Skip to content

Customer webhooks on @profullstack/webhooks 0.2.1 - #38

Merged
ralyodio merged 2 commits into
mainfrom
feat/webhooks
Oct 28, 2026
Merged

ralyodio merged 2 commits into
mainfrom
feat/webhooks

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Customer webhooks for r4ck.dev accounts, on @profullstack/webhooks 0.2.1 (pinned exactly).

Events (owner = the account)

type when data
server.listed a mirror tick lists a new offer matching one of your saved searches { saved_search, total, servers[≤50] }, subject saved_search:<id>
server.price_dropped an offer matching a saved search got cheaper in its billed-in currency (FX moves never fire) same, each server with price_before
pass.granted days of the pass added (credit code, invite bonus) { days, source, until }
api_key.created / api_key.revoked a key made / revoked { id, name, prefix } / { id }, never the key

One event per saved search and type per tick. Only accounts with an enabled endpoint are matched.

How

  • apps/web/src/lib/webhooks.js: postgresStore over a Bun.SQL adapter (query(text, params) -> { rows: await sql.unsafe(text, params) }), tested against Postgres. Tables in migration 0004_webhooks.sql (the package's schemaSql('pg')), runs on boot. hooks().start() once in main.js.
  • syncTick({ onChanges }) collects what each tick listed and cut; upsertServer now also returns the previous billed-in price. The daemon passes it to notifyWatchers.
  • /api/v1/webhooks (+ /*) behind the existing auth (session or r4k_ key; 401 otherwise).
  • Settings: Webhooks panel (add with event checkboxes, test, pause/on, rotate, remove; the secret is shown once on the answering page, never in a URL; last 10 deliveries).
  • CLI r4ck webhooks [list|add|update|rm|test|rotate|secret|deliveries|retry], version 0.3.0.
  • MCP: list_webhooks, create_webhook, update_webhook, delete_webhook, test_webhook, rotate_webhook_secret, webhook_deliveries.
  • Account deletion removes the account's endpoints and log. Docs + llms.txt list the route.

No existing outbound webhooks, so nothing to migrate.

Tests

test/webhooks.test.js (adapter, 401/200/400/201, api_key.created verified with verifySignature, listed → same price → drop → rise → paused through a real syncTick, MCP, settings form) and a CLI test. Deliveries go to a stub fetch.

🤖 Generated with Claude Code

Signed webhooks (Standard Webhooks headers, CloudEvents body) for every
account, with the hub's durable outbox in this site's Postgres.

- Events: server.listed and server.price_dropped (offers matching one of the
  account's saved searches, from each mirror tick; a drop is a cut in the
  billed-in price, never an FX move), pass.granted (credit code or invite),
  api_key.created, api_key.revoked (never the key itself).
- Store: postgresStore over a 3-line Bun.SQL adapter (sql.unsafe), tables
  from migration 0004 (schemaSql('pg')). hooks.start() once at boot.
- /api/v1/webhooks behind the existing key/session auth; settings panel
  (add with events, test, pause, rotate, remove, secret shown once, recent
  deliveries); `r4ck webhooks` (CLI 0.3.0); MCP list/create/update/delete/
  test_webhook, rotate_webhook_secret, webhook_deliveries.
- Account deletion removes the account's endpoints and log.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@socket-security

socket-security Bot commented Oct 28, 2026 •

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Added@​profullstack/​webhooks@​0.2.17610010090100

View full report

…eb's dependency)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@ralyodio
ralyodio merged commit 0300d2e into main Oct 28, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant