feat(super-admin): Platform Webhooks console — inbound + outbound

nextjs_space/app/api/super-admin/webhooks/inbound/route.ts

@@ -0,0 +1,146 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { withSuperAdmin } from "@/lib/api-auth";
+import { prisma } from "@/lib/db";
+import { apiError, apiValidationError } from "@/lib/api-error";
+import { requireSameOrigin } from "@/lib/security/require-same-origin";
+import { AUDIT_ACTIONS, createAuditLog, getClientInfo } from "@/lib/audit-log";
+import {
+  DRGREEN_CHANNEL,
+  getInboundWebhookStatus,
+  saveInboundWebhookSecret,
+  setInboundWebhookEnabled,
+} from "@/lib/drgreen/inbound-webhook-config";
+
+/**
+ * Inbound partner-webhook channel (Dr Green → BudStacks), PLATFORM scope.
+ * SUPER_ADMIN only — this secret authenticates events for every tenant, so it
+ * must never be reachable from tenant-admin.
+ *
+ * GET  → status + recent deliveries (never the secret itself)
+ * PUT  → rotate the secret / enable-disable the channel
+ *
+ * There is no URL to configure here: the receiving endpoint is ours and fixed
+ * in code (/api/webhooks/drgreen/status). What an operator manages is the
+ * verification secret, the on/off switch, and visibility of what arrived.
+ */
+
+const ROUTE_GET = "GET /api/super-admin/webhooks/inbound";
+const ROUTE_PUT = "PUT /api/super-admin/webhooks/inbound";
+
+/** How many recent deliveries the console shows. */
+const RECENT_LIMIT = 25;
+
+export const GET = withSuperAdmin(async () => {
+  try {
+    const status = await getInboundWebhookStatus();
+
+    // Delivery history is best-effort: the console must still render (and
+    // still let an operator set the secret) if this query fails.
+    let recent: Array<Record<string, unknown>> = [];
+    let stats = { total: 0, processed: 0, failed: 0 };
+    try {
+      const [rows, total, processed, failed] = await Promise.all([
+        prisma.drgreen_webhook_logs.findMany({
+          where: { webhookType: "status" },
+          orderBy: { createdAt: "desc" },
+          take: RECENT_LIMIT,
+          select: {
+            id: true,
+            tenantId: true,
+            drGreenClientId: true,
+            processed: true,
+            error: true,
+            createdAt: true,
+            payload: true,
+          },
+        }),
+        prisma.drgreen_webhook_logs.count({ where: { webhookType: "status" } }),
+        prisma.drgreen_webhook_logs.count({ where: { webhookType: "status", processed: true } }),
+        prisma.drgreen_webhook_logs.count({
+          where: { webhookType: "status", error: { not: null } },
+        }),
+      ]);
+      stats = { total, processed, failed };
+      recent = rows.map((row: any) => ({
+        id: row.id,
+        tenantId: row.tenantId,
+        clientId: row.drGreenClientId,
+        // The payload is already PII-redacted on write (sanitizeForLogging);
+        // only the event name is surfaced here.
+        event: typeof row.payload?.event === "string" ? row.payload.event : "unknown",
+        processed: row.processed,
+        error: row.error,
+        createdAt: row.createdAt.toISOString(),
+      }));
+    } catch {
+      // Leave recent/stats empty — status still renders.
+    }
+
+    return NextResponse.json({
+      channel: DRGREEN_CHANNEL,
+      // The endpoint Dr Green must POST to. Shown for copy/paste; not editable.
+      receivingPath: "/api/webhooks/drgreen/status",
+      status,
+      stats,
+      recent,
+    });
+  } catch (error) {
+    return apiError(error, { route: ROUTE_GET, safeMessage: "Failed to load webhook status" });
+  }
+});
+
+const updateSchema = z
+  .object({
+    // Min length is a weak-secret guard, not a format requirement — it must
+    // match whatever Dr Green signs with byte for byte.
+    secret: z.string().min(16).max(512).optional(),
+    isEnabled: z.boolean().optional(),
+  })
+  .refine((v) => v.secret !== undefined || v.isEnabled !== undefined, {
+    message: "Provide a secret to rotate, an isEnabled flag, or both",
+  });
+
+export const PUT = withSuperAdmin(async (req, { user }) => {
+  const originError = requireSameOrigin(req);
+  if (originError) return originError;
+
+  const body = await req.json().catch(() => null);
+  const parsed = updateSchema.safeParse(body);
+  if (!parsed.success) {
+    return apiValidationError(parsed.error.errors[0]?.message ?? "Invalid request", ROUTE_PUT);
+  }
+
+  try {
+    const actor = user.email ?? user.id;
+
+    if (parsed.data.secret !== undefined) {
+      await saveInboundWebhookSecret({ secret: parsed.data.secret, updatedBy: actor });
+    }
+    if (parsed.data.isEnabled !== undefined) {
+      await setInboundWebhookEnabled({ isEnabled: parsed.data.isEnabled, updatedBy: actor });
+    }
+
+    await createAuditLog({
+      action: AUDIT_ACTIONS.PLATFORM_WEBHOOK_CONFIG_UPDATED,
+      entityType: "PlatformWebhookConfig",
+      entityId: DRGREEN_CHANNEL,
+      userId: user.id,
+      userEmail: user.email ?? undefined,
+      // Records THAT the secret rotated, never the value.
+      metadata: {
+        secretRotated: parsed.data.secret !== undefined,
+        ...(parsed.data.isEnabled !== undefined ? { isEnabled: parsed.data.isEnabled } : {}),
+      },
+      ...getClientInfo(req.headers),
+    });
+
+    return NextResponse.json({ success: true, status: await getInboundWebhookStatus() });
+  } catch (error) {
+    return apiError(error, {
+      route: ROUTE_PUT,
+      safeMessage:
+        "Failed to save webhook settings. If this persists, the platform_webhook_config table may not be provisioned yet.",
+    });
+  }
+});

