fix(webhooks): name the methods switch for what it actually accepts

"Accept All HTTP Methods" was not true: HEAD and OPTIONS still answer 405, so
a browser preflight or a HEAD probe fails against a webhook whose panel says
every method is accepted. Overstating what the endpoint does is the bug this
whole change set exists to remove, so the switch should not reintroduce it.

Renames it to "Accept Other HTTP Methods", says "no others" in the description,
and renames the flag to match. Nothing has shipped under the old key, so no
saved state is orphaned.

Author: waleedlatif1

apps/sim/app/api/webhooks/trigger/[path]/route.test.ts

@@ -748,7 +748,7 @@ describe('Webhook Trigger API Route', () => {
         provider: 'generic',
         path: 'get-path',
         isActive: true,
-        providerConfig: { requireAuth: false, acceptAllMethods: true },
+        providerConfig: { requireAuth: false, acceptOtherMethods: true },
         workflowId: 'test-workflow-id',
       })
 
@@ -803,7 +803,7 @@ describe('Webhook Trigger API Route', () => {
         provider: 'generic',
         path: 'head-path',
         isActive: true,
-        providerConfig: { requireAuth: false, acceptAllMethods: true },
+        providerConfig: { requireAuth: false, acceptOtherMethods: true },
         workflowId: 'test-workflow-id',
       })
 
@@ -855,7 +855,7 @@ describe('Webhook Trigger API Route', () => {
           provider: 'generic',
           path: 'any-method-path',
           isActive: true,
-          providerConfig: { requireAuth: false, acceptAllMethods: true },
+          providerConfig: { requireAuth: false, acceptOtherMethods: true },
           workflowId: 'test-workflow-id',
         })
 

apps/sim/lib/webhooks/providers/generic.test.ts

@@ -10,8 +10,8 @@ interface ContextOptions {
   secretHeaderName?: string
   token?: string
   method?: string
-  /** `acceptAllMethods` — gates the `method` key and the non-POST route methods. */
-  acceptAllMethods?: boolean
+  /** `acceptOtherMethods` — gates the `method` key and the non-POST route methods. */
+  acceptOtherMethods?: boolean
   /** `exposeRequestHeaders` — gates the `headers` key. */
   exposeRequestHeaders?: boolean
 }
@@ -28,7 +28,7 @@ function context(
       providerConfig: {
         ...(options.secretHeaderName ? { secretHeaderName: options.secretHeaderName } : {}),
         ...(options.token ? { token: options.token } : {}),
-        ...(options.acceptAllMethods ? { acceptAllMethods: true } : {}),
+        ...(options.acceptOtherMethods ? { acceptOtherMethods: true } : {}),
         ...(options.exposeRequestHeaders ? { exposeRequestHeaders: true } : {}),
       },
     },
@@ -103,7 +103,7 @@ describe('genericHandler.formatInput body precedence', () => {
   it.each([
     ['query', { query: 'user typed this' }, { srcId: '123' }, {}],
     ['headers', { headers: 'user typed this' }, {}, { exposeRequestHeaders: true }],
-    ['method', { method: 'user typed this' }, {}, { acceptAllMethods: true, method: 'PUT' }],
+    ['method', { method: 'user typed this' }, {}, { acceptOtherMethods: true, method: 'PUT' }],
   ])('keeps a body field named "%s" instead of overwriting it', async (_key, body, query, opts) => {
     const result = await format(body, query, {
       ...(opts as ContextOptions),
@@ -217,18 +217,22 @@ describe('genericHandler delivery methods', () => {
   it('declares the extra methods and the flag that unlocks them', () => {
     expect(genericHandler.extraDeliveryMethods).toEqual({
       methods: ['GET', 'PUT', 'PATCH', 'DELETE'],
-      enabledBy: 'acceptAllMethods',
+      enabledBy: 'acceptOtherMethods',
     })
   })
 
   it('exposes the request method once the webhook accepts more than POST', async () => {
-    const result = await format({ event: 'test' }, {}, { method: 'DELETE', acceptAllMethods: true })
+    const result = await format(
+      { event: 'test' },
+      {},
+      { method: 'DELETE', acceptOtherMethods: true }
+    )
 
