refactor(webhooks): tighten the delivery route and metadata gating

Audit pass over the diff. No behavior change; the tests and mutation checks
are unchanged.

- `defineDeliveryRoute` takes a named option rather than a bare positional
  boolean, so the GET call site says what the flag means.
- A gated-off `method` is omitted from the merge input instead of being passed
  as an empty string for the filter to drop. The sentinel conflated "the owner
  did not enable this" with "a legacy job carried no method"; the filter still
  handles the second, which is what it is for.
- The accept-all-methods flag constant is no longer exported. Nothing outside
  the module read it, and its counterpart was already module-private.
- Say why the challenge handlers are offered the request a second time: the
  pre-admission pass answers only what is readable from the URL.

Author: waleedlatif1

apps/sim/app/api/webhooks/trigger/[path]/route.ts

@@ -50,7 +50,10 @@ type WebhookTriggerContract =
  * provider echoing a token it chose beats a generic "reachable" 200 when a path somehow has both
  * pending at once.
  */
-function defineDeliveryRoute(contract: WebhookTriggerContract, probeBeforeLookup = false) {
+function defineDeliveryRoute(
+  contract: WebhookTriggerContract,
+  options: { probeBeforeLookup?: boolean } = {}
+) {
   return withRouteHandler(async (request: NextRequest, context: RouteContext) => {
     const requestId = generateRequestId()
     const parsed = await parseRequest(contract, request, context)
@@ -60,7 +63,7 @@ function defineDeliveryRoute(contract: WebhookTriggerContract, probeBeforeLookup
     const challenge = await handleProviderChallenges({}, request, requestId, path)
     if (challenge) return challenge
 
-    if (probeBeforeLookup) {
+    if (options.probeBeforeLookup) {
       const verification = await handlePreLookupWebhookVerification(
         request.method,
         undefined,
@@ -88,7 +91,7 @@ function defineDeliveryRoute(contract: WebhookTriggerContract, probeBeforeLookup
  * a webhook for can only be answered there. `handleWebhookDelivery` runs the same check for every
  * method once the lookup comes back empty.
  */
-export const GET = defineDeliveryRoute(webhookTriggerGetContract, true)
+export const GET = defineDeliveryRoute(webhookTriggerGetContract, { probeBeforeLookup: true })
 
 export const POST = defineDeliveryRoute(webhookTriggerPostContract)
 
@@ -101,8 +104,9 @@ export const PATCH = defineDeliveryRoute(webhookTriggerPatchContract)
 export const DELETE = defineDeliveryRoute(webhookTriggerDeleteContract)
 
 /**
- * A 405 body carries `Allow` per RFC 9110. Every rejection here allows exactly `POST`: a webhook
- * that accepts more never reaches this path, so the header cannot be used to tell an unknown
+ * A 405 response carries `Allow` per RFC 9110. Every rejection here allows exactly `POST`: a
+ * webhook
+ * that accepts more never reaches this branch, so the header cannot be used to tell an unknown
  * path from a configured one.
  */
 function methodNotAllowedResponse(): NextResponse {
@@ -146,6 +150,10 @@ async function handleWebhookDelivery(
 
   const { body, rawBody } = parseResult
 
+  /**
+   * Offered a second time, now with the parsed body: the pre-admission pass answers only the
+   * handshakes readable from the URL, and the rest match on body shape.
+   */
   const challengeResponse = await handleProviderChallenges(body, request, requestId, path, rawBody)
   if (challengeResponse) {
     return challengeResponse

apps/sim/lib/webhooks/providers/generic.ts

@@ -20,7 +20,7 @@ const logger = createLogger('WebhookProvider:Generic')
  * Both default to off, so every webhook deployed before these existed keeps its current behavior:
  * `POST` only, and a workflow input that is exactly the request body.
  */
-export const GENERIC_ACCEPT_ALL_METHODS_FLAG = 'acceptAllMethods'
+const ACCEPT_ALL_METHODS_FLAG = 'acceptAllMethods'
 const EXPOSE_REQUEST_HEADERS_FLAG = 'exposeRequestHeaders'
 
 /**
@@ -140,7 +140,7 @@ function mergeRequestData(
 export const genericHandler: WebhookProviderHandler = {
   extraDeliveryMethods: {
     methods: ['GET', 'PUT', 'PATCH', 'DELETE'],
-    enabledBy: GENERIC_ACCEPT_ALL_METHODS_FLAG,
+    enabledBy: ACCEPT_ALL_METHODS_FLAG,
   },
 
   verifyAuth({ request, requestId, providerConfig }: AuthContext) {
@@ -235,18 +235,16 @@ export const genericHandler: WebhookProviderHandler = {
   }: FormatInputContext): Promise<FormatInputResult> {
     const providerConfig = (webhook.providerConfig as Record<string, unknown> | null) ?? {}
 
-    const exposesMethod = isProviderConfigFlagEnabled(
-      providerConfig[GENERIC_ACCEPT_ALL_METHODS_FLAG]
-    )
+    const exposesMethod = isProviderConfigFlagEnabled(providerConfig[ACCEPT_ALL_METHODS_FLAG])
     const exposesHeaders = isProviderConfigFlagEnabled(providerConfig[EXPOSE_REQUEST_HEADERS_FLAG])
 
     return {
       input: mergeRequestData(
         body,
         {
-          method: exposesMethod ? method : '',
+          ...(exposesMethod ? { method } : {}),
           query,
-          headers: exposesHeaders ? exposedHeaders(headers, providerConfig) : {},
+          ...(exposesHeaders ? { headers: exposedHeaders(headers, providerConfig) } : {}),
         },
         requestId
       ),