@rytass/bpm-core-nestjs-module 0.13.3 → 0.13.4

package/src/lib/workflow-webhook/index.d.ts

@@ -0,0 +1,24 @@
+export * from './workflow-webhook-allowlist';
+export * from './workflow-webhook-database-source';
+export * from './workflow-webhook-delivery-scheduler.service';
+export * from './workflow-webhook-delivery.entity';
+export * from './workflow-webhook-delivery.enums';
+export * from './workflow-webhook-delivery.object';
+export * from './workflow-webhook-delivery.resolver';
+export * from './workflow-webhook-delivery.service';
+export * from './workflow-webhook-delivery.subscriber';
+export * from './workflow-webhook-endpoint-admin.dto';
+export * from './workflow-webhook-endpoint-admin.resolver';
+export * from './workflow-webhook-endpoint-admin.service';
+export * from './workflow-webhook-endpoint.entity';
+export * from './workflow-webhook-enqueue';
+export * from './workflow-webhook-options';
+export * from './workflow-webhook-options.module';
+export * from './workflow-webhook-secret-cipher';
+export * from './workflow-webhook.errors';
+export * from './workflow-webhook.module';
+export * from './workflow-webhook.provider';
+export * from './workflow-webhook.queries';
+export * from './workflow-webhook.service';
+export * from './workflow-webhook.types';
+export * from './workflow-webhook.validator';

package/src/lib/workflow-webhook/index.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./workflow-webhook-allowlist"), exports);
+tslib_1.__exportStar(require("./workflow-webhook-database-source"), exports);
+tslib_1.__exportStar(require("./workflow-webhook-delivery-scheduler.service"), exports);
+tslib_1.__exportStar(require("./workflow-webhook-delivery.entity"), exports);
+tslib_1.__exportStar(require("./workflow-webhook-delivery.enums"), exports);
+tslib_1.__exportStar(require("./workflow-webhook-delivery.object"), exports);
+tslib_1.__exportStar(require("./workflow-webhook-delivery.resolver"), exports);
+tslib_1.__exportStar(require("./workflow-webhook-delivery.service"), exports);
+tslib_1.__exportStar(require("./workflow-webhook-delivery.subscriber"), exports);
+tslib_1.__exportStar(require("./workflow-webhook-endpoint-admin.dto"), exports);
+tslib_1.__exportStar(require("./workflow-webhook-endpoint-admin.resolver"), exports);
+tslib_1.__exportStar(require("./workflow-webhook-endpoint-admin.service"), exports);
+tslib_1.__exportStar(require("./workflow-webhook-endpoint.entity"), exports);
+tslib_1.__exportStar(require("./workflow-webhook-enqueue"), exports);
+tslib_1.__exportStar(require("./workflow-webhook-options"), exports);
+tslib_1.__exportStar(require("./workflow-webhook-options.module"), exports);
+tslib_1.__exportStar(require("./workflow-webhook-secret-cipher"), exports);
+tslib_1.__exportStar(require("./workflow-webhook.errors"), exports);
+tslib_1.__exportStar(require("./workflow-webhook.module"), exports);
+tslib_1.__exportStar(require("./workflow-webhook.provider"), exports);
+tslib_1.__exportStar(require("./workflow-webhook.queries"), exports);
+tslib_1.__exportStar(require("./workflow-webhook.service"), exports);
+tslib_1.__exportStar(require("./workflow-webhook.types"), exports);
+tslib_1.__exportStar(require("./workflow-webhook.validator"), exports);
+//# sourceMappingURL=index.js.map

package/src/lib/workflow-webhook/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/workflow-webhook/index.ts"],"names":[],"mappings":";;;AAAA,uEAA6C;AAC7C,6EAAmD;AACnD,wFAA8D;AAC9D,6EAAmD;AACnD,4EAAkD;AAClD,6EAAmD;AACnD,+EAAqD;AACrD,8EAAoD;AACpD,iFAAuD;AACvD,gFAAsD;AACtD,qFAA2D;AAC3D,oFAA0D;AAC1D,6EAAmD;AACnD,qEAA2C;AAC3C,qEAA2C;AAC3C,4EAAkD;AAClD,2EAAiD;AACjD,oEAA0C;AAC1C,oEAA0C;AAC1C,sEAA4C;AAC5C,qEAA2C;AAC3C,qEAA2C;AAC3C,mEAAyC;AACzC,uEAA6C"}

package/src/lib/workflow-webhook/workflow-webhook-allowlist.d.ts

@@ -0,0 +1,38 @@
+/**
+ * URL allowlist for webhook endpoints (ADR 18 §3.13).
+ *
+ * Pure functions: parsing happens once at boot so a malformed pattern fails
+ * the application rather than silently allowing or denying everything, and
+ * matching is called again on every delivery attempt so tightening the list
+ * takes effect on deliveries that are already queued.
+ */
+export type WorkflowWebhookUrlScheme = 'http' | 'https';
+export interface ParsedWorkflowWebhookUrlPattern {
+    /** Matches the URL's effective port (the scheme default when implicit). */
+    readonly port: string;
+    readonly scheme: WorkflowWebhookUrlScheme;
+    /** The pattern as written, for diagnostics. */
+    readonly source: string;
+    /**
+     * `true` when the host part carries no wildcard. Only an exact host may opt
+     * into a loopback or private address.
+     */
+    readonly hasLiteralHost: boolean;
+    readonly hostMatcher: RegExp;
+    readonly pathMatcher: RegExp;
+    readonly hostname: string;
+}
+export interface WorkflowWebhookUrlPatternParseResult {
+    readonly errors: readonly string[];
+    readonly patterns: readonly ParsedWorkflowWebhookUrlPattern[];
+}
+export declare function parseWorkflowWebhookUrlPatterns(patterns: readonly string[]): WorkflowWebhookUrlPatternParseResult;
+export declare function parseWorkflowWebhookUrlPattern(pattern: string): ParsedWorkflowWebhookUrlPattern;
+/**
+ * Whether `url` may be called. An empty pattern list denies everything: the
+ * caller decides whether an unconfigured allowlist means "deny" (the database
+ * source) or "not enforced" (the registry source), and conflating the two here
+ * would turn a missing configuration into an open door.
+ */
+export declare function isWorkflowWebhookUrlAllowed(url: string, patterns: readonly ParsedWorkflowWebhookUrlPattern[]): boolean;
+export declare function isInternalHostname(hostname: string): boolean;

