@shipfox/api-integration-linear 5.0.0 → 7.0.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-integration-linear",
   "license": "MIT",
-  "version": "5.0.0",
+  "version": "7.0.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -26,34 +26,33 @@
     "drizzle-orm": "^0.45.2",
     "ky": "^2.0.0",
     "zod": "^4.4.3",
-    "@shipfox/api-auth-context": "5.0.0",
-    "@shipfox/api-integration-core-dto": "5.0.0",
-    "@shipfox/api-workspaces": "5.0.0",
+    "@shipfox/api-auth-context": "6.0.0",
+    "@shipfox/api-integration-core-dto": "6.0.0",
+    "@shipfox/api-integration-linear-dto": "6.0.0",
+    "@shipfox/api-workspaces": "7.0.1",
     "@shipfox/config": "1.2.2",
-    "@shipfox/api-integration-linear-dto": "5.0.0",
-    "@shipfox/node-drizzle": "0.3.1",
-    "@shipfox/node-fastify": "0.2.3",
+    "@shipfox/node-drizzle": "0.3.2",
+    "@shipfox/node-fastify": "0.2.4",
     "@shipfox/node-opentelemetry": "0.5.2",
     "@shipfox/node-postgres": "0.4.2"
   },
-  "peerDependencies": {
-    "@shipfox/api-secrets": "5.0.0"
-  },
   "devDependencies": {
     "@types/pg": "^8.15.5",
     "drizzle-kit": "^0.31.10",
     "fastify": "^5.3.3",
     "fishery": "^2.4.0",
     "@shipfox/biome": "1.8.2",
+    "@shipfox/depcruise": "1.0.2",
     "@shipfox/swc": "1.2.6",
-    "@shipfox/typescript": "1.1.7",
     "@shipfox/ts-config": "1.3.8",
+    "@shipfox/typescript": "1.1.7",
     "@shipfox/vitest": "1.2.3"
   },
   "scripts": {
     "build": "shipfox-swc",
     "check": "shipfox-biome-check",
     "check:fix": "shipfox-biome-check --write",
+    "depcruise": "shipfox-depcruise",
     "test": "shipfox-vitest-run",
     "test:watch": "shipfox-vitest-watch",
     "type": "shipfox-tsc-check",

package/src/core/disconnect.test.ts

@@ -12,6 +12,7 @@ const deleteLinearInstallationByConnectionIdMock = vi.mocked(
 describe('disconnectLinearInstallation', () => {
   beforeEach(() => {
     deleteLinearInstallationByConnectionIdMock.mockClear();
+    deleteLinearInstallationByConnectionIdMock.mockResolvedValue(true);
   });
 
   it('deletes stored tokens before deleting connection records', async () => {
@@ -42,4 +43,50 @@ describe('disconnectLinearInstallation', () => {
     expect(deleteConnection).toHaveBeenCalledWith({connectionId: 'connection-1'}, {tx});
     expect(calls).toEqual(['secrets', 'connection']);
   });
+
+  it('keeps connection records when secret deletion fails', async () => {
+    const transaction = vi.fn();
+    const deleteConnection = vi.fn();
+
+    const run = disconnectLinearInstallation({
+      connectionId: 'connection-1',
+      getConnection: vi.fn(() => Promise.resolve({workspaceId: 'workspace-1'})),
+      deleteSecrets: vi.fn(() => Promise.reject(new Error('secret store unavailable'))),
+      transaction,
+      deleteConnection,
+    });
+
+    await expect(run).rejects.toThrow('secret store unavailable');
+    expect(transaction).not.toHaveBeenCalled();
+    expect(deleteLinearInstallationByConnectionIdMock).not.toHaveBeenCalled();
+    expect(deleteConnection).not.toHaveBeenCalled();
+  });
+
+  it('retries idempotent secret deletion after the records transaction fails', async () => {
+    const tx = Symbol('tx');
+    const deleteSecrets = vi.fn(() => Promise.resolve(0));
+    const deleteConnection = vi.fn(() => Promise.resolve(true));
+    const transaction = vi
+      .fn()
+      .mockImplementationOnce(async (fn: (value: symbol) => Promise<unknown>) => {
+        await fn(tx);
+        throw new Error('database commit failed');
+      })
+      .mockImplementationOnce(async (fn: (value: symbol) => Promise<unknown>) => await fn(tx));
+    const params = {
+      connectionId: 'connection-1',
+      getConnection: vi.fn(() => Promise.resolve({workspaceId: 'workspace-1'})),
+      deleteSecrets,
+      transaction,
+      deleteConnection,
+    };
+
+    const firstAttempt = disconnectLinearInstallation(params);
+    await expect(firstAttempt).rejects.toThrow('database commit failed');
+    await disconnectLinearInstallation(params);
+
+    expect(deleteSecrets).toHaveBeenCalledTimes(2);
+    expect(deleteLinearInstallationByConnectionIdMock).toHaveBeenCalledTimes(2);
+    expect(deleteConnection).toHaveBeenCalledTimes(2);
+  });
 });

