feat(webhook): add X-Webhook-Source header to indicate event origin

Derive source (admin/visitor/system) from EventScope and include
in webhook headers. Update @mx-space/webhook package types and handler.

Author: Innei

apps/core/src/modules/webhook/webhook.service.ts

@@ -20,6 +20,18 @@ import { WebhookEventModel } from './webhook-event.model'
 
 const ACCEPT_EVENTS = new Set(Object.values(BusinessEvents))
 
+type WebhookEventSource = 'admin' | 'visitor' | 'system'
+
+function scopeToSource(scope: EventScope): WebhookEventSource {
+  const hasVisitor = (scope & EventScope.TO_VISITOR) !== 0
+  const hasAdmin = (scope & EventScope.TO_ADMIN) !== 0
+
+  if (hasVisitor && !hasAdmin) return 'admin'
+  if (hasAdmin && !hasVisitor) return 'visitor'
+  if (hasVisitor && hasAdmin) return 'admin'
+  return 'system'
+}
+
 @Injectable()
 export class WebhookService implements OnModuleInit, OnModuleDestroy {
   constructor(
@@ -120,9 +132,11 @@ export class WebhookService implements OnModuleInit, OnModuleDestroy {
       rawPayload,
     )
 
+    const source = scopeToSource(scope)
+
     await Promise.all(
       scopedWebhooks.map((webhook) => {
-        return this.sendWebhookEvent(event, payload, webhook)
+        return this.sendWebhookEvent(event, payload, webhook, source)
       }),
     )
   }
@@ -131,6 +145,7 @@ export class WebhookService implements OnModuleInit, OnModuleDestroy {
     event: string,
     payload: object,
     webhook: WebhookModel,
+    source: WebhookEventSource = 'system',
   ) {
     const stringifyPayload = JSON.stringify(payload)
     const clonedPayload = JSON.parse(stringifyPayload)
@@ -147,6 +162,7 @@ export class WebhookService implements OnModuleInit, OnModuleDestroy {
         webhook.secret,
         stringifyPayload,
       ),
+      'X-Webhook-Source': source,
     }
     const webhookEvent = await this.webhookEventModel.create({
       event,

packages/webhook/src/handler.ts

@@ -2,9 +2,14 @@ import assert from 'node:assert'
 import { createHmac, timingSafeEqual } from 'node:crypto'
 import { EventEmitter } from 'node:events'
 import type { IncomingMessage, ServerResponse } from 'node:http'
+
 import { InvalidSignatureError } from './error'
 import type { BusinessEvents } from './event.enum'
-import type { ExtendedEventEmitter, GenericEvent } from './types'
+import type {
+  ExtendedEventEmitter,
+  GenericEvent,
+  WebhookEventSource,
+} from './types'
 
 interface CreateHandlerOptions {
   secret: string
@@ -24,12 +29,13 @@ export const createHandler = (options: CreateHandlerOptions): Handler => {
     try {
       const data = await readDataFromRequest({ req, secret })
 
-      const { type: event, payload } = data
+      const { type: event, payload, source } = data
 
-      handler.emitter.emit(event as any, payload)
+      handler.emitter.emit(event as any, payload, source)
       handler.emitter.emit('*', {
         type: event,
         payload,
+        source,
       })
       res.statusCode = 200
       res.setHeader('Content-Type', 'application/json')
@@ -74,10 +80,14 @@ export const readDataFromRequest = async ({
     verifyWebhook(secret, stringifyPayload, signature256 as string) &&
     verifyWebhookSha1(secret, stringifyPayload, signature as string)
 
+  const source = (req.headers['x-webhook-source'] ||
+    'system') as WebhookEventSource
+
   if (isValid) {
     return {
       type: event as BusinessEvents,
       payload: obj as any,
+      source,
     } as GenericEvent
   } else {
     console.error('revice a invalidate webhook payload', req.headers)

packages/webhook/src/types.ts

@@ -1,4 +1,5 @@
 import type { EventEmitter } from 'node:events'
+
 import type { CommentModel } from '@core/modules/comment/comment.model'
 import type { LinkModel } from '@core/modules/link/link.model'
 import type { NoteModel } from '@core/modules/note/note.model'
@@ -8,14 +9,19 @@ import type { PostModel } from '@core/modules/post/post.model'
 import type { NormalizedPost } from '@core/modules/post/post.type'
 import type { RecentlyModel } from '@core/modules/recently/recently.model'
 import type { SayModel } from '@core/modules/say/say.model'
+
 import type { ReaderModel } from '~/modules/reader/reader.model'
+
 import type { BusinessEvents } from './event.enum'
 
+export type WebhookEventSource = 'admin' | 'visitor' | 'system'
+
 export interface ExtendedEventEmitter extends EventEmitter {
   on: (<T extends BusinessEvents>(
     event: T,
     listener: (
       data: EventPayloadMapping[Extract<T, keyof EventPayloadMapping>],
+      source: WebhookEventSource,
     ) => void,
   ) => this) &
     ((event: '*', listener: (event: GenericEvent) => void) => this)
@@ -76,7 +82,7 @@ export interface IActivityLike {
 }
 
 // Auto Generaged type.
-export type GenericEvent =
+export type GenericEvent = (
   | { type: BusinessEvents.POST_CREATE; payload: NormalizedPost }
   | { type: BusinessEvents.POST_UPDATE; payload: NormalizedPost }
   | { type: BusinessEvents.POST_DELETE; payload: PayloadOnlyId }
@@ -115,3 +121,4 @@ export type GenericEvent =
       }
     }
   | { type: 'health_check'; payload: {} }
+) & { source: WebhookEventSource }