Custom Webhook Integrations by atul-upadhyay-7 · Pull Request #434 · Priyanshu-byte-coder/devtrack

atul-upadhyay-7 · 2026-05-20T09:37:24Z

Implements custom webhook integrations feature as requested in #381.

Features

Add custom webhook URLs that receive POST payloads on specific events
Choose which events trigger webhooks (goal completed, streak milestone, etc.)
See delivery status and retry failed deliveries
Test webhooks with a sample payload

API Endpoints

POST /api/webhooks/custom - Register new webhook
GET /api/webhooks/custom - List user's webhooks
PATCH /api/webhooks/custom/[id] - Update webhook
DELETE /api/webhooks/custom/[id] - Remove webhook
POST /api/webhooks/custom/[id]/test - Send test payload
POST /api/webhooks/custom/[id]/rotate-secret - Rotate secret key

Database Changes

webhook_configs table - Stores webhook configurations
webhook_deliveries table - Tracks delivery attempts
streak_milestones table - Tracks milestone achievements

Supported Events

goal.completed
goal.created
streak.milestone
daily.summary
weekly.summary
metrics.updated

- Add jira_credentials table to store Jira API credentials - Create API routes for fetching Jira issues and managing credentials - Add ProjectMetrics component to dashboard showing issue status - Connect Jira using domain, email and API token - Display To Do / In Progress / Done counts with avg time to close - Show recent issues with status indicator Connected Jira issues now appear alongside PR analytics in the dashboard, giving teams better visibility into their overall project velocity.

- Encrypt API tokens using AES-256-GCM before storing in database - Add token_iv column for decryption (IV stored alongside ciphertext) - Add unique constraint on user_id for reliable upsert operations - Add domain validation to prevent arbitrary domain connections - Add project key validation (Jira format: uppercase letters + numbers) - Refactor duplicate user resolution into shared requireUser() helper - Export categorizeStatus and calculateMetrics for potential testing Fixes security concerns from PR Priyanshu-byte-coder#419 review: - Tokens no longer stored in plaintext - Domain validation prevents SSRF-like attacks - Project key validation prevents JQL injection

Next.js route files cannot export non-HTTP functions like categorizeStatus and calculateMetrics. Moved them to src/lib/jira-utils.ts to satisfy Next.js build requirements.

- Add webhook_configs and webhook_deliveries tables - Add RLS policies for webhook tables - Add API routes for CRUD operations on webhooks - Add test endpoint for sending test payloads - Add secret rotation endpoint - Add webhook dispatch library with HMAC signing - Integrate webhook dispatch for goal.created and streak.milestone events - Add WebhookManager component to dashboard settings - Add streak_milestones table for tracking milestones

vercel · 2026-05-20T09:37:28Z

Someone is attempting to deploy a commit to the PRIYANSHU DOSHI's projects Team on Vercel.

A member of the Team first needs to authorize it.

github-actions · 2026-05-20T09:37:36Z

GSSoC Label Checklist 🏷️

@Priyanshu-byte-coder — please apply the appropriate labels before merging:

Difficulty (pick one):

level:beginner — 20 pts
level:intermediate — 35 pts
level:advanced — 55 pts
level:critical — 80 pts

Quality (optional):

quality:clean — ×1.2 multiplier
quality:exceptional — ×1.5 multiplier

Validation (required to score):

gssoc:approved — counts for points
gssoc:invalid / gssoc:spam / gssoc:ai-slop — does not score

Type labels (type:*) are auto-detected from files and title. Review and adjust if needed.
Points formula: (difficulty × quality_multiplier) + type_bonus

- Add PATCH endpoint for goal progress updates with goal.completed event - Add inline progress editing in GoalTracker component - Add webhook dispatch endpoints for daily.summary, weekly.summary, metrics.updated - Add GET endpoint for users to trigger summary webhooks manually - Fix TypeScript errors

Priyanshu-byte-coder

Blocking: SSRF vulnerability in webhook dispatch.

validateUrl() only checks for http:/https: protocol — it does not block private IPs, loopback addresses, or internal hostnames. An attacker can register http://169.254.169.254/latest/meta-data/ or any internal endpoint, and the server will make an authenticated fetch to it. Both the registration endpoint and the test-fire endpoint are affected.

Fix: Before making any outbound fetch, resolve the URL's hostname and block RFC-1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8, ::1), and link-local (169.254.0.0/16). Alternatively, use a DNS rebinding-safe HTTP client.

Additional required fixes:

No per-user webhook limit — dispatchToAllWebhooks fires all registered webhooks in parallel. Add a cap (e.g., 5 webhooks per user).
secret_key stored in plaintext in webhook_configs — store a keyed HMAC of the secret instead.
Jira credentials bundled in — the Jira domain validator (/^[a-zA-Z0-9][-a-zA-Z0-9]*...) also accepts private IPs and should be restricted to *.atlassian.net. This feature belongs in a separate PR.
Missing jira_credentials migration — the code references this table but no migration creates it.
Missing EOF newlines on all new files.