package/src/core/tokens.test.ts

@@ -13,8 +13,8 @@ import {
 
 let secrets: LinearSecretsStore;
 
-beforeAll(async () => {
-  secrets = await import('@shipfox/api-secrets');
+beforeEach(() => {
+  secrets = createInMemorySecretsStore();
 });
 
 function createConnectionContext() {
@@ -66,6 +66,20 @@ function storedToken(input: {
   });
 }
 
+function createInMemorySecretsStore(): LinearSecretsStore {
+  const values = new Map<string, string>();
+  const id = (params: {workspaceId: string; namespace: string; key: string}) =>
+    `${params.workspaceId}\0${params.namespace}\0${params.key}`;
+  return {
+    getSecret: async (params) => values.get(id(params)) ?? null,
+    setSecrets: async (params) => {
+      await Promise.resolve();
+      for (const [key, value] of Object.entries(params.values))
+        values.set(id({...params, key}), value);
+    },
+  };
+}
+
 describe('createLinearTokenStore.storeTokens', () => {
   it('stores access and refresh tokens in the Linear system namespace', async () => {
     const {workspaceId, connectionId, store} = createConnectionContext();

package/src/core/webhook-processor.test.ts

@@ -0,0 +1,154 @@
+import {createHmac, randomUUID} from 'node:crypto';
+import type {IntegrationConnection} from '@shipfox/api-integration-core-dto';
+import {createStoredWebhookRequest} from '@shipfox/api-integration-core-dto';
+import {db} from '#db/db.js';
+import {upsertLinearInstallation} from '#db/installations.js';
+import {linearInstallations} from '#db/schema/installations.js';
+import {createLinearWebhookProcessor} from './webhook-processor.js';
+
+const WEBHOOK_SECRET = 'test-webhook-secret';
+
+function fakeConnection(overrides: Partial<IntegrationConnection> = {}): IntegrationConnection {
+  return {
+    id: randomUUID(),
+    workspaceId: randomUUID(),
+    provider: 'linear',
+    externalAccountId: 'org-1',
+    slug: 'Linear_Acme',
+    displayName: 'Linear Acme',
+    lifecycleStatus: 'active',
+    createdAt: new Date(),
+    updatedAt: new Date(),
+    ...overrides,
+  };
+}
+
+function signedRequest(input: {
+  body: Record<string, unknown>;
+  deliveryId?: string | undefined;
+  receivedAt: string;
+}) {
+  const rawBody = Buffer.from(JSON.stringify(input.body));
+  const signature = createHmac('sha256', WEBHOOK_SECRET).update(rawBody).digest('hex');
+
+  return createStoredWebhookRequest({
+    requestId: randomUUID(),
+    routeId: 'linear',
+    receivedAt: input.receivedAt,
+    rawQueryString: '',
+    headers: {
+      'content-type': 'application/json',
+      'linear-delivery': input.deliveryId ?? randomUUID(),
+      'linear-event': String(input.body.type),
+      'linear-signature': signature,
+    },
+    body: rawBody,
+  });
+}
+
+async function seedInstallation(input: {
+  connectionId: string;
+  organizationId: string;
+}): Promise<void> {
+  await upsertLinearInstallation({
+    connectionId: input.connectionId,
+    organizationId: input.organizationId,
+    organizationUrlKey: 'acme',
+    appUserId: 'app-user-1',
+    scopes: ['read', 'write'],
+    status: 'installed',
+  });
+}
+
+describe('Linear webhook processor', () => {
+  beforeEach(async () => {
+    await db().delete(linearInstallations);
+  });
+
+  it('accepts a delayed request that was valid when the adapter received it', async () => {
