@rytass/bpm-core-nestjs-module 0.13.2 → 0.13.4

package/src/lib/workflow-webhook/workflow-webhook-endpoint-admin.resolver.js

@@ -0,0 +1,159 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkflowWebhookEndpointAdminResolver = void 0;
+const tslib_1 = require("tslib");
+const graphql_1 = require("@nestjs/graphql");
+const bpm_auth_1 = require("../bpm-auth");
+const workflow_webhook_endpoint_admin_dto_1 = require("./workflow-webhook-endpoint-admin.dto");
+const workflow_webhook_endpoint_admin_service_1 = require("./workflow-webhook-endpoint-admin.service");
+const workflow_webhook_queries_1 = require("./workflow-webhook.queries");
+const workflow_webhook_service_1 = require("./workflow-webhook.service");
+/**
+ * Database webhook endpoint management (ADR 18 §3.13), administrators only.
+ * Every object is mapped field by field, so an encrypted column cannot ride
+ * along into a response.
+ */
+let WorkflowWebhookEndpointAdminResolver = class WorkflowWebhookEndpointAdminResolver {
+    constructor(adminService, webhookService) {
+        this.adminService = adminService;
+        this.webhookService = webhookService;
+    }
+    workflowWebhookEndpointManagement() {
+        return Object.assign(new workflow_webhook_endpoint_admin_dto_1.WorkflowWebhookEndpointManagementObject(), {
+            allowedUrlPatterns: this.webhookService
+                .readOptions()
+                .allowedUrlPatterns.map((pattern) => pattern.source),
+            enabled: this.adminService.isEnabled(),
+        });
+    }
+    async workflowWebhookManagedEndpoints() {
+        return (await this.adminService.list()).map((row) => this.toObject(row));
+    }
+    async workflowWebhookEndpointAudits(endpointId) {
+        return (await this.adminService.listAudits(endpointId)).map((row) => toAuditObject(row));
+    }
+    async createWorkflowWebhookEndpoint(input, currentMemberId) {
+        return this.toObject(await this.adminService.create(input, currentMemberId ?? null));
+    }
+    async updateWorkflowWebhookEndpoint(input, currentMemberId) {
+        const { id, ...data } = input;
+        return this.toObject(await this.adminService.update(id, data, currentMemberId ?? null));
+    }
+    async setWorkflowWebhookEndpointActive(id, active, currentMemberId) {
+        return this.toObject(await this.adminService.setActive(id, active, currentMemberId ?? null));
+    }
+    /** `signingSecret: null` stops signing. The new value is never returned. */
+    async rotateWorkflowWebhookEndpointSecret(id, signingSecret, currentMemberId) {
+        return this.toObject(await this.adminService.rotateSecret(id, signingSecret, currentMemberId ?? null));
+    }
+    async testWorkflowWebhookEndpoint(id, currentMemberId) {
+        return Object.assign(new workflow_webhook_endpoint_admin_dto_1.WorkflowWebhookEndpointTestResultObject(), await this.adminService.testSend(id, currentMemberId ?? null));
+    }
+    toObject(row) {
+        return Object.assign(new workflow_webhook_endpoint_admin_dto_1.WorkflowWebhookManagedEndpointObject(), {
+            active: row.isActive,
+            createdAt: row.createdAt,
+            createdByMemberId: row.createdByMemberId,
+            deprecated: row.deprecated,
+            description: row.description,
+            hasSigningSecret: Boolean(row.encryptedSigningSecret),
+            headerNames: (0, workflow_webhook_endpoint_admin_service_1.readWorkflowWebhookHeaderNames)(row, this.webhookService.readOptions().secretEncryptionKey),
+            id: row.id,
+            key: row.key,
+            label: row.label,
+            method: row.method,
+            parameters: row.parameters.map((parameter) => Object.assign(new workflow_webhook_queries_1.WorkflowWebhookParameterObject(), {
+                description: parameter.description ?? null,
