@shipfox/api-integration-jira 10.2.0 → 12.0.0

package/src/db/installations.test.ts

@@ -9,7 +9,9 @@ import {
   getJiraInstallationByWebhookId,
   markJiraInstallationRevoked,
   updateJiraInstallationTokenExpiry,
+  updateJiraInstallationWebhook,
   upsertJiraInstallation,
+  withJiraWebhookRegistrationLock,
 } from './installations.js';
 
 function createInstallationInput(
@@ -62,6 +64,36 @@ describe('jira installations', () => {
     });
   });
 
+  it('preserves webhook metadata when reconnect upsert omits it', async () => {
+    const webhookExpiresAt = new Date('2030-01-01T00:00:00.000Z');
+    const input = createInstallationInput({webhookIds: [321], webhookExpiresAt});
+    await upsertJiraInstallation(input);
+
+    const result = await upsertJiraInstallation({
+      ...input,
+      scopes: ['read:jira-work', 'write:jira-work'],
+      webhookIds: undefined,
+      webhookExpiresAt: undefined,
+    });
+
+    expect(result.webhookIds).toEqual([321]);
+    expect(result.webhookExpiresAt).toEqual(webhookExpiresAt);
+  });
+
+  it('replaces webhook ids and expiry together after registration', async () => {
+    const input = createInstallationInput({webhookIds: [321]});
+    await upsertJiraInstallation(input);
+    const webhookExpiresAt = new Date('2030-02-01T00:00:00.000Z');
+
+    const result = await updateJiraInstallationWebhook({
+      connectionId: input.connectionId,
+      webhookIds: [654],
+      webhookExpiresAt,
+    });
+
+    expect(result).toMatchObject({webhookIds: [654], webhookExpiresAt});
+  });
+
   it('refuses to repoint a connection to a different Jira site', async () => {
     const first = createInstallationInput();
     await upsertJiraInstallation(first);
@@ -126,4 +158,36 @@ describe('jira installations', () => {
     expect(revoked?.status).toBe('revoked');
     expect(missing).toBeUndefined();
   });
+
+  it('serializes webhook registration lock contenders for one connection', async () => {
+    const connectionId = crypto.randomUUID();
+    let releaseFirst!: () => void;
+    let firstEntered!: () => void;
+    const firstReady = new Promise<void>((resolve) => {
+      firstEntered = resolve;
+    });
+    const firstRelease = new Promise<void>((resolve) => {
+      releaseFirst = resolve;
+    });
+
+    const first = withJiraWebhookRegistrationLock(connectionId, async () => {
+      firstEntered();
+      await firstRelease;
+      return 'first';
+    });
+    await firstReady;
+
+    let secondFinished = false;
+    const second = withJiraWebhookRegistrationLock(connectionId, () => {
+      secondFinished = true;
+      return Promise.resolve('second');
+    });
+    await Promise.resolve();
+    expect(secondFinished).toBe(false);
+
+    releaseFirst();
+    await expect(first).resolves.toBe('first');
+    await expect(second).resolves.toBe('second');
+    expect(secondFinished).toBe(true);
+  });
 });

package/src/db/installations.ts

@@ -1,5 +1,5 @@
 import {isUniqueViolation} from '@shipfox/node-drizzle';
-import {pgClient} from '@shipfox/node-postgres';
+import {pgClient, withPostgresSession} from '@shipfox/node-postgres';
 import {eq, sql} from 'drizzle-orm';
 import {
   JiraConnectionAlreadyLinkedError,
@@ -9,6 +9,41 @@ import {
 import {db} from './db.js';
 import {jiraInstallations, toJiraInstallation} from './schema/installations.js';
 
+export type JiraInstallationLock = <T>(lockKey: string, fn: () => Promise<T>) => Promise<T>;
+
+const JIRA_INSTALLATION_LOCK_RETRY_DELAY_MS = 100;
+const JIRA_INSTALLATION_LOCK_MAX_RETRY_DELAY_MS = 1_000;
+const JIRA_INSTALLATION_LOCK_TIMEOUT_MS = 30_000;
+
+export async function withJiraInstallationLock<T>(lockKey: string, fn: () => Promise<T>) {
+  const advisoryKey = `jira-installation:${lockKey}`;
+  const deadline = Date.now() + JIRA_INSTALLATION_LOCK_TIMEOUT_MS;
+  let retryDelayMs = JIRA_INSTALLATION_LOCK_RETRY_DELAY_MS;
+
+  while (true) {
+    const attempt = await withPostgresSession(async (client) => {
+      const lock = await client.query<{acquired: boolean}>(
+        'SELECT pg_try_advisory_lock(hashtext($1)) AS acquired',
+        [advisoryKey],
+      );
+      if (lock.rows[0]?.acquired !== true) return {acquired: false as const};
+
+      try {
+        return {acquired: true as const, value: await fn()};
+      } finally {
+        await client.query('SELECT pg_advisory_unlock(hashtext($1))', [advisoryKey]);
+      }
+    });
+
+    if (attempt.acquired) return attempt.value;
+    if (Date.now() >= deadline) {
+      throw new Error(`Timed out waiting for Jira installation lock: ${lockKey}`);
+    }
+    await new Promise((resolve) => setTimeout(resolve, retryDelayMs));
+    retryDelayMs = Math.min(retryDelayMs * 2, JIRA_INSTALLATION_LOCK_MAX_RETRY_DELAY_MS);
+  }
+}
+
 export type JiraInstallationStatus = 'installed' | 'revoked';
 
 export interface JiraInstallation {
@@ -46,6 +81,12 @@ export interface UpdateJiraInstallationTokenExpiryParams {
   scopes?: string[] | undefined;
 }
 
+export interface UpdateJiraInstallationWebhookParams {
+  connectionId: string;
+  webhookIds: number[];
+  webhookExpiresAt: Date | null;
+}
+
 type JiraDb = ReturnType<typeof db>;
 type JiraTx = Parameters<Parameters<JiraDb['transaction']>[0]>[0];
 
@@ -55,7 +96,6 @@ export async function upsertJiraInstallation(
 ): Promise<JiraInstallation> {
   const executor = (options.tx ?? db()) as JiraDb | JiraTx;
   const now = new Date();
-  const webhookIds = params.webhookIds ?? [];
   let row: typeof jiraInstallations.$inferSelect | undefined;
   try {
     [row] = await executor
@@ -67,7 +107,7 @@ export async function upsertJiraInstallation(
         siteName: params.siteName,
         authorizingAccountId: params.authorizingAccountId,
         scopes: params.scopes,
-        webhookIds,
+        webhookIds: params.webhookIds ?? [],
         webhookExpiresAt: params.webhookExpiresAt ?? null,
         status: params.status,
         tokenExpiresAt: params.tokenExpiresAt ?? null,
@@ -81,8 +121,10 @@ export async function upsertJiraInstallation(
           siteName: params.siteName,
           authorizingAccountId: params.authorizingAccountId,
           scopes: params.scopes,
-          webhookIds,
-          webhookExpiresAt: params.webhookExpiresAt ?? null,
+          ...(params.webhookIds === undefined ? {} : {webhookIds: params.webhookIds}),
+          ...(params.webhookExpiresAt === undefined
+            ? {}
+            : {webhookExpiresAt: params.webhookExpiresAt}),
           status: params.status,
           tokenExpiresAt: params.tokenExpiresAt ?? null,
           updatedAt: now,
@@ -134,6 +176,23 @@ export async function updateJiraInstallationTokenExpiry(
   return row ? toJiraInstallation(row) : undefined;
 }
 
+export async function updateJiraInstallationWebhook(
+  params: UpdateJiraInstallationWebhookParams,
+  options: {tx?: unknown} = {},
+): Promise<JiraInstallation | undefined> {
+  const executor = (options.tx ?? db()) as JiraDb | JiraTx;
+  const [row] = await executor
+    .update(jiraInstallations)
+    .set({
+      webhookIds: params.webhookIds,
+      webhookExpiresAt: params.webhookExpiresAt,
+      updatedAt: new Date(),
+    })
+    .where(eq(jiraInstallations.connectionId, params.connectionId))
+    .returning();
+  return row ? toJiraInstallation(row) : undefined;
+}
+
 export async function deleteJiraInstallationByConnectionId(
   connectionId: string,
   options: {tx?: unknown} = {},
@@ -154,6 +213,13 @@ export function withJiraRefreshLock<T>(
   return withJiraRefreshLockClient(connectionId, fn);
 }
 