+    const connection = fakeConnection();
+    const receivedAt = new Date(Date.now() - 10 * 60_000).toISOString();
+    const webhookTimestamp = new Date(receivedAt).getTime();
+    const publishIntegrationEventReceived = vi.fn(() => Promise.resolve({published: true}));
+    const processor = createLinearWebhookProcessor({
+      coreDb: db,
+      publishIntegrationEventReceived,
+      recordDeliveryOnly: vi.fn(() => Promise.resolve()),
+      getIntegrationConnectionById: vi.fn(() => Promise.resolve(connection)),
+    });
+    await seedInstallation({connectionId: connection.id, organizationId: 'org-delayed'});
+    const request = signedRequest({
+      receivedAt,
+      body: {
+        action: 'create',
+        type: 'Issue',
+        organizationId: 'org-delayed',
+        webhookTimestamp,
+        data: {id: 'issue-1'},
+      },
+    });
+
+    const result = await processor.process(request);
+
+    expect(result).toMatchObject({outcome: 'processed'});
+    expect(publishIntegrationEventReceived).toHaveBeenCalledTimes(1);
+  });
+
+  it('discards a request that was stale when the adapter received it', async () => {
+    const receivedAt = new Date().toISOString();
+    const publishIntegrationEventReceived = vi.fn(() => Promise.resolve({published: true}));
+    const processor = createLinearWebhookProcessor({
+      coreDb: db,
+      publishIntegrationEventReceived,
+      recordDeliveryOnly: vi.fn(() => Promise.resolve()),
+      getIntegrationConnectionById: vi.fn(),
+    });
+    const request = signedRequest({
+      receivedAt,
+      body: {
+        action: 'create',
+        type: 'Issue',
+        organizationId: 'org-stale',
+        webhookTimestamp: new Date(receivedAt).getTime() - 60_001,
+        data: {id: 'issue-1'},
+      },
+    });
+
+    const result = await processor.process(request);
+
+    expect(result).toMatchObject({outcome: 'discarded', reason: 'stale_at_receipt'});
+    expect(publishIntegrationEventReceived).not.toHaveBeenCalled();
+  });
+
+  it('records and drops an unsupported signed event', async () => {
+    const connection = fakeConnection();
+    const receivedAt = new Date().toISOString();
+    const deliveryId = randomUUID();
+    const recordDeliveryOnly = vi.fn(() => Promise.resolve());
+    const processor = createLinearWebhookProcessor({
+      coreDb: db,
+      publishIntegrationEventReceived: vi.fn(() => Promise.resolve({published: true})),
+      recordDeliveryOnly,
+      getIntegrationConnectionById: vi.fn(() => Promise.resolve(connection)),
+    });
+    await seedInstallation({connectionId: connection.id, organizationId: 'org-unsupported'});
+    const request = signedRequest({
+      deliveryId,
+      receivedAt,
+      body: {
+        action: 'create',
+        type: 'Reaction',
+        organizationId: 'org-unsupported',
+        webhookTimestamp: new Date(receivedAt).getTime(),
+        data: {id: 'reaction-1'},
+      },
+    });
+
+    const result = await processor.process(request);
+
+    expect(result).toEqual({outcome: 'discarded', reason: 'unsupported_event', deliveryId});
+    expect(recordDeliveryOnly).toHaveBeenCalledWith(
+      expect.objectContaining({provider: 'linear', deliveryId}),
+    );
+  });
+});

