Add isWebhook flag to prevent hooks from being resumed via public webhook endpoint#1270
Merged
Conversation
…hook endpoint Hooks created with createHook() are now non-resumable via the public webhook endpoint by default (isWebhook=false). Only hooks created with createWebhook() set isWebhook=true, allowing them to be resumed via the public URL. Also adds HookNotFoundError thrown by all world backends when a webhook token doesn't match any hook, and an e2e test for the new behavior. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Contributor
🦋 Changeset detectedLatest commit: e6f3979 The changes in this PR will be included in the next version bump. This PR includes changesets to release 19 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
📊 Benchmark Results
workflow with no steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Express | Next.js (Turbopack) workflow with 1 step💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Next.js (Turbopack) | Nitro workflow with 10 sequential steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Express | Next.js (Turbopack) workflow with 25 sequential steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Next.js (Turbopack) | Express workflow with 50 sequential steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) | Nitro | Express Promise.all with 10 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Express | Next.js (Turbopack) Promise.all with 25 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) | Nitro | Express Promise.all with 50 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Express | Next.js (Turbopack) | Nitro Promise.race with 10 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Next.js (Turbopack) | Express Promise.race with 25 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) | Nitro | Express Promise.race with 50 concurrent steps💻 Local Development
▲ Production (Vercel)
🔍 Observability: Nitro | Next.js (Turbopack) | Express Stream Benchmarks (includes TTFB metrics)workflow with stream💻 Local Development
▲ Production (Vercel)
🔍 Observability: Next.js (Turbopack) | Express | Nitro SummaryFastest Framework by WorldWinner determined by most benchmark wins
Fastest World by FrameworkWinner determined by most benchmark wins
Column Definitions
Worlds:
|
Contributor
🧪 E2E Test Results❌ Some tests failed Summary
❌ Failed Tests💻 Local Development (12 failed)astro-stable (1 failed):
express-stable (1 failed):
fastify-stable (1 failed):
hono-stable (1 failed):
nextjs-turbopack-canary (1 failed):
nextjs-turbopack-stable (1 failed):
nextjs-webpack-canary (1 failed):
nextjs-webpack-stable (1 failed):
nitro-stable (1 failed):
nuxt-stable (1 failed):
sveltekit-stable (1 failed):
vite-stable (1 failed):
📦 Local Production (12 failed)astro-stable (1 failed):
express-stable (1 failed):
fastify-stable (1 failed):
hono-stable (1 failed):
nextjs-turbopack-canary (1 failed):
nextjs-turbopack-stable (1 failed):
nextjs-webpack-canary (1 failed):
nextjs-webpack-stable (1 failed):
nitro-stable (1 failed):
nuxt-stable (1 failed):
sveltekit-stable (1 failed):
vite-stable (1 failed):
🐘 Local Postgres (12 failed)astro-stable (1 failed):
express-stable (1 failed):
fastify-stable (1 failed):
hono-stable (1 failed):
nextjs-turbopack-canary (1 failed):
nextjs-turbopack-stable (1 failed):
nextjs-webpack-canary (1 failed):
nextjs-webpack-stable (1 failed):
nitro-stable (1 failed):
nuxt-stable (1 failed):
sveltekit-stable (1 failed):
vite-stable (1 failed):
🪟 Windows (1 failed)nextjs-turbopack (1 failed):
🌍 Community Worlds (52 failed)mongodb (2 failed):
redis (1 failed):
turso (49 failed):
📋 Other (3 failed)e2e-local-dev-nest-stable (1 failed):
e2e-local-postgres-nest-stable (1 failed):
e2e-local-prod-nest-stable (1 failed):
Details by Category✅ ▲ Vercel Production
❌ 💻 Local Development
❌ 📦 Local Production
❌ 🐘 Local Postgres
❌ 🪟 Windows
❌ 🌍 Community Worlds
❌ 📋 Other
❌ Some E2E test jobs failed:
Check the workflow run for details. |
TooTallNate
approved these changes
Mar 5, 2026
- Default isWebhook to false at write time in events-storage - Default isWebhook to false at read time in hooks-storage (for old data) - Update test assertions to match HookNotFoundError message Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
…ration - Revert read-side default to `isWebhook ?? true` in world-local for backwards compatibility with existing hooks that predate the field - Add postgres migration 0009 to add `is_webhook` column with default true - Update drizzle schema to match Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Contributor
Author
|
Will fix the failing e2e tests with a separate clean PR (also happening on main) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
createHook()now default toisWebhook: false, preventing them from being resumed via the public/.well-known/workflow/v1/webhook/{token}endpointcreateWebhook()setsisWebhook: true, allowing public URL resumptionHookNotFoundErrorthrown by all world backends when a webhook token doesn't match any hookWebhookOptionsnow omits bothtokenandisWebhookfromHookOptions(token is always random for webhooks, isWebhook is always true)Test plan
createHook()hooks are not resumable via public webhook endpoint🤖 Generated with Claude Code