fix(webhooks): make generic webhook request metadata opt-in per webhook

The capabilities added on top of this branch changed behavior for every
generic webhook already deployed: each one began accepting GET, PUT, PATCH
and DELETE, and each one's workflow input gained `method` and `headers`. The
provider declared the capability, so no webhook owner chose it.

Gate both behind `providerConfig` flags written by two new switches, off by
default. A webhook deployed before these existed has neither flag, so it
answers POST only and its input is exactly the body, as before.

`query` stays ungated: it is dropped today, only appears when the caller's own
URL carries it, and adds nothing to a request without one.

Also generalize the Microsoft Teams challenge fix. Every challenge handler runs
before the webhook lookup and matches on payload shape alone, so any of them
will answer a delivery addressed to another provider on the same path. Gate
them centrally to POST via `challengeMethods`, which WhatsApp widens to GET for
Meta's verification handshake, rather than guarding one handler inline.

Alongside: widen the credential header denylist and withhold the webhook's own
token by value as well as by name; give PUT/PATCH/DELETE their own contracts
instead of reusing the POST one; parse, challenge and generate a request ID
once per delivery rather than twice on GET; answer every non-POST rejection
with the same 405 plus `Allow`; and drop the per-delivery warn logs to debug.

Author: waleedlatif1

apps/sim/app/api/webhooks/trigger/[path]/route.test.ts

@@ -690,7 +690,7 @@ describe('Webhook Trigger API Route', () => {
         provider: 'generic',
         path: 'get-path',
         isActive: true,
-        providerConfig: { requireAuth: false },
+        providerConfig: { requireAuth: false, acceptAllMethods: true },
         workflowId: 'test-workflow-id',
       })
 
@@ -707,6 +707,61 @@ describe('Webhook Trigger API Route', () => {
       expect(dispatchResolvedWebhookTargetMock).toHaveBeenCalledOnce()
     })
 
+    /**
+     * The compatibility guarantee for the route: a generic webhook deployed before the flag
+     * existed has no flag, so it answers exactly as it did before — 405, no execution.
+     */
+    it('rejects a GET delivery to a generic webhook that has not opted in', async () => {
+      testData.webhooks.push({
+        id: 'generic-webhook-id',
+        provider: 'generic',
+        path: 'opt-out-path',
+        isActive: true,
+        providerConfig: { requireAuth: false },
+        workflowId: 'test-workflow-id',
+      })
+
+      const req = createMockRequest(
+        'GET',
+        undefined,
+        {},
+        'http://localhost:3000/api/webhooks/trigger/opt-out-path?srcId=123'
+      )
+
+      const response = await GET(req, { params: Promise.resolve({ path: 'opt-out-path' }) })
+
+      expect(response.status).toBe(405)
+      expect(response.headers.get('Allow')).toBe('POST')
+      expect(dispatchResolvedWebhookTargetMock).not.toHaveBeenCalled()
+    })
+
+    /**
+     * Next derives HEAD from the exported GET, so a HEAD probe reaches the same handler. It must
+     * not execute a workflow: scanners and prefetchers send HEAD unprompted.
+     */
+    it('rejects a HEAD probe to a webhook that accepts every declared method', async () => {
+      testData.webhooks.push({
+        id: 'generic-webhook-id',
+        provider: 'generic',
+        path: 'head-path',
+        isActive: true,
+        providerConfig: { requireAuth: false, acceptAllMethods: true },
+        workflowId: 'test-workflow-id',
+      })
+
+      const req = createMockRequest(
+        'HEAD',
+        undefined,
+        {},
+        'http://localhost:3000/api/webhooks/trigger/head-path'
+      )
+
+      const response = await GET(req, { params: Promise.resolve({ path: 'head-path' }) })
+
+      expect(response.status).toBe(405)
+      expect(dispatchResolvedWebhookTargetMock).not.toHaveBeenCalled()
+    })
+
     it('rejects a GET delivery to a provider that only accepts POST', async () => {
       testData.webhooks.push({
         id: 'stripe-webhook-id',
@@ -742,7 +797,7 @@ describe('Webhook Trigger API Route', () => {
           provider: 'generic',
           path: 'any-method-path',
           isActive: true,
-          providerConfig: { requireAuth: false },
+          providerConfig: { requireAuth: false, acceptAllMethods: true },
           workflowId: 'test-workflow-id',
         })
 
