Method AutoDisableFailingWebhooks

internal/identity/webhooks.go:505–535

AutoDisableFailingWebhooks scans for webhooks whose recent delivery history exceeds the failure threshold and flips them to enabled=false with auto_disabled_at = now(). Returns the count of webhooks newly disabled. Designed to be called periodically (e.g. every 5 minutes) from a janitor goroutine.

(ctx context.Context)

// rows reached status='delivered'. The zero-delivered guard prevents
// a noisy webhook that's still mostly working from being disabled.
func (s *Store) AutoDisableFailingWebhooks(ctx context.Context) (int, error) {
	rows, err := s.pool.Query(ctx,
		`UPDATE webhooks
		 SET enabled = false,
		     auto_disabled_at = now()
		 WHERE id IN (
		     SELECT webhook_id
		     FROM webhook_subscriber_deliveries
		     WHERE created_at > now() - $2::interval
		     GROUP BY webhook_id
		     HAVING COUNT(*) FILTER (WHERE status = 'failed') >= $1
		        AND COUNT(*) FILTER (WHERE status = 'delivered') = 0
		 )
		 AND enabled = true
		 RETURNING id`,
		AutoDisableThreshold, AutoDisableWindow,
	)
	if err != nil {
		return 0, fmt.Errorf("auto-disable scan: %w", err)
	}
	defer rows.Close()
	count := 0
	for rows.Next() {
		var id string
		if err := rows.Scan(&id); err != nil {
			return count, err
		}
		count++
	}
	return count, rows.Err()
}

// ClearExpiredPrevSecrets nulls signing_secret_prev /
// signing_secret_prev_expires_at on rows past their grace window.