fix(plane): preserve webhook delivery during replacement

Author: waleedlatif1

apps/sim/app/api/webhooks/route.test.ts

@@ -589,7 +589,7 @@ describe('POST /api/webhooks subscription replacement recovery', () => {
       }
       queueCurrentRows()
       expect((await POST(replacementRequest())).status).toBe(500)
-      expect(external.size).toBe(priorCleanupFails ? 2 : 1)
+      expect(external.size).toBe(2)
       const retainedConfig = toRecord(persisted.providerConfig)
       if (priorCleanupFails) {
         expect(retainedConfig.projectId).toBe('next')
@@ -600,11 +600,11 @@ describe('POST /api/webhooks subscription replacement recovery', () => {
           webhookSecret: 'old-secret',
         })
         expect(external.get('external-old')?.active).toBe(true)
-        expect(external.get(String(retainedConfig.externalId))?.active).toBe(false)
+        expect(external.get(String(retainedConfig.externalId))?.active).toBe(true)
       } else {
         expect(retainedConfig.projectId).toBe('next')
         expect(retainedConfig.webhookSecret).toBe('new-secret')
-        expect(external.has('external-old')).toBe(false)
+        expect(external.get('external-old')?.active).toBe(true)
         expect(external.get(String(retainedConfig.externalId))?.active).toBe(false)
       }
       cleanupUnavailable = false

apps/sim/app/api/webhooks/route.ts

@@ -512,6 +512,20 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     if (existingWebhook && shouldRecreateSubscription) {
       const pendingPrevious = toRecord(existingWebhook.providerConfig?.previousSubscription)
       if (typeof pendingPrevious.provider === 'string') {
+        if (existingWebhook.providerConfig?.subscriptionActivationPending === true) {
+          await activateExternalWebhookSubscription(
+            request,
+            existingWebhook,
+            workflowRecord,
+            userId,
+            requestId
+          )
+          existingWebhook.providerConfig.subscriptionActivationPending = false
+          await db
+            .update(webhook)
+            .set({ providerConfig: existingWebhook.providerConfig })
+            .where(eq(webhook.id, existingWebhook.id))
+        }
         await cleanupExternalWebhook(
           {
             ...existingWebhook,
@@ -643,25 +657,6 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     }
 
     if (savedWebhook) {
-      const previousSubscription = toRecord(configToSave.previousSubscription)
-      if (typeof previousSubscription.provider === 'string') {
-        await cleanupExternalWebhook(
-          {
-            ...savedWebhook,
-            provider: previousSubscription.provider,
-            providerConfig: previousSubscription.providerConfig,
-          },
-          workflowRecord,
-          requestId,
-          { throwOnError: true }
-        )
-        configToSave.previousSubscription = undefined
-        await db
-          .update(webhook)
-          .set({ providerConfig: configToSave })
-          .where(eq(webhook.id, savedWebhook.id))
-        savedWebhook.providerConfig = configToSave
-      }
       if (
         !existingWebhook ||
         shouldRecreateSubscription ||
@@ -683,6 +678,25 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
           savedWebhook.providerConfig = configToSave
         }
       }
+      const previousSubscription = toRecord(configToSave.previousSubscription)
+      if (typeof previousSubscription.provider === 'string') {
+        await cleanupExternalWebhook(
+          {
+            ...savedWebhook,
+            provider: previousSubscription.provider,
+            providerConfig: previousSubscription.providerConfig,
+          },
+          workflowRecord,
+          requestId,
+          { throwOnError: true }
+        )
+        configToSave.previousSubscription = undefined
+        await db
+          .update(webhook)
+          .set({ providerConfig: configToSave })
+          .where(eq(webhook.id, savedWebhook.id))
+        savedWebhook.providerConfig = configToSave
+      }
     }
 
     if (existingWebhook && shouldRecreateSubscription && !deferPreviousCleanup) {

apps/sim/lib/webhooks/provider-subscriptions.test.ts

@@ -146,6 +146,34 @@ describe('cleanupExternalWebhook', () => {
     }
   )
 
