feat: make webhooks and documents editable instead of delete-and-recreate

Both could only be created and deleted. For a webhook that is actively harmful:
recreating it issues a new signing secret, so the receiver that verifies the
X-ApiCore-Signature header against the old one starts rejecting every delivery
without anyone changing it on purpose.

Backend:
- New PATCH /webhooks/:id behind a new webhooks:update permission, covering the
  target URL, the event selection and the active flag - the last of which had
  no way to be set after creation at all, so a misbehaving receiver could only
  be deleted. The signing secret is deliberately left alone and stays out of
  the audit log.
- A changed webhook URL runs through the same assertPublicWebhookUrl SSRF check
  as a new one; without that the edit would have been a way around the guard
  create() applies. Covered by a test.
- New PATCH /documents/:id behind a new documents:update permission, for
  re-linking a document filed against the wrong record and correcting its
  display name. Re-linking validates the new target with the existing
  assertEntityExists; the stored file is untouched.

Frontend:
- New webhook edit dialog. The event labels and the toggle helper moved out of
  the create dialog into lib/webhooks/labels.ts so both use one copy.
- Documents can be renamed from the attachment card.

Re-linking a document to a different record has no UI yet: it needs a two-step
picker (colony, then inspection) that is not worth building unprompted.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

ApiCore-Backend/src/documents/documents.controller.ts

@@ -6,6 +6,7 @@ import {
   Get,
   HttpCode,
   Param,
+  Patch,
   Post,
   Query,
   Res,
@@ -21,6 +22,7 @@ import { CurrentUser } from '../auth/decorators/current-user.decorator';
 import type { AuthenticatedUser } from '../auth/types/authenticated-user';
 import { isAllowedDocumentMimeType } from './document-mime-types';
 import { CreateDocumentDto } from './dto/create-document.dto';
+import { UpdateDocumentDto } from './dto/update-document.dto';
 import { DocumentsService } from './documents.service';
 
 const MAX_FILE_SIZE_BYTES = 10 * 1024 * 1024;
@@ -105,6 +107,16 @@ export class DocumentsController {
   }
 
   @RequirePermission('documents:delete')
+  @RequirePermission('documents:update')
+  @Patch(':id')
+  update(
+    @Param('id') id: string,
+    @Body() dto: UpdateDocumentDto,
+    @CurrentUser() actor: AuthenticatedUser,
+  ) {
+    return this.documentsService.update(id, dto, actor.id);
+  }
+
   @Delete(':id')
   @HttpCode(204)
   delete(@Param('id') id: string, @CurrentUser() actor: AuthenticatedUser) {

ApiCore-Backend/src/documents/documents.service.spec.ts

@@ -13,6 +13,7 @@ describe('DocumentsService', () => {
       findMany: jest.Mock;
       findUnique: jest.Mock;
       create: jest.Mock;
+      update: jest.Mock;
       delete: jest.Mock;
     };
     apiary: { findUnique: jest.Mock };
@@ -41,6 +42,7 @@ describe('DocumentsService', () => {
         findMany: jest.fn().mockResolvedValue([]),
         findUnique: jest.fn(),
         create: jest.fn(),
+        update: jest.fn(),
         delete: jest.fn(),
       },
       apiary: { findUnique: jest.fn() },
@@ -175,4 +177,63 @@ describe('DocumentsService', () => {
       );
     });
   });
+
+  describe('update', () => {
+    const existing = {
+      id: 'doc-1',
+      entityType: 'COLONY',
+      entityId: 'colony-1',
+      fileName: 'Rechnung.pdf',
+      mimeType: 'application/pdf',
+      sizeBytes: 1024,
+      storagePath: '/data/doc-1',
+      uploadedByUserId: 'user-1',
+      createdAt: new Date(),
+    };
+
+    it('rejects re-linking to a record that does not exist', async () => {
+      prisma.document.findUnique.mockResolvedValue(existing);
+      prisma.colony.findUnique.mockResolvedValue(null);
+
+      await expect(
+        service.update('doc-1', { entityId: 'missing-colony' }, 'user-2'),
+      ).rejects.toBeInstanceOf(NotFoundException);
+      expect(prisma.document.update).not.toHaveBeenCalled();
+    });
+
+    it('re-links a document and logs before and after', async () => {
+      prisma.document.findUnique.mockResolvedValue(existing);
+      prisma.colony.findUnique.mockResolvedValue({ id: 'colony-2' });
+      prisma.document.update.mockResolvedValue({
+        ...existing,
+        entityId: 'colony-2',
+      });
+
+      await service.update('doc-1', { entityId: 'colony-2' }, 'user-2');
+
+      expect(auditLog.record).toHaveBeenCalledWith(
+        expect.objectContaining({
+          entityType: 'Document',
+          entityId: 'doc-1',
+          action: 'UPDATE',
+        }),
+      );
+    });
+
+    it('does not re-check the target when only the file name changes', async () => {
+      prisma.document.findUnique.mockResolvedValue(existing);
+      prisma.document.update.mockResolvedValue({
+        ...existing,
+        fileName: 'Rechnung 2026.pdf',
+      });
+
+      await service.update(
+        'doc-1',
+        { fileName: 'Rechnung 2026.pdf' },
+        'user-2',
+      );
+
+      expect(prisma.colony.findUnique).not.toHaveBeenCalled();
+    });
+  });
 });

ApiCore-Backend/src/documents/documents.service.ts

@@ -11,6 +11,7 @@ import { AuditLogService } from '../audit/audit-log.service';
 import { matchesFileSignature } from '../common/file-signature';
 import { Document, DocumentEntityType } from '../../generated/prisma';
 import { ALLOWED_DOCUMENT_MIME_TYPES } from './document-mime-types';
+import { UpdateDocumentDto } from './dto/update-document.dto';
 
 export type DocumentSummary = Omit<Document, 'storagePath'>;
 
@@ -139,6 +140,40 @@ export class DocumentsService {
     };
   }
 
+  /**
+   * Re-links a document to a different record or corrects its display name.
+   * The stored file is untouched - replacing the content means uploading a
+   * new document.
+   */
+  async update(
+    id: string,
+    dto: UpdateDocumentDto,
+    actingUserId: string,
+  ): Promise<DocumentSummary> {
+    const before = await this.prisma.document.findUnique({ where: { id } });
+    if (!before) {
+      throw new NotFoundException('Document not found');
+    }
+    const entityType = dto.entityType ?? before.entityType;
+    const entityId = dto.entityId ?? before.entityId;
+    if (entityType !== before.entityType || entityId !== before.entityId) {
+      await this.assertEntityExists(entityType, entityId);
+    }
+    const document = await this.prisma.document.update({
+      where: { id },
+      data: { entityType, entityId, fileName: dto.fileName },
+    });
+    await this.auditLog.record({
+      entityType: 'Document',
+      entityId: id,
+      action: 'UPDATE',
+      userId: actingUserId,
+      beforeData: toSummary(before),
+      afterData: toSummary(document),
+    });
+    return toSummary(document);
+  }
+
   async delete(id: string, actingUserId: string): Promise<void> {
     const document = await this.prisma.document.findUnique({
       where: { id },

ApiCore-Backend/src/documents/dto/update-document.dto.ts

@@ -0,0 +1,27 @@
+import { ApiPropertyOptional } from '@nestjs/swagger';
+import { IsEnum, IsNotEmpty, IsOptional, IsString } from 'class-validator';
+import { DocumentEntityType } from '../../../generated/prisma';
+
+/**
+ * A document filed against the wrong record can be re-linked instead of
+ * deleted and uploaded again, and its display name corrected. The stored file
+ * itself is not touched: replacing the content means uploading a new document.
+ */
+export class UpdateDocumentDto {
+  @ApiPropertyOptional({ enum: DocumentEntityType })
+  @IsOptional()
+  @IsEnum(DocumentEntityType)
+  entityType?: DocumentEntityType;
+
+  @ApiPropertyOptional()
+  @IsOptional()
+  @IsString()
+  @IsNotEmpty()
+  entityId?: string;
+
+  @ApiPropertyOptional()
+  @IsOptional()
+  @IsString()
+  @IsNotEmpty()
+  fileName?: string;
+}