@orthacms/webhooks-server 0.5.0

package/dist/lib/infrastructure/webhook-delivery.repository.js

@@ -0,0 +1,255 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebhookDeliveryRepository = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const database_1 = require("@orthacms/database");
+const drizzle_orm_1 = require("drizzle-orm");
+const webhook_deliveries_1 = require("./schema/webhook-deliveries");
+/** The queue and the log, over one table. */
+let WebhookDeliveryRepository = class WebhookDeliveryRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    /**
+     * Queues one delivery per endpoint, ignoring rows that already exist.
+     *
+     * `ON CONFLICT DO NOTHING` against `unique(endpoint_id, event_id)` is the
+     * whole idempotency story for fan-out: outbox delivery is at-least-once, so
+     * this subscriber may be handed the same event twice, and the second pass
+     * must be a no-op rather than a duplicate POST.
+     */
+    async enqueue(deliveries) {
+        if (deliveries.length === 0)
+            return 0;
+        const rows = await this.db
+            .insert(webhook_deliveries_1.webhookDeliveries)
+            .values(deliveries.map((delivery) => ({
+            id: delivery.id,
+            endpointId: delivery.endpointId,
+            eventId: delivery.eventId,
+            eventKind: delivery.eventKind,
+            workspaceId: delivery.workspaceId,
+            contentType: delivery.contentType,
+            payload: delivery.payload,
+            status: 'pending'
+        })))
+            .onConflictDoNothing({
+            // Names the partial index explicitly: without the predicate
+            // Postgres cannot tell which of the table's unique indexes this
+            // arbiter refers to.
+            target: [
+                webhook_deliveries_1.webhookDeliveries.endpointId,
+                webhook_deliveries_1.webhookDeliveries.eventId
+            ],
+            where: (0, drizzle_orm_1.sql) `${webhook_deliveries_1.webhookDeliveries.redeliveryOf} is null`
+        })
+            .returning({ id: webhook_deliveries_1.webhookDeliveries.id });
+        return rows.length;
+    }
+    /** Queues a single delivery and returns its id (used by redelivery). */
+    async enqueueOne(delivery) {
+        const [row] = await this.db
+            .insert(webhook_deliveries_1.webhookDeliveries)
+            .values({
+            id: delivery.id,
+            endpointId: delivery.endpointId,
+            eventId: delivery.eventId,
+            eventKind: delivery.eventKind,
+            workspaceId: delivery.workspaceId,
+            contentType: delivery.contentType,
+            payload: delivery.payload,
+            redeliveryOf: delivery.redeliveryOf ?? null,
+            status: 'pending'
+        })
+            .returning({ id: webhook_deliveries_1.webhookDeliveries.id });
+        return row.id;
+    }
+    /**
+     * Claims up to `limit` deliveries and marks them `delivering`.
+     *
+     * The transaction covers **only the claim**. That is the point of the whole
+     * design: the HTTP request happens after this returns, with nothing open,
+     * so a slow receiver cannot hold a database transaction or a pool client.
+     *
+     * `FOR UPDATE SKIP LOCKED` lets several API processes claim disjoint rows
+     * without blocking each other, exactly as the outbox drain does.
+     *
+     * Rows stuck in `delivering` past `claimTimeoutMs` are reclaimed here
+     * rather than by a separate reaper: a worker that died mid-request left the
+     * row with no error, no retry and no way out, and folding the recovery into
+     * the claim means there is one query to get right instead of two.
+     */
+    async claim(limit, claimTimeoutMs) {
+        const now = new Date();
+        const staleBefore = new Date(now.getTime() - claimTimeoutMs);
+        return this.db.transaction(async (tx) => {
+            const rows = await tx
+                .select({
+                id: webhook_deliveries_1.webhookDeliveries.id,
+                endpointId: webhook_deliveries_1.webhookDeliveries.endpointId,
+                eventId: webhook_deliveries_1.webhookDeliveries.eventId,
+                eventKind: webhook_deliveries_1.webhookDeliveries.eventKind,
+                workspaceId: webhook_deliveries_1.webhookDeliveries.workspaceId,
+                payload: webhook_deliveries_1.webhookDeliveries.payload,
+                attempts: webhook_deliveries_1.webhookDeliveries.attempts
+            })
+                .from(webhook_deliveries_1.webhookDeliveries)
+                .where((0, drizzle_orm_1.or)((0, drizzle_orm_1.and)((0, drizzle_orm_1.inArray)(webhook_deliveries_1.webhookDeliveries.status, [
+                'pending',
+                'failed'
+            ]), (0, drizzle_orm_1.or)((0, drizzle_orm_1.sql) `${webhook_deliveries_1.webhookDeliveries.nextAttemptAt} is null`, (0, drizzle_orm_1.lte)(webhook_deliveries_1.webhookDeliveries.nextAttemptAt, now))), (0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(webhook_deliveries_1.webhookDeliveries.status, 'delivering'), (0, drizzle_orm_1.lt)(webhook_deliveries_1.webhookDeliveries.claimedAt, staleBefore))))
+                .orderBy(webhook_deliveries_1.webhookDeliveries.createdAt)
+                .limit(limit)
+                .for('update', { skipLocked: true });
+            if (rows.length === 0)
+                return [];
+            await tx
+                .update(webhook_deliveries_1.webhookDeliveries)
+                .set({ status: 'delivering', claimedAt: now })
+                .where((0, drizzle_orm_1.inArray)(webhook_deliveries_1.webhookDeliveries.id, rows.map((row) => row.id)));
+            return rows;
+        });
+    }
+    /** Records a successful attempt. */
+    async markSucceeded(id, outcome) {
+        await this.db
+            .update(webhook_deliveries_1.webhookDeliveries)
+            .set({
+            status: 'succeeded',
+            attempts: (0, drizzle_orm_1.sql) `${webhook_deliveries_1.webhookDeliveries.attempts} + 1`,
+            claimedAt: null,
+            nextAttemptAt: null,
+            lastStatusCode: outcome.statusCode,
+            lastError: null,
+            responseSnippet: outcome.responseSnippet,
+            durationMs: outcome.durationMs,
+            completedAt: new Date()
+        })
+            .where((0, drizzle_orm_1.eq)(webhook_deliveries_1.webhookDeliveries.id, id));
+    }
+    /** Records a failed attempt that will be tried again at `nextAttemptAt`. */
+    async markRetrying(id, outcome, nextAttemptAt) {
+        await this.db
+            .update(webhook_deliveries_1.webhookDeliveries)
+            .set({
+            status: 'failed',
+            attempts: (0, drizzle_orm_1.sql) `${webhook_deliveries_1.webhookDeliveries.attempts} + 1`,
+            claimedAt: null,
+            nextAttemptAt,
+            lastStatusCode: outcome.statusCode,
+            lastError: outcome.error,
+            responseSnippet: outcome.responseSnippet,
+            durationMs: outcome.durationMs
+        })
+            .where((0, drizzle_orm_1.eq)(webhook_deliveries_1.webhookDeliveries.id, id));
+    }
+    /** Records a final failure — no further attempt will be made. */
+    async markDead(id, outcome) {
+        await this.db
+            .update(webhook_deliveries_1.webhookDeliveries)
+            .set({
+            status: 'dead',
+            attempts: (0, drizzle_orm_1.sql) `${webhook_deliveries_1.webhookDeliveries.attempts} + 1`,
+            claimedAt: null,
+            nextAttemptAt: null,
+            lastStatusCode: outcome.statusCode,
+            lastError: outcome.error,
+            responseSnippet: outcome.responseSnippet,
+            durationMs: outcome.durationMs,
+            completedAt: new Date()
+        })
+            .where((0, drizzle_orm_1.eq)(webhook_deliveries_1.webhookDeliveries.id, id));
+    }
+    /** One page of an endpoint's delivery log, newest first. */
+    async list(endpointId, query) {
+        const filters = [(0, drizzle_orm_1.eq)(webhook_deliveries_1.webhookDeliveries.endpointId, endpointId)];
+        if (query.status) {
+            filters.push((0, drizzle_orm_1.eq)(webhook_deliveries_1.webhookDeliveries.status, query.status));
+        }
+        if (query.eventKind) {
+            filters.push((0, drizzle_orm_1.eq)(webhook_deliveries_1.webhookDeliveries.eventKind, query.eventKind));
+        }
+        const where = (0, drizzle_orm_1.and)(...filters);
+        const [{ total }] = await this.db
+            .select({ total: (0, drizzle_orm_1.count)() })
+            .from(webhook_deliveries_1.webhookDeliveries)
+            .where(where);
+        const pageCount = Math.max(1, Math.ceil(total / query.pageSize));
+        // Clamp rather than return an empty page: the log shrinks under the
+        // reader (retention, a redelivery finishing), and a page number that
+        // was valid a second ago should show the last page, not nothing.
+        const page = Math.min(Math.max(query.page, 1), pageCount);
+        const rows = await this.db
+            .select()
+            .from(webhook_deliveries_1.webhookDeliveries)
+            .where(where)
+            .orderBy((0, drizzle_orm_1.desc)(webhook_deliveries_1.webhookDeliveries.createdAt))
+            .limit(query.pageSize)
+            .offset((page - 1) * query.pageSize);
+        return {
+            items: rows.map(toView),
+            total,
+            page,
+            pageSize: query.pageSize,
+            pageCount
+        };
+    }
+    /**
+     * One delivery with its bodies — scoped to its endpoint so an id from
+     * another endpoint reads as "not found" rather than leaking across.
+     */
+    async findDetail(endpointId, deliveryId) {
+        const [row] = await this.db
+            .select()
+            .from(webhook_deliveries_1.webhookDeliveries)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(webhook_deliveries_1.webhookDeliveries.id, deliveryId), (0, drizzle_orm_1.eq)(webhook_deliveries_1.webhookDeliveries.endpointId, endpointId)))
+            .limit(1);
+        if (!row)
+            return null;
+        return {
+            ...toView(row),
+            payload: row.payload,
+            responseSnippet: row.responseSnippet
+        };
+    }
+    /**
+     * Deletes completed rows older than `before`.
+     *
+     * Only `succeeded` and `dead` are eligible: a `failed` row is still
+     * scheduled, and a `delivering` row may be in flight.
+     */
+    async pruneCompletedBefore(before) {
+        const rows = await this.db
+            .delete(webhook_deliveries_1.webhookDeliveries)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.inArray)(webhook_deliveries_1.webhookDeliveries.status, ['succeeded', 'dead']), (0, drizzle_orm_1.isNotNull)(webhook_deliveries_1.webhookDeliveries.completedAt), (0, drizzle_orm_1.lt)(webhook_deliveries_1.webhookDeliveries.completedAt, before)))
+            .returning({ id: webhook_deliveries_1.webhookDeliveries.id });
+        return rows.length;
+    }
+};
+exports.WebhookDeliveryRepository = WebhookDeliveryRepository;
+exports.WebhookDeliveryRepository = WebhookDeliveryRepository = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__param(0, (0, database_1.InjectDatabase)()),
+    tslib_1.__metadata("design:paramtypes", [Object])
+], WebhookDeliveryRepository);
+/** Row → the API shape, minus the bodies. */
+function toView(row) {
+    return {
+        id: row.id,
+        endpointId: row.endpointId,
+        eventId: row.eventId,
+        eventKind: row.eventKind,
+        workspaceId: row.workspaceId,
+        contentType: row.contentType,
+        status: row.status,
+        attempts: row.attempts,
+        nextAttemptAt: row.nextAttemptAt?.toISOString() ?? null,
+        statusCode: row.lastStatusCode,
+        error: row.lastError,
+        durationMs: row.durationMs,
+        createdAt: row.createdAt.toISOString(),
+        completedAt: row.completedAt?.toISOString() ?? null
+    };
+}

package/dist/lib/infrastructure/webhook-delivery.worker.d.ts

@@ -0,0 +1,72 @@
+import { type OnApplicationBootstrap, type OnModuleDestroy } from '@nestjs/common';
+import type { ResolvedWebhooksConfig } from '../types/webhooks-config';
+import { WebhookDeliveryRepository } from './webhook-delivery.repository';
+import { WebhookEndpointRepository } from './webhook-endpoint.repository';
+import { WebhookHttpClient } from './webhook-http.client';
+/**
+ * Sends queued deliveries.