     expect(result.input).toEqual({ event: 'test', method: 'DELETE' })
   })
 
   it('omits "method" for legacy queued jobs that carry none', async () => {
-    const result = await format({ event: 'test' }, {}, { method: '', acceptAllMethods: true })
+    const result = await format({ event: 'test' }, {}, { method: '', acceptOtherMethods: true })
 
     expect(result.input).not.toHaveProperty('method')
   })
@@ -240,7 +244,7 @@ describe('genericHandler delivery methods', () => {
    */
   it('treats a stringified "false" flag as off', async () => {
     const ctx = context({ event: 'test' }, {}, { method: 'DELETE' })
-    ;(ctx.webhook.providerConfig as Record<string, unknown>).acceptAllMethods = 'false'
+    ;(ctx.webhook.providerConfig as Record<string, unknown>).acceptOtherMethods = 'false'
 
     const result = await genericHandler.formatInput!(ctx)
 
@@ -249,7 +253,7 @@ describe('genericHandler delivery methods', () => {
 
   it('treats a stringified "true" flag as on', async () => {
     const ctx = context({ event: 'test' }, {}, { method: 'DELETE' })
-    ;(ctx.webhook.providerConfig as Record<string, unknown>).acceptAllMethods = 'true'
+    ;(ctx.webhook.providerConfig as Record<string, unknown>).acceptOtherMethods = 'true'
 
     const result = await genericHandler.formatInput!(ctx)
 

apps/sim/lib/webhooks/providers/generic.ts

@@ -20,7 +20,7 @@ const logger = createLogger('WebhookProvider:Generic')
  * Both default to off, so every webhook deployed before these existed keeps its current behavior:
  * `POST` only, and a workflow input that is exactly the request body.
  */
-const ACCEPT_ALL_METHODS_FLAG = 'acceptAllMethods'
+const ACCEPT_OTHER_METHODS_FLAG = 'acceptOtherMethods'
 const EXPOSE_REQUEST_HEADERS_FLAG = 'exposeRequestHeaders'
 
 /**
@@ -140,7 +140,7 @@ function mergeRequestData(
 export const genericHandler: WebhookProviderHandler = {
   extraDeliveryMethods: {
     methods: ['GET', 'PUT', 'PATCH', 'DELETE'],
-    enabledBy: ACCEPT_ALL_METHODS_FLAG,
+    enabledBy: ACCEPT_OTHER_METHODS_FLAG,
   },
 
   verifyAuth({ request, requestId, providerConfig }: AuthContext) {
@@ -235,7 +235,7 @@ export const genericHandler: WebhookProviderHandler = {
   }: FormatInputContext): Promise<FormatInputResult> {
     const providerConfig = (webhook.providerConfig as Record<string, unknown> | null) ?? {}
 
-    const exposesMethod = isProviderConfigFlagEnabled(providerConfig[ACCEPT_ALL_METHODS_FLAG])
+    const exposesMethod = isProviderConfigFlagEnabled(providerConfig[ACCEPT_OTHER_METHODS_FLAG])
     const exposesHeaders = isProviderConfigFlagEnabled(providerConfig[EXPOSE_REQUEST_HEADERS_FLAG])
 
     return {

apps/sim/triggers/generic/webhook.test.ts

@@ -25,7 +25,7 @@ describe('genericWebhookTrigger', () => {
    * `providerConfig`, and a newly created one must start in the same state rather than silently
    * opting every new webhook into replayable GET deliveries and headers in execution logs.
    */
-  it.each(['acceptAllMethods', 'exposeRequestHeaders'])('ships %s off by default', (id) => {
+  it.each(['acceptOtherMethods', 'exposeRequestHeaders'])('ships %s off by default', (id) => {
     const field = subBlock(id)
 
     expect(field?.type).toBe('switch')
@@ -36,7 +36,7 @@ describe('genericWebhookTrigger', () => {
     const instructions = setupInstructions()
 
     expect(instructions).toContain('The webhook accepts POST.')
-    expect(instructions).toContain('"Accept All HTTP Methods"')
+    expect(instructions).toContain('"Accept Other HTTP Methods"')
     expect(instructions).toContain('GET, PUT, PATCH and DELETE')
   })
 
@@ -57,7 +57,7 @@ describe('genericWebhookTrigger', () => {
    * reference dropdown must not offer a field the running webhook will not send.
    */
   it.each([
-    ['method', 'acceptAllMethods'],
+    ['method', 'acceptOtherMethods'],
     ['headers', 'exposeRequestHeaders'],
   ])('gates the %s output on the switch that produces it', (key, field) => {
     expect(genericWebhookTrigger.outputs[key].condition).toEqual({
@@ -81,4 +81,15 @@ describe('genericWebhookTrigger', () => {
   it('warns that authentication cannot be used with a plain link', () => {
     expect(setupInstructions()).toContain('cannot be used with a plain link')
   })
+
+  /**
+   * The switch accepts four named methods, not every method — HEAD and OPTIONS still answer 405.
+   * A title claiming "all" would be the same kind of overstatement this trigger exists to remove.
+   */
+  it('does not claim to accept methods it rejects', () => {
+    const field = subBlock('acceptOtherMethods')
+
+    expect(field?.title).not.toContain('All')
+    expect(field?.description).toContain('GET, PUT, PATCH and DELETE')
+  })
 })

apps/sim/triggers/generic/webhook.ts

@@ -51,11 +51,11 @@ export const genericWebhookTrigger: TriggerConfig = {
       mode: 'trigger',
     },
     {
-      id: 'acceptAllMethods',
-      title: 'Accept All HTTP Methods',
+      id: 'acceptOtherMethods',
+      title: 'Accept Other HTTP Methods',
       type: 'switch',
       description:
-        'Also accept GET, PUT, PATCH and DELETE, and expose the method under "method". Leave off unless you need it: a GET URL can be replayed by link prefetchers and scanners, and a request with no body cannot be deduplicated.',
+        'Also accept GET, PUT, PATCH and DELETE — no others — and expose the method under "method". Leave off unless you need it: a GET URL can be replayed by link prefetchers and scanners, and a request with no body cannot be deduplicated.',
       defaultValue: false,
       mode: 'trigger',
     },
@@ -136,8 +136,8 @@ export const genericWebhookTrigger: TriggerConfig = {
       defaultValue: [
         'Copy the webhook URL and use it in your external service or API.',
         'Configure your service to send webhooks to this URL.',
-        'The webhook accepts POST. Turn on "Accept All HTTP Methods" to also accept GET, PUT, PATCH and DELETE — for example to trigger the workflow from a link in an email.',
-        'Body fields are available in your workflow, and URL query parameters under "query" (for example "query.id"). Turn on "Expose Request Headers" to also get "headers" (for example "headers.x-event-name"), and "Accept All HTTP Methods" to also get "method".',
+        'The webhook accepts POST. Turn on "Accept Other HTTP Methods" to also accept GET, PUT, PATCH and DELETE — for example to trigger the workflow from a link in an email.',
+        'Body fields are available in your workflow, and URL query parameters under "query" (for example "query.id"). Turn on "Expose Request Headers" to also get "headers" (for example "headers.x-event-name"), and "Accept Other HTTP Methods" to also get "method".',
         'Authentication is header-based, so it cannot be used with a plain link. If authentication is enabled, include the token in the Secret Header Name you configured, or in "Authorization: Bearer TOKEN" if you left it blank — only the configured one is accepted, not either.',
         'To deduplicate incoming events, set the Deduplication Field to the dot-notation path of a unique identifier in the payload (e.g. "event.id"). Duplicate values within 7 days will be skipped.',
         'Enable "Verify Test Events" only if the sending service needs a temporary 200 response while validating the webhook URL.',
@@ -165,7 +165,7 @@ export const genericWebhookTrigger: TriggerConfig = {
       type: 'string',
       description:
         'HTTP method of the request. Yields to a body field of the same name if the caller sends one.',
-      condition: { field: 'acceptAllMethods', value: [true, 'true'] },
+      condition: { field: 'acceptOtherMethods', value: [true, 'true'] },
     },
     query: {
       type: 'object',