Nick SzaunigandClaude Opus 5
9a147ee123
Both could only be created and deleted. For a webhook that is actively harmful: recreating it issues a new signing secret, so the receiver that verifies the X-ApiCore-Signature header against the old one starts rejecting every delivery without anyone changing it on purpose. Backend: - New PATCH /webhooks/:id behind a new webhooks:update permission, covering the target URL, the event selection and the active flag - the last of which had no way to be set after creation at all, so a misbehaving receiver could only be deleted. The signing secret is deliberately left alone and stays out of the audit log. - A changed webhook URL runs through the same assertPublicWebhookUrl SSRF check as a new one; without that the edit would have been a way around the guard create() applies. Covered by a test. - New PATCH /documents/:id behind a new documents:update permission, for re-linking a document filed against the wrong record and correcting its display name. Re-linking validates the new target with the existing assertEntityExists; the stored file is untouched. Frontend: - New webhook edit dialog. The event labels and the toggle helper moved out of the create dialog into lib/webhooks/labels.ts so both use one copy. - Documents can be renamed from the attachment card. Re-linking a document to a different record has no UI yet: it needs a two-step picker (colony, then inspection) that is not worth building unprompted. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
57 lines
1.5 KiB
TypeScript
57 lines
1.5 KiB
TypeScript
import {
|
|
Body,
|
|
Controller,
|
|
Delete,
|
|
Get,
|
|
HttpCode,
|
|
Param,
|
|
Patch,
|
|
Post,
|
|
} from '@nestjs/common';
|
|
import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
|
|
import { RequirePermission } from '../auth/decorators/require-permission.decorator';
|
|
import { CurrentUser } from '../auth/decorators/current-user.decorator';
|
|
import type { AuthenticatedUser } from '../auth/types/authenticated-user';
|
|
import { CreateWebhookDto } from './dto/create-webhook.dto';
|
|
import { UpdateWebhookDto } from './dto/update-webhook.dto';
|
|
import { WebhooksService } from './webhooks.service';
|
|
|
|
@ApiTags('webhooks')
|
|
@ApiBearerAuth()
|
|
@Controller('webhooks')
|
|
export class WebhooksController {
|
|
constructor(private readonly webhooksService: WebhooksService) {}
|
|
|
|
@RequirePermission('webhooks:read')
|
|
@Get()
|
|
findAll() {
|
|
return this.webhooksService.findAll();
|
|
}
|
|
|
|
@RequirePermission('webhooks:create')
|
|
@Post()
|
|
create(
|
|
@Body() dto: CreateWebhookDto,
|
|
@CurrentUser() actor: AuthenticatedUser,
|
|
) {
|
|
return this.webhooksService.create(dto, actor.id);
|
|
}
|
|
|
|
@RequirePermission('webhooks:update')
|
|
@Patch(':id')
|
|
update(
|
|
@Param('id') id: string,
|
|
@Body() dto: UpdateWebhookDto,
|
|
@CurrentUser() actor: AuthenticatedUser,
|
|
) {
|
|
return this.webhooksService.update(id, dto, actor.id);
|
|
}
|
|
|
|
@RequirePermission('webhooks:delete')
|
|
@Delete(':id')
|
|
@HttpCode(204)
|
|
delete(@Param('id') id: string, @CurrentUser() actor: AuthenticatedUser) {
|
|
return this.webhooksService.delete(id, actor.id);
|
|
}
|
|
}
|