Method UpdateWebhook

internal/service/admin_webhooks.go:90–180

UpdateWebhook updates an existing webhook's event, endpoint, headers, or enabled state and returns a status message. Requires super-admin auth. Logic migrated from internal/graphql/update_webhook.go.

(ctx context.Context, meta RequestMetadata, params *model.UpdateWebhookRequest)

// enabled state and returns a status message. Requires super-admin auth. Logic
// migrated from internal/graphql/update_webhook.go.
func (p *provider) UpdateWebhook(ctx context.Context, meta RequestMetadata, params *model.UpdateWebhookRequest) (*model.Response, *ResponseSideEffects, error) {
	log := p.Log.With().Str("func", "UpdateWebhook").Logger()
	if err := p.requireSuperAdmin(ctx, meta); err != nil {
		return nil, nil, err
	}

	webhook, err := p.StorageProvider.GetWebhookByID(ctx, params.ID)
	if err != nil {
		log.Debug().Err(err).Msg("failed GetWebhookByID")
		return nil, nil, err
	}

	var headersMap map[string]interface{}
	if err := json.Unmarshal([]byte(webhook.Headers), &headersMap); err != nil {
		log.Debug().Err(err).Msg("error un-marshalling headers")
	}
	headersString := ""
	if headersMap != nil {
		headerBytes, err := json.Marshal(webhook.Headers)
		if err != nil {
			log.Debug().Err(err).Msg("failed to marshall headers")
			return nil, nil, err
		}
		headersString = string(headerBytes)
	}

	webhookDetails := &schemas.Webhook{
		ID:               webhook.ID,
		Key:              webhook.ID,
		EventName:        webhook.EventName,
		EventDescription: webhook.EventDescription,
		EndPoint:         webhook.EndPoint,
		Enabled:          webhook.Enabled,
		Headers:          headersString,
		CreatedAt:        webhook.CreatedAt,
	}

	if params.EventName != nil && webhookDetails.EventName != refs.StringValue(params.EventName) {
		if isValid := validators.IsValidWebhookEventName(refs.StringValue(params.EventName)); !isValid {
			log.Debug().Str("event_name", refs.StringValue(params.EventName)).Msg("invalid event name")
			return nil, nil, fmt.Errorf("invalid event name %s", refs.StringValue(params.EventName))
		}
		webhookDetails.EventName = refs.StringValue(params.EventName)
	}
	if params.Endpoint != nil && webhookDetails.EndPoint != refs.StringValue(params.Endpoint) {
		if strings.TrimSpace(refs.StringValue(params.Endpoint)) == "" {
			log.Debug().Msg("empty endpoint not allowed")
			return nil, nil, fmt.Errorf("empty endpoint not allowed")
		}
		// SSRF protection: validate endpoint URL and resolved IPs (skip in test env).
		if p.Env != constants.TestEnv {
			if err := validators.ValidateEndpointURL(refs.StringValue(params.Endpoint)); err != nil {
				log.Debug().Err(err).Str("endpoint", refs.StringValue(params.Endpoint)).Msg("endpoint URL rejected by SSRF filter")
				return nil, nil, fmt.Errorf("invalid endpoint: %s", err.Error())
			}
		}
		webhookDetails.EndPoint = refs.StringValue(params.Endpoint)
	}