+export function withJiraWebhookRegistrationLock<T>(
+  lockKey: string,
+  fn: (tx?: unknown) => Promise<T>,
+): Promise<T> {
+  return withJiraInstallationLock(lockKey, () => fn());
+}
+
 async function withJiraRefreshLockClient<T>(
   connectionId: string,
   fn: () => Promise<T>,

package/src/index.test.ts

@@ -11,4 +11,12 @@ describe('createJiraIntegrationProvider', () => {
       routes: [],
     });
   });
+
+  it('rejects incomplete receiver wiring instead of mounting registration without a receiver', () => {
+    expect(() =>
+      createJiraIntegrationProvider({
+        routes: {tokenStore: {} as never} as never,
+      }),
+    ).toThrow('requires all webhook receiver dependencies');
+  });
 });

package/src/index.ts

@@ -1,6 +1,8 @@
 import {JIRA_PROVIDER} from '@shipfox/api-integration-jira-dto';
 import {createJiraApiClient, type JiraApiClient} from '#api/client.js';
 import {config} from '#config.js';
+import {createJiraWebhookProcessor} from '#core/webhook-processor.js';
+import {registerJiraWebhook} from '#core/webhook-registration.js';
 import {closeDb, db} from '#db/db.js';
 import {getJiraInstallationByConnectionId} from '#db/installations.js';
 import {migrationsPath} from '#db/migrations.js';
@@ -8,15 +10,28 @@ import {
   type CreateJiraIntegrationRoutesOptions,
   createJiraIntegrationRoutes,
 } from '#presentation/routes/install.js';
+import {
+  type CreateJiraWebhookRoutesOptions,
+  createJiraWebhookRoutes,
+  JIRA_WEBHOOK_ROUTE_PREFIX,
+} from '#presentation/routes/webhooks.js';
+
+const TRAILING_SLASHES_RE = /\/+$/;
 
 export type {JiraProvider} from '@shipfox/api-integration-jira-dto';
 export type {
   JiraAccessibleResource,
   JiraApiClient,
   JiraAuthorization,
+  JiraDynamicWebhookRegistration,
   JiraIdentity,
 } from '#api/client.js';
-export {createJiraApiClient, mapJiraError} from '#api/client.js';
+export {
+  createJiraApiClient,
+  JIRA_DYNAMIC_WEBHOOK_EVENTS,
+  JIRA_DYNAMIC_WEBHOOK_JQL,
+  mapJiraError,
+} from '#api/client.js';
 export type {DisconnectJiraInstallationParams} from '#core/disconnect.js';
 export {disconnectJiraInstallation} from '#core/disconnect.js';
 export {
@@ -58,9 +73,18 @@ export type {
   StoreJiraTokensParams,
 } from '#core/tokens.js';
 export {createJiraTokenStore, jiraSecretsNamespace} from '#core/tokens.js';
+export type {
+  CreateJiraWebhookProcessorOptions,
+  JiraWebhookProcessor,
+} from '#core/webhook-processor.js';
+export {createJiraWebhookProcessor} from '#core/webhook-processor.js';
+export type {RegisterJiraWebhookParams} from '#core/webhook-registration.js';
+export {JIRA_WEBHOOK_TTL_MS, registerJiraWebhook} from '#core/webhook-registration.js';
 export type {
   JiraInstallation,
+  JiraInstallationLock,
   JiraInstallationStatus,
+  UpdateJiraInstallationWebhookParams,
   UpsertJiraInstallationParams,
 } from '#db/installations.js';
 export {
@@ -70,23 +94,70 @@ export {
   getJiraInstallationByWebhookId,
   markJiraInstallationRevoked,
   updateJiraInstallationTokenExpiry,
+  updateJiraInstallationWebhook,
   upsertJiraInstallation,
   withJiraRefreshLock,
+  withJiraWebhookRegistrationLock,
 } from '#db/installations.js';
+export type {CreateJiraWebhookRoutesOptions} from '#presentation/routes/webhooks.js';
+export {createJiraWebhookRoutes} from '#presentation/routes/webhooks.js';
 export {closeDb, config, db, migrationsPath};
 
 export interface CreateJiraIntegrationProviderOptions {
   jira?: JiraApiClient | undefined;
   getJiraInstallationByConnectionId?: typeof getJiraInstallationByConnectionId | undefined;
-  routes?: Omit<CreateJiraIntegrationRoutesOptions, 'jira' | 'connectionCapabilities'> | undefined;
+  routes?: JiraIntegrationProviderRoutesOptions | undefined;
 }
 
+type JiraIntegrationProviderRoutesOptions = Omit<
+  CreateJiraIntegrationRoutesOptions,
+  'jira' | 'connectionCapabilities' | 'registerJiraWebhook'
+> &
+  Omit<CreateJiraWebhookRoutesOptions, 'processor'>;
+
 export function createJiraIntegrationProvider(options: CreateJiraIntegrationProviderOptions = {}) {
   const jira = options.jira ?? createJiraApiClient();
   const getInstallationByConnectionId =
     options.getJiraInstallationByConnectionId ?? getJiraInstallationByConnectionId;
+  const webhookOptions = toJiraWebhookOptions(options.routes);
+  const webhookProcessor = webhookOptions ? createJiraWebhookProcessor(webhookOptions) : undefined;
+  const webhookRoutes = webhookOptions
+    ? [
+        createJiraWebhookRoutes({
+          coreDb: webhookOptions.coreDb,
+          publishIntegrationEventReceived: webhookOptions.publishIntegrationEventReceived,
+          recordDeliveryOnly: webhookOptions.recordDeliveryOnly,
+          getIntegrationConnectionById: webhookOptions.getIntegrationConnectionById,
+          processor: webhookProcessor,
+        }),
+      ]
+    : [];
   const routes = options.routes
-    ? [createJiraIntegrationRoutes({jira, connectionCapabilities: [], ...options.routes})]
+    ? [
+        createJiraIntegrationRoutes({
+          jira,
+          connectionCapabilities: [],
+          ...options.routes,
+          registerJiraWebhook: (input) =>
+            registerJiraWebhook({
+              jira,
+              connectionId: input.connectionId,
+              cloudId: input.cloudId,
+              accessToken: input.accessToken,
+              webhookUrl: jiraWebhookUrl(input.connectionId),
+              ...(input.withRegistrationLock
+                ? {withRegistrationLock: input.withRegistrationLock}
+                : {}),
+              ...(input.onRegistrationSuccess
+                ? {onRegistrationSuccess: input.onRegistrationSuccess}
+                : {}),
+              ...(input.onRegistrationFailure
+                ? {onRegistrationFailure: input.onRegistrationFailure}
+                : {}),
+            }).then(() => undefined),
+        }),
+        ...webhookRoutes,
+      ]
     : [];
   return {
     provider: JIRA_PROVIDER,
@@ -96,5 +167,33 @@ export function createJiraIntegrationProvider(options: CreateJiraIntegrationProv
       return (await getInstallationByConnectionId(connection.id))?.siteUrl;
     },
     routes,
+    webhookProcessors: webhookProcessor
+      ? [{routeIds: ['jira'] as const, processor: webhookProcessor}]
+      : undefined,
+  };
+}
+
+function jiraWebhookUrl(connectionId: string): string {
+  return `${config.JIRA_WEBHOOK_BASE_URL.replace(TRAILING_SLASHES_RE, '')}${JIRA_WEBHOOK_ROUTE_PREFIX}/${connectionId}`;
+}
+
+function toJiraWebhookOptions(
+  routes: CreateJiraIntegrationProviderOptions['routes'],
+): CreateJiraWebhookRoutesOptions | undefined {
+  if (!routes) return undefined;
+  if (
+    routes.coreDb === undefined ||
+    routes.publishIntegrationEventReceived === undefined ||
+    routes.recordDeliveryOnly === undefined ||
+    routes.getIntegrationConnectionById === undefined
+  )
+    throw new Error(
+      'Jira integration provider requires all webhook receiver dependencies: coreDb, publishIntegrationEventReceived, recordDeliveryOnly, and getIntegrationConnectionById',
+    );
+  return {
+    coreDb: routes.coreDb,
+    publishIntegrationEventReceived: routes.publishIntegrationEventReceived,
+    recordDeliveryOnly: routes.recordDeliveryOnly,
+    getIntegrationConnectionById: routes.getIntegrationConnectionById,
   };
 }