+                key: parameter.key,
+                label: parameter.label,
+                required: parameter.required,
+                type: parameter.type,
+            })),
+            secretRotatedAt: row.secretRotatedAt,
+            timeoutMs: row.timeoutMs,
+            updatedAt: row.updatedAt,
+            updatedByMemberId: row.updatedByMemberId,
+            url: row.url,
+            version: row.version,
+        });
+    }
+};
+exports.WorkflowWebhookEndpointAdminResolver = WorkflowWebhookEndpointAdminResolver;
+tslib_1.__decorate([
+    (0, graphql_1.Query)(() => workflow_webhook_endpoint_admin_dto_1.WorkflowWebhookEndpointManagementObject),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", workflow_webhook_endpoint_admin_dto_1.WorkflowWebhookEndpointManagementObject)
+], WorkflowWebhookEndpointAdminResolver.prototype, "workflowWebhookEndpointManagement", null);
+tslib_1.__decorate([
+    (0, graphql_1.Query)(() => [workflow_webhook_endpoint_admin_dto_1.WorkflowWebhookManagedEndpointObject]),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], WorkflowWebhookEndpointAdminResolver.prototype, "workflowWebhookManagedEndpoints", null);
+tslib_1.__decorate([
+    (0, graphql_1.Query)(() => [workflow_webhook_endpoint_admin_dto_1.WorkflowWebhookEndpointAuditObject]),
+    tslib_1.__param(0, (0, graphql_1.Args)('endpointId', { type: () => graphql_1.ID })),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], WorkflowWebhookEndpointAdminResolver.prototype, "workflowWebhookEndpointAudits", null);
+tslib_1.__decorate([
+    (0, graphql_1.Mutation)(() => workflow_webhook_endpoint_admin_dto_1.WorkflowWebhookManagedEndpointObject),
+    tslib_1.__param(0, (0, graphql_1.Args)('input')),
+    tslib_1.__param(1, (0, bpm_auth_1.BPMCurrentMemberId)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [workflow_webhook_endpoint_admin_dto_1.CreateWorkflowWebhookEndpointInput, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], WorkflowWebhookEndpointAdminResolver.prototype, "createWorkflowWebhookEndpoint", null);
+tslib_1.__decorate([
+    (0, graphql_1.Mutation)(() => workflow_webhook_endpoint_admin_dto_1.WorkflowWebhookManagedEndpointObject),
+    tslib_1.__param(0, (0, graphql_1.Args)('input')),
+    tslib_1.__param(1, (0, bpm_auth_1.BPMCurrentMemberId)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [workflow_webhook_endpoint_admin_dto_1.UpdateWorkflowWebhookEndpointInput, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], WorkflowWebhookEndpointAdminResolver.prototype, "updateWorkflowWebhookEndpoint", null);
+tslib_1.__decorate([
+    (0, graphql_1.Mutation)(() => workflow_webhook_endpoint_admin_dto_1.WorkflowWebhookManagedEndpointObject),
+    tslib_1.__param(0, (0, graphql_1.Args)('id', { type: () => graphql_1.ID })),
+    tslib_1.__param(1, (0, graphql_1.Args)('active')),
+    tslib_1.__param(2, (0, bpm_auth_1.BPMCurrentMemberId)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, Boolean, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], WorkflowWebhookEndpointAdminResolver.prototype, "setWorkflowWebhookEndpointActive", null);
+tslib_1.__decorate([
+    (0, graphql_1.Mutation)(() => workflow_webhook_endpoint_admin_dto_1.WorkflowWebhookManagedEndpointObject),
+    tslib_1.__param(0, (0, graphql_1.Args)('id', { type: () => graphql_1.ID })),
+    tslib_1.__param(1, (0, graphql_1.Args)('signingSecret', { nullable: true, type: () => String })),
+    tslib_1.__param(2, (0, bpm_auth_1.BPMCurrentMemberId)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, Object, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], WorkflowWebhookEndpointAdminResolver.prototype, "rotateWorkflowWebhookEndpointSecret", null);
+tslib_1.__decorate([