nextjs_space/app/api/super-admin/webhooks/outbound/[id]/route.ts

@@ -0,0 +1,51 @@
+import { NextResponse } from "next/server";
+import { withSuperAdminParams } from "@/lib/api-auth";
+import { prisma } from "@/lib/db";
+import { apiError } from "@/lib/api-error";
+import { requireSameOrigin } from "@/lib/security/require-same-origin";
+import { parseUuid } from "@/lib/validation/parse-uuid";
+import { AUDIT_ACTIONS, createAuditLog, getClientInfo } from "@/lib/audit-log";
+
+/**
+ * DELETE a PLATFORM outbound webhook (`webhooks` row with `tenantId: null`).
+ *
+ * The tenantId predicate is the authorization boundary, not a filter: without
+ * it this route would delete any tenant's endpoint by id.
+ */
+export const DELETE = withSuperAdminParams(async (req, { user }, params) => {
+  const originError = requireSameOrigin(req);
+  if (originError) return originError;
+
+  const id = parseUuid(params.id);
+
+  try {
+    const result = await prisma.webhooks.deleteMany({
+      where: { id, tenantId: null },
+    });
+
+    if (result.count === 0) {
+      return apiError(new Error("Platform webhook not found"), {
+        route: "DELETE /api/super-admin/webhooks/outbound/[id]",
+        status: 404,
+        safeMessage: "Webhook not found",
+      });
+    }
+
+    await createAuditLog({
+      action: AUDIT_ACTIONS.WEBHOOK_DELETED,
+      entityType: "Webhook",
+      entityId: id,
+      userId: user.id,
+      userEmail: user.email || undefined,
+      metadata: { scope: "platform" },
+      ...getClientInfo(req.headers),
+    });
+
+    return NextResponse.json({ success: true });
+  } catch (error) {
+    return apiError(error, {
+      route: "DELETE /api/super-admin/webhooks/outbound/[id]",
+      safeMessage: "Failed to delete webhook",
+    });
+  }
+});

