feat(control-plane): proxy webhook subscription create/delete to relayfile-cloud

cmd/relayfile-cli/control_plane.go

@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
 	"os"
 	"os/signal"
 	"path/filepath"
@@ -18,9 +19,9 @@ import (
 	"time"
 )
 
-const relayfileControlPlaneAPIVersion uint32 = 1
+const relayfileControlPlaneAPIVersion uint32 = 2
 
-var relayfileControlPlaneSupportedVersions = []uint32{relayfileControlPlaneAPIVersion}
+var relayfileControlPlaneSupportedVersions = []uint32{1, relayfileControlPlaneAPIVersion}
 
 type controlPlaneErrorCode string
 
@@ -119,6 +120,23 @@ type writebackSecretData struct {
 	Secret string `json:"secret"`
 }
 
+type webhookSubscriptionRequest struct {
+	Workspace string   `json:"workspace,omitempty"`
+	URL       string   `json:"url"`
+	PathGlobs []string `json:"pathGlobs"`
+	Secret    string   `json:"secret"`
+}
+
+type webhookSubscriptionResponse struct {
+	SubscriptionID string `json:"subscriptionId"`
+	Secret         string `json:"secret,omitempty"`
+}
+
+type deleteWebhookSubscriptionRequest struct {
+	Workspace      string `json:"workspace,omitempty"`
+	SubscriptionID string `json:"subscriptionId"`
+}
+
 func runControlPlane(args []string, stdout io.Writer) error {
 	if len(args) == 0 {
 		return errors.New("control-plane subcommand is required: serve")
@@ -210,6 +228,7 @@ func newControlPlaneHandler() http.Handler {
 	mux.HandleFunc("/v1/integrations/bindings", withControlPlaneVersion(handleControlPlaneListBindings))
 	mux.HandleFunc("/v1/integrations/unbind", withControlPlaneVersion(handleControlPlaneUnbind))
 	mux.HandleFunc("/v1/integrations/writeback-secret", withControlPlaneVersion(handleControlPlaneWritebackSecret))
+	mux.HandleFunc("/v1/integrations/webhook-subscriptions", withControlPlaneVersion(handleControlPlaneWebhookSubscription))
 	return mux
 }
 
@@ -449,6 +468,79 @@ func handleControlPlaneWritebackSecret(w http.ResponseWriter, r *http.Request) {
 	writeControlPlaneJSON(w, http.StatusOK, data)
 }
 