package/src/lib/workflow-webhook/workflow-webhook-allowlist.js

@@ -0,0 +1,296 @@
+"use strict";
+/**
+ * URL allowlist for webhook endpoints (ADR 18 §3.13).
+ *
+ * Pure functions: parsing happens once at boot so a malformed pattern fails
+ * the application rather than silently allowing or denying everything, and
+ * matching is called again on every delivery attempt so tightening the list
+ * takes effect on deliveries that are already queued.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseWorkflowWebhookUrlPatterns = parseWorkflowWebhookUrlPatterns;
+exports.parseWorkflowWebhookUrlPattern = parseWorkflowWebhookUrlPattern;
+exports.isWorkflowWebhookUrlAllowed = isWorkflowWebhookUrlAllowed;
+exports.isInternalHostname = isInternalHostname;
+const DEFAULT_PORTS = {
+    http: '80',
+    https: '443',
+};
+const LOOPBACK_HOSTNAMES = [
+    'localhost',
+    '127.0.0.1',
+    '0.0.0.0',
+    '[::1]',
+    '[::]',
+];
+function parseWorkflowWebhookUrlPatterns(patterns) {
+    const results = patterns.map((pattern, index) => {
+        try {
+            return { pattern: parseWorkflowWebhookUrlPattern(pattern) };
+        }
+        catch (error) {
+            return {
+                error: `workflowWebhookAllowedUrlPatterns[${index}] ${error instanceof Error ? error.message : 'is invalid'}`,
+            };
+        }
+    });
+    return {
+        errors: results.flatMap((result) => (result.error ? [result.error] : [])),
+        patterns: results.flatMap((result) => result.pattern ? [result.pattern] : []),
+    };
+}
+function parseWorkflowWebhookUrlPattern(pattern) {
+    const trimmed = pattern.trim();
+    if (!trimmed) {
+        throw new Error('is empty');
+    }
+    // A bare "*" means any public https host and any path. Internal addresses
+    // stay unreachable through it, like every other wildcard host.
+    const normalized = trimmed === '*' ? 'https://**/*' : trimmed;
+    const schemeMatch = /^([A-Za-z][A-Za-z0-9+.-]*):\/\//u.exec(normalized);
+    const scheme = schemeMatch ? schemeMatch[1].toLowerCase() : 'https';
+    if (scheme !== 'http' && scheme !== 'https') {
+        throw new Error(`"${pattern}" must use http:// or https://`);
+    }
+    const remainder = schemeMatch
+        ? normalized.slice(schemeMatch[0].length)
+        : normalized;
+    const slashIndex = remainder.indexOf('/');
+    const authority = slashIndex === -1 ? remainder : remainder.slice(0, slashIndex);
+    const path = slashIndex === -1 ? '/*' : remainder.slice(slashIndex);
+    if (!authority) {
+        throw new Error(`"${pattern}" is missing a host`);
+    }
+    if (authority.includes('@')) {
+        throw new Error(`"${pattern}" must not carry credentials`);
+    }
+    const portMatch = /:([0-9*]+)$/u.exec(authority);
+    const hostname = (portMatch ? authority.slice(0, -portMatch[0].length) : authority).toLowerCase();
+    const port = portMatch ? portMatch[1] : DEFAULT_PORTS[scheme];
+    if (!hostname) {
+        throw new Error(`"${pattern}" is missing a host`);
+    }
+    if (!/^[A-Za-z0-9*.\-[\]:]+$/u.test(hostname)) {
+        throw new Error(`"${pattern}" has an invalid host`);
+    }
+    return {
+        hasLiteralHost: !hostname.includes('*'),
+        hostMatcher: buildHostMatcher(hostname, pattern),
+        hostname,
+        pathMatcher: buildPathMatcher(path),
+        port,
+        scheme,
+        source: pattern,
+    };
+}
+/**
+ * Whether `url` may be called. An empty pattern list denies everything: the
+ * caller decides whether an unconfigured allowlist means "deny" (the database
+ * source) or "not enforced" (the registry source), and conflating the two here
+ * would turn a missing configuration into an open door.
+ */
+function isWorkflowWebhookUrlAllowed(url, patterns) {
+    const parsed = parseUrl(url);
+    if (!parsed) {
+        return false;
+    }
+    return patterns.some((pattern) => matchesPattern(parsed, pattern));
+}
+function parseUrl(url) {
+    const candidate = (() => {
+        try {
+            return new URL(url);
+        }
+        catch {
+            return null;
+        }
+    })();
+    if (!candidate) {
+        return null;
+    }
+    const scheme = candidate.protocol.replace(':', '').toLowerCase();
+    if (scheme !== 'http' && scheme !== 'https') {
+        return null;
+    }
+    // Credentials in the URL are never legitimate here and would let an
+    // otherwise-allowed host smuggle a different authority past a reader.
+    if (candidate.username || candidate.password) {
+        return null;
+    }
+    return {
+        hostname: candidate.hostname.toLowerCase(),
+        path: `${candidate.pathname}${candidate.search}`,
+        port: candidate.port || DEFAULT_PORTS[scheme],
+        scheme,
+    };
+}
+function matchesPattern(url, pattern) {
+    if (url.scheme !== pattern.scheme) {
+        return false;
+    }
+    if (pattern.port !== '*' && url.port !== pattern.port) {
+        return false;
+    }
+    if (!pattern.hostMatcher.test(url.hostname)) {
+        return false;
+    }
+    // A wildcard host must never reach the loopback interface, a private range
+    // or a bare IP: those are the addresses an SSRF is after, and a pattern that
+    // names them explicitly is the only way to opt in.
+    if (!pattern.hasLiteralHost && isInternalHostname(url.hostname)) {
+        return false;
+    }
+    return pattern.pathMatcher.test(url.path);
+}
+function isInternalHostname(hostname) {
+    const normalized = hostname.toLowerCase();
+    if (LOOPBACK_HOSTNAMES.includes(normalized)) {
+        return true;
+    }
+    if (normalized.endsWith('.localhost')) {
+        return true;
+    }
+    if (normalized.includes(':')) {
+        const groups = expandIpv6(normalized.replace(/[[\]]/gu, ''));
