fix(granola): never recover an orphaned endpoint by callback URL

The previous commit's URL-based recovery was unsafe. A redeploy reuses the live
registration's `path`, so the candidate and the currently serving endpoint share
a callback URL — listing by that URL and deleting every match would remove the
live deployment's endpoint and silently stop a working trigger, which is worse
than the leak it was trying to prevent.

Cleanup is now keyed solely on the id Granola returned. When the success body
carries no id there is no way to tell the candidate's endpoint from the live
one, so it is left in place: a leaked endpoint produces unverifiable deliveries
that Granola disables on its own, whereas deleting the wrong one takes down live
traffic with no signal.

The 2xx-missing-signing-secret case this originally fixed still cleans up, since
that response does carry an id.

Adds a test asserting no lookup or delete is attempted when the response has no
id, so URL matching cannot be reintroduced unnoticed.

Author: waleedlatif1

apps/sim/lib/webhooks/providers/granola.test.ts

@@ -1,7 +1,6 @@
 import crypto from 'node:crypto'
 import { NextRequest } from 'next/server'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import { getNotificationUrl } from '@/lib/webhooks/provider-subscription-utils'
 import { granolaHandler } from '@/lib/webhooks/providers/granola'
 
 const SECRET_BYTES = Buffer.from('granola-test-secret-key-padding!!!!!')
@@ -314,29 +313,19 @@ describe('Granola webhook provider', () => {
       expect(url).toBe('https://public-api.granola.ai/v1/webhook-endpoints/whe_orphan')
     })
 
-    it('recovers the endpoint by URL when the response body is unusable', async () => {
+    it('leaves the endpoint alone when the response carries no id', async () => {
+      /**
+       * A redeploy reuses the live registration's path, so the candidate and the currently
+       * serving endpoint share a callback URL. Recovering by URL would delete the live
+       * deployment's endpoint and kill a working trigger, so with no id there is nothing safe
+       * to do — leaking beats taking down live traffic. This asserts no lookup or delete is
+       * attempted, guarding against reintroducing URL matching.
+       */
       fetchMock.mockResolvedValueOnce({
         ok: true,
         status: 201,
-        json: async () => {
-          throw new Error('invalid json')
-        },
-      })
-      fetchMock.mockResolvedValueOnce({
-        ok: true,
-        status: 200,
-        json: async () => ({
-          webhook_endpoints: [
-            { id: 'whe_other', url: 'https://other.test/hook', url_redacted: false },
-            {
-              id: 'whe_mine',
-              url: getNotificationUrl({ path: 'p9' }),
-              url_redacted: false,
-            },
-          ],
-        }),
+        json: async () => ({}),
       })
-      fetchMock.mockResolvedValueOnce({ ok: true, status: 200 })
 
       await expect(
         granolaHandler.createSubscription!({
@@ -345,41 +334,7 @@ describe('Granola webhook provider', () => {
         } as never)
       ).rejects.toThrow()
 
-      const deleteCall = fetchMock.mock.calls.find(([, init]) => init?.method === 'DELETE')
-      expect(deleteCall?.[0]).toContain('whe_mine')
-      expect(deleteCall?.[0]).not.toContain('whe_other')
-    })
-
-    it('never deletes an endpoint whose URL was redacted to its origin', async () => {
-      /* A redacted url is only an origin, so matching on it could delete another workflow's
-         endpoint that happens to share the host. */
-      fetchMock.mockResolvedValueOnce({
-        ok: true,
-        status: 201,
-        json: async () => ({}),
-      })
-      fetchMock.mockResolvedValueOnce({
-        ok: true,
-        status: 200,
-        json: async () => ({
-          webhook_endpoints: [
-            {
-              id: 'whe_redacted',
-              url: getNotificationUrl({ path: 'p10' }),
-              url_redacted: true,
-            },
-          ],
-        }),
-      })
-
-      await expect(
-        granolaHandler.createSubscription!({
-          webhook: { id: 'wh_10', path: 'p10', providerConfig: { apiKey: 'grn_key' } },
-          requestId: 'granola-orphan3',
-        } as never)
-      ).rejects.toThrow()
-
-      expect(fetchMock.mock.calls.some(([, init]) => init?.method === 'DELETE')).toBe(false)
+      expect(fetchMock).toHaveBeenCalledTimes(1)
     })
 
     it('does not attempt cleanup when Granola rejected the request outright', async () => {

apps/sim/lib/webhooks/providers/granola.ts

@@ -130,69 +130,40 @@ async function deleteGranolaEndpoint(apiKey: string, endpointId: string): Promis
   }
 }
 
-/**
- * Find endpoints Granola is delivering to `url`.
- *
- * Used only to recover an endpoint whose id we never learned. Endpoints whose
- * `url` was redacted to its origin are skipped: the comparison would match any
- * endpoint sharing that origin, and deleting one of those could take down an
- * unrelated workflow's trigger.
- */
-async function findGranolaEndpointIdsByUrl(apiKey: string, url: string): Promise<string[]> {
-  const response = await fetch(GRANOLA_WEBHOOK_ENDPOINTS_URL, {
-    method: 'GET',
-    headers: {
-      Authorization: `Bearer ${apiKey}`,
-      'Content-Type': 'application/json',
-    },
-  })
-
-  if (!response.ok) return []
-
-  const body = (await response.json().catch(() => ({}))) as {
-    webhook_endpoints?: { id?: string; url?: string; url_redacted?: boolean }[]
-  }
-
-  return (body.webhook_endpoints ?? [])
-    .filter(
-      (endpoint) =>
-        endpoint.url_redacted !== true && endpoint.url === url && typeof endpoint.id === 'string'
-    )
-    .map((endpoint) => endpoint.id as string)
-}
-
 /**
  * Remove an endpoint Granola created for a registration that then failed.
  *
  * The registration service only rolls external state back when
  * `createSubscription` *returns*; a handler that throws is assumed to have left
- * nothing behind (`registration-service.ts` guards its rollback on
+ * nothing behind (`prepareStableWebhookCandidate` guards its rollback on
  * `preparedProviderConfig`). So anything already created here has to be undone
- * here, or the endpoint stays live with no external id recorded — delivering to
- * a path whose signature can never be verified, and duplicating on every retry.
+ * here, or the endpoint stays live with no external id recorded and keeps
+ * delivering to a callback whose signature can never be verified.
+ *
+ * Deliberately keyed on the id Granola returned, and nothing else. A redeploy
+ * reuses the live registration's `path`, so the candidate and the currently
+ * serving endpoint share a callback URL — recovering "our" endpoint by matching
+ * that URL would delete the live deployment's endpoint and silently kill a
+ * working trigger. When Granola's response carries no id there is no way to
+ * tell the two apart, so the endpoint is left in place: a leaked endpoint
+ * produces unverifiable deliveries that Granola eventually disables, which is
+ * far less harmful than taking down live traffic.
  *
  * Best effort by design: it never throws, because the caller is already
  * throwing the failure that matters.
  */
 async function cleanupOrphanedGranolaEndpoint(params: {
   apiKey: string
-  endpointId: string | undefined
-  notificationUrl: string
+  endpointId: string
   requestId: string
 }): Promise<void> {
-  const { apiKey, endpointId, notificationUrl, requestId } = params
+  const { apiKey, endpointId, requestId } = params
   try {
-    const endpointIds = endpointId
-      ? [endpointId]
-      : await findGranolaEndpointIdsByUrl(apiKey, notificationUrl)
-
-    for (const id of endpointIds) {
-      await deleteGranolaEndpoint(apiKey, id)
-      logger.info(`[${requestId}] Removed orphaned Granola webhook endpoint ${id}`)
-    }
+    await deleteGranolaEndpoint(apiKey, endpointId)
+    logger.info(`[${requestId}] Removed orphaned Granola webhook endpoint ${endpointId}`)
   } catch (error) {
     logger.error(
-      `[${requestId}] Failed to remove an orphaned Granola webhook endpoint; it may still be active`,
+      `[${requestId}] Failed to remove orphaned Granola webhook endpoint ${endpointId}; it may still be active`,
       error
     )
   }
@@ -303,9 +274,8 @@ export const granolaHandler: WebhookProviderHandler = {
     const folderIds = parseList(providerConfig.folderIds)
     const events = [...(GRANOLA_TRIGGER_TO_EVENT_TYPES[triggerId ?? ''] ?? [])]
 
-    const notificationUrl = getNotificationUrl(webhook)
     const requestBody: Record<string, unknown> = {
-      url: notificationUrl,
+      url: getNotificationUrl(webhook),
       scopes: scopes.length > 0 ? scopes : DEFAULT_GRANOLA_SCOPES,
     }
     if (events.length > 0) requestBody.events = events
@@ -319,27 +289,14 @@ export const granolaHandler: WebhookProviderHandler = {
       webhookId: webhook.id,
     })
 
-    let response: Response
-    try {
-      response = await fetch(GRANOLA_WEBHOOK_ENDPOINTS_URL, {
-        method: 'POST',
-        headers: {
-          Authorization: `Bearer ${apiKey}`,
-          'Content-Type': 'application/json',
-        },
-        body: JSON.stringify(requestBody),
-      })
-    } catch (error) {
-      /* The request may have reached Granola and created an endpoint before the
-         connection failed, so look one up by URL rather than assume it did not. */
-      await cleanupOrphanedGranolaEndpoint({
-        apiKey,
-        endpointId: undefined,
-        notificationUrl,
-        requestId,
-      })
-      throw error
-    }
+    const response = await fetch(GRANOLA_WEBHOOK_ENDPOINTS_URL, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify(requestBody),
+    })
 
     /* Granola rejected the request outright, so no endpoint exists to clean up. */
     if (!response.ok) {
@@ -360,12 +317,9 @@ export const granolaHandler: WebhookProviderHandler = {
       logger.error(
         `[${requestId}] Granola webhook endpoint response missing id or signing secret for webhook ${webhook.id}.`
       )
-      await cleanupOrphanedGranolaEndpoint({
-        apiKey,
-        endpointId: created.id,
-        notificationUrl,
-        requestId,
-      })
+      if (created.id) {
+        await cleanupOrphanedGranolaEndpoint({ apiKey, endpointId: created.id, requestId })
+      }
       throw new Error(
         'Granola created the webhook endpoint but did not return an ID and signing secret, so deliveries could not be verified.'
       )