feat: Phase 6 - MCP + Webhooks + Worker + Polish

- MCP server: stateless JSON-RPC 2.0 with 18 tools (tasks, habits, projects, notes, domains, search, activity) - Webhooks API: CRUD routes under /api/domains/[domainId]/webhooks/ with test endpoint and deliveries log - Webhook delivery: HMAC-SHA256 signed POST with retry (exponential backoff, max 6) - Worker rewrite: Drizzle ORM instead of PocketBase, polls jobs table, handles webhook_delivery, recurring_spawn, ai_dispatch - Rate limiting: token bucket per IP/API key (100 req/min REST, 300 req/min MCP) - Keyboard help overlay: ? opens Radix Dialog with search/filter, Esc closes - AI @mention stub: @agent in command palette dispatches CustomEvent - Mobile responsive: bottom nav, single-column kanban, day view calendar, 44px touch targets - Accessibility: skip-to-content link, focus rings, aria-labels, color contrast - E2E tests: mcp.spec.ts, webhooks.spec.ts, realtime.spec.ts added - Schema: api_keys and webhook_deliveries tables with migration - Removed old PocketBase-style database.ts from worker
2026-07-29 08:03:28 -04:00
parent eba1d78fb9
commit e5b7d9e2ee
28 changed files with 4959 additions and 884 deletions
@@ -0,0 +1,50 @@
+// AGENT INSTRUCTION: After every write (INSERT/UPDATE/DELETE), you MUST:
+// 1. Insert activity feed entry
+// 2. Call pg.notify('project_e_events', JSON.stringify({ type, action, id, workspace_id }))
+// See AGENTS.md for full rules.
+
+import { NextRequest, NextResponse } from 'next/server';
+import { withAuth, requireWorkspaceAccess, createErrorResponse } from '@/lib/auth';
+import { db, webhooks, webhookDeliveries } from '@project-e/db';
+import { and, desc, eq, sql } from 'drizzle-orm';
+
+type RouteContext = { params: Promise<{ domainId: string; id: string }> };
+
+// GET /api/domains/[domainId]/webhooks/[id]/deliveries — List deliveries for a webhook
+export const GET = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
+  const { domainId, id } = await context!.params;
+  await requireWorkspaceAccess(domainId);
+
+  // Verify webhook exists in this workspace
+  const [webhook] = await db.select({ id: webhooks.id })
+    .from(webhooks)
+    .where(and(eq(webhooks.id, id), eq(webhooks.workspaceId, domainId)))
+    .limit(1);
+
+  if (!webhook) {
+    return createErrorResponse('NOT_FOUND', 'Webhook not found', 404);
+  }
+
+  const { searchParams } = new URL(request.url);
+  const limit = Math.min(parseInt(searchParams.get('limit') || '50'), 200);
+  const offset = parseInt(searchParams.get('offset') || '0');
+
+  const [items, countResult] = await Promise.all([
+    db.select()
+      .from(webhookDeliveries)
+      .where(eq(webhookDeliveries.webhookId, id))
+      .orderBy(desc(webhookDeliveries.createdAt))
+      .limit(limit)
+      .offset(offset),
+    db.select({ count: sql<number>`count(*)` })
+      .from(webhookDeliveries)
+      .where(eq(webhookDeliveries.webhookId, id)),
+  ]);
+
+  return NextResponse.json({
+    items,
+    totalItems: Number(countResult[0]?.count || 0),
+    limit,
+    offset,
+  });
+});
@@ -0,0 +1,118 @@
+// AGENT INSTRUCTION: After every write (INSERT/UPDATE/DELETE), you MUST:
+// 1. Insert activity feed entry
+// 2. Call pg.notify('project_e_events', JSON.stringify({ type, action, id, workspace_id }))
+// See AGENTS.md for full rules.