+        // Not a parseable IPv6 literal: refuse to call it public.
+        if (!groups) {
+            return true;
+        }
+        const embedded = readEmbeddedIpv4(groups);
+        // ::ffff:127.0.0.1, ::127.0.0.1 and 64:ff9b::127.0.0.1 all reach an IPv4
+        // address, so judge the address they carry rather than the wrapper.
+        if (embedded) {
+            return isInternalHostname(embedded);
+        }
+        const [first] = groups;
+        return (groups.every((group) => group === 0) ||
+            (groups.slice(0, 7).every((group) => group === 0) && groups[7] === 1) ||
+            // Unique-local fc00::/7, link-local fe80::/10, deprecated site-local
+            // fec0::/10 and multicast ff00::/8.
+            (first & 0xfe00) === 0xfc00 ||
+            (first & 0xffc0) === 0xfe80 ||
+            (first & 0xffc0) === 0xfec0 ||
+            (first & 0xff00) === 0xff00);
+    }
+    const octets = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/u.exec(normalized);
+    if (!octets) {
+        return false;
+    }
+    const [first, second] = octets.slice(1).map((value) => Number(value));
+    const third = Number(octets[3]);
+    return (first === 0 ||
+        first === 10 ||
+        first === 127 ||
+        (first === 100 && second >= 64 && second <= 127) ||
+        (first === 169 && second === 254) ||
+        (first === 172 && second >= 16 && second <= 31) ||
+        (first === 192 && second === 0 && third === 0) ||
+        // TEST-NET-1/2/3 (192.0.2/24, 198.51.100/24, 203.0.113/24).
+        (first === 192 && second === 0 && third === 2) ||
+        (first === 198 && second === 51 && third === 100) ||
+        (first === 203 && second === 0 && third === 113) ||
+        (first === 192 && second === 168) ||
+        (first === 198 && (second === 18 || second === 19)) ||
+        // Multicast (224/4), reserved (240/4) and broadcast are never a webhook.
+        first >= 224);
+}
+/** Eight 16-bit groups, or `null` when the literal is not valid IPv6. */
+function expandIpv6(literal) {
+    const dottedTail = /^(.*:)(\d{1,3}(?:\.\d{1,3}){3})$/u.exec(literal);
+    const tailGroups = dottedTail ? ipv4ToIpv6Groups(dottedTail[2]) : null;
+    if (dottedTail && !tailGroups) {
+        return null;
+    }
+    const hexLiteral = dottedTail && tailGroups ? `${dottedTail[1]}${tailGroups}` : literal;
+    if ((hexLiteral.match(/::/gu) ?? []).length > 1) {
+        return null;
+    }
+    const [head, tail] = hexLiteral.includes('::')
+        ? hexLiteral.split('::')
+        : [hexLiteral, null];
+    const headGroups = head ? head.split(':') : [];
+    const trailingGroups = tail ? tail.split(':') : [];
+    const missing = 8 - headGroups.length - trailingGroups.length;
+    if ((tail === null && missing !== 0) || missing < 0) {
+        return null;
+    }
+    const groups = [
+        ...headGroups,
+        ...Array.from({ length: tail === null ? 0 : missing }, () => '0'),
+        ...trailingGroups,
+    ];
+    return groups.every((group) => /^[0-9a-f]{1,4}$/u.test(group))
+        ? groups.map((group) => Number.parseInt(group, 16))
+        : null;
+}
+function ipv4ToIpv6Groups(ipv4) {
+    const octets = ipv4.split('.').map((octet) => Number(octet));
+    if (octets.some((octet) => octet > 255)) {
+        return null;
+    }
+    return [
+        ((octets[0] << 8) | octets[1]).toString(16),
+        ((octets[2] << 8) | octets[3]).toString(16),
+    ].join(':');
+}
+/**
+ * The IPv4 address an IPv6 literal carries in its low 32 bits, for the
+ * prefixes that route to it: IPv4-mapped ::ffff:0:0/96, SIIT
+ * ::ffff:0:0:0/96, IPv4-compatible ::/96 and NAT64 64:ff9b::/96.
+ */
+function readEmbeddedIpv4(groups) {
+    const prefix = groups.slice(0, 6);
+    const zeroes = (count) => prefix.slice(0, count).every((group) => group === 0);
+    const carriesIpv4 = (zeroes(5) && prefix[5] === 0xffff) ||
+        (zeroes(4) && prefix[4] === 0xffff && prefix[5] === 0) ||
+        // ::/96 minus :: and ::1, which are judged as IPv6 themselves.
+        (zeroes(6) && (groups[6] !== 0 || groups[7] > 1)) ||
+        (prefix[0] === 0x64 &&
+            prefix[1] === 0xff9b &&
+            prefix.slice(2).every((group) => group === 0));
+    if (!carriesIpv4) {
+        return null;
+    }
+    return [
+        groups[6] >> 8,
+        groups[6] & 0xff,
+        groups[7] >> 8,
+        groups[7] & 0xff,
+    ].join('.');
+}
+function buildHostMatcher(hostname, pattern) {
+    const labels = hostname.split('.');
+    // "**" on its own is the any-host wildcard, which the bare "*" pattern
+    // normalizes to; every other use is a subdomain prefix.
+    if (labels.length === 1 && labels[0] === '**') {
+        return /^[a-z0-9.-]+$/u;
+    }
+    const parts = labels.map((label, index) => {
+        if (label === '**') {
+            if (index !== 0) {
+                throw new Error(`"${pattern}" may only use ** as the first host label`);
+            }
+            // Zero or more labels, so **.example.com also matches example.com.
+            return '(?:[a-z0-9-]+\\.)*';
+        }
+        if (label === '*') {
+            return `[a-z0-9-]+${index === labels.length - 1 ? '' : '\\.'}`;
+        }
+        if (label.includes('*')) {
+            throw new Error(`"${pattern}" may only use * as a whole host label, not part of one`);
+        }
+        return `${escapeRegExp(label)}${index === labels.length - 1 ? '' : '\\.'}`;
+    });
+    return new RegExp(`^${parts.join('')}$`, 'u');
+}
+function buildPathMatcher(path) {
+    const escaped = path
+        .split('*')
+        .map((segment) => escapeRegExp(segment))
+        .join('.*');
+    return new RegExp(`^${escaped}$`, 'u');
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&');
+}
+//# sourceMappingURL=workflow-webhook-allowlist.js.map

package/src/lib/workflow-webhook/workflow-webhook-allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-webhook-allowlist.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/workflow-webhook/workflow-webhook-allowlist.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;AAsCH,0EAqBC;AAED,wEA0DC;AAQD,kEAWC;AAoED,gDAsEC;AA3PD,MAAM,aAAa,GAAuD;IACxE,IAAI,EAAE,IAAI;IACV,KAAK,EAAE,KAAK;CACb,CAAC;AAEF,MAAM,kBAAkB,GAAsB;IAC5C,WAAW;IACX,WAAW;IACX,SAAS;IACT,OAAO;IACP,MAAM;CACP,CAAC;AAEF,SAAgB,+BAA+B,CAC7C,QAA2B;IAE3B,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QAC9C,IAAI,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,8BAA8B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,OAAO;gBACL,KAAK,EAAE,qCAAqC,KAAK,KAC/C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAC3C,EAAE;aACH,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzE,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACnC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CACvC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,8BAA8B,CAC5C,OAAe;IAEf,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAE/B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;IAED,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,UAAU,GAAG,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9D,MAAM,WAAW,GAAG,kCAAkC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAEpE,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,IAAI,OAAO,gCAAgC,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,SAAS,GAAG,WAAW;QAC3B,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACzC,CAAC,CAAC,UAAU,CAAC;IACf,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,SAAS,GACb,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAEpE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,IAAI,OAAO,qBAAqB,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,IAAI,OAAO,8BAA8B,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,CACf,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CACjE,CAAC,WAAW,EAAE,CAAC;IAChB,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAE9D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,IAAI,OAAO,qBAAqB,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,IAAI,OAAO,uBAAuB,CAAC,CAAC;IACtD,CAAC;IAED,OAAO;QACL,cAAc,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvC,WAAW,EAAE,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC;QAChD,QAAQ;QACR,WAAW,EAAE,gBAAgB,CAAC,IAAI,CAAC;QACnC,IAAI;QACJ,MAAM;QACN,MAAM,EAAE,OAAO;KAChB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,2BAA2B,CACzC,GAAW,EACX,QAAoD;IAEpD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAE7B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AACrE,CAAC;AASD,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,SAAS,GAAG,CAAC,GAAe,EAAE;QAClC,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAEjE,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oEAAoE;IACpE,sEAAsE;IACtE,IAAI,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE;QAC1C,IAAI,EAAE,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,MAAM,EAAE;QAChD,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,aAAa,CAAC,MAAM,CAAC;QAC7C,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,GAAc,EACd,OAAwC;IAExC,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,mDAAmD;IACnD,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,SAAgB,kBAAkB,CAAC,QAAgB;IACjD,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAE1C,IAAI,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;QAE7D,0DAA0D;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAE1C,yEAAyE;QACzE,oEAAoE;QACpE,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;QAEvB,OAAO,CACL,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC;YACpC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACrE,qEAAqE;YACrE,oCAAoC;YACpC,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM;YAC3B,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM;YAC3B,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM;YAC3B,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM,CAC5B,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,+CAA+C,CAAC,IAAI,CACjE,UAAU,CACX,CAAC;IAEF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAEtE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhC,OAAO,CACL,KAAK,KAAK,CAAC;QACX,KAAK,KAAK,EAAE;QACZ,KAAK,KAAK,GAAG;QACb,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,GAAG,CAAC;QAChD,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;QACjC,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,CAAC;QAC/C,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;QAC9C,4DAA4D;QAC5D,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;QAC9C,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG,CAAC;QACjD,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC;QAChD,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;QACjC,CAAC,KAAK,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC;QACnD,yEAAyE;QACzE,KAAK,IAAI,GAAG,CACb,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,UAAU,GAAG,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEvE,IAAI,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GACd,UAAU,IAAI,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAEvE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC5C,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;QACxB,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACvB,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,MAAM,cAAc,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC;IAE9D,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG;QACb,GAAG,UAAU;QACb,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC;QACjE,GAAG,cAAc;KAClB,CAAC;IAEF,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5D,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnD,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAE7D,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;KAC5C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,MAAyB;IACjD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAW,EAAE,CACxC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;IACvD,MAAM,WAAW,GACf,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;QACnC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtD,+DAA+D;QAC/D,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACjD,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;YACjB,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM;YACpB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACd,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI;QAChB,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACd,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI;KACjB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,OAAe;IACzD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEnC,uEAAuE;IACvE,wDAAwD;IACxD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACxC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,IAAI,OAAO,2CAA2C,CAAC,CAAC;YAC1E,CAAC;YAED,mEAAmE;YACnE,OAAO,oBAAoB,CAAC;QAC9B,CAAC;QAED,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAClB,OAAO,aAAa,KAAK,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QACjE,CAAC;QAED,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,IAAI,OAAO,yDAAyD,CACrE,CAAC;QACJ,CAAC;QAED,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,KAAK,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,OAAO,GAAG,IAAI;SACjB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;SACvC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC"}