+ *
+ * **The one structural rule:** the claim runs in a transaction, the POST does
+ * not. `WebhookDeliveryRepository.claim` opens a short transaction, marks a
+ * batch `delivering` and commits; only then does this worker touch the network.
+ * A receiver that takes the full timeout therefore costs one row's progress,
+ * not a held pool client and not the outbox.
+ *
+ * **Why a plain interval and not a scheduler.** `OutboxDispatcher`'s poll
+ * backstop and the alarms sweep set the precedent: one timer in-process, with
+ * the work behind it made safe to run concurrently. `FOR UPDATE SKIP LOCKED`
+ * means several API processes running this take disjoint rows, so scaling out
+ * simply sends faster.
+ *
+ * Deliveries in one batch run **serially**. Twenty parallel requests would be a
+ * burst aimed at whichever receivers happen to be subscribed, and the whole
+ * point of the retry schedule's jitter is not to do that.
+ */
+export declare class WebhookDeliveryWorker implements OnApplicationBootstrap, OnModuleDestroy {
+    private readonly deliveries;
+    private readonly endpoints;
+    private readonly http;
+    private readonly config;
+    private readonly logger;
+    private timer;
+    /** The tick in flight, so shutdown can wait for it. */
+    private running;
+    private stopped;
+    /** When the retention sweep last ran, so it is not run every tick. */
+    private lastPrunedAt;
+    constructor(deliveries: WebhookDeliveryRepository, endpoints: WebhookEndpointRepository, http: WebhookHttpClient, config: ResolvedWebhooksConfig);
+    /** Arms the interval, unless delivery is switched off. */
+    onApplicationBootstrap(): void;
+    /**
+     * Stops the timer and waits for the tick in flight.
+     *
+     * Waiting matters: a tick abandoned mid-batch leaves rows in `delivering`
+     * that only the claim's stale-row recovery will free, so the deliveries it
+     * had already sent would be retried after the timeout for no reason.
+     */
+    onModuleDestroy(): Promise<void>;
+    /** One guarded tick — skips if the previous one is still going. */
+    private tick;
+    /**
+     * Claims one batch, sends each delivery, then prunes if it is time.
+     *
+     * Public because "send what is claimable now" is a real operation and not
+     * only the timer's business: a deployment that runs the sender out of
+     * process, and the e2e suites, both need to drive a batch on demand rather
+     * than waiting for an interval to come round.
+     */
+    runOnce(): Promise<void>;
+    /** Sends one delivery and records what happened. */
+    private deliver;
+    /** Counts a dead delivery against the endpoint, disabling it at the cap. */
+    private penalise;
+    /**
+     * Deletes completed deliveries past the retention window, at most once an
+     * hour.
+     *
+     * The log is the only table here that nothing else prunes; without this it
+     * grows for the life of the deployment at the rate content is edited.
