feat: add config_webhook_endpoints table, store CRUD methods, and secret rotation with Standard Webhooks signing

[Pratham-Mishra04]

Summary

Introduces the config_webhook_endpoints table and all associated store-layer logic needed to persist, retrieve, update, and rotate secrets for registered webhook endpoints. This is the foundational persistence layer for outbound webhook delivery.

Changes

• Added TableWebhookEndpoint model (framework/configstore/tables/webhooks.go) defining the schema for webhook endpoints, including:
  • Supported event types (async_job.completed, async_job.failed)
  • Per-endpoint delivery tuning knobs (retries, backoff, timeouts, concurrency)
  • Custom delivery headers stored encrypted at rest
  • Signing secrets generated in Standard Webhooks format (whsec_ + base64 of 32 random bytes), encrypted at rest and never included in JSON serialization
  • BeforeSave/AfterFind GORM hooks handling serialization of virtual fields (Events, Headers) and encryption/decryption of sensitive columns
  • Validate() enforcing name, URL (HTTPS required unless allow_private_network is set, no credentials or fragments, private/link-local ranges blocked), event list, and header name rules
• Added migrationAddWebhookEndpointsTable database migration step
• Added ConfigStore interface methods: GetWebhookEndpoints, GetWebhookEndpointByID, GetWebhookEndpointByName, CreateWebhookEndpoint, UpdateWebhookEndpoint, DeleteWebhookEndpoint, RotateWebhookEndpointSecret
• Implemented all store methods on RDBConfigStore:
  • CreateWebhookEndpoint auto-generates an ID and signing secret when not supplied, enforces name uniqueness, and returns the plaintext secret on the struct for one-time display
  • UpdateWebhookEndpoint resets the consecutive-failure counter only on URL changes; re-enabling a disabled endpoint does not reset it
  • RotateWebhookEndpointSecret replaces the signing secret atomically; only the new secret is stored
• Added stub implementations of all new interface methods to MockConfigStore in the HTTP transport test package

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

go test ./framework/configstore/... ./framework/configstore/tables/... ./transports/bifrost-http/lib/...

Key test scenarios covered:

• TestWebhookEndpointCreate — ID and whsec_-prefixed secret are generated server-side; distinct endpoints receive distinct secrets
• TestWebhookEndpointCreateDuplicateName — returns ErrAlreadyExists
• TestWebhookEndpointUpdate — non-URL changes preserve the failure counter; URL changes reset it; signing secret is never modified
• TestWebhookEndpointUpdateReenablePreservesFailureCounter — re-enabling a disabled endpoint does not reset the failure counter
• TestWebhookEndpointRotateSecret — new secret is stored immediately; old secret is gone
• TestTableWebhookEndpoint_EncryptDecrypt — ciphertext is stored, plaintext is restored after read
• TestTableWebhookEndpoint_SecretsExcludedFromJSON — secret material never appears in JSON output
• TestTableWebhookEndpoint_HeadersEncryptDecrypt — custom headers are encrypted at rest; env references survive the round-trip as references

Breaking changes

• Yes
• No

Any type implementing the ConfigStore interface must add the seven new webhook endpoint methods. The MockConfigStore in the HTTP transport package has been updated; other mocks in the codebase will need the same stub additions.

Security considerations

• Signing secrets are generated using crypto/rand and formatted as whsec_ + base64(32 bytes), following the Standard Webhooks specification.
• Secrets and custom delivery headers are encrypted at rest using the existing encrypt package when encryption is enabled.
• Secrets are excluded from JSON serialization (json:"-") and are surfaced in plaintext only once — at creation or rotation time — via the in-memory struct field.
• Webhook URLs are validated against bifrost.ValidateExternalURL, which rejects link-local and metadata address ranges regardless of the allow_private_network flag. HTTP is only permitted when allow_private_network is explicitly set.
• Credentials and fragments are rejected from webhook URLs.
• Standard Webhooks signing headers and protocol-level headers are protected and cannot be overridden by caller-supplied custom headers.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Pratham-Mishra04]

