fix(webhooks): relax webhook CRUD from superAdminProcedure to adminProcedure (#1086)

Co-authored-by: Cascade Bot <bot@cascade.dev>

Author: aaight

src/api/routers/webhooks.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { router, superAdminProcedure } from '../trpc.js';
+import { adminProcedure, router } from '../trpc.js';
 import {
 	applyOneTimeTokens,
 	oneTimeTokensSchema,
@@ -23,7 +23,7 @@ import type {
 export type { GitHubWebhook, JiraWebhookInfo, SentryWebhookInfo, TrelloWebhook };
 
 export const webhooksRouter = router({
-	list: superAdminProcedure
+	list: adminProcedure
 		.input(
 			z.object({
 				projectId: z.string(),
@@ -65,7 +65,7 @@ export const webhooksRouter = router({
 			};
 		}),
 
-	create: superAdminProcedure
+	create: adminProcedure
 		.input(
 			z.object({
 				projectId: z.string(),
@@ -161,7 +161,7 @@ export const webhooksRouter = router({
 			return results;
 		}),
 
-	delete: superAdminProcedure
+	delete: adminProcedure
 		.input(
 			z.object({
 				projectId: z.string(),

tests/unit/api/routers/webhooks.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it, vi } from 'vitest';
-import { createMockSuperAdmin, createMockUser } from '../../../helpers/factories.js';
+import { createMockUser } from '../../../helpers/factories.js';
 import {
 	createCallerFor,
 	expectTRPCError,
@@ -75,7 +75,7 @@ import { webhooksRouter } from '../../../../src/api/routers/webhooks.js';
 
 const createCaller = createCallerFor(webhooksRouter);
 
-const mockUser = createMockSuperAdmin();
+const mockUser = createMockUser();
 
 const mockProject = {
 	id: 'my-project',
@@ -220,9 +220,25 @@ describe('webhooksRouter', () => {
 			await expectTRPCError(caller.list({ projectId: 'my-project' }), 'UNAUTHORIZED');
 		});
 
-		it('throws FORBIDDEN for admin role (not superadmin)', async () => {
+		it('allows admin role to list webhooks', async () => {
+			setupProjectContext();
+
+			mockFetch.mockResolvedValue({
+				ok: true,
+				json: () => Promise.resolve([]),
+			});
+			mockListWebhooks.mockResolvedValue({ data: [] });
+
 			const adminUser = createMockUser({ role: 'admin' });
 			const caller = createCaller({ user: adminUser, effectiveOrgId: adminUser.orgId });
+			const result = await caller.list({ projectId: 'my-project' });
+			expect(result.trello).toEqual([]);
+			expect(result.github).toEqual([]);
+		});
+
+		it('throws FORBIDDEN for member role', async () => {
+			const memberUser = createMockUser({ role: 'member' });
+			const caller = createCaller({ user: memberUser, effectiveOrgId: memberUser.orgId });
 			await expectTRPCError(caller.list({ projectId: 'my-project' }), 'FORBIDDEN');
 		});