feat(webhooks): add event dispatch signatures retries and delivery logs

- Integrates: webhook event/signature/queue pipeline via app/server/src/modules/webhooks/{events.ts,signature.ts,queue.ts,emitter.ts}, worker/plugin wiring in app/server/src/plugins/webhook-queue.ts, and server bootstrap/type decorations updates.

- Security/Behavior: signs outbound payloads with timestamped HMAC headers, enforces 5s delivery timeout, records each attempt in delivery logs, and requeues failures using the configured backoff ladder while emitting events from core auth actions.

- Validation: added webhook signature, queue, and emitter coverage in app/server/test/webhook-signature.test.ts, app/server/test/webhook-queue.test.ts, and app/server/test/webhook-emitter.test.ts; runtime execution remains pending because dependencies are not installed locally.

Author: ganeshwhere

app/server/src/index.ts

@@ -25,6 +25,7 @@ export async function buildServer(): Promise<FastifyInstance> {
   await server.register(import('./plugins/cache'))
   await server.register(import('./plugins/email'))
   await server.register(import('./plugins/email-queue'))
+  await server.register(import('./plugins/webhook-queue'))
   await server.register(import('./plugins/auth'))
 
   await server.register(import('./routes/auth'), { prefix: '/v1/auth' })

app/server/src/modules/auth/refresh.ts

@@ -89,6 +89,23 @@ async function handleReuseDetection(
     },
   })
 
+  if (typeof request.server.emitWebhookEvent === 'function') {
+    try {
+      await request.server.emitWebhookEvent({
+        type: 'session.compromised',
+        projectId: marker.projectId,
+        data: {
+          user: {
+            id: marker.userId,
+          },
+          reason: 'refresh_token_reuse_detected',
+        },
+      })
+    } catch (error) {
+      request.log.warn({ error }, 'Failed to enqueue compromised session webhook event')
+    }
+  }
+
   throw Errors.TOKEN_REUSE_DETECTED()
 }
 

app/server/src/modules/auth/signin.ts

@@ -109,6 +109,46 @@ export async function signinHandler(
 
   setRefreshTokenCookie(reply, refresh.token, config.nodeEnv === 'production')
 
+  if (typeof request.server.emitWebhookEvent === 'function') {
+    try {
+      await request.server.emitWebhookEvent({
+        type: 'user.signed_in',
+        projectId,
+        data: {
+          user: {
+            id: user.id,
+            email: user.email,
+            displayName: user.displayName,
+          },
+          session: {
+            id: session.id,
+            ipAddress: session.ipAddress,
+            userAgent: session.userAgent,
+          },
+        },
+      })
+
+      await request.server.emitWebhookEvent({
+        type: 'session.created',
+        projectId,
+        data: {
+          user: {
+            id: user.id,
+            email: user.email,
+            displayName: user.displayName,
+          },
+          session: {
+            id: session.id,
+            ipAddress: session.ipAddress,
+            userAgent: session.userAgent,
+          },
+        },
+      })
+    } catch (error) {
+      request.log.warn({ error }, 'Failed to enqueue signin webhook events')
+    }
+  }
+
   reply.send({
     data: {
       user,

app/server/src/modules/auth/signout.ts

@@ -30,6 +30,44 @@ export async function signoutHandler(
 
   if (session) {
     await request.server.dbAdapter.revokeSession(session.tokenHash)
+
+    if (typeof request.server.emitWebhookEvent === 'function') {
+      try {
+        await request.server.emitWebhookEvent({
+          type: 'user.signed_out',
+          projectId: payload.pid,
+          data: {
+            user: {
+              id: payload.sub,
+              email: payload.email,
+            },
+            session: {
+              id: session.id,
+              ipAddress: session.ipAddress,
+              userAgent: session.userAgent,
+            },
+          },
+        })
+
+        await request.server.emitWebhookEvent({
+          type: 'session.revoked',
+          projectId: payload.pid,
+          data: {
+            user: {
+              id: payload.sub,
+              email: payload.email,
+            },
+            session: {
+              id: session.id,
+              ipAddress: session.ipAddress,
+              userAgent: session.userAgent,
+            },
+          },
+        })
+      } catch (error) {
+        request.log.warn({ error }, 'Failed to enqueue signout webhook events')
+      }
+    }
   }
 
   clearRefreshTokenCookie(reply, config.nodeEnv === 'production')

app/server/src/modules/auth/signup.ts

@@ -88,6 +88,41 @@ export async function signupHandler(
 
   setRefreshTokenCookie(reply, refresh.token, config.nodeEnv === 'production')
 
+  if (typeof request.server.emitWebhookEvent === 'function') {
+    try {
+      await request.server.emitWebhookEvent({
+        type: 'user.created',
+        projectId,
+        data: {
+          user: {
+            id: user.id,
+            email: user.email,
+            displayName: user.displayName,
+          },
+        },
+      })
+
+      await request.server.emitWebhookEvent({
+        type: 'session.created',
+        projectId,
+        data: {
+          user: {
+            id: user.id,
+            email: user.email,
+            displayName: user.displayName,
+          },
+          session: {
+            id: session.id,
+            ipAddress: session.ipAddress,
+            userAgent: session.userAgent,
+          },
+        },
+      })
+    } catch (error) {
+      request.log.warn({ error }, 'Failed to enqueue signup webhook events')
+    }
+  }
+
   reply.code(201).send({
     data: {
       user,

app/server/src/modules/oauth/disconnect.ts

@@ -45,6 +45,23 @@ export async function oauthDisconnectHandler(
 
   await request.server.dbAdapter.deleteOAuthAccount(auth.sub, providerId)
 
+  if (typeof request.server.emitWebhookEvent === 'function') {
+    try {
+      await request.server.emitWebhookEvent({
+        type: 'oauth.disconnected',
+        projectId: auth.pid,
+        data: {
+          user: {
+            id: auth.sub,
+          },
+          provider: providerId,
+        },
+      })
+    } catch (error) {
+      request.log.warn({ error }, 'Failed to enqueue oauth disconnected webhook event')
+    }
+  }
+
   await request.server.dbAdapter.createAuditLog({
     projectId: auth.pid,
     userId: auth.sub,

app/server/src/modules/oauth/handlers.ts

@@ -75,7 +75,16 @@ async function resolveOAuthUser(
     avatarUrl: string | null
     rawProfile: Record<string, unknown>
   },
-) {
+): Promise<{
+  user: {
+    id: string
+    email: string
+    emailVerified: boolean
+    displayName: string | null
+    bannedAt: Date | null
+  }
+  linkedAccountCreated: boolean
+}> {
   const existingAccount = await request.server.dbAdapter.getOAuthAccount(
     data.projectId,
     data.provider,
@@ -89,7 +98,10 @@ async function resolveOAuthUser(
       throw Errors.UNAUTHORIZED()
     }
 
-    return existingUser
+    return {
+      user: existingUser,
+      linkedAccountCreated: false,
+    }
   }
 
   if (!data.email) {
@@ -109,6 +121,8 @@ async function resolveOAuthUser(
     })
   }
 
+  let linkedAccountCreated = false
+
   try {
     await request.server.dbAdapter.createOAuthAccount({
       userId: user.id,
@@ -117,6 +131,7 @@ async function resolveOAuthUser(
       providerUserId: data.providerUserId,
       rawProfile: data.rawProfile,
     })
+    linkedAccountCreated = true
   } catch {
     const account = await request.server.dbAdapter.getOAuthAccount(
       data.projectId,
@@ -129,7 +144,10 @@ async function resolveOAuthUser(
     }
   }
 
-  return user
+  return {
+    user,
+    linkedAccountCreated,
+  }
 }
 
 export async function oauthBeginHandler(
@@ -187,7 +205,7 @@ export async function oauthCallbackHandler(
   const tokenSet = await exchangeOAuthCode(providerConfig, query.code)
   const profile = await fetchOAuthProfile(providerConfig.id, providerConfig.userInfoUrl, tokenSet.accessToken)
 
-  const user = await resolveOAuthUser(request, {
+  const oauthResult = await resolveOAuthUser(request, {
     projectId: state.projectId,
     provider: providerConfig.id,
     providerUserId: profile.providerUserId,
@@ -197,6 +215,7 @@ export async function oauthCallbackHandler(
     avatarUrl: profile.avatarUrl,
     rawProfile: profile.rawProfile,
   })
+  const user = oauthResult.user
 
   if (user.bannedAt) {
     throw Errors.ACCOUNT_BANNED()
@@ -231,6 +250,60 @@ export async function oauthCallbackHandler(
 
   setRefreshTokenCookie(reply, refresh.token, config.nodeEnv === 'production')
 
+  if (typeof request.server.emitWebhookEvent === 'function') {
+    try {
+      if (oauthResult.linkedAccountCreated) {
+        await request.server.emitWebhookEvent({
+          type: 'oauth.connected',
+          projectId: state.projectId,
+          data: {
+            user: {
+              id: user.id,
+              email: user.email,
+            },
+            provider: providerConfig.id,
+          },
+        })
+      }
+
+      await request.server.emitWebhookEvent({
+        type: 'user.signed_in',
+        projectId: state.projectId,
+        data: {
+          user: {
+            id: user.id,
+            email: user.email,
+            displayName: user.displayName,
+          },
+          session: {
+            id: session.id,
+            ipAddress: session.ipAddress,
+            userAgent: session.userAgent,
+          },
+        },
+      })
+
+      await request.server.emitWebhookEvent({
+        type: 'session.created',
+        projectId: state.projectId,
+        data: {
+          user: {
+            id: user.id,
+            email: user.email,
+            displayName: user.displayName,
+          },
+          session: {
+            id: session.id,
+            ipAddress: session.ipAddress,
+            userAgent: session.userAgent,
+          },
+        },
+      })
+    } catch (error) {
+      request.log.warn({ error }, 'Failed to enqueue OAuth webhook events')
+    }
+  }
+
   const location = appendHash(
     appendQuery(state.redirectUrl, {
       provider: providerConfig.id,

app/server/src/modules/webhooks/emitter.ts

@@ -0,0 +1,45 @@
+import type { FastifyInstance } from 'fastify'
+
+import {
+  createWebhookEventPayload,
+  type WebhookEventInput,
+} from './events'
+
+export async function emitWebhookEvent(
+  server: FastifyInstance,
+  eventInput: WebhookEventInput,
+): Promise<void> {
+  const endpoints = await server.dbAdapter.listWebhookEndpoints(eventInput.projectId)
+
+  if (endpoints.length === 0) {
+    return
+  }
+
+  const payload = createWebhookEventPayload(eventInput)
+
+  const matchingEndpoints = endpoints.filter(
+    (endpoint) => endpoint.enabled && endpoint.events.includes(eventInput.type),
+  )
+
+  await Promise.all(
+    matchingEndpoints.map(async (endpoint) => {
+      await server.webhookQueue.add(
+        'deliver-webhook',
+        {
+          endpointId: endpoint.id,
+          url: endpoint.url,
+          secret: endpoint.secret,
+          event: eventInput.type,
+          payload,
+          attempt: 1,
+        },
+        {
+          delay: 0,
+          removeOnComplete: true,
+          removeOnFail: true,
+          attempts: 1,
+        },
+      )
+    }),
+  )
+}