+
+import { NextRequest, NextResponse } from 'next/server';
+import { withAuth, requireWorkspaceAccess, createErrorResponse, ApiError } from '@/lib/auth';
+import { recordActivity } from '@/lib/activity';
+import { db, webhooks } from '@project-e/db';
+import { and, eq } from 'drizzle-orm';
+import { z } from 'zod';
+
+const updateWebhookSchema = z.object({
+  name: z.string().optional(),
+  url: z.string().url('Must be a valid URL').optional(),
+  events: z.array(z.string()).optional(),
+  active: z.boolean().optional(),
+});
+
+type RouteContext = { params: Promise<{ domainId: string; id: string }> };
+
+// GET /api/domains/[domainId]/webhooks/[id] — Get a single webhook
+export const GET = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
+  const { domainId, id } = await context!.params;
+  await requireWorkspaceAccess(domainId);
+
+  const [webhook] = await db.select()
+    .from(webhooks)
+    .where(and(eq(webhooks.id, id), eq(webhooks.workspaceId, domainId)))
+    .limit(1);
+
+  if (!webhook) {
+    return createErrorResponse('NOT_FOUND', 'Webhook not found', 404);
+  }
+
+  // Never return the secret on GET
+  const { secret: _, ...safe } = webhook;
+  return NextResponse.json(safe);
+});
+
+// PATCH /api/domains/[domainId]/webhooks/[id] — Update a webhook
+export const PATCH = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
+  const { domainId, id } = await context!.params;
+  await requireWorkspaceAccess(domainId);
+
+  try {
+    const body = await request.json();
+    const data = updateWebhookSchema.parse(body);
+
+    const [existing] = await db.select()
+      .from(webhooks)
+      .where(and(eq(webhooks.id, id), eq(webhooks.workspaceId, domainId)))
+      .limit(1);
+
+    if (!existing) {
+      return createErrorResponse('NOT_FOUND', 'Webhook not found', 404);
+    }
+
+    const updateData: Record<string, unknown> = { updatedAt: new Date() };
+    if (data.name !== undefined) updateData.name = data.name;
+    if (data.url !== undefined) updateData.url = data.url;
+    if (data.events !== undefined) updateData.events = data.events;
+    if (data.active !== undefined) updateData.active = data.active;
+
+    const [updated] = await db.update(webhooks)
+      .set(updateData)
+      .where(eq(webhooks.id, id))
+      .returning();
+
+    await recordActivity({
+      actor: user.name,
+      action: 'updated',
+      entityType: 'webhook',
+      entityId: updated.id,
+      changes: updateData,
+      workspaceId: domainId,
+    });
+
+    const { secret: _, ...safe } = updated;
+    return NextResponse.json(safe);
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      return createErrorResponse('VALIDATION_ERROR', 'Invalid input', 400, error.issues);
+    }
+    if (error instanceof ApiError) {
+      return createErrorResponse(error.code, error.message, error.status);
+    }
+    console.error('[webhook PATCH] error:', error);
+    return createErrorResponse('INTERNAL_ERROR', 'Failed to update webhook', 500);
+  }
+});
+
+// DELETE /api/domains/[domainId]/webhooks/[id] — Delete a webhook
+export const DELETE = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
+  const { domainId, id } = await context!.params;
+  await requireWorkspaceAccess(domainId);
+
+  const [existing] = await db.select()
+    .from(webhooks)
+    .where(and(eq(webhooks.id, id), eq(webhooks.workspaceId, domainId)))
+    .limit(1);
+
+  if (!existing) {
+    return createErrorResponse('NOT_FOUND', 'Webhook not found', 404);
+  }
+
+  await db.delete(webhooks).where(eq(webhooks.id, id));
+
+  await recordActivity({
+    actor: user.name,
+    action: 'deleted',
+    entityType: 'webhook',
+    entityId: id,
+    workspaceId: domainId,
+  });
+
+  return new NextResponse(null, { status: 204 });
+});
@@ -0,0 +1,99 @@
+// AGENT INSTRUCTION: After every write (INSERT/UPDATE/DELETE), you MUST:
+// 1. Insert activity feed entry
+// 2. Call pg.notify('project_e_events', JSON.stringify({ type, action, id, workspace_id }))
+// See AGENTS.md for full rules.
+
+import { NextRequest, NextResponse } from 'next/server';
+import { withAuth, requireWorkspaceAccess, createErrorResponse } from '@/lib/auth';
+import { db, webhooks, webhookDeliveries } from '@project-e/db';
+import { and, eq } from 'drizzle-orm';
+import { createHmac } from 'node:crypto';
+
+type RouteContext = { params: Promise<{ domainId: string; id: string }> };
+
+// POST /api/domains/[domainId]/webhooks/[id]/test — Send a test event
+export const POST = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
+  const { domainId, id } = await context!.params;
+  await requireWorkspaceAccess(domainId);
+
+  const [webhook] = await db.select()
+    .from(webhooks)
+    .where(and(eq(webhooks.id, id), eq(webhooks.workspaceId, domainId)))
+    .limit(1);
+
+  if (!webhook) {
+    return createErrorResponse('NOT_FOUND', 'Webhook not found', 404);
+  }
+
+  if (!webhook.active) {
+    return createErrorResponse('WEBHOOK_DISABLED', 'Cannot test a disabled webhook', 400);
+  }
+
+  const testPayload = {
+    event: 'test.ping',
+    entity_type: 'test',
+    entity_id: 'test-001',
+    data: { message: 'This is a test webhook delivery from Project E.', webhook_id: webhook.id },
+    timestamp: new Date().toISOString(),
+    workspace_id: domainId,
+  };
+
+  const headers: Record<string, string> = {
+    'Content-Type': 'application/json',
+    'X-Event-Type': 'test.ping',
+  };
+
+  if (webhook.secret) {
+    const body = JSON.stringify(testPayload);
+    const signature = createHmac('sha256', webhook.secret)
+      .update(body)
+      .digest('hex');
+    headers['X-ProjectE-Signature'] = signature;
+  }
+
+  try {
+    const response = await fetch(webhook.url, {
+      method: 'POST',
+      headers,
+      body: JSON.stringify(testPayload),
+      signal: AbortSignal.timeout(10000),
+    });
+
+    const responseBody = await response.text();
+
+    // Record the delivery
+    await db.insert(webhookDeliveries).values({
+      webhookId: webhook.id,
+      event: 'test.ping',
+      payload: testPayload as Record<string, unknown>,
+      status: response.ok ? 'success' : 'failed',
+      statusCode: response.status,
+      responseBody: responseBody.substring(0, 1000),
+      attempts: 1,
+    });
+
+    return NextResponse.json({
+      success: response.ok,
+      status: response.status,
+      response: responseBody.substring(0, 500),
+    });
+  } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : String(error);
+
+    await db.insert(webhookDeliveries).values({
+      webhookId: webhook.id,
+      event: 'test.ping',
+      payload: testPayload as Record<string, unknown>,
+      status: 'failed',
+      statusCode: 0,
+      responseBody: errorMessage,
+      attempts: 1,
+    });
+
+    return NextResponse.json({
+      success: false,
+      status: 0,
+      response: errorMessage,
+    });
+  }
+});
@@ -0,0 +1,102 @@
+// AGENT INSTRUCTION: After every write (INSERT/UPDATE/DELETE), you MUST:
+// 1. Insert activity feed entry
+// 2. Call pg.notify('project_e_events', JSON.stringify({ type, action, id, workspace_id }))
+// See AGENTS.md for full rules.
