mirror of
https://github.com/hanzo-apps/dataroom.git
synced 2026-10-30 14:47:36 +00:00
zeekayandHanzo Dev
42425d6bcd
QStash was already gone — `lib/cron/index.ts` shipped a stub whose publishJSON
logged a warning, returned `{ messageId: "noop" }` and DISCARDED the event. Every
customer webhook has been silently dropped since. Its sibling stub, `receiver`,
returned `true` for any signature.
Deliveries now go to a KV list (lib/kv-queue/webhooks.ts): rpush to enqueue, lpop
to take, failures returned with a raised attempt count until MAX_ATTEMPTS so a
customer endpoint that is briefly down keeps its event and one that is gone does
not spin. The signature is computed at enqueue and carried with the item, so a
retry re-sends identical bytes rather than re-signing a payload whose shape may
have moved. Enqueue never throws: a KV outage must not fail the caller's write.
/api/cron/webhooks drains it.
The cron guard was worse than the stub. It read
if (process.env.VERCEL === "1") { ...verify Upstash-Signature... }
and this app runs on Kubernetes, so the branch was ALWAYS false — every
/api/cron/* route was reachable by anyone with the path, and the verifier behind
it asserted nothing anyway. Replaced with a shared secret that FAILS CLOSED: no
CRON_SECRET, no cron. Nothing schedules these today, so a missing secret costs
nothing where the old behaviour cost everything. It is a secret, not an identity —
user-facing auth stays with Hanzo IAM.
Also drops the QStash env block, the dead Upstash locker vars, and the vendor
vocabulary in lib/kv.ts, where the shims describe a SHAPE (options object,
{ score, member }) rather than whoever shipped it.
Verified with npx tsc --noEmit: 100 errors before and after, 0 introduced,
compared set-wise by file:line:code.
Co-authored-by: Hanzo Dev <[email protected]>
66 lines
1.6 KiB
TypeScript
66 lines
1.6 KiB
TypeScript
import { Webhook } from "@prisma/client";
|
|
|
|
import { enqueue } from "@/lib/kv-queue/webhooks";
|
|
|
|
import { createWebhookSignature } from "./signature";
|
|
import { prepareWebhookPayload } from "./transform";
|
|
import { EventDataProps, WebhookPayload, WebhookTrigger } from "./types";
|
|
|
|
// Send webhooks to multiple webhooks
|
|
export const sendWebhooks = async ({
|
|
webhooks,
|
|
trigger,
|
|
data,
|
|
}: {
|
|
webhooks: Pick<Webhook, "pId" | "url" | "secret">[];
|
|
trigger: WebhookTrigger;
|
|
data: EventDataProps;
|
|
}) => {
|
|
if (webhooks.length === 0) {
|
|
return;
|
|
}
|
|
|
|
const payload = prepareWebhookPayload(trigger, data);
|
|
|
|
return await Promise.all(
|
|
webhooks.map((webhook) =>
|
|
queueWebhookEvent({ webhook, payload }),
|
|
),
|
|
);
|
|
};
|
|
|
|
// Queue a webhook event for delivery (Hanzo KV).
|
|
//
|
|
// Was QStash, which this fork stubbed to a no-op — the event was signed, handed
|
|
// to `publishJSON`, logged as a warning and thrown away. The signature is still
|
|
// computed here, and now travels with the item so a retry re-sends identical
|
|
// bytes instead of re-signing.
|
|
const queueWebhookEvent = async ({
|
|
webhook,
|
|
payload,
|
|
}: {
|
|
webhook: Pick<Webhook, "pId" | "url" | "secret">;
|
|
payload: WebhookPayload;
|
|
}) => {
|
|
const body = JSON.stringify(payload);
|
|
const signature = await createWebhookSignature(webhook.secret, payload);
|
|
|
|
const queued = await enqueue({
|
|
webhookId: webhook.pId,
|
|
url: webhook.url,
|
|
body,
|
|
signature,
|
|
eventId: payload.id,
|
|
event: payload.event,
|
|
});
|
|
|
|
if (!queued) {
|
|
console.error("[webhooks] delivery not queued", {
|
|
webhookId: webhook.pId,
|
|
event: payload.event,
|
|
});
|
|
}
|
|
|
|
return { queued };
|
|
};
|