• docs: add Webhooks management API paths, schemas, and x-bf-async-webhook header parameter to async job endpoints #5270
• docs: add webhooks feature page and link it from async inference #5269
• feat: add dependency-free Go webhook receiver example with Standard Webhooks signature verification #5268
• test: add Postman e2e collection, Newman runner, and webhook-receiver sidecar for async webhook delivery #5267
• feat: add server-side pagination, search, and filtering to webhook endpoints list #5266
• feat: propagate inference request_id through async jobs and webhook deliveries for LLM log reconciliation #5265
• feat: add webhooks management UI with endpoint CRUD, delivery history, secret reveal, and sidebar entry #5264
• refactor: resolve async webhook endpoint by name at submit time via WebhookManager instead of pre-normalizing to ID in context #5252
• feat: add webhook endpoint admin API, in-memory store, config.json sync, and per-endpoint delivery tuning #5251
• feat: add WebhookDispatcher interface and wire async job terminal-state webhook notifications via BifrostContextKeyAsyncWebhook #5250
• feat: add webhook delivery dispatcher with SSRF-safe HTTP client, Standard Webhooks signing, and per-endpoint retry/concurrency tuning #5249
• feat: add webhook jobs work-queue and delivery history tables with store methods and tests #5248
• feat: add config_webhook_endpoints table, store CRUD methods, and secret rotation with Standard Webhooks signing #5247 👈 (View in Graphite)
• refactor: extract SSRF-safe dial logic into core/network package and replace duplicate implementations in fetch.go and skills_serving.go #5246
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: bf8f7ed2-5829-4c06-a912-1c9d0333ca6d

📥 Commits

Reviewing files that changed from the base of the PR and between b098b0b and 4b735cb.

📒 Files selected for processing (9)

• framework/configstore/migrations.go
• framework/configstore/rdb.go
• framework/configstore/rdb_test.go
• framework/configstore/store.go
• framework/configstore/tables/clientconfig_test.go
• framework/configstore/tables/encryption_test.go
• framework/configstore/tables/webhooks.go
• framework/configstore/tables/webhooks_test.go
• transports/bifrost-http/lib/config_test.go

---

📝 Walkthrough

Summary by CodeRabbit

• New Features

  • Added webhook endpoint management, including creation, updates, deletion, lookup, and listing.
  • Added support for subscribing to asynchronous job events.
  • Added secure webhook signing secret generation and rotation.
  • Added configurable delivery retries, timeouts, concurrency, and custom headers.
  • Added validation for endpoint URLs, events, and headers.
  • Added encryption for webhook secrets and sensitive header values.

• Bug Fixes

  • Improved handling of webhook delivery failure counters when endpoint URLs change.

• Tests

  • Added comprehensive coverage for validation, persistence, encryption, and endpoint lifecycle operations.

Walkthrough

Adds webhook endpoint models with validation and encrypted fields, a configstore migration, ConfigStore and RDB persistence methods, secret rotation, and comprehensive model and repository tests.

Changes

Webhook endpoint configuration

Layer / File(s)	Summary
Endpoint model, validation, and encryption framework/configstore/tables/webhooks.go, framework/configstore/tables/webhooks_test.go	Defines supported events, endpoint fields, URL and header validation, JSON persistence, encryption hooks, and round-trip tests for secrets and headers.
Migration and ConfigStore persistence framework/configstore/migrations.go, framework/configstore/store.go, framework/configstore/rdb.go, framework/configstore/rdb_test.go, framework/configstore/tables/encryption_test.go, transports/bifrost-http/lib/config_test.go	Adds the webhook endpoint table migration, ConfigStore methods, RDB CRUD and secret rotation, repository coverage, SQLite setup, and mock compatibility methods.
Existing test compatibility framework/configstore/tables/clientconfig_test.go	Repositions existing AfterFind assertions without changing their behavior.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Caller
  participant RDBConfigStore
  participant TableWebhookEndpoint
  participant ConfigstoreDatabase
  Caller->>RDBConfigStore: CreateWebhookEndpoint
  RDBConfigStore->>TableWebhookEndpoint: Validate endpoint
  RDBConfigStore->>ConfigstoreDatabase: Save encrypted endpoint
  ConfigstoreDatabase-->>RDBConfigStore: Commit result
  RDBConfigStore-->>Caller: Return creation result

Loading

Possibly related PRs

• maximhq/bifrost#5248: Adds the adjacent webhook jobs migration step.
• maximhq/bifrost#5249: Consumes webhook endpoint data for dispatch and signing.
• maximhq/bifrost#5266: Builds listing and API/UI flows on the webhook endpoint persistence.

Suggested reviewers: akshaydeo, danpiths

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 38.46% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title is concise and accurately summarizes the main change: adding webhook endpoint persistence, CRUD methods, and secret rotation.
Description check	✅ Passed	The description follows the template well and covers summary, changes, testing, breaking changes, security, and checklist items.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 07-14-feat_webhook_endpoint_registry_in_configstore

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"

---

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

This looks safe to merge.

• Unresolved secret references now fail before persistence.
• Create operations use a detached persistence value, so encryption hooks do not mutate caller-owned state.
• No blocking issues remain in the updated code.

Important Files Changed

Filename	Overview
framework/configstore/rdb.go	Adds webhook endpoint CRUD, secret generation, rotation, and safe handling of unresolved references and caller-owned values.
framework/configstore/tables/webhooks.go	Defines the webhook endpoint model, validation rules, serialization, and encryption hooks.
framework/configstore/migrations.go	Adds the reversible migration for the webhook endpoint table.
framework/configstore/rdb_test.go	Adds coverage for CRUD, failed-create retries, unresolved secrets, updates, and secret rotation.

_{Reviews (4): Last reviewed commit: "feat: webhook endpoint registry in confi..." | Re-trigger Greptile}

[coderabbitai]

Actionable comments posted: 3

🧹 Nitpick comments (1)

framework/configstore/tables/webhooks.go (1)

29-38: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Do not expose a mutable global event registry.

Any importing package can modify WebhookEvents, changing validation globally or racing with IsValid. Keep the slice private and return a clone from an accessor.

Proposed refactor

-// WebhookEvents lists every supported webhook event.
-var WebhookEvents = []WebhookEvent{
+var webhookEvents = []WebhookEvent{
 	WebhookEventAsyncJobCompleted,
 	WebhookEventAsyncJobFailed,
 }
 
+func SupportedWebhookEvents() []WebhookEvent {
+	return slices.Clone(webhookEvents)
+}
+
 func (e WebhookEvent) IsValid() bool {
-	return slices.Contains(WebhookEvents, e)
+	return slices.Contains(webhookEvents, e)
 }

As per coding guidelines, shared state must have clear ownership and remain race-safe.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@framework/configstore/tables/webhooks.go` around lines 29 - 38, Make the
webhook event registry private instead of exposing the mutable WebhookEvents
slice. Update IsValid to use the private registry, and add an accessor that
returns a clone of the registry so callers cannot mutate shared state or
introduce races.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@framework/configstore/rdb.go`:
- Around line 7444-7459: Update the create flow around the plaintextSecret
capture and transaction in the webhook endpoint method to defer restoring
endpoint.Secret before entering the transaction. Ensure the deferred restoration
runs on both successful and failed creates, including transaction commit errors,
while preserving the existing transaction and explicit success-path behavior
without restoring it redundantly.

In `@framework/configstore/tables/webhooks.go`:
- Around line 153-172: Update the webhook validation method containing the
numeric-field and header checks to enforce explicit upper bounds for retries,
backoff durations, timeouts, payload size, and concurrent deliveries, rejecting
values above the defined maxima. Also limit both the number of custom headers
and their aggregate serialized size, including header names and values, while
preserving the existing nonnegative and protected-header validation.
- Around line 176-199: Update validateWebhookEndpointURL to accept separate
allowHTTP and allowPrivateNetwork policies: permit HTTP only when allowHTTP is
enabled, while keeping private and loopback address access controlled
exclusively by allowPrivateNetwork. Ensure loopback IPv4 and IPv6 URLs are
rejected by default even when using HTTPS, and update webhook configuration
defaults and validation tests to cover HTTPS-only behavior plus both loopback
forms.

---

Nitpick comments:
In `@framework/configstore/tables/webhooks.go`:
- Around line 29-38: Make the webhook event registry private instead of exposing
the mutable WebhookEvents slice. Update IsValid to use the private registry, and
add an accessor that returns a clone of the registry so callers cannot mutate
shared state or introduce races.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 7fe28403-922c-4ea9-a95e-dde1892f7d20

📥 Commits

Reviewing files that changed from the base of the PR and between 968d6bf and b098b0b.

📒 Files selected for processing (9)

• framework/configstore/migrations.go
• framework/configstore/rdb.go
• framework/configstore/rdb_test.go
• framework/configstore/store.go
• framework/configstore/tables/clientconfig_test.go
• framework/configstore/tables/encryption_test.go
• framework/configstore/tables/webhooks.go
• framework/configstore/tables/webhooks_test.go
• transports/bifrost-http/lib/config_test.go

💤 Files with no reviewable changes (1)

• framework/configstore/tables/clientconfig_test.go

[Pratham-Mishra04]

Merge activity

• Jul 17, 8:36 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jul 17, 8:39 AM UTC: Graphite rebased this pull request as part of a merge.
• Jul 17, 8:40 AM UTC: @Pratham-Mishra04 merged this pull request with Graphite.

The base branch was changed.