Validates webhook URLs on create and update:
- HTTPS required (HTTP allowed for self-hosted and E2E)
- Blocks private IP ranges and localhost
- Blocks cloud metadata endpoints
Existing webhooks are preserved: validation only applies when URL is created or changed.
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-02-05 16:18:10 -03:00
sean-brydonGitHubsean@cal.com <Sean@brydon.io>Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: add Webhook resource to PBAC system with permission enforcement
- Add Webhook resource to PBAC permission registry with CRUD actions
- Implement PBAC permission checks in webhook handlers (create, edit, delete)
- Add webhook permission translations to common.json
- Use PermissionCheckService with fallback roles [ADMIN, OWNER] for team webhooks
- Maintain backward compatibility when PBAC is disabled
- Follow same pattern as workflow PBAC implementation from PR #22845
Co-Authored-By: sean@cal.com <Sean@brydon.io>
* fix: implement PBAC permission filtering in webhook list handler
- Add PermissionCheckService to filter team webhooks by webhook.read permission
- Only show webhooks from teams where user has proper permissions
- Maintain backward compatibility with fallback to all team memberships
Co-Authored-By: sean@cal.com <Sean@brydon.io>
* add migration for default roles
* new forUserMethod
* update webhook repository
* fix UI showing/hiding webhooks for webhoo.create teams
* WIP pbac procedure migratoin + tests
* add more roles to get fallback
* permissions in cmponents instead of readOnly
* passPermissions to list item
* push instant events logic
* Git merge
* wip teamId accessable refactor
* fix delete handler
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* feat: optimize Prisma queries by replacing findFirst with findUnique where applicable
- Replace findFirst/findFirstOrThrow with findUnique/findUniqueOrThrow for queries using unique constraints
- Maintain existing functionality and error handling behavior
- Focus on queries using primary keys and unique index fields from schema
- Revert problematic changes that caused test failures to maintain stability
Co-Authored-By: benny@cal.com <benny@cal.com>
* revert: exclude API files from Prisma query optimizations per user request
- Reverted all 55 API-related files to their original state
- Kept all non-API Prisma query optimizations intact
- API files include apps/api/v1, apps/api/v2, apps/web/app/api, and packages/app-store/*/api
- Non-API optimizations remain for packages/lib, packages/features, apps/web (non-api), etc.
Co-Authored-By: benny@cal.com <benny@cal.com>
* feat: optimize membership query in attributeUtils to use findUnique with userId_teamId constraint
Co-Authored-By: benny@cal.com <benny@cal.com>
* revert: exclude test files from Prisma query optimizations per user request
Co-Authored-By: benny@cal.com <benny@cal.com>
* revert: revert attributeUtils.ts to use findFirst for test compatibility
Co-Authored-By: benny@cal.com <benny@cal.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: benny@cal.com <benny@cal.com>
Co-authored-by: Anik Dhabal Babu <81948346+anikdhabal@users.noreply.github.com>
* fix trpc session circle dep
* fixes trpc session cirlce dep
* fix relative imports
* fix more imports to use types and not trpc
* fix exports
* Fixed types
---------
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
* feat: Delete/Create WebhookScheduledTriggers for existing bookings
* fix: type check
* fix: early return, query status in prisma, unnecessary trigger type check
* feat: add/delete scheduled webhook triggers for team and user
---------
Co-authored-by: v0ltZzie <samit091848@gmail.com>
Co-authored-by: Udit Takkar <53316345+Udit-takkar@users.noreply.github.com>
* db migration
* adjusted ui to include `platform` in dropdown for admin webhooks
* adjusted webhook/create.handler for platform
* adjusted `edit.handler` so that only ADMIN can update `platform` webhooks
* update `getWebhooks` for platform wide webhooks
* list platform webhooks if admin
* createFunction refactor
* update subscriberUrlReserved for platform webhooks
* fix delete webhook handler
* fix: added readOnly to WebhookListItem
* fix: admin cannot delete its own webhooks
* fix: ts error
---------
Co-authored-by: Joe Au-Yeung <65426560+joeauyeung@users.noreply.github.com>
* [CAL-1517] fix all Typescript warnings
* solve conflicts
* Update stripeCheckoutSession.handler.ts
Parse is a guard, so even though the variable is unused the parse itself is needed.
* Update ToolbarPlugin.tsx
Don't change dependency tree
---------
Co-authored-by: gitstart-calcom <gitstart@users.noreply.github.com>
Co-authored-by: Peer Richelsen <peeroke@gmail.com>
Co-authored-by: Alex van Andel <me@alexvanandel.com>
* allow event type specific webhooks for all event types
* first version of team webhooks
* add empty view
* design fixes when no teams + invalidate query on delete/update
* linke to new webhooks page with teamId in query
* make one button with dropdown instead of a button for every team
* add subtitle to dropdown
* add avatar fallback
* authorization when editing webhook
* fix event type webhooks
* fix authorization for delete handler
* code clean up
* fix disabled switch
* add migration
* fix subscriberUrlReservered function and fix authorization
* fix type error
* fix type error
* fix switch not updating
* make sure webhooks are triggered for the correct even types
* code clean up
* only show teams were user has write access
* make webhooks read-only for members
* fix comment
* fix type error
* fix webhook tests for team event types
* implement feedback
* code clean up from feedback
* code clean up (feedback)
* throw error if param missing in subscriberUrlReservered
* handle null/undefined values in getWebhooks itself
* better variable naming
* better check if webhook is readonly
* create assertPartOfTeamWithRequiredAccessLevel to remove duplicate code
---------
Co-authored-by: CarinaWolli <wollencarina@gmail.com>
Co-authored-by: alannnc <alannnc@gmail.com>