+
+import { NextRequest, NextResponse } from 'next/server';
+import { withAuth, requireWorkspaceAccess, createErrorResponse, ApiError } from '@/lib/auth';
+import { recordActivity } from '@/lib/activity';
+import { db, webhooks, webhookDeliveries } from '@project-e/db';
+import { and, asc, desc, eq, isNull, sql } from 'drizzle-orm';
+import { createHash, randomBytes } from 'node:crypto';
+import { z } from 'zod';
+
+const createWebhookSchema = z.object({
+  name: z.string().optional(),
+  url: z.string().url('Must be a valid URL'),
+  events: z.array(z.string()).default([]),
+  active: z.boolean().optional().default(true),
+});
+
+const updateWebhookSchema = z.object({
+  name: z.string().optional(),
+  url: z.string().url('Must be a valid URL').optional(),
+  events: z.array(z.string()).optional(),
+  active: z.boolean().optional(),
+});
+
+type RouteContext = { params: Promise<{ domainId: string }> };
+type IdRouteContext = { params: Promise<{ domainId: string; id: string }> };
+
+// GET /api/domains/[domainId]/webhooks — List webhooks
+export const GET = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
+  const { domainId } = await context!.params;
+  await requireWorkspaceAccess(domainId);
+
+  const { searchParams } = new URL(request.url);
+  const limit = Math.min(parseInt(searchParams.get('limit') || '50'), 200);
+  const offset = parseInt(searchParams.get('offset') || '0');
+
+  const [items, countResult] = await Promise.all([
+    db.select()
+      .from(webhooks)
+      .where(eq(webhooks.workspaceId, domainId))
+      .orderBy(desc(webhooks.createdAt))
+      .limit(limit)
+      .offset(offset),
+    db.select({ count: sql<number>`count(*)` })
+      .from(webhooks)
+      .where(eq(webhooks.workspaceId, domainId)),
+  ]);
+
+  return NextResponse.json({
+    items,
+    totalItems: Number(countResult[0]?.count || 0),
+    limit,
+    offset,
+  });
+});
+
+// POST /api/domains/[domainId]/webhooks — Create a webhook
+export const POST = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
+  const { domainId } = await context!.params;
+  await requireWorkspaceAccess(domainId);
+
+  try {
+    const body = await request.json();
+    const data = createWebhookSchema.parse(body);
+
+    // Generate a webhook secret (shown only once on create)
+    const secret = `whsec_${randomBytes(24).toString('hex')}`;
+
+    const [webhook] = await db.insert(webhooks).values({
+      name: data.name ?? null,
+      url: data.url,
+      secret,
+      events: data.events,
+      active: data.active ?? true,
+      workspaceId: domainId,
+    }).returning();
+
+    await recordActivity({
+      actor: user.name,
+      action: 'created',
+      entityType: 'webhook',
+      entityId: webhook.id,
+      changes: { name: webhook.name, url: webhook.url, events: webhook.events },
+      workspaceId: domainId,
+    });
+
+    // Return the secret on create — it won't be shown again
+    return NextResponse.json({ ...webhook, secret }, { status: 201 });
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      return createErrorResponse('VALIDATION_ERROR', 'Invalid input', 400, error.issues);
+    }
+    if (error instanceof ApiError) {
+      return createErrorResponse(error.code, error.message, error.status);
+    }
+    console.error('[webhooks POST] error:', error);
+    return createErrorResponse('INTERNAL_ERROR', 'Failed to create webhook', 500);
+  }
+});