paygate-mcp 3.7.0 → 3.8.0

package/dist/server.js

@@ -183,7 +183,7 @@ class PayGateServer {
             this.audit.log('key.auto_topped_up', 'system', `Auto-topup: added ${amount} credits`, {
                 keyMasked, creditsAdded: amount, newBalance,
             });
-            this.gate.webhook?.emitAdmin('key.auto_topped_up', 'system', {
+            this.emitWebhookAdmin('key.auto_topped_up', 'system', {
                 keyMasked, creditsAdded: amount, newBalance,
             });
             // Sync to Redis (if configured)
@@ -373,6 +373,16 @@ class PayGateServer {
                 break;
             case '/webhooks/stats':
                 return this.handleWebhookStats(req, res);
+            case '/webhooks/filters':
+                if (req.method === 'GET')
+                    return this.handleListWebhookFilters(req, res);
+                if (req.method === 'POST')
+                    return this.handleCreateWebhookFilter(req, res);
+                break;
+            case '/webhooks/filters/update':
+                return this.handleUpdateWebhookFilter(req, res);
+            case '/webhooks/filters/delete':
+                return this.handleDeleteWebhookFilter(req, res);
             // ─── Team management endpoints ────────────────────────────────────
             case '/teams':
                 if (req.method === 'GET')
@@ -611,7 +621,7 @@ class PayGateServer {
                 const fired = this.alerts.check(apiKey, keyRecord, { rateLimitDenied: isRateLimited });
                 // Send alert events via webhook
                 for (const alert of fired) {
-                    this.gate.webhook?.emitAdmin('alert.fired', 'system', {
+                    this.emitWebhookAdmin('alert.fired', 'system', {
                         alertType: alert.type,
                         keyPrefix: alert.keyPrefix,
                         keyName: alert.keyName,
@@ -825,6 +835,9 @@ class PayGateServer {
                 alerts: 'GET /alerts — Get pending alerts + POST /alerts — Configure alert rules (requires X-Admin-Key)',
                 webhookDeadLetters: 'GET /webhooks/dead-letter — View failed webhook deliveries + DELETE to clear (requires X-Admin-Key)',
                 webhookStats: 'GET /webhooks/stats — Webhook delivery statistics (requires X-Admin-Key)',
+                webhookFilters: 'GET|POST /webhooks/filters — List or create webhook filter rules (requires X-Admin-Key)',
+                updateWebhookFilter: 'POST /webhooks/filters/update — Update a webhook filter rule (requires X-Admin-Key)',
+                deleteWebhookFilter: 'POST /webhooks/filters/delete — Delete a webhook filter rule (requires X-Admin-Key)',
                 teams: 'GET /teams — List teams + POST /teams — Create team (requires X-Admin-Key)',
                 teamsUpdate: 'POST /teams/update — Update team (requires X-Admin-Key)',
                 teamsDelete: 'POST /teams/delete — Delete team (requires X-Admin-Key)',
@@ -964,7 +977,7 @@ class PayGateServer {
             deniedTools: record.deniedTools,
             expiresAt: record.expiresAt,
         });
-        this.gate.webhook?.emitAdmin('key.created', 'admin', {
+        this.emitWebhookAdmin('key.created', 'admin', {
             keyMasked: (0, audit_1.maskKeyForAudit)(record.key), name, credits,
         });
         res.writeHead(201, { 'Content-Type': 'application/json' });
@@ -1040,7 +1053,7 @@ class PayGateServer {
             creditsAdded: credits,
             newBalance: record?.credits,
         });
-        this.gate.webhook?.emitAdmin('key.topup', 'admin', {
+        this.emitWebhookAdmin('key.topup', 'admin', {
             keyMasked: (0, audit_1.maskKeyForAudit)(params.key), creditsAdded: credits, newBalance: record?.credits,
         });
         res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -1086,7 +1099,7 @@ class PayGateServer {
         this.audit.log('key.revoked', 'admin', `Key revoked`, {
             keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
         });
-        this.gate.webhook?.emitAdmin('key.revoked', 'admin', {
+        this.emitWebhookAdmin('key.revoked', 'admin', {
             keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
         });
         res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -1132,7 +1145,7 @@ class PayGateServer {
             oldKeyMasked: (0, audit_1.maskKeyForAudit)(params.key),
             newKeyMasked: (0, audit_1.maskKeyForAudit)(rotated.key),
         });
-        this.gate.webhook?.emitAdmin('key.rotated', 'admin', {
+        this.emitWebhookAdmin('key.rotated', 'admin', {
             oldKeyMasked: (0, audit_1.maskKeyForAudit)(params.key),
             newKeyMasked: (0, audit_1.maskKeyForAudit)(rotated.key),
         });
@@ -1479,7 +1492,7 @@ class PayGateServer {
             keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
             threshold, amount, maxDaily,
         });
-        this.gate.webhook?.emitAdmin('key.auto_topup_configured', 'admin', {
+        this.emitWebhookAdmin('key.auto_topup_configured', 'admin', {
             keyMasked: (0, audit_1.maskKeyForAudit)(params.key), threshold, amount, maxDaily,
         });
         res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -2084,13 +2097,151 @@ class PayGateServer {
             return;
         }
         const stats = this.gate.webhook.getRetryStats();
+        const routerStats = this.gate.webhookRouter ? this.gate.webhookRouter.getAggregateStats() : null;
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({
             configured: true,
             maxRetries: this.gate.webhook.maxRetries,
             ...stats,
+            ...(routerStats ? { filters: routerStats } : {}),
         }));
     }
+    // ─── /webhooks/filters — Webhook filter CRUD ─────────────────────────────
+    handleListWebhookFilters(req, res) {
+        if (!this.checkAdmin(req, res))
+            return;
+        if (!this.gate.webhookRouter) {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ count: 0, filters: [], message: 'No webhook router configured' }));
+            return;
+        }
+        const filters = this.gate.webhookRouter.listRules();
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ count: filters.length, filters }));
+    }
+    async handleCreateWebhookFilter(req, res) {
+        if (!this.checkAdmin(req, res, 'admin'))
+            return;
+        if (!this.gate.webhookRouter) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'No webhook configured. Set webhookUrl or webhookFilters to enable webhook routing.' }));
+            return;
+        }
+        const body = await this.readBody(req);
+        let params;
+        try {
+            params = JSON.parse(body);
+        }
+        catch {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid JSON' }));
+            return;
+        }
+        try {
+            const rule = this.gate.webhookRouter.addRule({
+                id: '', // auto-generated
+                name: String(params.name || ''),
+                events: Array.isArray(params.events) ? params.events.map(String) : [],
+                url: String(params.url || ''),
+                secret: params.secret ? String(params.secret) : undefined,
+                keyPrefixes: Array.isArray(params.keyPrefixes) ? params.keyPrefixes.map(String) : undefined,
+                active: params.active !== false,
+            });
+            this.audit.log('webhook_filter.created', 'admin', `Webhook filter created: ${rule.name}`, { filterId: rule.id, name: rule.name });
+            res.writeHead(201, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(rule));
+        }
+        catch (err) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: err.message }));
+        }
+    }
+    async handleUpdateWebhookFilter(req, res) {
+        if (req.method !== 'POST') {
+            res.writeHead(405, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Method not allowed. Use POST.' }));
+            return;
+        }
+        if (!this.checkAdmin(req, res, 'admin'))
+            return;
+        if (!this.gate.webhookRouter) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'No webhook router configured' }));
+            return;
+        }
+        const body = await this.readBody(req);
+        let params;
+        try {
+            params = JSON.parse(body);
+        }
+        catch {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid JSON' }));
+            return;
+        }
+        const filterId = String(params.id || '');
+        if (!filterId) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Missing id field' }));
+            return;
+        }
+        try {
+            const rule = this.gate.webhookRouter.updateRule(filterId, {
+                name: params.name !== undefined ? String(params.name) : undefined,
+                events: Array.isArray(params.events) ? params.events.map(String) : undefined,
+                url: params.url !== undefined ? String(params.url) : undefined,
+                secret: params.secret !== undefined ? String(params.secret) : undefined,
+                keyPrefixes: Array.isArray(params.keyPrefixes) ? params.keyPrefixes.map(String) : undefined,
+                active: params.active !== undefined ? Boolean(params.active) : undefined,
+            });
+            this.audit.log('webhook_filter.updated', 'admin', `Webhook filter updated: ${rule.name}`, { filterId: rule.id });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(rule));
+        }
+        catch (err) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: err.message }));
+        }
+    }
+    async handleDeleteWebhookFilter(req, res) {
+        if (req.method !== 'POST') {
+            res.writeHead(405, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Method not allowed. Use POST.' }));
+            return;
+        }
+        if (!this.checkAdmin(req, res, 'admin'))
+            return;
+        if (!this.gate.webhookRouter) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'No webhook router configured' }));
+            return;
+        }
+        const body = await this.readBody(req);
+        let params;
+        try {
+            params = JSON.parse(body);
+        }
+        catch {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid JSON' }));
+            return;
+        }
+        const filterId = String(params.id || '');
+        if (!filterId) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Missing id field' }));
+            return;
+        }
+        const deleted = this.gate.webhookRouter.deleteRule(filterId);
+        if (!deleted) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Filter not found' }));
+            return;
+        }
+        this.audit.log('webhook_filter.deleted', 'admin', `Webhook filter deleted: ${filterId}`, { filterId });
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: true, message: `Filter ${filterId} deleted` }));
+    }
     // ─── /audit — Query audit log ─────────────────────────────────────────────
     handleAudit(req, res) {
         if (req.method !== 'GET') {
@@ -2881,7 +3032,7 @@ class PayGateServer {
             newKeyMasked: record.key.slice(0, 7) + '...' + record.key.slice(-4),
             role,
         });
-        this.gate.webhook?.emitAdmin('admin_key.created', callerMasked, {
+        this.emitWebhookAdmin('admin_key.created', callerMasked, {
             newKeyMasked: record.key.slice(0, 7) + '...' + record.key.slice(-4),
             name: params.name,
             role,
@@ -2935,7 +3086,7 @@ class PayGateServer {
         this.audit.log('admin_key.revoked', callerMasked, `Revoked admin key ${targetMasked}`, {
             revokedKeyMasked: targetMasked,
         });
-        this.gate.webhook?.emitAdmin('admin_key.revoked', callerMasked, {
+        this.emitWebhookAdmin('admin_key.revoked', callerMasked, {
             revokedKeyMasked: targetMasked,
         });
         res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -2946,6 +3097,17 @@ class PayGateServer {
      * (setAcl, setExpiry, setQuota, setTags, setIpAllowlist, setSpendingLimit).
      * Fire-and-forget: errors logged, never thrown.
      */
+    /**
+     * Route admin webhook events through the WebhookRouter (for filter rules) or direct emitter.
+     */
+    emitWebhookAdmin(type, actor, metadata = {}) {
+        if (this.gate.webhookRouter) {
+            this.gate.webhookRouter.emitAdmin(type, actor, metadata);
+        }
+        else if (this.gate.webhook) {
+            this.gate.webhook.emitAdmin(type, actor, metadata);
+        }
+    }
     syncKeyMutation(apiKey) {
         if (!this.redisSync)
             return;