+    (0, graphql_1.Mutation)(() => workflow_webhook_endpoint_admin_dto_1.WorkflowWebhookEndpointTestResultObject),
+    tslib_1.__param(0, (0, graphql_1.Args)('id', { type: () => graphql_1.ID })),
+    tslib_1.__param(1, (0, bpm_auth_1.BPMCurrentMemberId)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], WorkflowWebhookEndpointAdminResolver.prototype, "testWorkflowWebhookEndpoint", null);
+exports.WorkflowWebhookEndpointAdminResolver = WorkflowWebhookEndpointAdminResolver = tslib_1.__decorate([
+    (0, graphql_1.Resolver)(),
+    (0, bpm_auth_1.BPMAdminOnly)(),
+    tslib_1.__metadata("design:paramtypes", [workflow_webhook_endpoint_admin_service_1.WorkflowWebhookEndpointAdminService,
+        workflow_webhook_service_1.WorkflowWebhookService])
+], WorkflowWebhookEndpointAdminResolver);
+function toAuditObject(row) {
+    return Object.assign(new workflow_webhook_endpoint_admin_dto_1.WorkflowWebhookEndpointAuditObject(), {
+        action: row.action,
+        actorMemberId: row.actorMemberId,
+        changedFields: row.changedFields,
+        createdAt: row.createdAt,
+        endpointId: row.endpointId,
+        id: row.id,
+    });
+}
+//# sourceMappingURL=workflow-webhook-endpoint-admin.resolver.js.map

package/src/lib/workflow-webhook/workflow-webhook-endpoint-admin.resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-webhook-endpoint-admin.resolver.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/workflow-webhook/workflow-webhook-endpoint-admin.resolver.ts"],"names":[],"mappings":";;;;AAAA,6CAAsE;AACtE,0CAA+D;AAC/D,+FAO+C;AAC/C,uGAGmD;AAKnD,yEAA4E;AAC5E,yEAAoE;AAEpE;;;;GAIG;AAGI,IAAM,oCAAoC,GAA1C,MAAM,oCAAoC;IAC/C,YACmB,YAAiD,EACjD,cAAsC;QADtC,iBAAY,GAAZ,YAAY,CAAqC;QACjD,mBAAc,GAAd,cAAc,CAAwB;IACtD,CAAC;IAGJ,iCAAiC;QAC/B,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,6EAAuC,EAAE,EAAE;YAClE,kBAAkB,EAAE,IAAI,CAAC,cAAc;iBACpC,WAAW,EAAE;iBACb,kBAAkB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;YACtD,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE;SACvC,CAAC,CAAC;IACL,CAAC;IAGK,AAAN,KAAK,CAAC,+BAA+B;QAGnC,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC;IAGK,AAAN,KAAK,CAAC,6BAA6B,CACO,UAAkB;QAE1D,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAClE,aAAa,CAAC,GAAG,CAAC,CACnB,CAAC;IACJ,CAAC;IAGK,AAAN,KAAK,CAAC,6BAA6B,CAClB,KAAyC,EAClC,eAA+B;QAErD,OAAO,IAAI,CAAC,QAAQ,CAClB,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,eAAe,IAAI,IAAI,CAAC,CAC/D,CAAC;IACJ,CAAC;IAGK,AAAN,KAAK,CAAC,6BAA6B,CAClB,KAAyC,EAClC,eAA+B;QAErD,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QAE9B,OAAO,IAAI,CAAC,QAAQ,CAClB,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,eAAe,IAAI,IAAI,CAAC,CAClE,CAAC;IACJ,CAAC;IAGK,AAAN,KAAK,CAAC,gCAAgC,CACJ,EAAU,EAC1B,MAAe,EACT,eAA+B;QAErD,OAAO,IAAI,CAAC,QAAQ,CAClB,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,IAAI,IAAI,CAAC,CACvE,CAAC;IACJ,CAAC;IAED,4EAA4E;IAEtE,AAAN,KAAK,CAAC,mCAAmC,CACP,EAAU,EAE1C,aAA4B,EACN,eAA+B;QAErD,OAAO,IAAI,CAAC,QAAQ,CAClB,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAClC,EAAE,EACF,aAAa,EACb,eAAe,IAAI,IAAI,CACxB,CACF,CAAC;IACJ,CAAC;IAGK,AAAN,KAAK,CAAC,2BAA2B,CACC,EAAU,EACpB,eAA+B;QAErD,OAAO,MAAM,CAAC,MAAM,CAClB,IAAI,6EAAuC,EAAE,EAC7C,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,EAAE,eAAe,IAAI,IAAI,CAAC,CAC9D,CAAC;IACJ,CAAC;IAEO,QAAQ,CACd,GAAkC;QAElC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,0EAAoC,EAAE,EAAE;YAC/D,MAAM,EAAE,GAAG,CAAC,QAAQ;YACpB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;YACrD,WAAW,EAAE,IAAA,wEAA8B,EACzC,GAAG,EACH,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,mBAAmB,CACtD;YACD,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC3C,MAAM,CAAC,MAAM,CAAC,IAAI,yDAA8B,EAAE,EAAE;gBAClD,WAAW,EAAE,SAAS,CAAC,WAAW,IAAI,IAAI;gBAC1C,GAAG,EAAE,SAAS,CAAC,GAAG;gBAClB,KAAK,EAAE,SAAS,CAAC,KAAK;gBACtB,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,IAAI,EAAE,SAAS,CAAC,IAAI;aACrB,CAAC,CACH;YACD,eAAe,EAAE,GAAG,CAAC,eAAe;YACpC,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,OAAO,EAAE,GAAG,CAAC,OAAO;SACrB,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAhIY,oFAAoC;AAO/C;IADC,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,6EAAuC,CAAC;;;4CAChB,6EAAuC;6FAO3E;AAGK;IADL,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,CAAC,0EAAoC,CAAC,CAAC;;;;2FAKnD;AAGK;IADL,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,CAAC,wEAAkC,CAAC,CAAC;IAE/C,mBAAA,IAAA,cAAI,EAAC,YAAY,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,YAAE,EAAE,CAAC,CAAA;;;;yFAKxC;AAGK;IADL,IAAA,kBAAQ,EAAC,GAAG,EAAE,CAAC,0EAAoC,CAAC;IAElD,mBAAA,IAAA,cAAI,EAAC,OAAO,CAAC,CAAA;IACb,mBAAA,IAAA,6BAAkB,GAAE,CAAA;;6CADC,wEAAkC;;yFAMzD;AAGK;IADL,IAAA,kBAAQ,EAAC,GAAG,EAAE,CAAC,0EAAoC,CAAC;IAElD,mBAAA,IAAA,cAAI,EAAC,OAAO,CAAC,CAAA;IACb,mBAAA,IAAA,6BAAkB,GAAE,CAAA;;6CADC,wEAAkC;;yFAQzD;AAGK;IADL,IAAA,kBAAQ,EAAC,GAAG,EAAE,CAAC,0EAAoC,CAAC;IAElD,mBAAA,IAAA,cAAI,EAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,YAAE,EAAE,CAAC,CAAA;IAC9B,mBAAA,IAAA,cAAI,EAAC,QAAQ,CAAC,CAAA;IACd,mBAAA,IAAA,6BAAkB,GAAE,CAAA;;;;4FAKtB;AAIK;IADL,IAAA,kBAAQ,EAAC,GAAG,EAAE,CAAC,0EAAoC,CAAC;IAElD,mBAAA,IAAA,cAAI,EAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,YAAE,EAAE,CAAC,CAAA;IAC9B,mBAAA,IAAA,cAAI,EAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAA;IAE7D,mBAAA,IAAA,6BAAkB,GAAE,CAAA;;;;+FAStB;AAGK;IADL,IAAA,kBAAQ,EAAC,GAAG,EAAE,CAAC,6EAAuC,CAAC;IAErD,mBAAA,IAAA,cAAI,EAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,YAAE,EAAE,CAAC,CAAA;IAC9B,mBAAA,IAAA,6BAAkB,GAAE,CAAA;;;;uFAMtB;+CA3FU,oCAAoC;IAFhD,IAAA,kBAAQ,GAAE;IACV,IAAA,uBAAY,GAAE;6CAGoB,6EAAmC;QACjC,iDAAsB;GAH9C,oCAAoC,CAgIhD;AAED,SAAS,aAAa,CACpB,GAAuC;IAEvC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,wEAAkC,EAAE,EAAE;QAC7D,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,EAAE,EAAE,GAAG,CAAC,EAAE;KACX,CAAC,CAAC;AACL,CAAC"}

package/src/lib/workflow-webhook/workflow-webhook-endpoint-admin.service.d.ts

@@ -0,0 +1,93 @@
+import { NotifyWebhookParameterType } from '@rytass/bpm-core-shared/workflow';
+import { Repository } from 'typeorm';
+import { DatabaseWorkflowWebhookEndpointSource } from './workflow-webhook-database-source';
+import { WorkflowWebhookDeliveryService, WorkflowWebhookTestOutcome } from './workflow-webhook-delivery.service';
+import { WorkflowWebhookEndpointAuditEntity, WorkflowWebhookEndpointEntity } from './workflow-webhook-endpoint.entity';
+import { BPMResolvedWorkflowWebhookOptions } from './workflow-webhook-options';
+import { WorkflowWebhookService } from './workflow-webhook.service';
+export interface WorkflowWebhookEndpointHeaderData {
+    readonly name: string;
+    readonly value: string;
+}
+export interface WorkflowWebhookEndpointParameterData {
+    readonly description?: string | null;
+    readonly key: string;
+    readonly label: string;
+    readonly required: boolean;
+    readonly type: NotifyWebhookParameterType;
+}
+export interface CreateWorkflowWebhookEndpointData {
+    readonly deprecated?: boolean | null;
+    readonly description?: string | null;
+    readonly headers?: readonly WorkflowWebhookEndpointHeaderData[] | null;
+    readonly key: string;
+    readonly label: string;
+    readonly method?: string | null;
+    readonly parameters: readonly WorkflowWebhookEndpointParameterData[];
+    readonly signingSecret?: string | null;
+    readonly timeoutMs?: number | null;
+    readonly url: string;
+    readonly version: number;
+}
+/**
+ * Omitted fields stay as they are. `headers` replaces the whole set when
+ * given — values are write-only, so there is nothing to merge into — and
+ * `parameters` must match the stored contract (a change needs a new version).
