Leon SerfatyandClaude Opus 4.8
c9968531e4
Batch commit of the pending working tree on security/audit-fixes-2026-07. Major areas: - Outbound webhooks / Zapier: schema + signed delivery with retries, public v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain. - Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when Spaces is unconfigured instead of silently using ephemeral disk. - Integrations & features (concurrent work): accounting (QuickBooks/Xero), e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding, expanded legal pages. - DB migrations 0006–0009. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
83 lines
3.0 KiB
TypeScript
83 lines
3.0 KiB
TypeScript
import { NextResponse } from "next/server"
|
|
import { desc, eq } from "drizzle-orm"
|
|
import { db } from "@/lib/db"
|
|
import { webhook_endpoints } from "@/lib/db/schema"
|
|
import { resolveApiRequest } from "@/lib/api-auth"
|
|
import { webhookEndpointSchema } from "@/lib/validations"
|
|
import { isWebhookEvent } from "@/lib/webhooks/events"
|
|
import { assertSafeWebhookUrl, WebhookUrlError } from "@/lib/webhooks/ssrf"
|
|
import { generateWebhookSecret } from "@/lib/webhooks/deliver"
|
|
|
|
// Public REST API (v1) — outbound webhook subscriptions. Bearer API-key auth.
|
|
// This is the surface Zapier's REST Hooks use: POST here to subscribe, DELETE
|
|
// /:id to unsubscribe. Scoped by the resolved account owner id.
|
|
|
|
const unauthorized = () =>
|
|
NextResponse.json({ error: { code: 401, message: "Unauthorized" } }, { status: 401 })
|
|
const forbidden = () =>
|
|
NextResponse.json({ error: { code: 403, message: "Forbidden" } }, { status: 403 })
|
|
const badRequest = (message: unknown) =>
|
|
NextResponse.json({ error: { code: 400, message } }, { status: 400 })
|
|
|
|
// The signing secret is not returned on list/read (only at creation & rotation).
|
|
const PUBLIC_COLUMNS = {
|
|
id: webhook_endpoints.id,
|
|
url: webhook_endpoints.url,
|
|
description: webhook_endpoints.description,
|
|
events: webhook_endpoints.events,
|
|
status: webhook_endpoints.status,
|
|
source: webhook_endpoints.source,
|
|
last_success_at: webhook_endpoints.last_success_at,
|
|
last_error_at: webhook_endpoints.last_error_at,
|
|
failure_count: webhook_endpoints.failure_count,
|
|
created_at: webhook_endpoints.created_at,
|
|
}
|
|
|
|
export async function GET(request: Request) {
|
|
const ctx = await resolveApiRequest(request)
|
|
if (!ctx) return unauthorized()
|
|
|
|
const data = await db
|
|
.select(PUBLIC_COLUMNS)
|
|
.from(webhook_endpoints)
|
|
.where(eq(webhook_endpoints.user_id, ctx.ownerId))
|
|
.orderBy(desc(webhook_endpoints.created_at))
|
|
|
|
return NextResponse.json({ data, count: data.length })
|
|
}
|
|
|
|
export async function POST(request: Request) {
|
|
const ctx = await resolveApiRequest(request)
|
|
if (!ctx) return unauthorized()
|
|
if (!ctx.canWrite) return forbidden()
|
|
|
|
const body = await request.json().catch(() => null)
|
|
const parsed = webhookEndpointSchema.safeParse(body)
|
|
if (!parsed.success) return badRequest(parsed.error.flatten())
|
|
|
|
try {
|
|
await assertSafeWebhookUrl(parsed.data.url)
|
|
} catch (e) {
|
|
return badRequest(e instanceof WebhookUrlError ? e.message : "Invalid webhook URL")
|
|
}
|
|
|
|
// Requests coming through Zapier's REST-hook subscribe carry a Zapier UA.
|
|
const ua = request.headers.get("user-agent") ?? ""
|
|
const source = /zapier/i.test(ua) ? "zapier" : "api"
|
|
|
|
const [data] = await db
|
|
.insert(webhook_endpoints)
|
|
.values({
|
|
user_id: ctx.ownerId,
|
|
url: parsed.data.url,
|
|
description: parsed.data.description || null,
|
|
events: Array.from(new Set(parsed.data.events.filter(isWebhookEvent))),
|
|
secret: generateWebhookSecret(),
|
|
source,
|
|
})
|
|
.returning()
|
|
|
|
// Return the secret exactly once, at creation, so the subscriber can verify signatures.
|
|
return NextResponse.json({ data }, { status: 201 })
|
|
}
|