+  it('cleans the tracked prior subscription when the replacement has no deletion handler', async () => {
+    const external = new Set(['previous-registration'])
+    mockGetProviderHandler.mockImplementation((provider: string) =>
+      provider === 'plane'
+        ? {
+            deleteSubscription: async () => {
+              external.delete('previous-registration')
+            },
+          }
+        : {}
+    )
+    await cleanupExternalWebhook(
+      {
+        provider: 'webhook',
+        providerConfig: {
+          previousSubscription: {
+            provider: 'plane',
+            providerConfig: { externalId: 'previous-registration' },
+          },
+        },
+      },
+      { userId: 'user-1', workspaceId: 'workspace-1' },
+      'request-1',
+      { throwOnError: true }
+    )
+    expect(external.size).toBe(0)
+  })
+
   it('resolves {{ENV_VAR}} references before deleting the provider subscription', async () => {
     const deleteSubscription = vi.fn().mockResolvedValue(undefined)
     mockGetProviderHandler.mockReturnValue({ deleteSubscription })

apps/sim/lib/webhooks/provider-subscriptions.ts

@@ -282,8 +282,9 @@ export async function cleanupExternalWebhook(
 ): Promise<void> {
   const provider = webhook.provider as string
   const handler = getProviderHandler(provider)
+  const previousSubscription = toRecord(toRecord(webhook.providerConfig).previousSubscription)
 
-  if (!handler.deleteSubscription) {
+  if (!handler.deleteSubscription && typeof previousSubscription.provider !== 'string') {
     return
   }
 
@@ -303,7 +304,6 @@ export async function cleanupExternalWebhook(
       { envVars, onResolved: (name, value) => secrets.set(name, value) }
     )
     resolvedProviderConfig = resolvedWebhook.providerConfig
-    const previousSubscription = toRecord(resolvedProviderConfig.previousSubscription)
     if (typeof previousSubscription.provider === 'string') {
       await cleanupExternalWebhook(
         {
@@ -317,6 +317,8 @@ export async function cleanupExternalWebhook(
       )
     }
 
+    if (!handler.deleteSubscription) return
+
     /** Workspace archival precedes provider cleanup; routing still uses its canonical owner. */
     await withResourceOutboundScope(
       { workspaceId },

apps/sim/lib/webhooks/providers/plane.test.ts

@@ -69,6 +69,48 @@ describe('Plane signed webhook delivery', () => {
     ).toBe(401)
   })
 
+  it.each(['webhook-a', 'untracked-webhook'])(
+    'accepts the tracked previous secret only for its subscription: %s',
+    async (webhookId) => {
+      const raw = JSON.stringify({ ...V2, webhook_id: webhookId })
+      const signature = createHmac('sha256', SECRET).update(raw).digest('hex')
+      const ctx = authContext(raw, signature, 'replacement-secret')
+      ctx.providerConfig.previousSubscription = {
+        provider: 'plane',
+        providerConfig: { externalId: 'webhook-a', webhookSecret: SECRET },
+      }
+      if (!planeHandler.verifyAuth) throw new Error('Plane authentication is missing')
+      const response = await planeHandler.verifyAuth(ctx)
+      expect(response?.status ?? 200).toBe(webhookId === 'webhook-a' ? 200 : 401)
+    }
+  )
+
+  it('keeps the previous event scope until replacement activation succeeds', async () => {
+    if (!planeHandler.matchEvent) throw new Error('Plane event filtering is missing')
+    const config = {
+      triggerId: 'plane_workitem_created',
+      projectId: 'project-b',
+      subscriptionActivationPending: true,
+      previousSubscription: {
+        provider: 'plane',
+        providerConfig: {
+          externalId: 'webhook-a',
+          triggerId: 'plane_workitem_updated',
+          projectId: 'project-a',
+        },
+      },
+    }
+    expect(await planeHandler.matchEvent(matchContext(V1, config))).toBe(true)
+    expect(
+      await planeHandler.matchEvent(
+        matchContext(V1, { ...config, subscriptionActivationPending: false })
+      )
+    ).toBe(false)
+    expect(
+      await planeHandler.matchEvent(matchContext({ ...V1, webhook_id: 'replacement' }, config))
+    ).toBe(false)
+  })
+
   it('deduplicates v2 retries by event ID while separating distinct events', () => {
     if (!planeHandler.extractIdempotencyId) throw new Error('Plane deduplication is missing')
     const original = planeHandler.extractIdempotencyId(V2)

apps/sim/lib/webhooks/providers/plane.ts

@@ -75,39 +75,67 @@ async function deletePlaneWebhook(
     throw new Error(`Plane webhook deletion failed (HTTP ${response.status})`)
 }
 