+ */
+export interface UpdateWorkflowWebhookEndpointData {
+    readonly deprecated?: boolean | null;
+    readonly description?: string | null;
+    readonly headers?: readonly WorkflowWebhookEndpointHeaderData[] | null;
+    readonly label?: string | null;
+    readonly method?: string | null;
+    readonly parameters?: readonly WorkflowWebhookEndpointParameterData[] | null;
+    readonly timeoutMs?: number | null;
+    readonly url?: string | null;
+}
+/** One test send per endpoint every 10 s, at most 5 per 10 minutes. */
+export declare const WORKFLOW_WEBHOOK_TEST_MIN_INTERVAL_MS = 10000;
+export declare const WORKFLOW_WEBHOOK_TEST_WINDOW_MS = 600000;
+export declare const WORKFLOW_WEBHOOK_TEST_MAX_PER_WINDOW = 5;
+/**
+ * Administrator management of database webhook endpoints (ADR 18 §3.13).
+ *
+ * Header values and the signing secret go in encrypted and never come back
+ * out: not in a response, an error message or a log. Every change writes an
+ * audit row naming the fields that changed, never their values.
+ */
+export declare class WorkflowWebhookEndpointAdminService {
+    private readonly endpointRepository;
+    private readonly auditRepository;
+    private readonly webhookService;
+    private readonly deliveryService;
+    private readonly databaseSource;
+    private readonly options;
+    private readonly testSends;
+    constructor(endpointRepository: Repository<WorkflowWebhookEndpointEntity>, auditRepository: Repository<WorkflowWebhookEndpointAuditEntity>, webhookService: WorkflowWebhookService, deliveryService: WorkflowWebhookDeliveryService, databaseSource: DatabaseWorkflowWebhookEndpointSource, options?: BPMResolvedWorkflowWebhookOptions);
+    isEnabled(): boolean;
+    list(): Promise<readonly WorkflowWebhookEndpointEntity[]>;
+    listAudits(endpointId: string): Promise<readonly WorkflowWebhookEndpointAuditEntity[]>;
+    create(data: CreateWorkflowWebhookEndpointData, actorMemberId: string | null): Promise<WorkflowWebhookEndpointEntity>;
+    update(id: string, data: UpdateWorkflowWebhookEndpointData, actorMemberId: string | null): Promise<WorkflowWebhookEndpointEntity>;
+    setActive(id: string, active: boolean, actorMemberId: string | null): Promise<WorkflowWebhookEndpointEntity>;
+    /** `null` removes the secret, so BPM stops signing requests. */
+    rotateSecret(id: string, signingSecret: string | null, actorMemberId: string | null): Promise<WorkflowWebhookEndpointEntity>;
+    /**
+     * Sends a sample event — placeholder ids and a sample value for every
+     * declared parameter, never a real case — through the normal delivery
+     * path, and reports what the receiver answered.
+     */
+    testSend(id: string, actorMemberId: string | null, now?: number): Promise<WorkflowWebhookTestOutcome>;
+    private acquireTestSend;
+    private readCipher;
+    private readRow;
+    private readUrl;
+    private encryptHeaders;
+    private encryptSecret;
+    private audit;
+}
+/**
+ * The header names of a stored endpoint, for the admin view. Decrypting the
+ * envelope is the only way to know them; the values are dropped at once.
+ */
+export declare function readWorkflowWebhookHeaderNames(row: WorkflowWebhookEndpointEntity, secretEncryptionKey: string | null): readonly string[];