+     */
+    private pruneIfDue;
+}
+//# sourceMappingURL=webhook-delivery.worker.d.ts.map

package/dist/lib/infrastructure/webhook-delivery.worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-delivery.worker.d.ts","sourceRoot":"","sources":["../../../src/lib/infrastructure/webhook-delivery.worker.ts"],"names":[],"mappings":"AAAA,OAAO,EAGH,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACvB,MAAM,gBAAgB,CAAC;AAQxB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EACH,yBAAyB,EAG5B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBACa,qBACT,YAAW,sBAAsB,EAAE,eAAe;IAW9C,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAErB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAb3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IACjE,OAAO,CAAC,KAAK,CAA+C;IAC5D,uDAAuD;IACvD,OAAO,CAAC,OAAO,CAA8B;IAC7C,OAAO,CAAC,OAAO,CAAS;IACxB,sEAAsE;IACtE,OAAO,CAAC,YAAY,CAAK;gBAGJ,UAAU,EAAE,yBAAyB,EACrC,SAAS,EAAE,yBAAyB,EACpC,IAAI,EAAE,iBAAiB,EAEvB,MAAM,EAAE,sBAAsB;IAGnD,0DAA0D;IAC1D,sBAAsB,IAAI,IAAI;IAa9B;;;;;;OAMG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAStC,mEAAmE;YACrD,IAAI;IAQlB;;;;;;;OAOG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAuB9B,oDAAoD;YACtC,OAAO;IAwFrB,4EAA4E;YAC9D,QAAQ;IAgBtB;;;;;;OAMG;YACW,UAAU;CAgB3B"}

package/dist/lib/infrastructure/webhook-delivery.worker.js

@@ -0,0 +1,216 @@
+"use strict";
+var WebhookDeliveryWorker_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebhookDeliveryWorker = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const webhooks_domain_1 = require("@orthacms/webhooks-domain");
+const webhooks_tokens_1 = require("../webhooks.tokens");
+const webhook_delivery_repository_1 = require("./webhook-delivery.repository");
+const webhook_endpoint_repository_1 = require("./webhook-endpoint.repository");
+const webhook_http_client_1 = require("./webhook-http.client");
+/**
+ * Sends queued deliveries.
+ *
+ * **The one structural rule:** the claim runs in a transaction, the POST does
+ * not. `WebhookDeliveryRepository.claim` opens a short transaction, marks a
+ * batch `delivering` and commits; only then does this worker touch the network.
+ * A receiver that takes the full timeout therefore costs one row's progress,
+ * not a held pool client and not the outbox.
+ *
+ * **Why a plain interval and not a scheduler.** `OutboxDispatcher`'s poll
+ * backstop and the alarms sweep set the precedent: one timer in-process, with
+ * the work behind it made safe to run concurrently. `FOR UPDATE SKIP LOCKED`
+ * means several API processes running this take disjoint rows, so scaling out
+ * simply sends faster.
+ *
+ * Deliveries in one batch run **serially**. Twenty parallel requests would be a
+ * burst aimed at whichever receivers happen to be subscribed, and the whole
+ * point of the retry schedule's jitter is not to do that.
+ */
+let WebhookDeliveryWorker = WebhookDeliveryWorker_1 = class WebhookDeliveryWorker {
+    deliveries;
+    endpoints;
+    http;
+    config;
+    logger = new common_1.Logger(WebhookDeliveryWorker_1.name);
+    timer = null;
+    /** The tick in flight, so shutdown can wait for it. */
+    running = null;
+    stopped = false;
+    /** When the retention sweep last ran, so it is not run every tick. */
+    lastPrunedAt = 0;
+    constructor(deliveries, endpoints, http, config) {
+        this.deliveries = deliveries;
+        this.endpoints = endpoints;
+        this.http = http;
+        this.config = config;
+    }
+    /** Arms the interval, unless delivery is switched off. */
+    onApplicationBootstrap() {
+        const interval = this.config.deliveryIntervalMs;
+        if (interval <= 0) {
+            this.logger.log('Webhook delivery is disabled (deliveryIntervalMs is 0); events will queue but nothing will be sent from this process.');
+            return;
+        }
+        this.timer = setInterval(() => void this.tick(), interval);
+        // Never hold the process open for a background sender.
+        this.timer.unref?.();
+    }
+    /**
+     * Stops the timer and waits for the tick in flight.
+     *
+     * Waiting matters: a tick abandoned mid-batch leaves rows in `delivering`
+     * that only the claim's stale-row recovery will free, so the deliveries it
+     * had already sent would be retried after the timeout for no reason.
+     */
+    async onModuleDestroy() {
+        this.stopped = true;
+        if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = null;
+        }
+        if (this.running)
+            await this.running;
+    }
+    /** One guarded tick — skips if the previous one is still going. */
+    async tick() {
+        if (this.running || this.stopped)
+            return;
+        this.running = this.runOnce().finally(() => {
+            this.running = null;
+        });
+        await this.running;
+    }
+    /**
+     * Claims one batch, sends each delivery, then prunes if it is time.
+     *
+     * Public because "send what is claimable now" is a real operation and not
+     * only the timer's business: a deployment that runs the sender out of
+     * process, and the e2e suites, both need to drive a batch on demand rather
+     * than waiting for an interval to come round.
+     */
+    async runOnce() {
+        try {
+            const claimed = await this.deliveries.claim(this.config.batchSize, this.config.claimTimeoutMs);
+            for (const delivery of claimed) {
+                if (this.stopped)
+                    break;
+                await this.deliver(delivery);
+            }
+            await this.pruneIfDue();
+        }
+        catch (error) {
+            // A failing tick must never kill the interval; the next one retries
+            // from whatever state the database is in.
+            this.logger.error('A webhook delivery tick failed', error instanceof Error ? error.stack : String(error));
+        }
+    }
+    /** Sends one delivery and records what happened. */
+    async deliver(delivery) {
+        const endpoint = await this.endpoints.findForDelivery(delivery.endpointId);
+        if (!endpoint) {
+            // The endpoint was deleted between the claim and now. The row is on
+            // its way out by cascade; closing it keeps it from being re-claimed
+            // in the meantime.
+            await this.deliveries.markDead(delivery.id, {
+                statusCode: null,
+                error: 'The endpoint was deleted before this delivery was sent.',
+                responseSnippet: null,
+                durationMs: 0
+            });
+            return;
+        }
+        if (!endpoint.enabled) {
+            // Switched off — by hand or automatically — after this row was
+            // queued. Sending anyway would defeat the switch.
+            await this.deliveries.markDead(delivery.id, {
+                statusCode: null,
+                error: 'The endpoint was disabled before this delivery was sent.',
+                responseSnippet: null,
+                durationMs: 0
+            });
+            return;
+        }
+        const attempt = delivery.attempts + 1;
+        const response = await this.http.send({
+            url: endpoint.url,
+            secret: endpoint.secret,
+            headers: endpoint.headers,
+            body: delivery.payload,
+            eventKind: delivery.eventKind,
+            deliveryId: delivery.id,
+            eventId: delivery.eventId,
+            workspaceId: delivery.workspaceId,
+            attempt
+        });
+        const outcome = {
+            statusCode: response.statusCode,
+            error: response.error,
+            responseSnippet: response.responseSnippet,
+            durationMs: response.durationMs
+        };
+        // No status at all — a timeout, a refused connection, a rejected
+        // address — is a transport failure, which is retryable in the same way
+        // a 5xx is.
+        const verdict = response.statusCode === null
+            ? { outcome: 'retry' }
+            : (0, webhooks_domain_1.classifyStatus)(response.statusCode, response.retryAfterMs);
+        if (verdict.outcome === 'succeeded') {
+            await this.deliveries.markSucceeded(delivery.id, outcome);
+            await this.endpoints.recordSuccess(endpoint.id);
+            return;
+        }
+        if (verdict.outcome === 'dead' ||
+            (0, webhooks_domain_1.isExhausted)(attempt, this.config.maxAttempts)) {
+            await this.deliveries.markDead(delivery.id, {
+                ...outcome,
+                error: verdict.outcome === 'dead'
+                    ? verdict.reason
+                    : (outcome.error ??
