tapimo 0.5.3 → 0.7.0

package/src/internal/Webhooks.test.ts

@@ -78,6 +78,45 @@ describe('createSubscription', () => {
     )
   })
 
+  test('counts paused subscriptions toward the live subscription cap', async () => {
+    const db = TestApp.database()
+    const created = await Webhooks.createSubscription(db, createInput(), { maxPerOwner: 1 })
+    await Webhooks.updateSubscription(db, apiKeyOwner, created.id, { status: 'paused' })
+
+    await expect(
+      Webhooks.createSubscription(db, createInput(), { maxPerOwner: 1 }),
+    ).rejects.toBeInstanceOf(Webhooks.LimitExceededError)
+    await Webhooks.deleteSubscription(db, apiKeyOwner, created.id)
+    await expect(
+      Webhooks.createSubscription(db, createInput(), { maxPerOwner: 1 }),
+    ).resolves.toMatchObject({ status: 'active' })
+  })
+
+  test('enforces the per-owner cap across concurrent creates', async () => {
+    const getDb = TestApp.databaseFactory()
+    const results = await Promise.allSettled(
+      Array.from({ length: 8 }, () =>
+        Webhooks.createSubscription(getDb(), createInput(), { maxPerOwner: 3 }),
+      ),
+    )
+
+    expect(results.map((result) => result.status).sort()).toMatchInlineSnapshot(`
+      [
+        "fulfilled",
+        "fulfilled",
+        "fulfilled",
+        "rejected",
+        "rejected",
+        "rejected",
+        "rejected",
+        "rejected",
+      ]
+    `)
+    for (const result of results)
+      if (result.status === 'rejected') expect(result.reason).toBeInstanceOf(Webhooks.LimitExceededError) // prettier-ignore
+    expect(await Webhooks.listSubscriptions(getDb(), apiKeyOwner)).toHaveLength(3)
+  })
+
   test('rejects an undeliverable URL before persisting', async () => {
     const db = TestApp.database()
     await expect(
@@ -204,6 +243,27 @@ describe('updateSubscription', () => {
       `[Webhooks.InvalidUrlError: Webhook URL rejected (protocol): http://10.0.0.1]`,
     )
   })
+
+  test('requires recreation before activating URL signing for a provider destination', async () => {
+    const db = TestApp.database()
+    const created = await Webhooks.createSubscription(
+      db,
+      createInput({
+        destination: {
+          type: 'slack',
+          url: 'https://hooks.slack.com/services/T000/B000/xxxx',
+        },
+      }),
+    )
+
+    await expect(
+      Webhooks.updateSubscription(db, apiKeyOwner, created.id, {
+        destination: { type: 'url', url: 'https://hooks.example.com/v2' },
+      }),
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[Webhooks.InvalidDestinationTransitionError: Create a new webhook to change a provider-managed destination to an HTTPS endpoint.]`,
+    )
+  })
 })
 
 describe('listActive', () => {
@@ -548,6 +608,86 @@ describe('delivery log', () => {
     `)
   })
 
+  test('deliverCurrentAndRecord skips paused and deleted queued subscriptions', async () => {
+    const db = TestApp.database()
+    const paused = await Webhooks.createSubscription(db, createInput())
+    const removed = await Webhooks.createSubscription(db, createInput())
+    const pausedEnvelope = Webhooks.buildEnvelope({
+      blockNumber: 1,
+      data: { amount: '1' },
+      logIndex: 0,
+      subscription: paused,
+    })
+    const removedEnvelope = Webhooks.buildEnvelope({
+      blockNumber: 1,
+      data: { amount: '1' },
+      logIndex: 1,
+      subscription: removed,
+    })
+    await Webhooks.updateSubscription(db, apiKeyOwner, paused.id, { status: 'paused' })
+    await Webhooks.deleteSubscription(db, apiKeyOwner, removed.id)
+    let requests = 0
+    const fetch = (async () => {
+      requests++
+      return new Response(null, { status: 200 })
+    }) satisfies typeof globalThis.fetch
+
+    await expect(
+      Webhooks.deliverCurrentAndRecord(db, paused, pausedEnvelope, { fetch }),
+    ).resolves.toEqual({ status: 'skipped' })
+    await expect(
+      Webhooks.deliverCurrentAndRecord(db, removed, removedEnvelope, { fetch }),
+    ).resolves.toEqual({ status: 'skipped' })
+    expect(requests).toBe(0)
+  })
+
+  test('deliverCurrentAndRecord uses the current destination and secret', async () => {
+    const db = TestApp.database()
+    const created = await Webhooks.createSubscription(db, createInput())
+    const envelope = Webhooks.buildEnvelope({
+      blockNumber: 1,
+      data: { amount: '1' },
+      logIndex: 0,
+      subscription: created,
+    })
+    const current = await Webhooks.updateSubscription(db, apiKeyOwner, created.id, {
+      destination: { type: 'url', url: 'https://hooks.example.com/current' },
+    })
+    const queued = { ...created, secret: `whsec_${'ff'.repeat(32)}` }
+    const captured: { body: string; signature: string | null; url: string } = {
+      body: '',
+      signature: null,
+      url: '',
+    }
+    const fetch = (async (input, init) => {
+      captured.body = typeof init?.body === 'string' ? init.body : ''
+      captured.signature = new Headers(init?.headers).get(Webhooks.signatureHeader)
+      captured.url = input instanceof Request ? input.url : input.toString()
+      return new Response(null, { status: 200 })
+    }) satisfies typeof globalThis.fetch
+
+    const delivery = await Webhooks.deliverCurrentAndRecord(db, queued, envelope, { fetch })
+
+    expect(delivery.status).toBe('delivered')
+    expect(captured.url).toBe('https://hooks.example.com/current')
+    expect(
+      Webhooks.verify({
+        body: captured.body,
+        secret: current!.secret,
+        signature: captured.signature ?? '',
+        tolerance: Number.POSITIVE_INFINITY,
+      }),
+    ).toBe(true)
+    expect(
+      Webhooks.verify({
+        body: captured.body,
+        secret: queued.secret,
+        signature: captured.signature ?? '',
+        tolerance: Number.POSITIVE_INFINITY,
+      }),
+    ).toBe(false)
+  })
+
   test('deleteSubscription removes the delivery log', async () => {
     const db = TestApp.database()
     const created = await Webhooks.createSubscription(db, createInput())