package/src/lib/workflow-webhook/workflow-webhook-database-source.d.ts

@@ -0,0 +1,33 @@
+import { OnApplicationBootstrap } from '@nestjs/common';
+import { EntityManager, Repository } from 'typeorm';
+import { WorkflowWebhookEndpointEntity } from './workflow-webhook-endpoint.entity';
+import { BPMResolvedWorkflowWebhookOptions } from './workflow-webhook-options';
+import { BPMWorkflowWebhookEndpoint, BPMWorkflowWebhookEndpointSource } from './workflow-webhook.types';
+/**
+ * Endpoints maintained by a BPM administrator (ADR 18 §3.13), read straight
+ * from `workflow_webhook_endpoints` on every lookup so a change applies to
+ * the next attempt without a restart or a cache to invalidate.
+ *
+ * A disabled row is still returned, flagged `disabled` (and `deprecated`, so
+ * the designer stops offering it): a delivery must be able to tell "switched
+ * off" from "never existed".
+ */
+export declare class DatabaseWorkflowWebhookEndpointSource implements BPMWorkflowWebhookEndpointSource, OnApplicationBootstrap {
+    private readonly endpointRepository;
+    readonly kind: "DATABASE";
+    private readonly logger;
+    private readonly cipher;
+    constructor(endpointRepository: Repository<WorkflowWebhookEndpointEntity>, options?: BPMResolvedWorkflowWebhookOptions);
+    /**
+     * A wrong key still boots (any 32 bytes parse), and would otherwise only
+     * show up as every database delivery failing to build its request. One
+     * stored value is decrypted at boot so the mistake is logged at once; the
+     * log names the problem, never a value.
+     */
+    onApplicationBootstrap(): Promise<void>;
+    get(key: string, version: number, manager?: EntityManager): Promise<BPMWorkflowWebhookEndpoint | null>;
+    list(): Promise<readonly BPMWorkflowWebhookEndpoint[]>;
+    toEndpoint(row: WorkflowWebhookEndpointEntity): BPMWorkflowWebhookEndpoint;
+    private readHeaders;
+    private decrypt;
+}