@@ -762,6 +817,29 @@ describe('Webhook Trigger API Route', () => {
       }
     )
 
+    it('rejects a PUT delivery to a generic webhook that has not opted in', async () => {
+      testData.webhooks.push({
+        id: 'generic-webhook-id',
+        provider: 'generic',
+        path: 'opt-out-path',
+        isActive: true,
+        providerConfig: { requireAuth: false },
+        workflowId: 'test-workflow-id',
+      })
+
+      const req = createMockRequest(
+        'PUT',
+        { event: 'test' },
+        {},
+        'http://localhost:3000/api/webhooks/trigger/opt-out-path'
+      )
+
+      const response = await PUT(req, { params: Promise.resolve({ path: 'opt-out-path' }) })
+
+      expect(response.status).toBe(405)
+      expect(dispatchResolvedWebhookTargetMock).not.toHaveBeenCalled()
+    })
+
     it('rejects a PUT delivery to a provider that only accepts POST', async () => {
       testData.webhooks.push({
         id: 'stripe-webhook-id',
@@ -785,6 +863,35 @@ describe('Webhook Trigger API Route', () => {
       expect(dispatchResolvedWebhookTargetMock).not.toHaveBeenCalled()
     })
 
+    /**
+     * Every non-POST rejection is the same 405, whether the path is unknown, holds only
+     * non-path triggers, or holds a trigger that has not opted in — so a probe cannot tell
+     * a configured path from an unused one.
+     */
+    it('returns the same 405 for a DELETE to a non-path trigger as to an unknown path', async () => {
+      testData.webhooks.push({
+        id: 'internal-webhook-id',
+        provider: 'sim',
+        path: 'internal-path',
+        isActive: true,
+        providerConfig: {},
+        workflowId: 'test-workflow-id',
+      })
+
+      const req = createMockRequest(
+        'DELETE',
+        undefined,
+        {},
+        'http://localhost:3000/api/webhooks/trigger/internal-path'
+      )
+
+      const response = await DELETE(req, { params: Promise.resolve({ path: 'internal-path' }) })
+
+      expect(response.status).toBe(405)
+      expect(response.headers.get('Allow')).toBe('POST')
+      expect(dispatchResolvedWebhookTargetMock).not.toHaveBeenCalled()
+    })
+
     it('returns 405 for a DELETE to an unknown path', async () => {
       const req = createMockRequest(
         'DELETE',

apps/sim/app/api/webhooks/trigger/[path]/route.ts

@@ -1,6 +1,12 @@
 import { createLogger } from '@sim/logger'
 import { type NextRequest, NextResponse } from 'next/server'
-import { webhookTriggerGetContract, webhookTriggerPostContract } from '@/lib/api/contracts/webhooks'
+import {
+  webhookTriggerDeleteContract,
+  webhookTriggerGetContract,
+  webhookTriggerPatchContract,
+  webhookTriggerPostContract,
+  webhookTriggerPutContract,
+} from '@/lib/api/contracts/webhooks'
 import { parseRequest } from '@/lib/api/server'
 import { admissionRejectedResponse, tryAdmit } from '@/lib/core/admission/gate'
 import { generateRequestId } from '@/lib/core/utils/request'
@@ -22,71 +28,93 @@ export const dynamic = 'force-dynamic'
 export const runtime = 'nodejs'
 export const maxDuration = 60
 
-export const GET = withRouteHandler(
-  async (request: NextRequest, context: { params: Promise<{ path: string }> }) => {
+type RouteContext = { params: Promise<{ path: string }> }
+
+type WebhookTriggerContract =
+  | typeof webhookTriggerGetContract
+  | typeof webhookTriggerPostContract
+  | typeof webhookTriggerPutContract
+  | typeof webhookTriggerPatchContract
+  | typeof webhookTriggerDeleteContract
+
+/**
+ * Shared delivery entry point. Parses the path once, sheds load, and hands off — so a request is
+ * parsed, challenged and looked up exactly once no matter which method it arrived on.
+ */
+function defineDeliveryRoute(
+  contract: WebhookTriggerContract,
+  beforeAdmission?: (
+    request: NextRequest,
+    requestId: string,
+    path: string
+  ) => Promise<NextResponse | null>
+) {
+  return withRouteHandler(async (request: NextRequest, context: RouteContext) => {
     const requestId = generateRequestId()
-    const parsed = await parseRequest(webhookTriggerGetContract, request, context)
+    const parsed = await parseRequest(contract, request, context)
     if (!parsed.success) return parsed.response
     const { path } = parsed.data.params
 
-    // Handle provider-specific GET verifications (Microsoft Graph, WhatsApp, etc.)
-    const challengeResponse = await handleProviderChallenges({}, request, requestId, path)
-    if (challengeResponse) {
-      return challengeResponse
-    }
-
-    const verificationResponse = await handlePreLookupWebhookVerification(
-      request.method,
-      undefined,
-      requestId,
-      path
-    )
-    if (verificationResponse) {
-      return verificationResponse
-    }
+    const earlyResponse = await beforeAdmission?.(request, requestId, path)
+    if (earlyResponse) return earlyResponse
 
     const ticket = tryAdmit()
     if (!ticket) {
       return admissionRejectedResponse()
     }
 
     try {
-      return await handleWebhookDelivery(request, context, webhookTriggerGetContract)
+      return await handleWebhookDelivery(request, requestId, path)
     } finally {
       ticket.release()
     }
-  }
+  })
+}
+
+/**
+ * `GET` alone runs the pre-lookup verification probe before the webhook lookup, because a
+ * provider validating a URL it has not been given a webhook for can only be answered there.
+ * `handleWebhookDelivery` runs the same check for every method once the lookup comes back empty.
+ */
+export const GET = defineDeliveryRoute(webhookTriggerGetContract, (request, requestId, path) =>
+  handlePreLookupWebhookVerification(request.method, undefined, requestId, path)
 )
 
-const handleBodyDelivery = withRouteHandler(
-  async (request: NextRequest, context: { params: Promise<{ path: string }> }) => {
-    const ticket = tryAdmit()
-    if (!ticket) {
-      return admissionRejectedResponse()
-    }
+export const POST = defineDeliveryRoute(webhookTriggerPostContract)
 
-    try {
-      return await handleWebhookDelivery(request, context, webhookTriggerPostContract)
-    } finally {
-      ticket.release()
-    }
-  }
-)
+/**
+ * Accepted only by a webhook whose provider declares the method AND whose owner has opted in.
+ * Everything else gets a 405 from `handleWebhookDelivery`.
+ */
+export const PUT = defineDeliveryRoute(webhookTriggerPutContract)
+export const PATCH = defineDeliveryRoute(webhookTriggerPatchContract)
+export const DELETE = defineDeliveryRoute(webhookTriggerDeleteContract)
 
-export const POST = handleBodyDelivery
+/**
+ * A 405 body carries `Allow` per RFC 9110. Every rejection here allows exactly `POST`: a webhook
+ * that accepts more never reaches this path, so the header cannot be used to tell an unknown
+ * path from a configured one.
+ */
+function methodNotAllowedResponse(): NextResponse {
+  return new NextResponse('Method not allowed', { status: 405, headers: { Allow: 'POST' } })
+}
 
 /**
- * Methods a provider must opt into via `extraDeliveryMethods`. A delivery to a path whose
- * triggers have not opted in gets a 405 from `handleWebhookDelivery`.
+ * The answer for a path that will not accept this delivery. `POST` keeps its historical 404 so
+ * existing callers see no change; anything else answers 405 uniformly, whether the path is
+ * unknown, holds only non-path triggers, or holds a trigger that has not opted into the method —
+ * so a probe cannot tell those apart.
  */
-export const PUT = handleBodyDelivery
-export const PATCH = handleBodyDelivery
-export const DELETE = handleBodyDelivery
+function notDeliverableResponse(method: string): NextResponse {
+  return method === 'POST'
+    ? new NextResponse('Not Found', { status: 404 })
+    : methodNotAllowedResponse()
+}
 
 async function handleWebhookDelivery(
   request: NextRequest,
-  context: { params: Promise<{ path: string }> },
-  contract: typeof webhookTriggerGetContract | typeof webhookTriggerPostContract
+  requestId: string,
+  path: string
 ): Promise<NextResponse> {
   const receivedAt = Date.now()
   /**
@@ -99,11 +127,6 @@ async function handleWebhookDelivery(
     ? Number(slackRequestTimestamp) * 1000
     : undefined
 