+func handleControlPlaneWebhookSubscription(w http.ResponseWriter, r *http.Request) {
+	switch r.Method {
+	case http.MethodPost:
+		var req webhookSubscriptionRequest
+		if err := decodeControlPlaneJSON(r, &req); err != nil {
+			writeControlPlaneError(w, http.StatusBadRequest, controlPlaneErrInvalidArgument, err.Error())
+			return
+		}
+		if strings.TrimSpace(req.URL) == "" || len(req.PathGlobs) == 0 || strings.TrimSpace(req.Secret) == "" {
+			writeControlPlaneError(w, http.StatusBadRequest, controlPlaneErrInvalidArgument, "url, pathGlobs, and secret are required")
+			return
+		}
+		commandClient, err := prepareWorkspaceCommandClient(strings.TrimSpace(req.Workspace), "", "", defaultJoinScopes)
+		if err != nil {
+			writeControlPlaneMappedError(w, err)
+			return
+		}
+		workspaceID := strings.TrimSpace(commandClient.workspaceID)
+		if workspaceID == "" {
+			writeControlPlaneMappedError(w, errors.New("could not resolve relayfile workspace id"))
+			return
+		}
+		var response webhookSubscriptionResponse
+		if err := commandClient.client.postJSON(
+			r.Context(),
+			fmt.Sprintf("/v1/workspaces/%s/webhooks", url.PathEscape(workspaceID)),
+			map[string]any{
+				"url":       strings.TrimSpace(req.URL),
+				"pathGlobs": req.PathGlobs,
+				"secret":    strings.TrimSpace(req.Secret),
+			},
+			&response,
+		); err != nil {
+			writeControlPlaneMappedError(w, err)
+			return
+		}
+		writeControlPlaneJSON(w, http.StatusOK, response)
+	case http.MethodDelete:
+		var req deleteWebhookSubscriptionRequest
+		if err := decodeControlPlaneJSON(r, &req); err != nil {
+			writeControlPlaneError(w, http.StatusBadRequest, controlPlaneErrInvalidArgument, err.Error())
+			return
+		}
+		subscriptionID := strings.TrimSpace(req.SubscriptionID)
+		if subscriptionID == "" {
+			writeControlPlaneError(w, http.StatusBadRequest, controlPlaneErrInvalidArgument, "subscriptionId is required")
+			return
+		}
+		commandClient, err := prepareWorkspaceCommandClient(strings.TrimSpace(req.Workspace), "", "", defaultJoinScopes)
+		if err != nil {
+			writeControlPlaneMappedError(w, err)
+			return
+		}
+		workspaceID := strings.TrimSpace(commandClient.workspaceID)
+		if workspaceID == "" {
+			writeControlPlaneMappedError(w, errors.New("could not resolve relayfile workspace id"))
+			return
+		}
+		if err := commandClient.client.deleteJSON(
+			r.Context(),
+			fmt.Sprintf("/v1/workspaces/%s/webhooks/%s", url.PathEscape(workspaceID), url.PathEscape(subscriptionID)),
+			"",
+			nil,
+		); err != nil {
+			writeControlPlaneMappedError(w, err)
+			return
+		}
+		writeControlPlaneJSON(w, http.StatusOK, map[string]bool{"ok": true})
+	default:
+		writeControlPlaneError(w, http.StatusMethodNotAllowed, controlPlaneErrInvalidArgument, "method not allowed")
+	}
+}
+
 func controlPlaneHello() helloResponse {
 	return helloResponse{
 		DaemonVersion:        relayfileVersion,

cmd/relayfile-cli/control_plane_test.go

@@ -35,12 +35,15 @@ func TestControlPlaneHelloVersionAndCLIVersion(t *testing.T) {
 	if status != http.StatusOK {
 		t.Fatalf("hello status = %d", status)
 	}
-	if hello.DaemonVersion != "0.10.17" || hello.APIVersion != 1 {
+	if hello.DaemonVersion != "0.10.17" || hello.APIVersion != 2 {
 		t.Fatalf("unexpected hello response: %#v", hello)
 	}
+	if len(hello.SupportedAPIVersions) != 2 || hello.SupportedAPIVersions[0] != 1 || hello.SupportedAPIVersions[1] != 2 {
+		t.Fatalf("unexpected supported API versions: %#v", hello.SupportedAPIVersions)
+	}
 
