Method handleCreateWebhook

internal/server/handlers_webhooks.go:33–84

handleCreateWebhook registers a new webhook for a workspace.

(w http.ResponseWriter, r *http.Request)

// handleCreateWebhook registers a new webhook for a workspace.
func (s *Server) handleCreateWebhook(w http.ResponseWriter, r *http.Request) {
	if !requireMinRole(w, r, "owner") {
		return
	}
	workspaceID, ok := s.getWorkspaceID(w, r)
	if !ok {
		return
	}

	// Enforce webhook count limit (workspace-scoped)
	if !s.enforcePlanLimit(w, workspaceID, "webhooks") {
		return
	}

	var input models.WebhookCreate
	if err := decodeJSON(r, &input); err != nil {
		writeError(w, http.StatusBadRequest, "bad_request", err.Error())
		return
	}

	if input.URL == "" {
		writeError(w, http.StatusBadRequest, "bad_request", "url is required")
		return
	}

	// "enc:" is the reserved marker the store uses to tag encrypted secrets at
	// rest (see internal/store/encryption.go::encryptedPrefix). Reject a raw
	// secret that starts with it so a user-supplied plaintext can never be
	// mistaken for ciphertext on read (which would break signing/dispatch,
	// including on keyless self-host instances).
	if strings.HasPrefix(input.Secret, "enc:") {
		writeError(w, http.StatusBadRequest, "bad_request", "secret must not start with the reserved prefix \"enc:\"")
		return
	}

	// Validate URL to prevent SSRF attacks
	if err := webhooks.ValidateWebhookURL(input.URL); err != nil {
		writeError(w, http.StatusBadRequest, "bad_request", "Invalid webhook URL: "+err.Error())
		return
	}

	hook, err := s.store.CreateWebhook(workspaceID, input)
	if err != nil {
		writeInternalError(w, err)
		return
	}

	// The creation response is the ONLY place the raw secret is returned, so
	// the caller can record it for HMAC verification. It is masked everywhere
	// else (BUG-2057).
	writeJSON(w, http.StatusCreated, hook)
}

// handleListWebhooks returns all webhooks for a workspace.
// Restricted to owners since webhook URLs may contain secret tokens.