Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[Backend] Build Webhook Setup & Configuration System (Secure, Validated, Multi-Event, Production Ready)

Aperta
  • Qualcosa non va?
#5 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
25/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Tranquilla
Stack tecnologico
typescript
Ambito
api, authorization, backend, databases, security

Direzione di ricerca

Start by locating the backend entry points for the listed /api/v1/webhooks endpoints and the existing authentication, RBAC, and persistence patterns. Review the requested unit, integration, and security test categories before defining the work. Done means the setup APIs, validation, secret protection, SSRF checks, authorization, pagination, and acceptance criteria are covered by tests.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

We need to build a system where communities can create and manage webhooks.

This system allows users to:

Register webhook URLs
Select events to listen to
Set secrets for security
Define permissions
Enable/disable webhooks

👉 This is only setup/config layer, not delivery.

🎯 Goals

System must be:

  • Secure (SSRF-safe, secret protected)
  • Flexible (multi-event support)
  • Scalable (multiple webhooks per community)
  • Production-ready (validation + management APIs)

🧱 CORE FEATURES

1️⃣ CREATE WEBHOOK

Endpoint

POST /api/v1/webhooks

Payload

{
  "name": "Discord Notifications",
  "url": "https://discord.com/api/webhooks/xxx",
  "events": [
    "member.created",
    "event.created",
    "hackathon.created"
  ],
  "secret": "optional-secret-key",
  "permissions": ["read", "notify"]
}

Validations

URL Validation

  • must be HTTPS

  • valid domain

  • block:

    • localhost
    • 127.0.0.1
    • internal IPs (SSRF protection)
Events Validation

Allowed events:

member.created
member.activated
event.created
event.updated
hackathon.created
community.approved
github.push
github.pr.opened
Secret Validation
  • optional
  • min length: 8
  • must be hashed before storing

Flow

validate input
→ validate URL
→ validate events
→ hash secret
→ store webhook
→ return success

2️⃣ LIST WEBHOOKS

Endpoint

GET /api/v1/webhooks

Features

  • list all webhooks for community

  • pagination

  • filter by:

    • active/inactive
    • event type

3️⃣ GET SINGLE WEBHOOK

GET /api/v1/webhooks/:id

4️⃣ UPDATE WEBHOOK

Endpoint

PATCH /api/v1/webhooks/:id

Allowed Updates

  • name
  • URL
  • events
  • permissions
  • secret (re-hash)

5️⃣ DELETE WEBHOOK

DELETE /api/v1/webhooks/:id

6️⃣ ENABLE / DISABLE WEBHOOK

PATCH /api/v1/webhooks/:id/toggle

Purpose

  • temporarily stop webhook without deleting

7️⃣ WEBHOOK TEST ENDPOINT

Endpoint

POST /api/v1/webhooks/:id/test

Purpose

  • send test payload to URL
  • verify integration works

Payload Example

{
  "event": "test",
  "message": "Webhook setup successful"
}

🔐 SECURITY (VERY IMPORTANT)

1. SSRF Protection

Block:

localhost
127.0.0.1
internal IP ranges

2. Secret Handling

  • hash using SHA256 or bcrypt
  • never return secret in API

3. Authentication

  • only authenticated users
  • must belong to community

4. Authorization (RBAC)

Only allowed roles:

CommunityOwner
Admin

🧾 DATABASE DESIGN

Webhook Schema

communityId
name
url
events
secretHash
permissions
active
createdBy
createdAt
updatedAt

Indexes

communityId
events
active

⚠️ ERROR HANDLING

Standard Format

{
  "success": false,
  "message": "Invalid webhook URL"
}

Common Errors

  • invalid URL
  • invalid event type
  • unauthorized
  • webhook not found

🧪 TESTING

Unit Tests

  • URL validation
  • event validation
  • secret hashing

Integration Tests

  • create webhook
  • update webhook
  • delete webhook

Security Tests

  • SSRF attempts
  • invalid input

🧨 EDGE CASES

invalid URL
duplicate webhook
invalid events
large payload
malicious URL

📊 OBSERVABILITY

Logs

  • webhook created
  • webhook updated
  • webhook deleted

Metrics

webhooks created
active webhooks
failed test requests

⚙️ PERFORMANCE

  • indexed queries
  • pagination for list API

🌍 ENVIRONMENT

DEV
STAGING
PROD

✅ ACCEPTANCE CRITERIA

✔ Webhook can be created
✔ Events selection works
✔ Secret stored securely
✔ URL validation works
✔ SSRF protection active
✔ Webhook test endpoint works
✔ RBAC enforced
✔ APIs fully functional

🔥 FINAL SUMMARY

This system is:

Webhook configuration system (like Stripe / GitHub setup UI backend)
Lingua principale
TypeScript
Stelle
1
Fork
0
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

  • Include un Dockerfile o un file Docker Compose
  • Nessun modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di NexGenStudioDev/CommDesk-Backend

Tutte le issue di NexGenStudioDev/CommDesk-Backend

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.