nextjs_space/app/api/super-admin/webhooks/outbound/route.ts

@@ -0,0 +1,104 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import crypto from "crypto";
+import { withSuperAdmin } from "@/lib/api-auth";
+import { prisma } from "@/lib/db";
+import { apiError, apiValidationError } from "@/lib/api-error";
+import { requireSameOrigin } from "@/lib/security/require-same-origin";
+import { parseJsonBody } from "@/lib/validation/body";
+import { assertSafeWebhookUrl } from "@/lib/integrations/webhook-ssrf";
+import { AUDIT_ACTIONS, createAuditLog, getClientInfo } from "@/lib/audit-log";
+
+/**
+ * PLATFORM-scope outbound webhooks — rows in `webhooks` with `tenantId: null`.
+ *
+ * The tenant-admin page manages a tenant's own destinations; this manages the
+ * platform's. Same table, same delivery machinery (`triggerWebhook` selects on
+ * `tenantId: tenantId || null`), which is why no migration is needed — the
+ * column has always been nullable.
+ *
+ * Scope note for operators: a platform webhook fires on PLATFORM-level events
+ * only, not on every tenant's activity.
+ */
+
+const ROUTE = "/api/super-admin/webhooks/outbound";
+
+const createSchema = z
+  .object({
+    url: z.string().url().max(2000),
+    events: z.array(z.string().min(1).max(100)).min(1).max(50),
+    description: z.string().max(1000).optional(),
+  })
+  .strict();
+
+export const GET = withSuperAdmin(async () => {
+  try {
+    const webhooks = await prisma.webhooks.findMany({
+      where: { tenantId: null },
+      include: { _count: { select: { webhook_deliveries: true } } },
+      orderBy: { createdAt: "desc" },
+    });
+
+    return NextResponse.json({
+      webhooks: webhooks.map(({ _count, secret, ...webhook }: any) => ({
+        ...webhook,
+        // Signing secret is shown once at creation; never re-served on list.
+        secretPreview: `${String(secret).slice(0, 6)}…`,
+        _count: { deliveries: _count.webhook_deliveries },
+      })),
+    });
+  } catch (error) {
+    return apiError(error, { route: `GET ${ROUTE}`, safeMessage: "Failed to fetch webhooks" });
+  }
+});
+
+export const POST = withSuperAdmin(async (req, { user }) => {
+  const originError = requireSameOrigin(req);
+  if (originError) return originError;
+
+  try {
+    const { url, events, description } = await parseJsonBody(req, createSchema);
+
+    // SSRF egress guard — same rule as the tenant route: public HTTPS only,
+    // never an internal/private-resolving address.
+    try {
+      await assertSafeWebhookUrl(url);
+    } catch {
+      return apiValidationError(
+        "Webhook URL is not allowed. Use a public HTTPS endpoint.",
+        ROUTE,
+      );
+    }
+
+    const secret = crypto.randomBytes(32).toString("hex");
+    const webhook = await prisma.webhooks.create({
+      data: {
+        // `webhooks.id` carries no DB default — set it explicitly.
+        id: crypto.randomUUID(),
+        tenantId: null,
+        url,
+        events,
+        secret,
+        description: description || "",
+        isActive: true,
+        updatedAt: new Date(),
+      },
+    });
+
+    await createAuditLog({
+      action: AUDIT_ACTIONS.WEBHOOK_CREATED,
+      entityType: "Webhook",
+      entityId: webhook.id,
+      userId: user.id,
+      userEmail: user.email || undefined,
+      metadata: { url, events, scope: "platform" },
+      ...getClientInfo(req.headers),
+    });
+
+    // Only response that ever carries the secret — the operator copies it into
+    // the receiving system now or rotates by recreating the endpoint.
+    return NextResponse.json({ webhook: { ...webhook, secret } }, { status: 201 });
+  } catch (error) {
+    return apiError(error, { route: `POST ${ROUTE}`, safeMessage: "Failed to create webhook" });
+  }
+});

nextjs_space/app/api/webhooks/drgreen/status/route.ts

@@ -9,6 +9,7 @@ import {
   type DrGreenWebhookPayload,
 } from "@/lib/drgreen/drgreen-webhook-verify";
 import { dispatchEvent } from "@/lib/drgreen/status-event-handlers";
+import { resolveInboundVerification } from "@/lib/drgreen/inbound-webhook-config";
 import { apiError, apiValidationError } from "@/lib/api-error";
 import { logger } from "@/lib/logger";
 import { invalidateProductCache } from "@/lib/drgreen/doctor-green-api";
@@ -73,7 +74,23 @@ export async function POST(request: NextRequest) {
   // Flag-gated: when the env var is unset (the default until Dr Green confirms
   // they sign with one platform secret), this block is skipped and the existing
   // per-tenant resolve-then-verify path below runs EXACTLY as before.
-  const platformSecret = process.env.DRGREEN_WEBHOOK_SECRET;
+  // Platform secret now resolves from super-admin → Platform Webhooks first,
+  // falling back to DRGREEN_WEBHOOK_SECRET. The lookup fails soft (missing
+  // table / unreadable row → env), so this path behaves exactly as before
+  // until an operator saves a secret in the console.
+  const verification = await resolveInboundVerification();
+
+  // Channel switched off in the console — refuse regardless of signature.
+  if (!verification.enabled) {
+    console.error("[DrGreen Status] Inbound channel disabled in super-admin");
+    return apiError(new Error("Inbound webhooks disabled"), {
+      route: "POST /api/webhooks/drgreen/status",
+      status: 403,
+      safeMessage: "Inbound webhooks are disabled",
+    });
+  }
+
+  const platformSecret = verification.secret;
   let verifiedByPlatformSecret = false;
   if (platformSecret) {
     if (!verifyDrGreenWebhookSignature(rawBody, signature, platformSecret)) {