lorebase-keeper 0.2.3__py3-none-any.whl

lorebase_keeper/routes/vault.py

@@ -0,0 +1,332 @@
+"""Erasure of personal data held in the vault (design 13.5, AC-22).
+
+`POST /domains/{d}/vault/erase` erases the vaulted values of one data subject, needing
+`pii.erase` on the whole Domain (only `admin` holds it among the built-in roles):
+
+- by Record: `kind` and `key`, optionally limited to some vault `attributes`; every value the
+  Record ever held in them, under every key it had (key changes), on every branch and Revision;
+- by value: `kind`, a vault `attribute` and the `value`; every Record of the Kind holding it
+  or a case variant of it (same matching form, `lorebase_core.types.matching`), on every branch
+  and Revision.
+
+Revisions keep their hashes and structure: Record objects hold tokens, and reads of an erased
+token answer `keeper.reads.sensitivity.erased_value`. Erasing again changes nothing (`erased`
+counts the values erased by this request). A later write of an erased value is stored erased,
+refused or stored again, as `vault.erased_values` says. The erasure and its audit entry (action
+`vault.erase`, with the Kind, a keyed digest of the key (`lorebase_store.digests`) or the
+Attribute, and the count, never the key or the value) commit in one transaction. Attribute and
+Kind names are read in the schema of `branch` (default: the Domain's default branch).
+
+Vault keys rotate (`lorebase_store.vault.rotation`), under `vault.manage`, which installation
+administrators hold: `GET /vault/keys` counts the rows stored under each encryption key and
+fingerprint key and tells which earlier keys no row uses any more; `POST /vault/rotate` queues
+the `vault.rotate` job that makes the outdated rows of every Domain again under the current
+keys, in batches, continuing where it stopped.
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Annotated, Any, Literal, Self
+
+from fastapi import APIRouter, Depends, Request
+from pydantic import BaseModel, Field, JsonValue, model_validator
+
+from lorebase_core.model import Kind, Schema
+from lorebase_core.types import EncodingError, encode_value
+from lorebase_keeper.auth.audit import annotate, suppress
+from lorebase_keeper.auth.deps import Access, require, require_installation
+from lorebase_keeper.auth.permissions import Permission
+from lorebase_keeper.context import StoreDep, require_domain
+from lorebase_keeper.errors import (
+    CONFLICT,
+    NOT_FOUND,
+    UNAVAILABLE,
+    Problem,
+    ProblemError,
+    ValidationProblem,
+)
+from lorebase_keeper.reading.problems import invalid
+from lorebase_store.auth import AuditRepository, NewAuditEntry
+from lorebase_store.commit.schema import load_compiled
+from lorebase_store.jobs import VAULT_ROTATE_JOB, enqueue_job
+from lorebase_store.repositories import MaterializedRepository
+from lorebase_store.vault import erase_matching, erase_record, usage
+from lorebase_store.vault.store import VaultLockTimeoutError
+
+router = APIRouter(tags=["vault"])
+log = logging.getLogger("lorebase.keeper.vault")
+
+ERASE_ACTION = "vault.erase"
+KEY_DIGEST = "erased_record_key"
+"""Purpose of the keyed digest of `<kind id>/<key>` held by the audit entry of an erasure."""
+
+_ERRORS: dict[int | str, dict[str, Any]] = {
+    403: {"model": Problem, "description": "The caller lacks pii.erase on the Domain."},
+    404: {"model": Problem, "description": "Domain, branch or Kind not found."},
+    409: {"model": Problem, "description": "Erasure by value needs the vault keys."},
+    503: {"model": Problem, "description": "The vault of the Domain stayed locked."},
+    422: {"model": ValidationProblem, "description": "Invalid request."},
+}
+
+Erase = Annotated[Access, Depends(require(Permission.PII_ERASE))]
+Manage = Annotated[Access, Depends(require_installation(Permission.VAULT_MANAGE))]
+
+ROTATE_ACTION = "vault.rotate"
+
+_KEY_ERRORS: dict[int | str, dict[str, Any]] = {
+    403: {"model": Problem, "description": "The caller is not an installation administrator."},
+    409: {"model": Problem, "description": "The vault is not configured."},
+}
+
+
+class EraseIn(BaseModel):
+    """Whose values to erase: a Record (`key`, optional `attributes`) or a value
+    (`attribute` and `value`)."""