package/src/presentation/routes/install.ts

@@ -25,6 +25,7 @@ import type {JiraPendingSelectionStore} from '#core/pending.js';
 import {formatJiraOAuthScopes} from '#core/scopes.js';
 import {signJiraInstallState} from '#core/state.js';
 import type {JiraTokenStore} from '#core/tokens.js';
+import type {JiraInstallationLock} from '#db/installations.js';
 import {toIntegrationConnectionDto} from '#presentation/dto/integrations.js';
 import {jiraRouteErrorHandler} from './errors.js';
 
@@ -38,6 +39,17 @@ export interface CreateJiraIntegrationRoutesOptions {
   connectJiraInstallation(
     input: ConnectJiraInstallationInput,
   ): Promise<IntegrationConnection<'jira'>>;
+  registerJiraWebhook(input: {
+    connectionId: string;
+    cloudId: string;
+    accessToken: string;
+    withRegistrationLock?: JiraInstallationLock;
+    onRegistrationSuccess: (input: {tx?: unknown}) => Promise<void>;
+    onRegistrationFailure: (input: {tx?: unknown}) => Promise<void>;
+  }): Promise<void>;
+  withJiraInstallationLock?: JiraInstallationLock;
+  markConnectionActive(input: {connectionId: string; tx?: unknown}): Promise<void>;
+  markConnectionError(input: {connectionId: string; tx?: unknown}): Promise<void>;
   disconnectJiraInstallation(input: {connectionId: string}): Promise<void>;
   connectionCapabilities: IntegrationCapability[];
   requireActiveWorkspaceMembership?: (input: {

