refactor(api): extract webhook router support

packages/api/src/router/webhook.ts

@@ -1,10 +1,14 @@
 import { z } from "zod";
-import { TRPCError } from "@trpc/server";
 import { createTRPCRouter, adminProcedure } from "../trpc.js";
-import { WEBHOOK_EVENTS } from "../lib/webhook-dispatcher.js";
 import { createAuditEntry } from "../lib/audit.js";
-
-const webhookEventEnum = z.enum(WEBHOOK_EVENTS as unknown as [string, ...string[]]);
+import {
+  buildWebhookCreateData,
+  buildWebhookUpdateData,
+  createWebhookInputSchema,
+  loadWebhookOrThrow,
+  sendWebhookTestRequest,
+  updateWebhookInputSchema,
+} from "./webhook-support.js";
 
 export const webhookRouter = createTRPCRouter({
   /** List all webhooks. */
@@ -17,34 +21,14 @@ export const webhookRouter = createTRPCRouter({
   /** Get a single webhook by ID. */
   getById: adminProcedure
     .input(z.object({ id: z.string() }))
-    .query(async ({ ctx, input }) => {
-      const wh = await ctx.db.webhook.findUnique({ where: { id: input.id } });
-      if (!wh) {
-        throw new TRPCError({ code: "NOT_FOUND", message: "Webhook not found" });
-      }
-      return wh;
-    }),
+    .query(async ({ ctx, input }) => loadWebhookOrThrow(ctx.db, input.id)),
 
   /** Create a new webhook. */
   create: adminProcedure
-    .input(
-      z.object({
-        name: z.string().min(1).max(200),
-        url: z.string().url(),
-        secret: z.string().optional(),
-        events: z.array(webhookEventEnum).min(1),
-        isActive: z.boolean().default(true),
-      }),
-    )
+    .input(createWebhookInputSchema)
     .mutation(async ({ ctx, input }) => {
       const webhook = await ctx.db.webhook.create({
-        data: {
-          name: input.name,
-          url: input.url,
-          ...(input.secret !== undefined ? { secret: input.secret } : {}),
-          events: input.events,
-          isActive: input.isActive,
-        },
+        data: buildWebhookCreateData(input),
       });
 
       void createAuditEntry({
@@ -66,30 +50,15 @@ export const webhookRouter = createTRPCRouter({
     .input(
       z.object({
         id: z.string(),
-        data: z.object({
-          name: z.string().min(1).max(200).optional(),
-          url: z.string().url().optional(),
-          secret: z.string().nullish(),
-          events: z.array(webhookEventEnum).min(1).optional(),
-          isActive: z.boolean().optional(),
-        }),
+        data: updateWebhookInputSchema,
       }),
     )
     .mutation(async ({ ctx, input }) => {
-      const existing = await ctx.db.webhook.findUnique({ where: { id: input.id } });
-      if (!existing) {
-        throw new TRPCError({ code: "NOT_FOUND", message: "Webhook not found" });
-      }
+      const existing = await loadWebhookOrThrow(ctx.db, input.id);
 
       const updated = await ctx.db.webhook.update({
         where: { id: input.id },
-        data: {
-          ...(input.data.name !== undefined ? { name: input.data.name } : {}),
-          ...(input.data.url !== undefined ? { url: input.data.url } : {}),
-          ...(input.data.secret !== undefined ? { secret: input.data.secret } : {}),
-          ...(input.data.events !== undefined ? { events: input.data.events } : {}),
-          ...(input.data.isActive !== undefined ? { isActive: input.data.isActive } : {}),
-        },
+        data: buildWebhookUpdateData(input.data),
       });
 
       void createAuditEntry({
@@ -111,10 +80,7 @@ export const webhookRouter = createTRPCRouter({
   delete: adminProcedure
     .input(z.object({ id: z.string() }))
     .mutation(async ({ ctx, input }) => {
-      const existing = await ctx.db.webhook.findUnique({ where: { id: input.id } });
-      if (!existing) {
-        throw new TRPCError({ code: "NOT_FOUND", message: "Webhook not found" });
-      }
+      const existing = await loadWebhookOrThrow(ctx.db, input.id);
       await ctx.db.webhook.delete({ where: { id: input.id } });
 
       void createAuditEntry({
@@ -133,62 +99,8 @@ export const webhookRouter = createTRPCRouter({
   test: adminProcedure
     .input(z.object({ id: z.string() }))
     .mutation(async ({ ctx, input }) => {
-      const wh = await ctx.db.webhook.findUnique({ where: { id: input.id } });
-      if (!wh) {
-        throw new TRPCError({ code: "NOT_FOUND", message: "Webhook not found" });
-      }
-
-      const testPayload = {
-        event: "webhook.test",
-        timestamp: new Date().toISOString(),
-        payload: {
-          webhookId: wh.id,
-          webhookName: wh.name,
-          message: "This is a test payload from CapaKraken.",
-        },
-      };
-
-      const body = JSON.stringify(testPayload);
-
-      const headers: Record<string, string> = {
-        "Content-Type": "application/json",
-        "X-Webhook-Event": "webhook.test",
-      };
-
-      if (wh.secret) {
-        const { createHmac } = await import("node:crypto");
-        const signature = createHmac("sha256", wh.secret)
-          .update(body)
-          .digest("hex");
-        headers["X-Webhook-Signature"] = signature;
-      }
-
-      const controller = new AbortController();
-      const timeout = setTimeout(() => controller.abort(), 5_000);
-
-      let result: { success: boolean; statusCode: number; statusText: string };
-
-      try {
-        const response = await fetch(wh.url, {
-          method: "POST",
-          headers,
-          body,
-          signal: controller.signal,
-        });
-        result = {
-          success: response.ok,
-          statusCode: response.status,
-          statusText: response.statusText,
-        };
-      } catch (err) {
-        result = {
-          success: false,
-          statusCode: 0,
-          statusText: err instanceof Error ? err.message : "Unknown error",
-        };
-      } finally {
-        clearTimeout(timeout);
-      }
+      const wh = await loadWebhookOrThrow(ctx.db, input.id);
+      const result = await sendWebhookTestRequest(wh);
 
       void createAuditEntry({
         db: ctx.db,