+
+    kind: str = Field(description="Kind api name.")
+    key: str | None = Field(default=None, description="Key of the Record whose values to erase.")
+    attributes: list[str] | None = Field(
+        default=None,
+        min_length=1,
+        description="With `key`: only these vault Attributes (api names); default: all.",
+    )
+    attribute: str | None = Field(
+        default=None, description="Vault Attribute (api name) whose `value` to erase."
+    )
+    value: JsonValue = Field(
+        default=None, description="With `attribute`: the value to erase in every Record."
+    )
+    branch: str | None = Field(
+        default=None, description="Branch whose schema names Kinds and Attributes."
+    )
+
+    @model_validator(mode="after")
+    def _one_subject(self) -> Self:
+        by_key = self.key is not None
+        by_value = self.attribute is not None
+        if by_key == by_value:
+            raise ValueError("give either key (and attributes) or attribute and value")
+        if by_value and (self.value is None or self.attributes is not None):
+            raise ValueError("erasure by value takes attribute and value only")
+        return self
+
+
+class EraseOut(BaseModel):
+    domain: str
+    kind: str
+    mode: Literal["record", "value"]
+    erased: int = Field(description="Vault values erased by this request.")
+    unopenable: int = Field(
+        default=0,
+        description="Rows looked at that are sealed under a key no longer configured: their "
+        "fingerprints could not be made again, so a case variant among them may be missed.",
+    )
+
+
+@router.post(
+    "/domains/{domain_id}/vault/erase",
+    summary="Erase personal data from the vault",
+    response_model=EraseOut,
+    responses=_ERRORS,
+)
+async def erase(
+    domain_id: str, body: EraseIn, access: Erase, store: StoreDep, request: Request
+) -> EraseOut:
+    """Erase the vaulted values of a Record or a value in a Kind, on every Revision."""
+    annotate(request, action=ERASE_ACTION, target=body.kind)
+    try:
+        async with store.sessions() as session, session.begin():
+            domain = await require_domain(session, domain_id)
+            branch = body.branch or domain.default_branch
+            compiled = await MaterializedRepository(
+                session, domain_id, branch, writes=store.runtime.settings.writes
+            ).schema()
+            if compiled is None:
+                raise ProblemError(NOT_FOUND, f"Branch {branch!r} not found or not materialized.")
+            schema = load_compiled(compiled.compiled)
+            kind = _kind(schema, body.kind)
+            at = store.clock()
+            if body.key is not None:
+                attribute_ids = (
+                    None
+                    if body.attributes is None
+                    else [
+                        _vault_attribute(kind, name, f"/body/attributes/{index}")
+                        for index, name in enumerate(body.attributes)
+                    ]
+                )
+                erasure = await erase_record(
+                    session,
+                    domain_id,
+                    kind.id,
+                    body.key,
+                    attribute_ids,
+                    keys=store.runtime.vault,
+                    at=at,
+                    lock_timeout_ms=store.runtime.vault_settings.erase_lock_timeout_ms,
+                )
+                mode: Literal["record", "value"] = "record"
+                digests = await store.runtime.digests.ready(session)
+                key_digest = digests.digest(domain_id, KEY_DIGEST, f"{kind.id}/{body.key}".encode())
+                target = f"{kind.api_name}/#{key_digest[:16]}"
+                details: dict[str, Any] = {"kind": kind.id, "key_digest": key_digest}
+                if body.attributes is not None:
+                    details["attributes"] = attribute_ids
+            else:
+                assert body.attribute is not None
+                attribute_id = _vault_attribute(kind, body.attribute, "/body/attribute")
+                keys = store.runtime.vault
+                if keys is None:
+                    raise ProblemError(
+                        CONFLICT, "Erasure by value needs vault.token_key and vault.encryption_key."
+                    )
+                try:
+                    canonical = encode_value(kind.attributes[attribute_id].type, body.value)
+                except EncodingError as error:
+                    raise invalid("/body/value", str(error), "value_invalid") from None
+                erasure = await erase_matching(
+                    session,
+                    domain_id,
+                    kind.id,
+                    attribute_id,
+                    canonical,
+                    keys,
+                    at=at,
+                    lock_timeout_ms=store.runtime.vault_settings.erase_lock_timeout_ms,
+                )
+                mode = "value"
+                target = f"{kind.api_name}.{body.attribute}"
+                details = {"kind": kind.id, "attribute": attribute_id}
+            details["erased"] = erasure.erased
+            if erasure.unopenable:
+                details["unopenable"] = erasure.unopenable
+            if erasure.linked:
+                # Flagged for an administrator: the subject's keys were changed unusually often.
