EndpointWithSecretResponse>;
+    /** Replaces an endpoint's configuration. */
+    update(id: string, body: SaveWebhookEndpointDto): Promise<WebhookEndpointView>;
+    /** Deletes the endpoint and its delivery log. */
+    delete(id: string): Promise<void>;
+    /** Rotates the signing secret and returns the new one, once. */
+    rotateSecret(id: string): Promise<EndpointWithSecretResponse>;
+    /**
+     * Sends a synthetic `ping` and reports the result.
+     *
+     * Synchronous and unqueued: the person who pressed the button is waiting,
+     * and it does not count against the endpoint's failure budget.
+     */
+    test(id: string): Promise<WebhookTestResult>;
+    /**
+     * Maps this plugin's domain errors onto HTTP.
+     *
+     * A rejected URL is a 422 rather than a 400 because the request was
+     * well-formed and the value was refused by policy — and the message is
+     * written to be shown in the form that produced it.
+     */
+    private run;
+}
+export {};
+//# sourceMappingURL=webhook-endpoints.controller.d.ts.map

package/dist/lib/http/controllers/webhook-endpoints.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-endpoints.controller.d.ts","sourceRoot":"","sources":["../../../../src/lib/http/controllers/webhook-endpoints.controller.ts"],"names":[],"mappings":"AAeA,OAAO,EAMH,KAAK,UAAU,EAClB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,iDAAiD,CAAC;AAEzF,OAAO,KAAK,EACR,mBAAmB,EACnB,iBAAiB,EACpB,MAAM,4BAA4B,CAAC;AAGpC,2EAA2E;AAC3E,UAAU,0BAA0B;IAChC,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;GAYG;AACH,qBAGa,0BAA0B;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,uBAAuB;IAE/D,iEAAiE;IASjE,IAAI,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAItC,oBAAoB;IAId,GAAG,CACuB,EAAE,EAAE,MAAM,GACvC,OAAO,CAAC,mBAAmB,CAAC;IAI/B;;;;;;OAMG;IAUG,MAAM,CACA,IAAI,EAAE,sBAAsB,EACrB,IAAI,EAAE,UAAU,GAChC,OAAO,CAAC,0BAA0B,CAAC;IAMtC,4CAA4C;IAUtC,MAAM,CACoB,EAAE,EAAE,MAAM,EAC9B,IAAI,EAAE,sBAAsB,GACrC,OAAO,CAAC,mBAAmB,CAAC;IAI/B,iDAAiD;IAS3C,MAAM,CAA6B,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE,gEAAgE;IAW1D,YAAY,CACc,EAAE,EAAE,MAAM,GACvC,OAAO,CAAC,0BAA0B,CAAC;IAItC;;;;;OAKG;IAWG,IAAI,CACsB,EAAE,EAAE,MAAM,GACvC,OAAO,CAAC,iBAAiB,CAAC;IAI7B;;;;;;OAMG;YACW,GAAG;CAapB"}