package/src/core/webhook-processor.ts

@@ -0,0 +1,127 @@
+import {Buffer} from 'node:buffer';
+import {
+  decodeWebhookBody,
+  type GetIntegrationConnectionByIdFn,
+  type PublishIntegrationEventReceivedFn,
+  type RecordDeliveryOnlyFn,
+  type StoredWebhookRequest,
+  type WebhookProcessingResult,
+} from '@shipfox/api-integration-core-dto';
+import {
+  LINEAR_PROVIDER,
+  linearWebhookBaseEnvelopeSchema,
+} from '@shipfox/api-integration-linear-dto';
+import {verifyHexHmacSignature} from '@shipfox/node-fastify';
+import {logger} from '@shipfox/node-opentelemetry';
+import type {NodePgDatabase} from 'drizzle-orm/node-postgres';
+import {config} from '#config.js';
+import {handleLinearWebhook} from '#core/webhook.js';
+
+const DELIVERY_HEADER = 'linear-delivery';
+const EVENT_HEADER = 'linear-event';
+const SIGNATURE_HEADER = 'linear-signature';
+const WEBHOOK_REPLAY_WINDOW_MS = 60_000;
+
+export interface CreateLinearWebhookProcessorOptions {
+  coreDb: () => NodePgDatabase<Record<string, unknown>>;
+  publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;
+  recordDeliveryOnly: RecordDeliveryOnlyFn;
+  getIntegrationConnectionById: GetIntegrationConnectionByIdFn;
+}
+
+export interface LinearWebhookProcessor {
+  process(request: StoredWebhookRequest): Promise<WebhookProcessingResult>;
+}
+
+export function createLinearWebhookProcessor(
+  options: CreateLinearWebhookProcessorOptions,
+): LinearWebhookProcessor {
+  return {process: (request) => processLinearWebhookRequest(options, request)};
+}
+
+async function processLinearWebhookRequest(
+  options: CreateLinearWebhookProcessorOptions,
+  request: StoredWebhookRequest,
+): Promise<WebhookProcessingResult> {
+  if (request.route_id !== 'linear') {
+    throw new Error(`Linear processor cannot process ${request.route_id} requests`);
+  }
+
+  const deliveryId = request.headers[DELIVERY_HEADER];
+  const event = request.headers[EVENT_HEADER];
+  const signature = request.headers[SIGNATURE_HEADER];
+  if (!deliveryId || !event || !signature) {
+    return {outcome: 'discarded', reason: 'missing_required_input'};
+  }
+
+  const rawBody = Buffer.from(decodeWebhookBody(request.body));
+  if (
+    !verifyHexHmacSignature({
+      rawBody,
+      signature,
+      secret: config.LINEAR_WEBHOOK_SIGNING_SECRET,
+    })
+  ) {
+    return {outcome: 'discarded', reason: 'invalid_signature', deliveryId};
+  }
+
+  let rawPayload: unknown;
+  try {
+    rawPayload = JSON.parse(rawBody.toString('utf8'));
+  } catch (error) {
+    logger().warn({deliveryId, err: error}, 'linear webhook payload JSON parse failed');
+    return {outcome: 'discarded', reason: 'malformed_payload', deliveryId};
+  }
+
+  const payload = linearWebhookBaseEnvelopeSchema.safeParse(rawPayload);
+  if (!payload.success) {
+    logger().warn(
+      {deliveryId, issues: payload.error.issues},
+      'linear webhook envelope failed schema validation',
+    );
+    await recordSignedDeliveryOnly(options, deliveryId);
+    return {outcome: 'discarded', reason: 'unsupported_event', deliveryId};
+  }
+
+  const receivedAt = new Date(request.received_at).getTime();
+  if (Math.abs(receivedAt - payload.data.webhookTimestamp) > WEBHOOK_REPLAY_WINDOW_MS) {
+    return {outcome: 'discarded', reason: 'stale_at_receipt', deliveryId};
+  }
+
+  if (event !== payload.data.type) {
+    logger().warn(
+      {deliveryId, event, type: payload.data.type},
+      'linear webhook event header did not match payload type',
+    );
+    await recordSignedDeliveryOnly(options, deliveryId);
+    return {outcome: 'discarded', reason: 'unsupported_event', deliveryId};
+  }
+
+  const result = await options.coreDb().transaction(async (tx) =>
+    handleLinearWebhook({
+      tx,
+      deliveryId,
+      payload: payload.data,
+      rawPayload,
+      publishIntegrationEventReceived: options.publishIntegrationEventReceived,
+      recordDeliveryOnly: options.recordDeliveryOnly,
+      getIntegrationConnectionById: options.getIntegrationConnectionById,
+    }),
+  );
+
+  if (result.outcome === 'published') return {outcome: 'processed', deliveryId};
+  if (result.outcome === 'duplicate') return {outcome: 'duplicate', deliveryId};
+  if (result.outcome === 'unsupported-event') {
+    return {outcome: 'discarded', reason: 'unsupported_event', deliveryId};
+  }
+  return {outcome: 'discarded', reason: 'connection_unavailable', deliveryId};
+}
+
+async function recordSignedDeliveryOnly(
+  options: Pick<CreateLinearWebhookProcessorOptions, 'coreDb' | 'recordDeliveryOnly'>,
+  deliveryId: string,
+): Promise<void> {
+  await options.coreDb().transaction(async (tx) => {
+    await options.recordDeliveryOnly({tx, provider: LINEAR_PROVIDER, deliveryId});
+  });
+}

package/src/index.ts

@@ -3,6 +3,7 @@ import {createLinearApiClient, type LinearApiClient} from '#api/client.js';
 import {config} from '#config.js';
 import {LinearAgentToolsProvider} from '#core/agent-tools-provider.js';
 import type {LinearTokenStore} from '#core/tokens.js';
+import {createLinearWebhookProcessor} from '#core/webhook-processor.js';
 import {closeDb, db} from '#db/db.js';
 import {getLinearInstallationByConnectionId} from '#db/installations.js';
 import {migrationsPath} from '#db/migrations.js';
@@ -67,6 +68,11 @@ export {
 } from '#core/tokens.js';
 export type {HandleLinearWebhookOutcome, HandleLinearWebhookParams} from '#core/webhook.js';
 export {handleLinearWebhook} from '#core/webhook.js';
+export type {
+  CreateLinearWebhookProcessorOptions,
+  LinearWebhookProcessor,
+} from '#core/webhook-processor.js';
+export {createLinearWebhookProcessor} from '#core/webhook-processor.js';
 export type {
   LinearInstallation,
   LinearInstallationStatus,
@@ -124,6 +130,10 @@ export function createLinearIntegrationProvider(
         agent_tools: new LinearAgentToolsProvider(options.agentTools),
       }
     : {};
+  const webhookProcessor =
+    options.routes && hasLinearWebhookRoutesOptions(options.routes)
+      ? createLinearWebhookProcessor(options.routes)
+      : undefined;
 
   const routes = options.routes
     ? [
@@ -134,8 +144,8 @@ export function createLinearIntegrationProvider(
         }),
       ]
     : [];
-  if (options.routes && hasLinearWebhookRoutesOptions(options.routes)) {
-    routes.push(createLinearWebhookRoutes(options.routes));
+  if (options.routes && hasLinearWebhookRoutesOptions(options.routes) && webhookProcessor) {
+    routes.push(createLinearWebhookRoutes({...options.routes, processor: webhookProcessor}));
   }
 
   return {
@@ -149,6 +159,9 @@ export function createLinearIntegrationProvider(
     },
     ...options.cleanup,
     routes,
+    webhookProcessors: webhookProcessor
+      ? [{routeIds: ['linear'] as const, processor: webhookProcessor}]
+      : undefined,
   };
 }
 

package/src/presentation/routes/install.test.ts

@@ -16,12 +16,7 @@ import {verifyLinearInstallState} from '#core/state.js';
 import type {LinearTokenStore} from '#core/tokens.js';
 import {createLinearIntegrationProvider} from '#index.js';
 
-vi.mock('@shipfox/api-workspaces', () => ({
-  requireWorkspaceMembership: vi.fn(() => Promise.resolve()),
-}));
-
-const {requireWorkspaceMembership} = await import('@shipfox/api-workspaces');
-const requireWorkspaceMembershipMock = vi.mocked(requireWorkspaceMembership);
+const requireWorkspaceMembershipMock = vi.fn(() => Promise.resolve());
 let authenticatedMemberships: UserContextMembership[] = [];
 
 const fakeUserAuth: AuthMethod = {
@@ -120,6 +115,7 @@ async function createTestApp(options: CreateTestAppOptions = {}): Promise<Fastif
         ),
       disconnectLinearInstallation:
         options.disconnectLinearInstallation ?? vi.fn(() => Promise.resolve()),
+      requireActiveWorkspaceMembership: requireWorkspaceMembershipMock,
     },
   });
   const app = await createApp({

package/src/presentation/routes/install.ts

@@ -7,7 +7,6 @@ import {
   linearCallbackQuerySchema,
   linearCallbackResponseSchema,
 } from '@shipfox/api-integration-linear-dto';
-import {requireWorkspaceMembership} from '@shipfox/api-workspaces';
 import {defineRoute, type RouteGroup} from '@shipfox/node-fastify';
 import type {LinearApiClient} from '#api/client.js';
 import {config} from '#config.js';
@@ -33,6 +32,11 @@ export interface CreateLinearIntegrationRoutesOptions {
   ) => Promise<IntegrationConnection<'linear'>>;
   disconnectLinearInstallation: (input: {connectionId: string}) => Promise<void>;
   connectionCapabilities: IntegrationCapability[];
+  requireActiveWorkspaceMembership?: (input: {
+    workspaceId: string;
+    userId: string;
+    memberships: ReadonlyArray<import('@shipfox/api-auth-context').UserContextMembership>;
+  }) => Promise<unknown>;
 }
 
 export function createLinearIntegrationRoutes({
@@ -42,6 +46,7 @@ export function createLinearIntegrationRoutes({
   connectLinearInstallation,
   disconnectLinearInstallation,
   connectionCapabilities,
+  requireActiveWorkspaceMembership,
 }: CreateLinearIntegrationRoutesOptions): RouteGroup {
   const createInstallRoute = defineRoute({
     method: 'POST',
@@ -95,7 +100,8 @@ export function createLinearIntegrationRoutes({
           errorDescription: query.error_description,
           sessionUserId: actor.userId,
           sessionMemberships: actor.memberships,
-          requireWorkspaceMembership,
+          requireWorkspaceMembership:
+            requireActiveWorkspaceMembership ?? unavailableWorkspaceMembershipCheck,
         });
       }
       const connection = await handleLinearCallback({
@@ -105,7 +111,8 @@ export function createLinearIntegrationRoutes({
         state: query.state,
         sessionUserId: actor.userId,
         sessionMemberships: actor.memberships,
-        requireWorkspaceMembership,
+        requireWorkspaceMembership:
+          requireActiveWorkspaceMembership ?? unavailableWorkspaceMembershipCheck,
         getExistingLinearConnection,
         connectLinearInstallation,
         disconnectLinearInstallation,
@@ -121,6 +128,14 @@ export function createLinearIntegrationRoutes({
   };
 }
 
+function unavailableWorkspaceMembershipCheck(_input: {
+  workspaceId: string;
+  userId: string;
+  memberships: ReadonlyArray<import('@shipfox/api-auth-context').UserContextMembership>;
+}): Promise<never> {
+  return Promise.reject(new Error('Workspaces inter-module client is not configured'));
+}
+
 function isLinearOAuthErrorCallback(
   query: LinearCallbackQueryDto,
 ): query is LinearCallbackQueryDto & {

package/src/presentation/routes/webhooks.test.ts

@@ -1,5 +1,6 @@
 import {createHmac, randomUUID} from 'node:crypto';
 import type {IntegrationConnection} from '@shipfox/api-integration-core-dto';
+import {WEBHOOK_MAX_RAW_BODY_BYTES} from '@shipfox/api-integration-core-dto';
 import {closeApp, createApp} from '@shipfox/node-fastify';
 import type {FastifyInstance} from 'fastify';
 import {db} from '#db/db.js';
@@ -267,6 +268,42 @@ describe('Linear webhook route', () => {
     expect(recordDeliveryOnly).not.toHaveBeenCalled();
   });
 
+  it('rejects a body too large for the shared webhook request before processing it', async () => {
+    const {app, publishIntegrationEventReceived, recordDeliveryOnly} = await createTestApp();
+    const body = 'a'.repeat(WEBHOOK_MAX_RAW_BODY_BYTES + 1);
+
+    const res = await app.inject({
+      method: 'POST',
+      url: '/webhooks/integrations/linear',
+      headers: signedHeaders(body, 'Issue', randomUUID()),
+      payload: body,
+    });
+
+    expect(res.statusCode).toBe(413);
+    expect(res.json()).toEqual({code: 'body-too-large'});
+    expect(publishIntegrationEventReceived).not.toHaveBeenCalled();
+    expect(recordDeliveryOnly).not.toHaveBeenCalled();
+  });
+
+  it('rejects invalid stored request metadata before processing it', async () => {
+    const {app, publishIntegrationEventReceived, recordDeliveryOnly} = await createTestApp();
+    const body = JSON.stringify(linearPayload());
+    const headers = signedHeaders(body, 'Issue', randomUUID());
+    headers['linear-event'] = 'a'.repeat(8 * 1024 + 1);
+
+    const res = await app.inject({
+      method: 'POST',
+      url: '/webhooks/integrations/linear',
+      headers,
+      payload: body,
+    });
+
+    expect(res.statusCode).toBe(400);
+    expect(res.json()).toEqual({code: 'invalid-webhook-request'});
+    expect(publishIntegrationEventReceived).not.toHaveBeenCalled();
+    expect(recordDeliveryOnly).not.toHaveBeenCalled();
+  });
+
   it('rejects malformed JSON after signature verification', async () => {
     const {app, publishIntegrationEventReceived, recordDeliveryOnly} = await createTestApp();
     const body = '{"type":';