package/src/lib/workflow-webhook/workflow-webhook-database-source.js

@@ -0,0 +1,129 @@
+"use strict";
+var DatabaseWorkflowWebhookEndpointSource_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DatabaseWorkflowWebhookEndpointSource = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const typeorm_2 = require("typeorm");
+const workflow_webhook_endpoint_entity_1 = require("./workflow-webhook-endpoint.entity");
+const workflow_webhook_options_1 = require("./workflow-webhook-options");
+const workflow_webhook_secret_cipher_1 = require("./workflow-webhook-secret-cipher");
+/**
+ * Endpoints maintained by a BPM administrator (ADR 18 §3.13), read straight
+ * from `workflow_webhook_endpoints` on every lookup so a change applies to
+ * the next attempt without a restart or a cache to invalidate.
+ *
+ * A disabled row is still returned, flagged `disabled` (and `deprecated`, so
+ * the designer stops offering it): a delivery must be able to tell "switched
+ * off" from "never existed".
+ */
+let DatabaseWorkflowWebhookEndpointSource = DatabaseWorkflowWebhookEndpointSource_1 = class DatabaseWorkflowWebhookEndpointSource {
+    constructor(endpointRepository, options = workflow_webhook_options_1.DEFAULT_BPM_WORKFLOW_WEBHOOK_OPTIONS) {
+        this.endpointRepository = endpointRepository;
+        this.kind = 'DATABASE';
+        this.logger = new common_1.Logger(DatabaseWorkflowWebhookEndpointSource_1.name);
+        this.cipher = options.secretEncryptionKey
+            ? new workflow_webhook_secret_cipher_1.WorkflowWebhookSecretCipher(options.secretEncryptionKey)
+            : null;
+    }
+    /**
+     * A wrong key still boots (any 32 bytes parse), and would otherwise only
+     * show up as every database delivery failing to build its request. One
+     * stored value is decrypted at boot so the mistake is logged at once; the
+     * log names the problem, never a value.
+     */
+    async onApplicationBootstrap() {
+        if (!this.cipher) {
+            return;
+        }
+        const sample = await this.endpointRepository
+            .createQueryBuilder('endpoint')
+            .where('endpoint.encryptedHeaders IS NOT NULL OR endpoint.encryptedSigningSecret IS NOT NULL')
+            .getOne()
+            .catch(() => null);
+        const envelope = sample?.encryptedSigningSecret ?? sample?.encryptedHeaders ?? null;
+        if (!envelope) {
+            return;
+        }
+        try {
+            this.cipher.decrypt(envelope);
+        }
+        catch {
+            this.logger.error('workflowWebhookSecretEncryptionKey cannot decrypt the stored webhook endpoint secrets; database endpoint deliveries will fail until the original key is restored');
+        }
+    }
+    async get(key, version, manager) {
+        const repository = manager?.getRepository(workflow_webhook_endpoint_entity_1.WorkflowWebhookEndpointEntity) ??
+            this.endpointRepository;
+        const row = await repository.findOne({ where: { key, version } });
+        return row ? this.toEndpoint(row) : null;
+    }
+    async list() {
+        const rows = await this.endpointRepository.find({
+            order: { key: 'ASC', version: 'ASC' },
+        });
+        return rows.map((row) => this.toEndpoint(row));
+    }
+    toEndpoint(row) {
+        return {
+            // Decrypted per attempt, so a rotated secret or edited header applies
+            // to deliveries that are already queued.
+            buildRequest: async () => ({
+                headers: this.readHeaders(row.encryptedHeaders),
+                method: readMethod(row.method),
+                ...(row.encryptedSigningSecret
+                    ? { signingSecret: this.decrypt(row.encryptedSigningSecret) }
+                    : {}),
+                ...(row.timeoutMs ? { timeoutMs: row.timeoutMs } : {}),
+                url: row.url,
+            }),
+            descriptor: {
+                deprecated: row.deprecated || !row.isActive,
+                ...(row.description ? { description: row.description } : {}),
+                disabled: !row.isActive,
+                key: row.key,
+                label: row.label,
+                parameters: row.parameters.map((parameter) => ({
+                    ...(parameter.description
+                        ? { description: parameter.description }
+                        : {}),
+                    key: parameter.key,
+                    label: parameter.label,
+                    required: parameter.required,
+                    type: parameter.type,
+                })),
+                version: row.version,
+            },
+        };
+    }
+    readHeaders(envelope) {
+        if (!envelope) {
+            return {};
+        }
+        const parsed = JSON.parse(this.decrypt(envelope));
+        return typeof parsed === 'object' && parsed !== null
+            ? Object.fromEntries(Object.entries(parsed).filter((entry) => typeof entry[1] === 'string'))
+            : {};
+    }
+    decrypt(envelope) {
+        if (!this.cipher) {
+            // Unreachable through BPM's own wiring: without a key the options
+            // resolution drops this source, so its rows are not looked up at all.
+            throw new Error('Webhook secret encryption key is not configured');
+        }
+        return this.cipher.decrypt(envelope);
+    }
+};
+exports.DatabaseWorkflowWebhookEndpointSource = DatabaseWorkflowWebhookEndpointSource;
+exports.DatabaseWorkflowWebhookEndpointSource = DatabaseWorkflowWebhookEndpointSource = DatabaseWorkflowWebhookEndpointSource_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__param(0, (0, typeorm_1.InjectRepository)(workflow_webhook_endpoint_entity_1.WorkflowWebhookEndpointEntity)),
+    tslib_1.__param(1, (0, common_1.Optional)()),
+    tslib_1.__param(1, (0, common_1.Inject)(workflow_webhook_options_1.BPM_WORKFLOW_WEBHOOK_OPTIONS)),
+    tslib_1.__metadata("design:paramtypes", [typeorm_2.Repository, Object])
+], DatabaseWorkflowWebhookEndpointSource);
+function readMethod(value) {
+    return value === 'PUT' || value === 'PATCH' ? value : 'POST';
+}
+//# sourceMappingURL=workflow-webhook-database-source.js.map