- Add SSRF protection: block private IPs, loopback, link-local addresses before any outbound webhook fetch (registration, test-fire, dispatch) - Add per-user webhook limit (5 webhooks max) in dispatch and creation - Encrypt secret_key in webhook_configs using AES-256-GCM instead of plaintext - Restrict Jira domain validator to *.atlassian.net only - Add missing jira_credentials migration - Add secret_iv column to webhook_configs for encrypted secrets - Add EOF newlines to all modified files

atul-upadhyay-7 · 2026-05-21T02:35:36Z

Security Fixes Applied

Addressed all mentor review feedback:

1. SSRF Vulnerability Fix

Created src/lib/ssrf-protection.ts with DNS-based IP resolution and blocking
Blocks RFC-1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
Blocks loopback (127.0.0.0/8, ::1) and link-local (169.254.0.0/16)
Applied to: webhook registration, test-fire endpoint, and dispatch function

2. Per-User Webhook Limit

Added cap of 5 webhooks per user
Enforced at creation time and in dispatchToAllWebhooks()

3. Secret Key Encryption

secret_key now stored encrypted (AES-256-GCM) instead of plaintext
Added secret_iv column to webhook_configs table
Migration: 20260521000000_add_secret_iv_to_webhook_configs.sql

4. Jira Domain Restriction

Validator now only accepts *.atlassian.net domains
Prevents private IP injection via domain field

5. Missing Migration

Added 20260521000001_add_jira_credentials.sql for jira_credentials table

6. EOF Newlines

Added trailing newlines to all modified/new files

…ng EOF newlines - Add POST /api/webhooks/custom/[id]/deliveries/[deliveryId]/retry endpoint to re-deliver failed webhook deliveries - Add trailing newlines to dispatch routes, goal routes, and streak migration

atul-upadhyay-7 · 2026-05-21T02:49:03Z

Additional Fixes Applied

After deep analysis against issue #381 requirements, found and fixed remaining gaps:

7. Retry Failed Deliveries (Issue #381 Requirement #3)

Added POST /api/webhooks/custom/[id]/deliveries/[deliveryId]/retry endpoint
Re-delivers the original payload with full SSRF protection
Logs new delivery attempt to webhook_deliveries table
Validates webhook is enabled and URL is safe before retry

8. Remaining EOF Newlines

Fixed trailing newlines on:
- src/app/api/webhooks/dispatch/route.ts
- src/app/api/webhooks/dispatch/metrics/route.ts
- src/app/api/goals/[id]/route.ts
- src/app/api/goals/route.ts
- supabase/migrations/20260520000002_add_streak_milestones.sql

Complete Issue #381 Coverage

Requirement	Status
1. Custom webhook URLs with POST payloads	✅ PASS
2. Event selection (6 events)	✅ PASS
3. Delivery status + retry	✅ PASS (retry endpoint added)
4. Test webhooks	✅ PASS
5. All 6 API endpoints	✅ PASS (7 with retry)
6. Database tables + RLS	✅ PASS
7. All 7 supported events dispatched	✅ PASS

All Mentor Blockers Resolved

Blocker	Status
SSRF vulnerability	✅ RESOLVED
No per-user limit	✅ RESOLVED
Plaintext secret_key	✅ RESOLVED
Jira domain validator	✅ RESOLVED
Missing jira_credentials migration	✅ RESOLVED
Missing EOF newlines	✅ RESOLVED

Atul Upadhyay and others added 5 commits May 20, 2026 12:19

Merge branch 'main' into feature/jira-integration

e675517

fix: move categorizeStatus/calculateMetrics to lib/jira-utils.ts

4074a4b

Next.js route files cannot export non-HTTP functions like categorizeStatus and calculateMetrics. Moved them to src/lib/jira-utils.ts to satisfy Next.js build requirements.

atul-upadhyay-7 requested a review from Priyanshu-byte-coder as a code owner May 20, 2026 09:37

github-actions Bot added the gssoc26 GSSoC 2026 contribution label May 20, 2026

Priyanshu-byte-coder requested changes May 20, 2026

View reviewed changes

Priyanshu-byte-coder added level:advanced GSSoC: Advanced difficulty (55 pts) type:feature GSSoC type bonus: new feature type:security GSSoC type bonus: security (+20 pts) labels May 20, 2026

atul-upadhyay-7 and others added 3 commits May 20, 2026 22:08

Merge branch 'main' into feature/custom-webhook-integrations

7b20445

Merge branch 'main' into feature/custom-webhook-integrations

1f881a7

fix: add retry endpoint for failed webhook deliveries and fix remaini…

8a7522a

…ng EOF newlines - Add POST /api/webhooks/custom/[id]/deliveries/[deliveryId]/retry endpoint to re-deliver failed webhook deliveries - Add trailing newlines to dispatch routes, goal routes, and streak migration

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Custom Webhook Integrations#434

Custom Webhook Integrations#434
atul-upadhyay-7 wants to merge 10 commits into
Priyanshu-byte-coder:mainfrom
atul-upadhyay-7:feature/custom-webhook-integrations

atul-upadhyay-7 commented May 20, 2026

Uh oh!

vercel Bot commented May 20, 2026

Uh oh!

github-actions Bot commented May 20, 2026

Uh oh!

Priyanshu-byte-coder left a comment

Uh oh!

atul-upadhyay-7 commented May 21, 2026

Uh oh!

atul-upadhyay-7 commented May 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

atul-upadhyay-7 commented May 20, 2026

Features

API Endpoints

Database Changes

Supported Events

Uh oh!

vercel Bot commented May 20, 2026

Uh oh!

github-actions Bot commented May 20, 2026

GSSoC Label Checklist 🏷️

Uh oh!

Priyanshu-byte-coder left a comment

Choose a reason for hiding this comment

Uh oh!

atul-upadhyay-7 commented May 21, 2026

Security Fixes Applied

1. SSRF Vulnerability Fix

2. Per-User Webhook Limit

3. Secret Key Encryption

4. Jira Domain Restriction

5. Missing Migration

6. EOF Newlines

Uh oh!

atul-upadhyay-7 commented May 21, 2026

Additional Fixes Applied

7. Retry Failed Deliveries (Issue #381 Requirement #3)

8. Remaining EOF Newlines

Complete Issue #381 Coverage

All Mentor Blockers Resolved

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants