feat(webhooks): outbound webhooks with HMAC-SHA256 signing and API key auth

Webhook registration/management. HMAC-signed delivery with retry. Events: recipe.created/updated, comment.created, follower.new. REST API key creation for programmatic access.
2026-07-01 08:11:19 +02:00
parent d6032edc00
commit 3f96d1ea41
8 changed files with 420 additions and 0 deletions
@@ -0,0 +1,104 @@
+import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
+import { db, webhooks, eq, and } from "@epicure/db";
+import { requireSession } from "@/lib/api-auth";
+
+const VALID_EVENTS = ["recipe.created", "recipe.updated", "recipe.published", "recipe.deleted"] as const;
+
+const UpdateWebhookBody = z.object({
+  url: z.string().min(1).max(2048).optional(),
+  events: z.array(z.enum(VALID_EVENTS)).optional(),
+  active: z.boolean().optional(),
+});
+
+export async function DELETE(
+  _req: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const { id } = await params;
+
+  const existing = await db
+    .select({ id: webhooks.id })
+    .from(webhooks)
+    .where(and(eq(webhooks.id, id), eq(webhooks.userId, session!.user.id)))
+    .limit(1);
+
+  if (existing.length === 0) {
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  }
+
+  await db
+    .delete(webhooks)
+    .where(and(eq(webhooks.id, id), eq(webhooks.userId, session!.user.id)));
+
+  return new NextResponse(null, { status: 204 });
+}
+
+export async function PATCH(
+  req: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const { session, response } = await requireSession();
+  if (response) return response;
+
+  const { id } = await params;
+
+  const existing = await db
+    .select({ id: webhooks.id })
+    .from(webhooks)
+    .where(and(eq(webhooks.id, id), eq(webhooks.userId, session!.user.id)))
+    .limit(1);
+
+  if (existing.length === 0) {
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  }
+
+  const body = await req.json() as unknown;
+  const parsed = UpdateWebhookBody.safeParse(body);
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: "Validation error", issues: parsed.error.issues },
+      { status: 400 }
+    );
+  }
+
+  if (parsed.data.url) {
+    try {
+      new URL(parsed.data.url);
+    } catch {
+      return NextResponse.json({ error: "Invalid URL" }, { status: 400 });
+    }
+  }
+
+  const updates: Partial<{ url: string; events: string[]; active: boolean }> = {};
+  if (parsed.data.url !== undefined) updates.url = parsed.data.url;
+  if (parsed.data.events !== undefined) updates.events = parsed.data.events;
+  if (parsed.data.active !== undefined) updates.active = parsed.data.active;
+
+  if (Object.keys(updates).length === 0) {
+    return NextResponse.json({ error: "No fields to update" }, { status: 400 });
+  }
+
+  await db
+    .update(webhooks)
+    .set(updates)
+    .where(and(eq(webhooks.id, id), eq(webhooks.userId, session!.user.id)));
+
+  const updated = await db
+    .select({
+      id: webhooks.id,
+      userId: webhooks.userId,
+      url: webhooks.url,
+      events: webhooks.events,
+      active: webhooks.active,
+      createdAt: webhooks.createdAt,
+    })
+    .from(webhooks)
+    .where(eq(webhooks.id, id))
+    .limit(1);
+
+  return NextResponse.json(updated[0]);
+}