package/src/presentation/routes/webhooks.test.ts

@@ -0,0 +1,132 @@
+import {Buffer} from 'node:buffer';
+import {WEBHOOK_MAX_RAW_BODY_BYTES} from '@shipfox/api-integration-spi';
+import {closeApp, createApp} from '@shipfox/node-fastify';
+import type {FastifyInstance} from 'fastify';
+import type {JiraWebhookProcessor} from '#core/webhook-processor.js';
+import {createJiraWebhookRoutes} from './webhooks.js';
+
+function createTestApp(processor: JiraWebhookProcessor): Promise<FastifyInstance> {
+  return createApp({
+    routes: [
+      createJiraWebhookRoutes({
+        coreDb: vi.fn() as never,
+        publishIntegrationEventReceived: vi.fn() as never,
+        recordDeliveryOnly: vi.fn() as never,
+        getIntegrationConnectionById: vi.fn() as never,
+        processor,
+      }),
+    ],
+    swagger: false,
+  });
+}
+
+describe('Jira webhook route', () => {
+  afterEach(async () => {
+    await closeApp();
+  });
+
+  it('stores the connection path and lower-case authorization header', async () => {
+    const process = vi.fn().mockResolvedValue({outcome: 'processed', deliveryId: 'delivery-1'});
+    const processor = {process: process as JiraWebhookProcessor['process']};
+    const app = await createTestApp(processor);
+    const connectionId = 'c0a8012e-0b6d-4d8f-8d5c-6d74102602b0';
+
+    const response = await app.inject({
+      method: 'POST',
+      url: `/webhooks/integrations/jira/${connectionId}`,
+      headers: {
+        authorization: 'Bearer signed-token',
+        'content-type': 'application/json',
+        'x-atlassian-webhook-identifier': 'jira-delivery-1',
+      },
+      payload: '{}',
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(process).toHaveBeenCalledWith(
+      expect.objectContaining({
+        route_id: 'jira',
+        path_parameters: {connection_id: connectionId},
+        headers: {
+          authorization: 'Bearer signed-token',
+          'content-type': 'application/json',
+          'x-atlassian-webhook-identifier': 'jira-delivery-1',
+        },
+      }),
+    );
+  });
+
+  it('returns 401 for an authentication failure without recording a delivery', async () => {
+    const process = vi.fn().mockResolvedValue({
+      outcome: 'discarded',
+      reason: 'invalid_signature',
+      deliveryId: 'delivery-1',
+    });
+    const processor = {process: process as JiraWebhookProcessor['process']};
+    const app = await createTestApp(processor);
+
+    const response = await app.inject({
+      method: 'POST',
+      url: '/webhooks/integrations/jira/c0a8012e-0b6d-4d8f-8d5c-6d74102602b0',
+      headers: {'content-type': 'application/json'},
+      payload: '{}',
+    });
+
+    expect(response.statusCode).toBe(401);
+    expect(response.json()).toEqual({error: 'invalid authorization'});
+  });
+
+  it.each([
+    ['a processed delivery', {outcome: 'processed', deliveryId: 'delivery-1'}],
+    ['a duplicate delivery', {outcome: 'duplicate', deliveryId: 'delivery-1'}],
+    ['a deliberate drop', {outcome: 'discarded', reason: 'connection_unavailable'}],
+  ] as const)('returns 200 for %s', async (_description, result) => {
+    const process = vi.fn().mockResolvedValue(result);
+    const app = await createTestApp({process: process as JiraWebhookProcessor['process']});
+
+    const response = await app.inject({
+      method: 'POST',
+      url: '/webhooks/integrations/jira/c0a8012e-0b6d-4d8f-8d5c-6d74102602b0',
+      headers: {authorization: 'Bearer signed-token', 'content-type': 'application/json'},
+      payload: '{}',
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(process).toHaveBeenCalledOnce();
+  });
+
+  it('returns 400 for a malformed payload result', async () => {
+    const process = vi.fn().mockResolvedValue({
+      outcome: 'discarded',
+      reason: 'malformed_payload',
+      deliveryId: 'delivery-1',
+    });
+    const app = await createTestApp({process: process as JiraWebhookProcessor['process']});
+
+    const response = await app.inject({
+      method: 'POST',
+      url: '/webhooks/integrations/jira/c0a8012e-0b6d-4d8f-8d5c-6d74102602b0',
+      headers: {authorization: 'Bearer signed-token', 'content-type': 'application/json'},
+      payload: '{}',
+    });
+
+    expect(response.statusCode).toBe(400);
+    expect(response.json()).toEqual({error: 'malformed JSON'});
+    expect(process).toHaveBeenCalledOnce();
+  });
+
+  it('returns 413 for oversized input without invoking the processor', async () => {
+    const process = vi.fn();
+    const app = await createTestApp({process: process as JiraWebhookProcessor['process']});
+
+    const response = await app.inject({
+      method: 'POST',
+      url: '/webhooks/integrations/jira/c0a8012e-0b6d-4d8f-8d5c-6d74102602b0',
+      headers: {authorization: 'Bearer signed-token', 'content-type': 'application/json'},
+      payload: Buffer.alloc(WEBHOOK_MAX_RAW_BODY_BYTES + 1, 97),
+    });
+
+    expect(response.statusCode).toBe(413);
+    expect(process).not.toHaveBeenCalled();
+  });
+});