+function previousPlaneDeliveryConfig(
+  providerConfig: Record<string, unknown>,
+  payload: unknown
+): Record<string, unknown> | undefined {
+  const previous = toRecord(providerConfig.previousSubscription)
+  const config = toRecord(previous.providerConfig)
+  return previous.provider === 'plane' &&
+    typeof config.externalId === 'string' &&
+    toRecord(payload).webhook_id === config.externalId
+    ? config
+    : undefined
+}
+
+const verifyPlaneSignature = createHmacVerifier({
+  configKey: 'webhookSecret',
+  headerName: 'X-Plane-Signature',
+  providerLabel: 'Plane',
+  requireSecret: true,
+  validateFn: (secret, signature, rawBody) =>
+    typeof secret === 'string' &&
+    secret.length > 0 &&
+    /^[a-f0-9]{64}$/.test(signature) &&
+    safeCompare(hmacSha256Hex(rawBody, secret), signature),
+})
+
 export const planeHandler: WebhookProviderHandler = {
-  verifyAuth: createHmacVerifier({
-    configKey: 'webhookSecret',
-    headerName: 'X-Plane-Signature',
-    providerLabel: 'Plane',
-    requireSecret: true,
-    validateFn: (secret, signature, rawBody) =>
-      typeof secret === 'string' &&
-      secret.length > 0 &&
-      /^[a-f0-9]{64}$/.test(signature) &&
-      safeCompare(hmacSha256Hex(rawBody, secret), signature),
-  }),
+  verifyAuth(ctx) {
+    let providerConfig = ctx.providerConfig
+    if (providerConfig.previousSubscription) {
+      try {
+        const payload: unknown = JSON.parse(ctx.rawBody)
+        providerConfig = previousPlaneDeliveryConfig(providerConfig, payload) ?? providerConfig
+      } catch {}
+    }
+    return verifyPlaneSignature({ ...ctx, providerConfig })
+  },
 
   async matchEvent({ body, providerConfig }) {
     const { planeEventName, PLANE_TRIGGER_EVENTS } = await import('@/triggers/plane/utils')
     const payload = toRecord(body)
+    const matchConfig =
+      (providerConfig.subscriptionActivationPending === true
+        ? previousPlaneDeliveryConfig(providerConfig, payload)
+        : undefined) ?? providerConfig
     const eventName = planeEventName(body)
     if (!eventName) return false
-    const triggerId = providerConfig.triggerId
+    const triggerId = matchConfig.triggerId
     if (
       typeof triggerId === 'string' &&
       triggerId !== 'plane_webhook' &&
       PLANE_TRIGGER_EVENTS[triggerId] !== eventName
     )
       return false
-    const workspaceId = providerConfig.workspaceId
+    const workspaceId = matchConfig.workspaceId
     if (
       typeof workspaceId === 'string' &&
       workspaceId.trim() &&
       workspaceId.trim() !== payload.workspace_id
     )
       return false
-    const projectId = providerConfig.projectId
+    const projectId = matchConfig.projectId
     if (typeof projectId === 'string' && projectId.trim()) {
       const records = Array.isArray(payload.data)
         ? payload.data

apps/sim/lib/workflows/deployment-outbox.test.ts

@@ -633,6 +633,21 @@ describe('versioned deployment preparation outbox', () => {
     )
   })
 
+  it('retires obsolete subscriptions even when new activation fails', async () => {
+    mockIsDeploymentOperationCurrent.mockResolvedValue(true)
+    mockGetDeploymentOperation.mockResolvedValue(operation({ status: 'active', completedAt: NOW }))
+    queueTableRows(schemaMock.workflow, [
+      { id: 'workflow-1', name: 'Workflow', workspaceId: 'workspace-1' },
+    ])
+    const external = new Set(['retired-subscription'])
+    mockActivatePendingWebhookSubscriptions.mockRejectedValue(new Error('activation unavailable'))
+    mockCleanupRetiredWebhookRegistrations.mockImplementation(async () => {
+      external.delete('retired-subscription')
+    })
+    await expect(handler()(payload(), context())).rejects.toThrow('activation unavailable')
+    expect(external.size).toBe(0)
+  })
+
   it('continues through the outbox while stale webhooks remain, then checkpoints the cleanup', async () => {
     mockIsDeploymentOperationCurrent.mockResolvedValue(true)
     mockGetDeploymentOperation.mockResolvedValue(operation({ status: 'active', completedAt: NOW }))

apps/sim/lib/workflows/deployment-outbox.ts

@@ -596,6 +596,7 @@ async function runPostActivationWork(params: {
   context: OutboxEventContext
 }): Promise<DeferredOutboxHandlerResult | undefined> {
   await emitPostActivationSideEffects(params)
+  let activationFailure: Error | undefined
   const activationHasMore = await activatePendingWebhookSubscriptionsAfterActivation({
     request: new NextRequest(new URL('/api/webhooks', getBaseUrl())),
     fence: {
@@ -608,8 +609,10 @@ async function runPostActivationWork(params: {
     userId: params.payload.userId,
     requestId: params.payload.requestId,
     signal: params.context.signal,
+  }).catch((error: unknown) => {
+    activationFailure = toError(error)
+    return false
   })
-  if (activationHasMore) return continueOutboxHandler('webhook_activation_pending')
   await cleanupRetiredWebhooksForOperation({
     payload: params.payload,
     workflow: params.workflow,
@@ -622,7 +625,9 @@ async function runPostActivationWork(params: {
     checkpoint: params.checkpoint,
     context: params.context,
   })
-  return cleanupComplete ? undefined : continueOutboxHandler(INACTIVE_CLEANUP_CONTINUATION_REASON)
+  if (!cleanupComplete) return continueOutboxHandler(INACTIVE_CLEANUP_CONTINUATION_REASON)
+  if (activationFailure) throw activationFailure
+  return activationHasMore ? continueOutboxHandler('webhook_activation_pending') : undefined
 }
 
 async function prepareReadinessComponent(params: {

apps/sim/scripts/test-plane-e2e.ts

@@ -208,6 +208,11 @@ async function receiveDelivery(request: Request): Promise<Response> {
 }
 const server = publicCallback
   ? createServer(async (incoming, outgoing) => {
+      if (incoming.method !== 'POST') {
+        outgoing.writeHead(405, { Allow: 'POST' })
+        outgoing.end()
+        return
+      }
       try {
         const chunks: Buffer[] = []
         let size = 0
@@ -243,6 +248,19 @@ const server = publicCallback
     })
   : undefined
 server?.listen(Number(process.env.PLANE_E2E_LISTENER_PORT || 49187), '127.0.0.1')
+if (server) {
+  await check('webhook ingress rejects method probes safely', async () => {
+    for (const method of ['GET', 'HEAD']) {
+      // boundary-raw-fetch: Exercise the local webhook ingress protocol over real HTTP.
+      const response = await fetch(
+        `http://127.0.0.1:${process.env.PLANE_E2E_LISTENER_PORT || 49187}/${callbackPath}`,
+        { method }
+      )
+      assert.equal(response.status, 405)
+    }
+    assert.equal(deliveryErrors.length, 0)
+  })
+}
 
 try {
   for (const version of ['v2', 'v1'] as const) {

apps/sim/tools/plane/list_labels.ts

@@ -195,6 +195,7 @@ export const planeListLabelsTool: ToolConfig<PlaneListLabelsParams, PlaneListLab
               count: { key: 'count', type: 'boolean', required: false },
               fields: { key: 'fields', type: 'string', required: false },
               cursor: { key: 'cursor', type: 'string', required: false },
+              parent_id__isnull: { key: 'parent_id__isnull', type: 'boolean', required: false },
             })
           )
     },