feat(sdk): add webhook consumer support - #3376
Open
Sanderhoff-alt wants to merge 1 commit into
Open
Conversation
Sanderhoff-alt
force-pushed
the
feat/webhook-consumer-sdks
branch
from
August 11, 2026 08:20
dd2a08a to
307a682
Compare
Add webhook event models and consumer APIs to the Python, TypeScript, Go, and Rust SDKs, including raw-body HMAC verification, parse-only helpers, verify-then-parse entry points, and forward-compatible handling for unknown events. Keep ordinary client generation on an OpenAPI projection without the top-level webhooks keyword while preserving webhook component schemas. Extract and validate that projection through reusable build scripts. Generate the TypeScript runtime validation schema from OpenAPI and use Ajv instead of maintaining a separate hand-written field list. Return TypeScript events through a discriminated known/unknown wrapper.
Sanderhoff-alt
force-pushed
the
feat/webhook-consumer-sdks
branch
from
August 11, 2026 08:25
307a682 to
386c65d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add webhook consumer APIs to the Python, TypeScript, Go, and Rust SDKs. The SDKs verify the exact raw request body, parse known events into generated models, and preserve unknown events through a forward-compatible envelope.
Technical Design
The main OpenAPI document remains the single source of truth for webhook event schemas. Ordinary client generation uses a validated projection that removes only the top-level
webhookskeyword because the current generators do not handle OpenAPI 3.1 webhooks consistently. Webhook component schemas remain available to the generated clients.The consumer layer is intentionally hand-written. It owns raw-body handling, HMAC-SHA256 verification, constant-time comparison, header extraction, event dispatch, and the verify-before-parse workflow. Generated code owns event models, field types, serialization, and deserialization.
Known events are selected from the signed body event discriminator. Unknown event names are returned as forward-compatible envelopes that preserve unknown top-level and data fields. The TypeScript API exposes a discriminated
kindwrapper so callers can narrow known and unknown events safely.TypeScript runtime validation is generated from the same OpenAPI schemas and compiled with Ajv. The validator map is derived from the generated discriminator mapping rather than maintaining a second hard-coded event list. Python enforces the same RFC3339 timestamp contract at the consumer boundary, while Go and Rust rely on their generated model deserializers and standard date-time parsers.
The client-generation scripts validate projection invariants, schema references, generated webhook artifacts, and deterministic schema output. The root lockfile records the TypeScript runtime dependencies.
Scope
This PR is limited to consumer-side event models, raw-body signature verification, parsing, forward-compatible unknown event handling, and usage documentation. It does not change the webhook delivery protocol or server retry behavior.
GET delivery consumption remains outside the current contract because main currently signs a payload but sends an empty GET body; the consumer APIs are method-independent once the sender emits the signed body.
Verification
Webhook tests pass for the server, Python, TypeScript, Go, and Rust consumers. TypeScript type-checking and production build pass, schema generation is deterministic across hash seeds, Python scripts compile, and
npm ci --dry-runvalidates the lockfile dependency graph.Closes #3071