+                        `Gave up after ${attempt} attempts.`)
+            });
+            await this.penalise(endpoint.id, endpoint.name);
+            return;
+        }
+        const delayMs = verdict.retryAfterMs ?? (0, webhooks_domain_1.nextAttemptDelayMs)(attempt);
+        await this.deliveries.markRetrying(delivery.id, outcome, new Date(Date.now() + delayMs));
+    }
+    /** Counts a dead delivery against the endpoint, disabling it at the cap. */
+    async penalise(endpointId, endpointName) {
+        const disabled = await this.endpoints.recordFailure(endpointId, this.config.autoDisableAfter);
+        if (disabled) {
+            this.logger.warn(`Webhook endpoint "${endpointName}" (${endpointId}) was disabled after ` +
+                `${this.config.autoDisableAfter} consecutive failed deliveries.`);
+        }
+    }
+    /**
+     * Deletes completed deliveries past the retention window, at most once an
+     * hour.
+     *
+     * The log is the only table here that nothing else prunes; without this it
+     * grows for the life of the deployment at the rate content is edited.
+     */
+    async pruneIfDue() {
+        const retentionDays = this.config.retentionDays;
+        if (retentionDays <= 0)
+            return;
+        const hour = 60 * 60_000;
+        if (Date.now() - this.lastPrunedAt < hour)
+            return;
+        this.lastPrunedAt = Date.now();
+        const cutoff = new Date(Date.now() - retentionDays * 24 * hour);
+        const removed = await this.deliveries.pruneCompletedBefore(cutoff);
+        if (removed > 0) {
+            this.logger.log(`Pruned ${removed} webhook deliveries older than ${retentionDays} days.`);
+        }
+    }
+};
+exports.WebhookDeliveryWorker = WebhookDeliveryWorker;
+exports.WebhookDeliveryWorker = WebhookDeliveryWorker = WebhookDeliveryWorker_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__param(3, (0, webhooks_tokens_1.InjectWebhooksConfig)()),
+    tslib_1.__metadata("design:paramtypes", [webhook_delivery_repository_1.WebhookDeliveryRepository,
+        webhook_endpoint_repository_1.WebhookEndpointRepository,
+        webhook_http_client_1.WebhookHttpClient, Object])
+], WebhookDeliveryWorker);

package/dist/lib/infrastructure/webhook-endpoint.repository.d.ts

@@ -0,0 +1,88 @@
+import { type Database } from '@orthacms/database';
+import type { WebhookEndpointView } from '../domain/webhook-views';
+/** The fields a create or update writes. */
+export interface EndpointWriteModel {
+    name: string;
+    url: string;
+    enabled: boolean;
+    eventKinds: string[];
+    contentTypes: string[];
+    allWorkspaces: boolean;
+    workspaceIds: string[];
+    headers: Record<string, string>;
+}
+/** An endpoint as the delivery path needs it — secret included. */
+export interface EndpointWithSecret {
+    id: string;
+    name: string;
+    url: string;
+    secret: string;
+    headers: Record<string, string>;
+    enabled: boolean;
+}
+/** The subscription-relevant columns, for fan-out. */
+export interface EndpointSubscriptionRow {
+    id: string;
+    enabled: boolean;
+    allWorkspaces: boolean;
+    workspaceIds: string[];
+    eventKinds: string[];
+    contentTypes: string[];
+}
+/** Reads and writes over the two endpoint tables. */
+export declare class WebhookEndpointRepository {
+    private readonly db;
+    constructor(db: Database);
+    /**
+     * Every enabled endpoint with its workspace set, for fan-out.
+     *
+     * One query with an aggregated sub-select rather than a join: a join would
+     * return one row per workspace and force the caller to regroup, and this
+     * runs on every content write.
+     */
+    listSubscriptions(): Promise<EndpointSubscriptionRow[]>;
+    /** The endpoint the worker is about to POST to, or null when it is gone. */
+    findForDelivery(id: string): Promise<EndpointWithSecret | null>;
+    /** Every endpoint, newest first, each with its last delivery. */
+    list(): Promise<WebhookEndpointView[]>;
+    /** One endpoint, or null. */
+    findById(id: string): Promise<WebhookEndpointView | null>;
+    /**
+     * Creates an endpoint and its workspace set in one transaction, so an
+     * endpoint can never exist with half its subscription.
+     */
+    create(model: EndpointWriteModel, secret: string, createdBy: string | null): Promise<string>;
+    /** Applies a full write model to an existing endpoint. */
+    update(id: string, model: EndpointWriteModel): Promise<void>;
+    /** Rotates the signing secret. */
+    replaceSecret(id: string, secret: string): Promise<void>;
+    /** Deletes the endpoint; its workspaces and deliveries cascade. */
+    delete(id: string): Promise<void>;
+    /** Whether an endpoint with this id exists. */
+    exists(id: string): Promise<boolean>;
+    /** Clears the consecutive-failure count after a delivery succeeded. */
+    recordSuccess(id: string): Promise<void>;
+    /**
+     * Counts one dead delivery against the endpoint and switches it off once
+     * `threshold` of them have arrived in a row.
+     *
+     * The increment and the test are one statement so two workers finishing
+     * failed deliveries at the same moment cannot both read the old count and
+     * both decide not to disable.
+     *
+     * @returns whether this failure switched the endpoint off.
+     */
+    recordFailure(id: string, threshold: number): Promise<boolean>;
+    /** Replaces an endpoint's workspace rows to match `model`. */
+    private replaceWorkspaces;
+    /** Workspace ids per endpoint, for a set of endpoints. */
+    private workspacesFor;
+    /**
+     * The most recent delivery per endpoint.
+     *
+     * `DISTINCT ON` rather than a window function or N queries: one index scan
+     * over `(endpoint_id, created_at)` answers the whole list page.
+     */
+    private lastDeliveriesFor;
+}
+//# sourceMappingURL=webhook-endpoint.repository.d.ts.map

package/dist/lib/infrastructure/webhook-endpoint.repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-endpoint.repository.d.ts","sourceRoot":"","sources":["../../../src/lib/infrastructure/webhook-endpoint.repository.ts"],"names":[],"mappings":"AACA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAGnE,OAAO,KAAK,EACR,mBAAmB,EAEtB,MAAM,yBAAyB,CAAC;AAQjC,4CAA4C;AAC5C,MAAM,WAAW,kBAAkB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,mEAAmE;AACnE,MAAM,WAAW,kBAAkB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,EAAE,OAAO,CAAC;CACpB;AAED,sDAAsD;AACtD,MAAM,WAAW,uBAAuB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,OAAO,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,qDAAqD;AACrD,qBACa,yBAAyB;IACJ,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ;IAE3D;;;;;;OAMG;IACG,iBAAiB,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAyB7D,4EAA4E;IACtE,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAkBrE,iEAAiE;IAC3D,IAAI,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAuB5C,6BAA6B;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAoB/D;;;OAGG;IACG,MAAM,CACR,KAAK,EAAE,kBAAkB,EACzB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAAG,IAAI,GACzB,OAAO,CAAC,MAAM,CAAC;IAuBlB,0DAA0D;IACpD,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBlE,kCAAkC;IAC5B,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW9D,mEAAmE;IAC7D,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMvC,+CAA+C;IACzC,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAS1C,uEAAuE;IACjE,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO9C;;;;;;;;;OASG;IACG,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAepE,8DAA8D;YAChD,iBAAiB;IAqB/B,0DAA0D;YAC5C,aAAa;IAiB3B;;;;;OAKG;YACW,iBAAiB;CAgClC"}