package/src/lib/workflow-webhook/workflow-webhook-database-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-webhook-database-source.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/workflow-webhook/workflow-webhook-database-source.ts"],"names":[],"mappings":";;;;;AAAA,2CAMwB;AACxB,6CAAmD;AACnD,qCAAoD;AACpD,yFAAmF;AACnF,yEAIoC;AACpC,qFAA+E;AAO/E;;;;;;;;GAQG;AAEI,IAAM,qCAAqC,6CAA3C,MAAM,qCAAqC;IAWhD,YAEE,kBAA8E,EAG9E,UAA6C,+DAAoC;QAHhE,uBAAkB,GAAlB,kBAAkB,CAA2C;QAVvE,SAAI,GAAG,UAAmB,CAAC;QAEnB,WAAM,GAAG,IAAI,eAAM,CAClC,uCAAqC,CAAC,IAAI,CAC3C,CAAC;QAWA,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,mBAAmB;YACvC,CAAC,CAAC,IAAI,4DAA2B,CAAC,OAAO,CAAC,mBAAmB,CAAC;YAC9D,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,sBAAsB;QAC1B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB;aACzC,kBAAkB,CAAC,UAAU,CAAC;aAC9B,KAAK,CACJ,sFAAsF,CACvF;aACA,MAAM,EAAE;aACR,KAAK,CAAC,GAAS,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,QAAQ,GACZ,MAAM,EAAE,sBAAsB,IAAI,MAAM,EAAE,gBAAgB,IAAI,IAAI,CAAC;QAErE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,kKAAkK,CACnK,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CACP,GAAW,EACX,OAAe,EACf,OAAuB;QAEvB,MAAM,UAAU,GACd,OAAO,EAAE,aAAa,CAAC,gEAA6B,CAAC;YACrD,IAAI,CAAC,kBAAkB,CAAC;QAC1B,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAElE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;YAC9C,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE;SACtC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,UAAU,CAAC,GAAkC;QAC3C,OAAO;YACL,sEAAsE;YACtE,yCAAyC;YACzC,YAAY,EAAE,KAAK,IAAwC,EAAE,CAAC,CAAC;gBAC7D,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,gBAAgB,CAAC;gBAC/C,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC9B,GAAG,CAAC,GAAG,CAAC,sBAAsB;oBAC5B,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE;oBAC7D,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtD,GAAG,EAAE,GAAG,CAAC,GAAG;aACb,CAAC;YACF,UAAU,EAAE;gBACV,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,GAAG,CAAC,QAAQ;gBAC3C,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,QAAQ,EAAE,CAAC,GAAG,CAAC,QAAQ;gBACvB,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;oBAC7C,GAAG,CAAC,SAAS,CAAC,WAAW;wBACvB,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE;wBACxC,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,EAAE,SAAS,CAAC,GAAG;oBAClB,KAAK,EAAE,SAAS,CAAC,KAAK;oBACtB,QAAQ,EAAE,SAAS,CAAC,QAAQ;oBAC5B,IAAI,EAAE,SAAS,CAAC,IAAI;iBACrB,CAAC,CAAC;gBACH,OAAO,EAAE,GAAG,CAAC,OAAO;aACrB;SACF,CAAC;IACJ,CAAC;IAEO,WAAW,CACjB,QAAuB;QAEvB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE3D,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAC3B,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CACnE,CACF;YACH,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAEO,OAAO,CAAC,QAAgB;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,kEAAkE;YAClE,sEAAsE;YACtE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;CACF,CAAA;AA1IY,sFAAqC;gDAArC,qCAAqC;IADjD,IAAA,mBAAU,GAAE;IAaR,mBAAA,IAAA,0BAAgB,EAAC,gEAA6B,CAAC,CAAA;IAE/C,mBAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,mBAAA,IAAA,eAAM,EAAC,uDAA4B,CAAC,CAAA;6CAFA,oBAAU;GAbtC,qCAAqC,CA0IjD;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/D,CAAC"}

package/src/lib/workflow-webhook/workflow-webhook-delivery-scheduler.service.d.ts

@@ -0,0 +1,25 @@
+import { OnApplicationBootstrap, OnApplicationShutdown } from '@nestjs/common';
+import { WorkflowWebhookDeliveryService } from './workflow-webhook-delivery.service';
+import { WorkflowWebhookService } from './workflow-webhook.service';
+/**
+ * The fallback that retries failed attempts, releases rows the immediate kick
+ * missed, and reclaims rows a crashed worker left in progress. `SKIP LOCKED`
+ * in the claim lets several API instances run it at once.
+ */
+export declare class WorkflowWebhookDeliverySchedulerService implements OnApplicationBootstrap, OnApplicationShutdown {
+    private readonly deliveryService;
+    private readonly webhookService;
+    private readonly logger;
+    private timer;
+    private scanning;
+    constructor(deliveryService: WorkflowWebhookDeliveryService, webhookService: WorkflowWebhookService);
+    onApplicationBootstrap(): Promise<void>;
+    onApplicationShutdown(): void;
+    /**
+     * Unset means "on when there is anything to deliver to": a host with no
+     * endpoints gets no idle timer, and one with endpoints never silently loses
+     * its retries.
+     */
+    isEnabled(): Promise<boolean>;
+    scan(): Promise<void>;
+}