 	var errResp map[string]controlPlaneError
-	status = controlPlaneJSONWithoutVersion(t, client, http.MethodGet, baseURL+"/v1/hello?apiVersion=2", nil, &errResp)
+	status = controlPlaneJSONWithoutVersion(t, client, http.MethodGet, baseURL+"/v1/hello?apiVersion=3", nil, &errResp)
 	if status != http.StatusUpgradeRequired {
 		t.Fatalf("incompatible hello status = %d, want %d", status, http.StatusUpgradeRequired)
 	}
@@ -187,6 +190,30 @@ func TestControlPlaneCloudIntegrationConformance(t *testing.T) {
 				t.Fatalf("unexpected writeback-secret channel: %q", r.URL.Query().Get("channel"))
 			}
 			_, _ = w.Write([]byte(`{"ok":true,"data":{"url":"https://relay.test/writeback","secret":"sec_123"}}`))
+		case "/v1/workspaces/ws_123/webhooks":
+			if r.Method != http.MethodPost {
+				t.Fatalf("expected webhooks POST, got %s", r.Method)
+			}
+			var body struct {
+				URL       string   `json:"url"`
+				PathGlobs []string `json:"pathGlobs"`
+				Secret    string   `json:"secret"`
+			}
+			if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+				t.Fatalf("decode webhook subscription body failed: %v", err)
+			}
+			if body.URL != "https://cast.test/v1/integrations/relayfile/inbound/ws/ch" ||
+				len(body.PathGlobs) != 1 ||
+				body.PathGlobs[0] != "/github/repos/acme/widgets/issues/**" ||
+				body.Secret != "inbound-secret" {
+				t.Fatalf("unexpected webhook subscription body: %#v", body)
+			}
+			_, _ = w.Write([]byte(`{"subscriptionId":"whsub_123"}`))
+		case "/v1/workspaces/ws_123/webhooks/whsub_123":
+			if r.Method != http.MethodDelete {
+				t.Fatalf("expected webhooks DELETE, got %s", r.Method)
+			}
+			w.WriteHeader(http.StatusNoContent)
 		default:
 			t.Fatalf("unexpected path: %s", r.URL.Path)
 		}
@@ -240,6 +267,32 @@ func TestControlPlaneCloudIntegrationConformance(t *testing.T) {
 	if secret.URL != "https://relay.test/writeback" || secret.Secret != "sec_123" {
 		t.Fatalf("unexpected writeback secret: %#v", secret)
 	}
+
+	var subscription webhookSubscriptionResponse
+	status = controlPlaneJSON(t, client, http.MethodPost, baseURL+"/v1/integrations/webhook-subscriptions", webhookSubscriptionRequest{
+		Workspace: "demo",
+		URL:       "https://cast.test/v1/integrations/relayfile/inbound/ws/ch",
+		PathGlobs: []string{"/github/repos/acme/widgets/issues/**"},
+		Secret:    "inbound-secret",
+	}, &subscription)
+	if status != http.StatusOK {
+		t.Fatalf("webhook subscription status = %d", status)
+	}
+	if subscription.SubscriptionID != "whsub_123" {
+		t.Fatalf("unexpected webhook subscription: %#v", subscription)
+	}
+
+	var deleted map[string]bool
+	status = controlPlaneJSON(t, client, http.MethodDelete, baseURL+"/v1/integrations/webhook-subscriptions", deleteWebhookSubscriptionRequest{
+		Workspace:      "demo",
+		SubscriptionID: "whsub_123",
+	}, &deleted)
+	if status != http.StatusOK {
+		t.Fatalf("delete webhook subscription status = %d", status)
+	}
+	if !deleted["ok"] {
+		t.Fatalf("unexpected delete response: %#v", deleted)
+	}
 }
 
 func startControlPlaneTestServer(t *testing.T) (*http.Client, string, func()) {

openapi/relayfile-control-plane-v1.openapi.yaml

@@ -6,7 +6,7 @@ info:
     Versioned local control-plane contract for the relayfile daemon/CLI.
     The service listens on a user-owned Unix domain socket
     (`RELAYFILE_SOCK`, or `$XDG_RUNTIME_DIR/relayfile.sock`) and uses
-    `X-Relayfile-API-Version: 1` for client compatibility checks.
+    `X-Relayfile-API-Version: 2` for client compatibility checks.
 servers:
   - url: http://relayfile.local
     description: Logical HTTP origin over the relayfile Unix domain socket.
@@ -228,6 +228,43 @@ paths:
             application/json:
               schema:
                 $ref: "#/components/schemas/WritebackSecret"
+  /v1/integrations/webhook-subscriptions:
+    post:
+      operationId: createWebhookSubscription
+      summary: Create a server-side relayfile webhook subscription
+      parameters:
+        - $ref: "#/components/parameters/ApiVersionHeader"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/WebhookSubscriptionRequest"
+      responses:
+        "200":
+          description: Created webhook subscription
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/WebhookSubscriptionResponse"
+    delete:
+      operationId: deleteWebhookSubscription
+      summary: Delete a server-side relayfile webhook subscription
+      parameters:
+        - $ref: "#/components/parameters/ApiVersionHeader"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/DeleteWebhookSubscriptionRequest"
+      responses:
+        "200":
+          description: Subscription deleted
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/DeleteWebhookSubscriptionResponse"
 components:
   parameters:
     ApiVersionHeader:
@@ -237,7 +274,7 @@ components:
       schema:
         type: integer
         format: uint32
-        const: 1
+        const: 2
     ApiVersionQuery:
       name: apiVersion
       in: query
@@ -485,6 +522,44 @@ components:
           type: string
         secret:
           type: string
+    WebhookSubscriptionRequest:
+      type: object
+      required: [url, pathGlobs, secret]
+      properties:
+        workspace:
+          type: string
+        url:
+          type: string
+          format: uri
+        pathGlobs:
+          type: array
+          minItems: 1
+          items:
+            type: string
+        secret:
+          type: string
+    WebhookSubscriptionResponse:
+      type: object
+      required: [subscriptionId]
+      properties:
+        subscriptionId:
+          type: string
+        secret:
+          type: string
+    DeleteWebhookSubscriptionRequest:
+      type: object
+      required: [subscriptionId]
+      properties:
+        workspace:
+          type: string
+        subscriptionId:
+          type: string
+    DeleteWebhookSubscriptionResponse:
+      type: object
+      required: [ok]
+      properties:
+        ok:
+          type: boolean
     ErrorEnvelope:
       type: object
       required: [error]