package/dist/lib/http/controllers/webhook-endpoints.controller.js

@@ -0,0 +1,213 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebhookEndpointsController = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const identity_server_1 = require("@orthacms/identity-server");
+const webhooks_domain_1 = require("@orthacms/webhooks-domain");
+const webhook_endpoints_service_1 = require("../../application/webhook-endpoints.service");
+const save_webhook_endpoint_dto_1 = require("../../application/dto/save-webhook-endpoint.dto");
+const errors_1 = require("../../domain/errors");
+/**
+ * The endpoint surface: `/api/webhooks`.
+ *
+ * Global rather than workspace-scoped, so there is no `WorkspaceGuard` here:
+ * an endpoint spans whichever workspaces it names, and which systems this
+ * installation notifies is a deployment decision. Both permissions are
+ * admin-only for the same reason — the rows hold a signing secret and reach
+ * across every workspace.
+ *
+ * `OriginGuard` is applied per write route, matching content's and alarms'
+ * controllers: these are cookie-authenticated and therefore CSRF-able, while
+ * the reads change nothing.
+ */
+let WebhookEndpointsController = class WebhookEndpointsController {
+    endpoints;
+    constructor(endpoints) {
+        this.endpoints = endpoints;
+    }
+    /** Every endpoint, newest first, each with its last delivery. */
+    list() {
+        return this.endpoints.list();
+    }
+    /** One endpoint. */
+    async get(id) {
+        return this.run(() => this.endpoints.get(id));
+    }
+    /**
+     * Creates an endpoint and mints its signing secret.
+     *
+     * **This is the only response that ever contains the secret.** Every other
+     * route returns `secretHint` instead, so a secret cannot be recovered by
+     * anyone who missed it — including whoever created it.
+     */
+    async create(body, user) {
+        return this.run(() => this.endpoints.create(toWriteModel(body), user.id));
+    }
+    /** Replaces an endpoint's configuration. */
+    async update(id, body) {
+        return this.run(() => this.endpoints.update(id, toWriteModel(body)));
+    }
+    /** Deletes the endpoint and its delivery log. */
+    async delete(id) {
+        await this.run(() => this.endpoints.delete(id));
+    }
+    /** Rotates the signing secret and returns the new one, once. */
+    async rotateSecret(id) {
+        return this.run(() => this.endpoints.rotateSecret(id));
+    }
+    /**
+     * Sends a synthetic `ping` and reports the result.
+     *
+     * Synchronous and unqueued: the person who pressed the button is waiting,
+     * and it does not count against the endpoint's failure budget.
+     */
+    async test(id) {
+        return this.run(() => this.endpoints.sendTest(id));
+    }
+    /**
+     * Maps this plugin's domain errors onto HTTP.
+     *
+     * A rejected URL is a 422 rather than a 400 because the request was
+     * well-formed and the value was refused by policy — and the message is
+     * written to be shown in the form that produced it.
+     */
+    async run(operation) {
+        try {
+            return await operation();
+        }
+        catch (error) {
+            if (error instanceof errors_1.WebhookEndpointNotFoundError) {
+                throw new common_1.NotFoundException(error.message);
+            }
+            if (error instanceof webhooks_domain_1.WebhookUrlRejectedError) {
+                throw new common_1.UnprocessableEntityException(error.message);
+            }
+            throw error;
+        }
+    }
+};
+exports.WebhookEndpointsController = WebhookEndpointsController;
+tslib_1.__decorate([
+    (0, swagger_1.ApiOperation)({
+        summary: 'List webhook endpoints',
+        description: 'Every configured endpoint with its filters and the outcome of ' +
+            'its most recent delivery. Never includes the signing secret.'
+    }),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.WEBHOOKS_READ),
+    (0, common_1.Get)(),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], WebhookEndpointsController.prototype, "list", null);
+tslib_1.__decorate([
+    (0, swagger_1.ApiOperation)({ summary: 'Get a webhook endpoint' }),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.WEBHOOKS_READ),
+    (0, common_1.Get)(':id'),
+    tslib_1.__param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], WebhookEndpointsController.prototype, "get", null);
+tslib_1.__decorate([
+    (0, swagger_1.ApiOperation)({
+        summary: 'Create a webhook endpoint',
+        description: 'Creates the endpoint and returns its signing secret. The secret ' +
+            'is shown once and is never returned again.'
+    }),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.WEBHOOKS_MANAGE),
+    (0, common_1.UseGuards)(identity_server_1.OriginGuard),
+    (0, common_1.Post)(),
+    tslib_1.__param(0, (0, common_1.Body)()),
+    tslib_1.__param(1, (0, identity_server_1.CurrentUser)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [save_webhook_endpoint_dto_1.SaveWebhookEndpointDto, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], WebhookEndpointsController.prototype, "create", null);
+tslib_1.__decorate([
+    (0, swagger_1.ApiOperation)({
+        summary: 'Update a webhook endpoint',
+        description: 'Replaces the endpoint’s configuration. Re-enabling it by hand ' +
+            'also clears an automatic disable and its failure count.'
+    }),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.WEBHOOKS_MANAGE),
+    (0, common_1.UseGuards)(identity_server_1.OriginGuard),
+    (0, common_1.Patch)(':id'),
+    tslib_1.__param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    tslib_1.__param(1, (0, common_1.Body)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, save_webhook_endpoint_dto_1.SaveWebhookEndpointDto]),
+    tslib_1.__metadata("design:returntype", Promise)
+], WebhookEndpointsController.prototype, "update", null);
+tslib_1.__decorate([
+    (0, swagger_1.ApiOperation)({
+        summary: 'Delete a webhook endpoint',
+        description: 'Deletes the endpoint and, with it, its delivery log.'
+    }),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.WEBHOOKS_MANAGE),
+    (0, common_1.UseGuards)(identity_server_1.OriginGuard),
+    (0, common_1.Delete)(':id'),
+    (0, common_1.HttpCode)(204),
+    tslib_1.__param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], WebhookEndpointsController.prototype, "delete", null);
+tslib_1.__decorate([
+    (0, swagger_1.ApiOperation)({
+        summary: 'Rotate a webhook signing secret',
+        description: 'Mints a new signing secret and returns it once. It takes effect ' +
+            'immediately, including for deliveries already queued, so the ' +
+            'receiver needs it in place before rotating.'
+    }),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.WEBHOOKS_MANAGE),
+    (0, common_1.UseGuards)(identity_server_1.OriginGuard),
+    (0, common_1.Post)(':id/secret'),
+    tslib_1.__param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], WebhookEndpointsController.prototype, "rotateSecret", null);
+tslib_1.__decorate([
+    (0, swagger_1.ApiOperation)({
+        summary: 'Send a test delivery',
+        description: 'Posts a synthetic `ping` event and reports the response. It is ' +
+            'not queued and does not count towards automatic disabling.'
+    }),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.WEBHOOKS_MANAGE),
+    (0, common_1.UseGuards)(identity_server_1.OriginGuard),
+    (0, common_1.Post)(':id/test'),
+    (0, common_1.HttpCode)(200),
+    tslib_1.__param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], WebhookEndpointsController.prototype, "test", null);
+exports.WebhookEndpointsController = WebhookEndpointsController = tslib_1.__decorate([
+    (0, swagger_1.ApiTags)('webhooks'),
+    (0, common_1.UseGuards)(identity_server_1.PermissionsGuard),
+    (0, common_1.Controller)('webhooks'),
+    tslib_1.__metadata("design:paramtypes", [webhook_endpoints_service_1.WebhookEndpointsService])
+], WebhookEndpointsController);
+/**
+ * DTO → the repository's write model, resolving what an omitted field means.
+ *
+ * Every default here says "everything": an omitted filter is not an empty
+ * subscription, it is an unfiltered one. The one exception is `allWorkspaces`,
+ * which defaults to false — "all workspaces" reaches across tenants and should
+ * be something someone chose, not something they forgot to say.
+ */
+function toWriteModel(dto) {
+    const allWorkspaces = dto.allWorkspaces ?? false;
+    return {
+        name: dto.name.trim(),
+        url: dto.url.trim(),
+        enabled: dto.enabled ?? true,
+        eventKinds: dto.eventKinds ?? [],
+        contentTypes: dto.contentTypes ?? [],
+        allWorkspaces,
+        workspaceIds: allWorkspaces ? [] : (dto.workspaceIds ?? []),
+        headers: dto.headers ?? {}
+    };
+}

package/dist/lib/http/controllers/webhook-events.controller.d.ts

@@ -0,0 +1,13 @@
+import { type WebhookEventDescriptor } from '@orthacms/webhooks-domain';
+/**
+ * `GET /api/webhook-events` — the catalogue of subscribable event kinds.
+ *
+ * The admin's event picker is built from this rather than from a list compiled
+ * into the SPA, so a deployment running a newer server offers the kinds that
+ * server actually knows about. Same idea as `GET /api/content-schema`.
+ */
+export declare class WebhookEventsController {
+    /** Every kind an endpoint may subscribe to. */
+    list(): readonly WebhookEventDescriptor[];
+}
+//# sourceMappingURL=webhook-events.controller.d.ts.map

package/dist/lib/http/controllers/webhook-events.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-events.controller.d.ts","sourceRoot":"","sources":["../../../../src/lib/http/controllers/webhook-events.controller.ts"],"names":[],"mappings":"AAOA,OAAO,EAEH,KAAK,sBAAsB,EAC9B,MAAM,2BAA2B,CAAC;AAEnC;;;;;;GAMG;AACH,qBAGa,uBAAuB;IAChC,+CAA+C;IAQ/C,IAAI,IAAI,SAAS,sBAAsB,EAAE;CAG5C"}

package/dist/lib/http/controllers/webhook-events.controller.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebhookEventsController = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const identity_server_1 = require("@orthacms/identity-server");
+const webhooks_domain_1 = require("@orthacms/webhooks-domain");
+/**
+ * `GET /api/webhook-events` — the catalogue of subscribable event kinds.
+ *
+ * The admin's event picker is built from this rather than from a list compiled
+ * into the SPA, so a deployment running a newer server offers the kinds that
+ * server actually knows about. Same idea as `GET /api/content-schema`.
+ */
+let WebhookEventsController = class WebhookEventsController {
+    /** Every kind an endpoint may subscribe to. */
+    list() {
+        return webhooks_domain_1.WEBHOOK_EVENTS;
+    }
+};
+exports.WebhookEventsController = WebhookEventsController;
+tslib_1.__decorate([
+    (0, swagger_1.ApiOperation)({
+        summary: 'List subscribable webhook events',
+        description: 'The catalogue the endpoint editor’s event picker is built from.'
+    }),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.WEBHOOKS_READ),
+    (0, common_1.Get)(),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Array)
+], WebhookEventsController.prototype, "list", null);
+exports.WebhookEventsController = WebhookEventsController = tslib_1.__decorate([
+    (0, swagger_1.ApiTags)('webhooks'),
+    (0, common_1.UseGuards)(identity_server_1.PermissionsGuard),
+    (0, common_1.Controller)('webhook-events')
+], WebhookEventsController);

package/dist/lib/infrastructure/event-mapping.d.ts

@@ -0,0 +1,13 @@
+import type { DomainEvent } from '@orthacms/database';
+import type { WebhookRoutableEvent, WebhookSourceEvent } from '@orthacms/webhooks-domain';
+/** The routing facts, for the subscription filters. */
+export declare function toRoutableEvent(event: DomainEvent): WebhookRoutableEvent;
+/**
+ * The full source event, for the envelope.
+ *
+ * `actor` and `workspaceId` are lifted out of the payload into the envelope's
+ * own fields, so `data` carries what the event kind is *about* and nothing that
+ * every event has.
+ */
+export declare function toSourceEvent(event: DomainEvent): WebhookSourceEvent;
+//# sourceMappingURL=event-mapping.d.ts.map

package/dist/lib/infrastructure/event-mapping.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-mapping.d.ts","sourceRoot":"","sources":["../../../src/lib/infrastructure/event-mapping.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAER,oBAAoB,EACpB,kBAAkB,EACrB,MAAM,2BAA2B,CAAC;AAcnC,uDAAuD;AACvD,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,oBAAoB,CAMxE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,kBAAkB,CAgBpE"}