Nick SzaunigandClaude Opus 5
9a147ee123
Both could only be created and deleted. For a webhook that is actively harmful: recreating it issues a new signing secret, so the receiver that verifies the X-ApiCore-Signature header against the old one starts rejecting every delivery without anyone changing it on purpose. Backend: - New PATCH /webhooks/:id behind a new webhooks:update permission, covering the target URL, the event selection and the active flag - the last of which had no way to be set after creation at all, so a misbehaving receiver could only be deleted. The signing secret is deliberately left alone and stays out of the audit log. - A changed webhook URL runs through the same assertPublicWebhookUrl SSRF check as a new one; without that the edit would have been a way around the guard create() applies. Covered by a test. - New PATCH /documents/:id behind a new documents:update permission, for re-linking a document filed against the wrong record and correcting its display name. Re-linking validates the new target with the existing assertEntityExists; the stored file is untouched. Frontend: - New webhook edit dialog. The event labels and the toggle helper moved out of the create dialog into lib/webhooks/labels.ts so both use one copy. - Documents can be renamed from the attachment card. Re-linking a document to a different record has no UI yet: it needs a two-step picker (colony, then inspection) that is not worth building unprompted. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
28 lines
791 B
TypeScript
28 lines
791 B
TypeScript
import { ApiPropertyOptional } from '@nestjs/swagger';
|
|
import { IsEnum, IsNotEmpty, IsOptional, IsString } from 'class-validator';
|
|
import { DocumentEntityType } from '../../../generated/prisma';
|
|
|
|
/**
|
|
* A document filed against the wrong record can be re-linked instead of
|
|
* deleted and uploaded again, and its display name corrected. The stored file
|
|
* itself is not touched: replacing the content means uploading a new document.
|
|
*/
|
|
export class UpdateDocumentDto {
|
|
@ApiPropertyOptional({ enum: DocumentEntityType })
|
|
@IsOptional()
|
|
@IsEnum(DocumentEntityType)
|
|
entityType?: DocumentEntityType;
|
|
|
|
@ApiPropertyOptional()
|
|
@IsOptional()
|
|
@IsString()
|
|
@IsNotEmpty()
|
|
entityId?: string;
|
|
|
|
@ApiPropertyOptional()
|
|
@IsOptional()
|
|
@IsString()
|
|
@IsNotEmpty()
|
|
fileName?: string;
|
|
}
|