packages/client/src/client.test.ts

@@ -64,8 +64,8 @@ describe('RelayfileControlPlaneClient lifecycle', () => {
     const client = new RelayfileControlPlaneClient({ socketPath: '/nope.sock', autoStart: false });
     vi.spyOn(client, 'hello').mockResolvedValue({
       daemonVersion: '0.10.17',
-      apiVersion: 2,
-      supportedApiVersions: [2],
+      apiVersion: 1,
+      supportedApiVersions: [1],
     });
     await expect(client.ensureReady()).rejects.toMatchObject({ code: 'VERSION_INCOMPATIBLE' });
   });
@@ -106,6 +106,42 @@ describe('RelayfileControlPlaneClient lifecycle', () => {
   });
 });
 
+describe('RelayfileControlPlaneClient integration webhook subscriptions', () => {
+  it('posts and deletes webhook subscriptions through the control-plane socket', async () => {
+    const client = new RelayfileControlPlaneClient({ socketPath: '/nope.sock', autoStart: false });
+    vi.spyOn(client, 'ensureReady').mockResolvedValue(undefined);
+    const rawRequest = vi.spyOn(client as unknown as { rawRequest: (opts: unknown) => Promise<unknown> }, 'rawRequest');
+    rawRequest.mockResolvedValueOnce({ subscriptionId: 'whsub_123' }).mockResolvedValueOnce({ ok: true });
+
+    await expect(
+      client.createWebhookSubscription({
+        workspace: 'demo',
+        url: 'https://cast.test/v1/integrations/relayfile/inbound/ws/ch',
+        pathGlobs: ['/github/repos/acme/widgets/issues/**'],
+        secret: 'inbound-secret',
+      })
+    ).resolves.toEqual({ subscriptionId: 'whsub_123' });
+
+    await expect(client.deleteWebhookSubscription('whsub_123', 'demo')).resolves.toEqual({ ok: true });
+
+    expect(rawRequest).toHaveBeenNthCalledWith(1, {
+      method: 'POST',
+      path: '/v1/integrations/webhook-subscriptions',
+      body: {
+        workspace: 'demo',
+        url: 'https://cast.test/v1/integrations/relayfile/inbound/ws/ch',
+        pathGlobs: ['/github/repos/acme/widgets/issues/**'],
+        secret: 'inbound-secret',
+      },
+    });
+    expect(rawRequest).toHaveBeenNthCalledWith(2, {
+      method: 'DELETE',
+      path: '/v1/integrations/webhook-subscriptions',
+      body: { subscriptionId: 'whsub_123', workspace: 'demo' },
+    });
+  });
+});
+
 // Real-daemon contract tests — opt-in via RELAYFILE_BIN (CI builds the binary:
 // `go build -o relayfile ./cmd/relayfile-cli`). Boots the daemon and drives the
 // client over the socket.