-  const requestId = generateRequestId()
-  const parsed = await parseRequest(contract, request, context)
-  if (!parsed.success) return parsed.response
-  const { path } = parsed.data.params
-
   const earlyChallenge = await handleProviderChallenges({}, request, requestId, path)
   if (earlyChallenge) {
     return earlyChallenge
@@ -132,18 +155,18 @@ async function handleWebhookDelivery(
 
   if (allWebhooksForPath.length > 0 && pathWebhooks.length === 0) {
     logger.warn(`[${requestId}] Rejected HTTP delivery to non-path trigger: ${path}`)
-    return new NextResponse('Not Found', { status: 404 })
+    return notDeliverableResponse(request.method)
   }
 
   const webhooksForPath = pathWebhooks.filter(({ webhook: foundWebhook }) =>
-    acceptsWebhookDeliveryMethod(foundWebhook.provider, request.method)
+    acceptsWebhookDeliveryMethod(foundWebhook.provider, request.method, foundWebhook.providerConfig)
   )
 
   if (pathWebhooks.length > 0 && webhooksForPath.length === 0) {
     logger.warn(
       `[${requestId}] Rejected ${request.method} delivery to path ${path}: no trigger on this path accepts that method`
     )
-    return new NextResponse('Method not allowed', { status: 405 })
+    return methodNotAllowedResponse()
   }
 
   if (webhooksForPath.length === 0) {
@@ -158,11 +181,7 @@ async function handleWebhookDelivery(
     }
 
     logger.warn(`[${requestId}] Webhook or workflow not found for path: ${path}`)
-    // Unknown paths keep answering 405 on GET so probes cannot tell an unknown path
-    // from one whose trigger only accepts POST.
-    return request.method === 'POST'
-      ? new NextResponse('Not Found', { status: 404 })
-      : new NextResponse('Method not allowed', { status: 405 })
+    return notDeliverableResponse(request.method)
   }
 
   // Process each webhook matched on this path

apps/sim/lib/api/contracts/webhooks.ts

@@ -273,6 +273,44 @@ export const webhookTriggerPostContract = defineRouteContract({
   },
 })
 
+/**
+ * `PUT`, `PATCH` and `DELETE` deliveries. Same shape as the `POST` contract — they exist as
+ * separate declarations rather than reusing it so each route method is described by a contract
+ * that states its own method, which is what the boundary audit and any future client read.
+ */
+export const webhookTriggerPutContract = defineRouteContract({
+  method: 'PUT',
+  path: '/api/webhooks/trigger/[path]',
+  params: webhookTriggerParamsSchema,
+  response: {
+    mode: 'json',
+    // untyped-response: webhook trigger forwards arbitrary provider challenge or workflow execution payloads
+    schema: z.unknown(),
+  },
+})
+
+export const webhookTriggerPatchContract = defineRouteContract({
+  method: 'PATCH',
+  path: '/api/webhooks/trigger/[path]',
+  params: webhookTriggerParamsSchema,
+  response: {
+    mode: 'json',
+    // untyped-response: webhook trigger forwards arbitrary provider challenge or workflow execution payloads
+    schema: z.unknown(),
+  },
+})
+
+export const webhookTriggerDeleteContract = defineRouteContract({
+  method: 'DELETE',
+  path: '/api/webhooks/trigger/[path]',
+  params: webhookTriggerParamsSchema,
+  response: {
+    mode: 'json',
+    // untyped-response: webhook trigger forwards arbitrary provider challenge or workflow execution payloads
+    schema: z.unknown(),
+  },
+})
+
 /**
  * TikTok app-level webhook ingress. Signature is verified from the raw body
  * before this schema runs; `content` remains a JSON string per TikTok docs.