+                details["linked_keys"] = erasure.keys
+                log.warning(
+                    "erasure followed many key changes",
+                    extra={"domain_id": domain_id, "kind": kind.id, "linked_keys": erasure.keys},
+                )
+            await AuditRepository(session).append(
+                NewAuditEntry(
+                    actor=access.principal.id,
+                    action=ERASE_ACTION,
+                    domain_id=domain_id,
+                    target=target,
+                    details={"mode": mode, **details},
+                    at=at,
+                )
+            )
+    except VaultLockTimeoutError as error:
+        raise ProblemError(
+            UNAVAILABLE,
+            f"{error}; retry later.",
+            headers={"Retry-After": "5"},
+        ) from None
+    # The entry above is the audit record of the erasure; the request's own entry would repeat it.
+    suppress(request)
+    return EraseOut(
+        domain=domain_id,
+        kind=kind.api_name,
+        mode=mode,
+        erased=erasure.erased,
+        unopenable=erasure.unopenable,
+    )
+
+
+class VaultKeysOut(BaseModel):
+    """Which keys the vault rows use."""
+
+    key_id: str = Field(description="Encryption key new values are sealed under.")
+    token_key_id: str = Field(description="Token key new tokens and fingerprints use.")
+    fingerprint_key: str = Field(description="Current fingerprint key: token key id/scheme.")
+    encryption_keys: dict[str, int] = Field(description="Live rows by encryption key id.")
+    fingerprint_keys: dict[str, int] = Field(
+        description="Live rows by fingerprint key (`legacy`: written before rotation)."
+    )
+    tombstone_keys: dict[str, int] = Field(
+        description="Fingerprints of erased values by fingerprint key."
+    )
+    outdated: int = Field(description="Live rows the rotation job still has to make again.")
+    removable_keys: list[str] = Field(
+        description="Ids in vault.previous_keys that no row uses: they can be removed."
+    )
+    removable_token_keys: list[str] = Field(
+        description="Ids in vault.previous_token_keys that no row or tombstone uses."
+    )
+    digests: str = Field(
+        description="Key of the keyed digests: vault.digest_key, vault.token_key or "
+        "installation (the database's own secret)."
+    )
+
+
+class RotationQueued(BaseModel):
+    job_id: int = Field(description="Id of the queued (or already pending) rotation job.")
+
+
+@router.get(
+    "/vault/keys",
+    summary="Show which keys the vault rows use",
+    response_model=VaultKeysOut,
+    responses=_KEY_ERRORS,
+)
+async def vault_keys(access: Manage, store: StoreDep) -> VaultKeysOut:
+    """Rows by encryption key and fingerprint key, and the earlier keys that can be removed."""
+    keys = store.runtime.vault
+    if keys is None:
+        raise ProblemError(CONFLICT, "The vault is not configured.")
+    settings = store.runtime.vault_settings
+    async with store.sessions() as session, session.begin():
+        found = await usage(session)
+    token_ids_in_use = {k.split("/", 1)[0] for k in found.fingerprint_keys} | {
+        k.split("/", 1)[0] for k in found.tombstone_keys
+    }
+    return VaultKeysOut(
+        key_id=keys.key_id,
+        token_key_id=keys.token_key_id,
+        fingerprint_key=keys.fingerprint_key,
+        encryption_keys=found.encryption_keys,
+        fingerprint_keys=found.fingerprint_keys,
+        tombstone_keys=found.tombstone_keys,
+        outdated=found.outdated(keys),
+        removable_keys=sorted(k for k in settings.previous_keys if k not in found.encryption_keys),
+        removable_token_keys=sorted(
+            k
+            for k in settings.previous_token_keys
+            if k not in token_ids_in_use and "legacy" not in token_ids_in_use
+        ),
+        digests=store.runtime.digests.source,
+    )
+
+
+@router.post(
+    "/vault/rotate",
+    status_code=202,
+    summary="Queue a vault key rotation",
+    response_model=RotationQueued,
+    responses=_KEY_ERRORS,
+)
+async def rotate_vault(access: Manage, store: StoreDep, request: Request) -> RotationQueued:
+    """Queue the job that makes the rows stored under earlier keys again under the current
+    ones."""
+    if store.runtime.vault is None:
+        raise ProblemError(CONFLICT, "The vault is not configured.")
+    async with store.sessions() as session, session.begin():
+        job_id = await enqueue_job(session, VAULT_ROTATE_JOB, payload={}, unique=True)
+    annotate(request, action=ROTATE_ACTION, job=job_id)
+    return RotationQueued(job_id=job_id)
+
+
+def _kind(schema: Schema, name: str) -> Kind:
+    kind = schema.kind_by_api_name(name)
+    if kind is None:
+        raise ProblemError(NOT_FOUND, f"Kind {name} not found.")
+    return kind
+
+
+def _vault_attribute(kind: Kind, name: str, pointer: str) -> str:
+    attribute = kind.attribute_by_api_name(name)
+    if attribute is None or not attribute.in_vault:
+        raise invalid(pointer, f"{name} is not a vault Attribute of {kind.api_name}", "not_vault")
+    return attribute.id

lorebase_keeper/routes/webhooks.py

@@ -0,0 +1,298 @@
+"""Webhooks of a Domain (design 10.5): create, list, update clearances, delete.
+
+Managing webhooks needs `domain.settings` (the `admin` role). A new webhook's secret is
+returned once; only its digest is stored (`lorebase_store.webhooks.signing`), sealed under
+`webhooks.encryption_key` (`lorebase_store.webhooks.keys`). Without that key a webhook is
+created only when `webhooks.allow_unsealed_keys` is set (local development). Every change is
+written to the audit log (`webhook.create`, `webhook.update`, `webhook.delete`) without the
+secret or the full URL. Deliveries are made by `lorebase_store.webhooks.deliver_pending`, run by
+a worker.
+
+A webhook subscribes to `revision.committed`, to `operation.<side effect>` events or to every
+Operation event (`operation.*`). Sensitive values in Operation events reach it masked unless it
+holds `clearances` for their tags; granting one needs the matching clearance permission
+(`pii.read`, `confidential.read`, `restricted.read`) on the whole Domain, so an administrator
+cannot route values to a webhook that they could not read themselves. `PATCH` replaces the
+clearances: the permission is needed only for those it adds, so anyone managing webhooks can
+narrow one.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterable
+from datetime import datetime
+from typing import Annotated, Any, Literal, cast
+from urllib.parse import urlsplit
+
+from fastapi import APIRouter, Depends, Request, Response
+from pydantic import BaseModel, ConfigDict, Field
+
+from lorebase_core.model import Sensitivity
+from lorebase_keeper.auth.audit import annotate
+from lorebase_keeper.auth.deps import Access, AuthDep, require
+from lorebase_keeper.auth.permissions import Permission
+from lorebase_keeper.context import StoreDep, require_domain
+from lorebase_keeper.errors import (
+    CONFLICT,
+    FORBIDDEN,
+    NOT_FOUND,
+    Problem,
+    ProblemError,
+    ValidationProblem,
+)
+from lorebase_keeper.reading.problems import invalid
+from lorebase_keeper.reading.sensitivity import CLEARANCES, Clearance, clearance_of
+from lorebase_platform.settings import Settings
+from lorebase_store.outbox_events import EVENT_TYPES, event_type_problem
+from lorebase_store.webhooks import (
+    WebhookRepository,
+    WebhookRow,
+    WebhookSettings,
+    new_secret,
+    signing_key,
+    webhook_settings,
+)
+from lorebase_store.webhooks.delivery import scheme_problem
+from lorebase_store.webhooks.keys import SigningKeys
+
+router = APIRouter(tags=["webhooks"])
+
+BASE = "/domains/{domain_id}/webhooks"
+_ERRORS: dict[int | str, dict[str, Any]] = {
+    403: {"model": Problem, "description": "The caller lacks domain.settings."},
+    404: {"model": Problem, "description": "Domain or webhook not found."},
+    422: {"model": ValidationProblem, "description": "Invalid request."},
+}
+_CLEARANCE_ERRORS: dict[int | str, dict[str, Any]] = {
+    **_ERRORS,
+    403: {
+        "model": Problem,
+        "description": "The caller lacks domain.settings, or a clearance it gives the webhook.",
+    },
+}
+_CREATE_ERRORS: dict[int | str, dict[str, Any]] = {
+    **_CLEARANCE_ERRORS,
+    409: {
+        "model": Problem,
+        "description": "The Domain has the most webhooks allowed, or webhooks.encryption_key "
+        "is not configured.",
+    },
+}
+
+Manage = Annotated[Access, Depends(require(Permission.DOMAIN_SETTINGS))]
+
+
+def get_webhook_settings(request: Request) -> WebhookSettings:
+    return webhook_settings(cast(Settings, request.app.state.settings))
+
+
+WebhookSettingsDep = Annotated[WebhookSettings, Depends(get_webhook_settings)]
+
+
+class CreateWebhook(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    url: str = Field(min_length=1, max_length=2048, description="Target of the POST requests.")
+    events: list[str] | None = Field(
+        default=None,
+        min_length=1,
+        description="Event types delivered: revision.committed, operation.<side effect>, or "
+        "operation.* for every Operation event; default: revision.committed and operation.*.",
+    )
+    branches: list[str] | None = Field(
+        default=None, min_length=1, description="Only events of these branches; default: all."
+    )
+    description: str | None = Field(default=None, max_length=500)
+    clearances: list[Literal["pii", "confidential", "restricted"]] = Field(
+        default_factory=list,
+        description="Sensitivity tags whose values the webhook receives in clear; others are "
+        "masked. Each needs the matching clearance permission on the Domain.",
+    )
+
+
+class UpdateWebhook(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    clearances: list[Literal["pii", "confidential", "restricted"]] = Field(
+        description="The new clearances, replacing the current ones. Each one added needs the "
+        "matching clearance permission on the Domain; removing needs only domain.settings."
+    )
+
+
+class WebhookOut(BaseModel):
+    id: str
+    url: str
+    description: str | None = None
+    events: list[str]
+    branches: list[str] | None = None
+    clearances: list[str] = Field(default_factory=list)
+    created_by: str
+    created_at: datetime
+
+
+class WebhookCreated(WebhookOut):
+    """A new webhook; `secret` is shown this once."""
+
+    secret: str = Field(
+        description="Signing secret. Requests carry `t=<unix>,v1=<hex HMAC-SHA256>` computed "
+        "over `<t>.<body>` with the key SHA-256(secret)."
+    )
+
+
+class WebhookList(BaseModel):
+    items: list[WebhookOut]
+
+
+def _out(row: WebhookRow) -> dict[str, Any]:
+    return {
+        "id": row.id,
+        "url": row.url,
+        "description": row.description,
+        "events": list(row.event_types),
+        "branches": None if row.branches is None else list(row.branches),
+        "clearances": list(row.clearances),
+        "created_by": row.created_by,
+        "created_at": row.created_at,
+    }
+
+
+def _require_sealing(settings: WebhookSettings) -> None:
+    """409 unless signing keys are sealed, or storing them usable is explicitly allowed."""
+    if settings.encryption_key is None and not settings.allow_unsealed_keys:
+        raise ProblemError(
+            CONFLICT,
+            "Creating a webhook needs webhooks.encryption_key, which seals its signing key "
+            "(webhooks.allow_unsealed_keys allows it without, for local development only).",
+            extensions={"code": "encryption_key_required", "setting": "webhooks.encryption_key"},
+        )
+
+
+def _require_clearances(held: Clearance, tags: Iterable[str]) -> None:
+    """403 unless `held` (the caller's clearance) covers, Domain-wide, every tag."""
+    wanted = set(tags)
+    missing = sorted(
+        CLEARANCES[Sensitivity(tag)].value
+        for tag in wanted
+        if Sensitivity(tag) not in held.everywhere
+    )
+    if missing:
+        raise ProblemError(
+            FORBIDDEN,
+            f"Clearing a webhook for sensitive values needs {' and '.join(missing)} on the Domain.",
+            extensions={"code": "clearance_required", "permission": missing[0]},
+        )
+
+
+@router.post(BASE, status_code=201, summary="Create a webhook", responses=_CREATE_ERRORS)
+async def create_webhook(
+    domain_id: str,
+    body: CreateWebhook,
+    access: Manage,
+    store: StoreDep,
+    settings: WebhookSettingsDep,
+    request: Request,
+    auth: AuthDep,
+) -> WebhookCreated:
+    """Register an endpoint for the Domain's events; the secret is returned once."""
+    _require_sealing(settings)
+    problem = scheme_problem(body.url, settings)
+    if problem is not None:
+        raise invalid("/body/url", problem, "invalid_target")
+    events = body.events or list(EVENT_TYPES)
+    for index, event in enumerate(events):
+        unknown = event_type_problem(event)
+        if unknown is not None:
+            raise invalid(f"/body/events/{index}", unknown, "unknown")
+    if body.clearances:
+        held = await clearance_of(auth.authorizer, access.principal, domain_id, None)
+        _require_clearances(held, body.clearances)
+    secret = new_secret(settings.secret_bytes)
+    async with store.sessions() as session, session.begin():
+        await require_domain(session, domain_id)
+        webhooks = WebhookRepository(session, domain_id)
+        if await webhooks.count() >= settings.max_per_domain:
+            raise ProblemError(
+                CONFLICT, f"The Domain already has {settings.max_per_domain} webhooks."
+            )
+        row = await webhooks.add(
+            url=body.url,
+            description=body.description,
+            event_types=sorted(set(events)),
+            branches=None if body.branches is None else sorted(set(body.branches)),
+            signing_key=SigningKeys.from_settings(settings).store(signing_key(secret)),
+            created_by=access.principal.id,
+            clearances=body.clearances,
+        )
+    annotate(
+        request,
+        action="webhook.create",
+        target=row.id,
+        host=urlsplit(row.url).hostname,
+        events=list(row.event_types),
+        branches=None if row.branches is None else list(row.branches),
+        clearances=list(row.clearances),
+    )
+    return WebhookCreated(**_out(row), secret=secret)
+
+
+@router.get(BASE, summary="List webhooks", response_model=WebhookList, responses=_ERRORS)
+async def list_webhooks(domain_id: str, access: Manage, store: StoreDep) -> WebhookList:
+    """Webhooks of the Domain, oldest first (secrets are never shown again)."""
+    async with store.sessions() as session, session.begin():
+        await require_domain(session, domain_id)
+        rows = await WebhookRepository(session, domain_id).all()
+    return WebhookList(items=[WebhookOut(**_out(row)) for row in rows])
+
+
+@router.patch(
+    f"{BASE}/{{webhook_id}}",
+    summary="Change the clearances of a webhook",
+    response_model=WebhookOut,
+    responses=_CLEARANCE_ERRORS,
+)
+async def update_webhook(
+    domain_id: str,
+    webhook_id: str,
+    body: UpdateWebhook,
+    access: Manage,
+    store: StoreDep,
+    request: Request,
+    auth: AuthDep,
+) -> WebhookOut:
+    """Replace the sensitivity clearances of a webhook; only added ones need their permission."""
+    # Read before the row lock: the authorizer may be slow, the lock is held only to compare.
+    held = await clearance_of(auth.authorizer, access.principal, domain_id, None)
+    async with store.sessions() as session, session.begin():
+        await require_domain(session, domain_id)
+        webhooks = WebhookRepository(session, domain_id)
+        current = await webhooks.get(webhook_id, for_update=True)
+        if current is None:
+            raise ProblemError(NOT_FOUND, f"Webhook {webhook_id!r} not found.")
+        _require_clearances(held, set(body.clearances) - set(current.clearances))
+        row = await webhooks.set_clearances(webhook_id, body.clearances)
+    if row is None:
+        raise ProblemError(NOT_FOUND, f"Webhook {webhook_id!r} not found.")
+    annotate(
+        request,
+        action="webhook.update",
+        target=row.id,
+        clearances_before=list(current.clearances),
+        clearances=list(row.clearances),
+    )
+    return WebhookOut(**_out(row))
+
+
+@router.delete(
+    f"{BASE}/{{webhook_id}}", status_code=204, summary="Delete a webhook", responses=_ERRORS
+)
+async def delete_webhook(
+    domain_id: str, webhook_id: str, access: Manage, store: StoreDep, request: Request
+) -> Response:
+    """Remove a webhook and its pending deliveries."""
+    async with store.sessions() as session, session.begin():
+        await require_domain(session, domain_id)
+        deleted = await WebhookRepository(session, domain_id).delete(webhook_id)
+    if not deleted:
+        raise ProblemError(NOT_FOUND, f"Webhook {webhook_id!r} not found.")
+    annotate(request, action="webhook.delete", target=webhook_id)
+    return Response(status_code=204)