Host-neutral help (deployment-specific facts removed), registered with
HelpBundles, gated by HelpBundleAssertions. QQQ 4.1.0-RC.7.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Help bundle for the app and all five tables (how rows get created, where
event types come from), applied by WebhooksHelp. Setup card on the home.
WebhooksTablesGuardrailTest. Test that an expired secret stops signing
before it is retired. Nothing is seeded (owner choices and logs).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Delete the local shared/signing package (WebhookSigner, WebhookVerifier,
WebhookSecret, WebhookVerificationException) and use core
com.kingsrook.qqq.backend.core.utils.webhooks from QQQ 4.1.0-RC.5.
Delivery signing, inbound verification and secret generation and rotation
all go through core. The wire format is unchanged: same headers, v1,
prefix, whsec_ secrets and timestamp tolerance. Endpoints, secret storage
and delivery stay in this qbit.
Refs QRun-IO/qqq#1160 (this repo has issues disabled), architecture review
QRun-IO/qqq#1150 finding F11.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The owner approved removing the old code. Deletes the 0.x engine
(actions/, model/, tables/, the old processes and registry plugins) and
its tests, which 1.0 replaced, and drops the TEMPORARY compiler and
Checkstyle exclusions from pom.xml and the note in CLAUDE.md/AGENTS.md.
./mvnw clean verify: 144 tests, 0 failures, Checkstyle clean, JaCoCo
gate met.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Checked against Next UI 1.0.0-RC.14 with a local demo server (H2, real
traffic from the engine): Next's sanitizer removes <style>, so the home
now uses inline styles only, with intrinsic auto-fit grids instead of
media queries; the relation widgets and the payload span the full record
width; deliveries and attempts drop the insert, update and delete
capabilities so the UI offers no Edit or New (they are written only by
the qbit); the home widget is labelled Overview. Screenshots at 390 and
1440 px, light and dark: no page or inner horizontal scroll.
Adds the test-scoped WebhooksDemoServer used for the screenshots.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Rebuilds the qbit on QQQ 4.1.0-RC.4 per the assessment (QRun-IO/qqq#1105,
decisions D1-D8):
- webhooks_endpoint, webhooks_endpoint_secret, webhooks_subscription,
webhooks_delivery and webhooks_delivery_attempt (snake_case, webhooks_
prefix), permissions webhooks.view / manage / admin
- Standard Webhooks signing with per-endpoint secrets (AES-GCM or env
references) and overlapping rotation
- SSRF-safe client: private, loopback, link-local and metadata ranges
blocked, DNS pinned, no redirects, timeouts, size cap, admin-only
internal allowlist (shared/ is an internal copy of QRun-IO/qqq#1109,
replaced at RC.5)
- event sources: table insert/update/delete (record change listener),
process completed/failed, ESB topics (own events skipped, CloudEvent
id dedup), custom events and a channel API for other qbits
- delivery: unique attempt-row claims with leases (no double sends across
replicas), retries with backoff, Retry-After, dead letters and Replay,
serial mode, per-endpoint rate limits, health with probation and
auto-disable, alerts through the Alerts SPI when present, retention
- subscriptions: record filters, record security, read permission check,
detail levels, include and exclude fields, payload customizer hook
- app home dashboard, actions with the standard review/result screens,
ESB / Quick Search / API integration hooks
- JaCoCo gate, Checkstyle in verify, Maven wrapper, default 4.1 profile,
Postgres DDL in docs/ddl
The 0.x sources stay in the tree, excluded from the build, until their
removal is approved.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- add re-try upon rate-limit http errors
- fully implemented record filtering
- add app-specified security fields
- remove all hard-coded constants, putting in config class
- add clearing of memoization in WebhookSubscriptionsHelper
- add ad-hoc events
- add "event details" to json content
- fix health checker
- add ActionFlag to omit webhooks
- make test process optionally move unhealthy to probation
james.maesandClaude Opus 5.5