package/src/presentation/routes/webhooks.ts

@@ -0,0 +1,115 @@
+import {randomUUID} from 'node:crypto';
+import type {StoredWebhookRequest, WebhookProcessingResult} from '@shipfox/api-integration-spi';
+import {createStoredWebhookRequest, WEBHOOK_MAX_RAW_BODY_BYTES} from '@shipfox/api-integration-spi';
+import {
+  ClientError,
+  defineRoute,
+  type RouteGroup,
+  rawBodyPlugin,
+  WEBHOOK_BODY_LIMIT,
+} from '@shipfox/node-fastify';
+import {z} from 'zod';
+import {
+  type CreateJiraWebhookProcessorOptions,
+  createJiraWebhookProcessor,
+  type JiraWebhookProcessor,
+} from '#core/webhook-processor.js';
+
+const jiraWebhookParamsSchema = z.object({connectionId: z.string().uuid()});
+export const JIRA_WEBHOOK_ROUTE_PREFIX = '/webhooks/integrations/jira';
+
+export interface CreateJiraWebhookRoutesOptions
+  extends Omit<CreateJiraWebhookProcessorOptions, 'getJiraInstallationByConnectionId'> {
+  processor?: JiraWebhookProcessor | undefined;
+}
+
+export function createJiraWebhookRoutes(options: CreateJiraWebhookRoutesOptions): RouteGroup {
+  const processor = options.processor ?? createJiraWebhookProcessor(options);
+  const route = defineRoute({
+    method: 'POST',
+    path: '/:connectionId',
+    auth: [],
+    description: 'Jira dynamic webhook receiver.',
+    options: {bodyLimit: WEBHOOK_BODY_LIMIT},
+    schema: {params: jiraWebhookParamsSchema},
+    handler: async (request, reply) => {
+      const body = request.body;
+      if (!(body instanceof Uint8Array)) {
+        throw new ClientError('Expected raw JSON body', 'invalid-webhook-request', {status: 400});
+      }
+      const result = await processor.process(
+        createJiraStoredWebhookRequest({
+          body,
+          connectionId: request.params.connectionId,
+          headers: request.headers,
+          rawQueryString: request.raw.url?.split('?')[1] ?? '',
+        }),
+      );
+      return sendJiraWebhookResponse(reply, result);
+    },
+  });
+
+  return {
+    prefix: JIRA_WEBHOOK_ROUTE_PREFIX,
+    auth: [],
+    plugins: [rawBodyPlugin],
+    routes: [route],
+  };
+}
+
+function createJiraStoredWebhookRequest(input: {
+  body: Uint8Array;
+  connectionId: string;
+  headers: Record<string, string | string[] | undefined>;
+  rawQueryString: string;
+}): StoredWebhookRequest {
+  if (input.body.byteLength > WEBHOOK_MAX_RAW_BODY_BYTES) {
+    throw new ClientError('Webhook request body is too large', 'body-too-large', {status: 413});
+  }
+  try {
+    return createStoredWebhookRequest({
+      requestId: randomUUID(),
+      routeId: 'jira',
+      receivedAt: new Date().toISOString(),
+      rawQueryString: input.rawQueryString,
+      headers: jiraWebhookHeaders(input.headers),
+      body: input.body,
+      connectionId: input.connectionId,
+    });
+  } catch (error) {
+    throw new ClientError('Webhook request metadata is invalid', 'invalid-webhook-request', {
+      cause: error,
+    });
+  }
+}
+
+function jiraWebhookHeaders(
+  headers: Record<string, string | string[] | undefined>,
+): Record<string, string> {
+  return Object.fromEntries(
+    ['authorization', 'content-type', 'x-atlassian-webhook-identifier'].flatMap((name) => {
+      const value = headers[name];
+      return typeof value === 'string' ? [[name, value]] : [];
+    }),
+  );
+}
+
+function sendJiraWebhookResponse(
+  reply: {code(statusCode: number): void},
+  result: WebhookProcessingResult,
+) {
+  if (result.outcome !== 'discarded') {
+    reply.code(200);
+    return null;
+  }
+  if (result.reason === 'invalid_signature' || result.reason === 'missing_required_input') {
+    reply.code(401);
+    return {error: 'invalid authorization'};
+  }
+  if (result.reason === 'malformed_payload') {
+    reply.code(400);
+    return {error: 'malformed JSON'};
+  }
+  reply.code(200);
+  return null;
+}

package/test/env.ts

@@ -8,7 +8,6 @@ process.env.TZ = 'UTC';
 process.env.JIRA_OAUTH_CLIENT_ID = 'test-client-id';
 process.env.JIRA_OAUTH_CLIENT_SECRET = 'test-client-secret';
 process.env.JIRA_OAUTH_REDIRECT_URL = 'https://shipfox.example.com/integrations/jira/callback';
-process.env.JIRA_WEBHOOK_SIGNING_SECRET = 'test-signing-secret';
 process.env.JIRA_WEBHOOK_BASE_URL = 'https://shipfox.example.com';
 process.env.JIRA_API_BASE_URL = 'http://127.0.0.1:0';
 process.env.JIRA_AUTH_BASE_URL = 'http://127.0.0.1:0';