fix(tiktok): preserve webhook delivery guarantees

Author: Bill Leoutsakos

apps/sim/app/api/webhooks/tiktok/route.test.ts

@@ -145,7 +145,7 @@ describe('TikTok app webhook route', () => {
     expect(order).toEqual(['start:webhook-1', 'end:webhook-1', 'start:webhook-2', 'end:webhook-2'])
   })
 
-  it('acknowledges provider-local dispatch failures like the Slack app route', async () => {
+  it('returns a retryable response when a target cannot be dispatched', async () => {
     mockFindWebhooksByRoutingKey.mockResolvedValue([target('webhook-1')])
     mockDispatchResolvedWebhookTarget.mockResolvedValue({
       outcome: 'failed',
@@ -154,7 +154,7 @@ describe('TikTok app webhook route', () => {
 
     const response = await POST(signedRequest())
 
-    expect(response.status).toBe(200)
+    expect(response.status).toBe(503)
   })
 
   it('returns 503 when target lookup fails', async () => {

apps/sim/app/api/webhooks/tiktok/route.ts

@@ -98,22 +98,29 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     const legacyWebhooks = await findLegacyTikTokWebhooks(envelope.user_openid)
     const webhooks = [...routedWebhooks, ...legacyWebhooks]
     let dispatched = 0
+    let failed = 0
     for (const { webhook, workflow } of webhooks) {
       const result = await dispatchResolvedWebhookTarget(webhook, workflow, envelope, request, {
         requestId,
         receivedAt,
         triggerTimestampMs: envelope.create_time * 1000,
       })
       if (result.outcome === 'queued') dispatched += 1
+      if (result.outcome === 'failed') failed += 1
     }
 
     logger.info(`[${requestId}] Processed TikTok webhook delivery`, {
       dispatched,
+      failed,
       event: envelope.event,
       targetCount: webhooks.length,
       userOpenIdPrefix: envelope.user_openid.slice(0, 12),
     })
 
+    if (failed > 0) {
+      return NextResponse.json({ error: 'Temporarily unable to accept webhook' }, { status: 503 })
+    }
+
     return NextResponse.json({ ok: true })
   } catch (error) {
     logger.error(`[${requestId}] TikTok webhook processing error`, {

apps/sim/lib/credentials/__tests__/webhook-deactivation.test.ts

@@ -0,0 +1,41 @@
+/**
+ * @vitest-environment node
+ */
+
+import {
+  dbChainMock,
+  dbChainMockFns,
+  drizzleOrmMock,
+  resetDbChainMock,
+  schemaMock,
+} from '@sim/testing'
+import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('@sim/db', () => ({ ...dbChainMock, ...schemaMock }))
+vi.mock('@sim/db/schema', () => schemaMock)
+vi.mock('drizzle-orm', () => drizzleOrmMock)
+
+import { clearCredentialRefs } from '@/lib/credentials/deletion'
+
+describe('credential-bound webhook deactivation', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    resetDbChainMock()
+  })
+
+  afterAll(() => {
+    resetDbChainMock()
+  })
+
+  it('deactivates TikTok and Slack webhook registrations when a credential is removed', async () => {
+    await clearCredentialRefs('credential-1', 'workspace-1')
+
+    expect(dbChainMockFns.update).toHaveBeenCalledWith(schemaMock.webhook)
+    expect(dbChainMockFns.set).toHaveBeenCalledWith(
+      expect.objectContaining({ isActive: false, updatedAt: expect.any(Date) })
+    )
+    expect(drizzleOrmMock.eq).toHaveBeenCalledWith(schemaMock.webhook.provider, 'tiktok')
+    expect(drizzleOrmMock.eq).toHaveBeenCalledWith(schemaMock.webhook.provider, 'slack_app')
+    expect(drizzleOrmMock.eq).toHaveBeenCalledWith(schemaMock.webhook.provider, 'slack')
+  })
+})

apps/sim/lib/credentials/deletion.ts

@@ -90,18 +90,18 @@ export async function clearCredentialRefs(
     clearInPausedExecutions(credentialId, workspaceId, needle),
     clearInWorkflowCheckpoints(credentialId, workspaceId, needle),
     clearInKnowledgeConnectors(credentialId),
-    deactivateSlackAppWebhooks(credentialId),
+    deactivateCredentialBoundWebhooks(credentialId),
   ])
 }
 
 /**
- * Deactivates Slack trigger webhooks bound to this credential so inbound
- * events stop routing once the account is disconnected: native (`slack_app`)
- * rows reference it via `providerConfig.credentialId`, custom-bot (`slack`)
- * rows via `routingKey` = the bot credential id. Neither is a foreign key, so
+ * Deactivates app-level trigger webhooks bound to this credential so inbound
+ * events stop routing once the account is disconnected. Native Slack and
+ * TikTok rows reference it via `providerConfig.credentialId`; custom-bot Slack
+ * rows use `routingKey` = the bot credential id. Neither is a foreign key, so
  * neither is covered by CASCADE.
  */
-async function deactivateSlackAppWebhooks(credentialId: string): Promise<void> {
+async function deactivateCredentialBoundWebhooks(credentialId: string): Promise<void> {
   await db
     .update(schema.webhook)
     .set({ isActive: false, updatedAt: new Date() })
@@ -113,6 +113,10 @@ async function deactivateSlackAppWebhooks(credentialId: string): Promise<void> {
             eq(schema.webhook.provider, 'slack_app'),
             sql`${schema.webhook.providerConfig}->>'credentialId' = ${credentialId}`
           ),
+          and(
+            eq(schema.webhook.provider, 'tiktok'),
+            sql`${schema.webhook.providerConfig}->>'credentialId' = ${credentialId}`
+          ),
           and(eq(schema.webhook.provider, 'slack'), eq(schema.webhook.routingKey, credentialId))
         )
       )