package/src/internal/Webhooks.ts

@@ -161,8 +161,8 @@ export type Delivery = {
 
 /**
  * Creates a subscription, validating its URL and (optionally) enforcing a
- * per-owner cap, then persists it. The cap check stays best-effort (count then
- * insert, non-transactional) — parity with the old store behavior.
+ * per-owner cap, then persists it. Capped writes serialize per owner so
+ * concurrent requests cannot exceed the limit.
  */
 export async function createSubscription(
   db: Db.Db,
@@ -174,11 +174,6 @@ export async function createSubscription(
   const now = (options.now ?? (() => new Date()))()
   const iso = now.toISOString()
 
-  if (options.maxPerOwner !== undefined) {
-    const existing = await WebhookSubscriptions.count(db, input.owner, iso)
-    if (existing >= options.maxPerOwner) throw new LimitExceededError(options.maxPerOwner)
-  }
-
   const subscription: Subscription = {
     chainId: input.chainId,
     ...(input.context === undefined ? {} : { context: input.context }),
@@ -197,14 +192,20 @@ export async function createSubscription(
       : { expiresAt: new Date(now.getTime() + input.ttl).toISOString() }),
   }
 
-  await WebhookSubscriptions.insert(db, subscription)
+  if (options.maxPerOwner !== undefined) {
+    const inserted = await WebhookSubscriptions.insertWithinLimit(db, subscription, {
+      maxPerOwner: options.maxPerOwner,
+      now: iso,
+    })
+    if (!inserted) throw new LimitExceededError(options.maxPerOwner)
+  } else await WebhookSubscriptions.insert(db, subscription)
   return subscription
 }
 
 export declare namespace createSubscription {
   /** Options for {@link createSubscription}. */
   type Options = {
-    /** Reject creation once the owner has this many subscriptions. */
+    /** Reject creation once the owner has this many live subscriptions. */
     maxPerOwner?: number | undefined
     /** Clock used for timestamps (injectable for tests). */
     now?: (() => Date) | undefined
@@ -268,6 +269,8 @@ export async function updateSubscription(
   const current = await getSubscription(db, owner, id)
   if (!current) return null
 
+  if (current.destination.type !== 'url' && patch.destination?.type === 'url')
+    throw new InvalidDestinationTransitionError()
   if (patch.destination !== undefined) WebhookDestination.assertDestination(patch.destination)
 
   const now = (options.now ?? (() => new Date()))()
@@ -550,6 +553,39 @@ export declare namespace deliverAndRecord {
   }
 }
 
+/**
+ * Re-resolves an enqueued subscription before delivery. Missing or inactive
+ * subscriptions are skipped; delivery uses the current destination and secret.
+ */
+export async function deliverCurrentAndRecord(
+  db: Db.Db,
+  queued: Subscription,
+  envelope: Envelope,
+  options: deliverAndRecord.Options = {},
+): Promise<deliverCurrentAndRecord.Result> {
+  const subscription = await getSubscription(db, queued.owner, queued.id)
+  if (!subscription || subscription.status !== 'active') return { status: 'skipped' }
+  return {
+    result: await deliverAndRecord(db, subscription, envelope, options),
+    status: 'delivered',
+  }
+}
+
+export declare namespace deliverCurrentAndRecord {
+  /** Authoritative delivery outcome, or a skipped stale queue message. */
+  type Result =
+    | {
+        /** Transport result from the current subscription state. */
+        result: WebhookDestination.Result
+        /** The current subscription was delivered. */
+        status: 'delivered'
+      }
+    | {
+        /** The queued subscription is absent or inactive. */
+        status: 'skipped'
+      }
+}
+
 /** Builds a delivery-log row from an attempt's envelope and classified result. */
 function buildDelivery(
   input: {
@@ -783,6 +819,14 @@ export class LimitExceededError extends Error {
   }
 }
 
+/** Thrown when an update would activate URL signing with an unrecoverable secret. */
+export class InvalidDestinationTransitionError extends Error {
+  constructor() {
+    super('Create a new webhook to change a provider-managed destination to an HTTPS endpoint.')
+    this.name = 'Webhooks.InvalidDestinationTransitionError'
+  }
+}
+
 /**
  * Thrown when a subscription's `filters` fail to validate against the schema for
  * its `eventType`. The detection path treats stored filters as **fail-closed**: