feat: webhooks

[crowlKats]

Closes #1030

Needs to setup a job to delete old (7 days) deliveries

[crowlKats]

add npm tarball ready event

[KnorpelSenf]

Thank you for working on this!

Managing webhooks for a scope is still broken for me, see the comment below.

I think we should have some details on how the payload objects are structured if JSON is selected. This can either be a short example in the settings page, but either way we should likely have a page in the docs. The webhook UI should then link to this page.

[KnorpelSenf]

It calls this endpoint when looking at http://jsr.test/@std/~/settings which leads to 400 - malformedRequest because there is no package name

[crowlKats]

not sure i understand

[KnorpelSenf]

When you view the scope settings, there's a 400 and the settings page can't be displayed. This is caused because it tries to fetch this endpoint, which then panics because there is no package name. Instead, it should fetch the webhook settings for the scope (a different endpoint).

[KnorpelSenf]

I think it makes sense to publish a small package to https://jsr.io/@jsr which exports both the webhook types and a utility function to verify the signature. Essentially

function verify(header: string, body: string):
  | { ok: true, event: BigUnionOfEvents }
  | { ok: false }

What do you think?

I can write this package, but I obviously don't have publish permission so it might have to be transferred in some way once it works.

[crowlKats]

@KnorpelSenf i do like that, but can we keep that in a follow-up, and then include in that package also frontend/api_types.ts?
would then just be a directory in this repo, and we can set up automatic publishing in CI.

[KnorpelSenf]

Absolutely! I didn't think it could live in this repo (so I didn't think of including it in this PR) but that makes perfect sense!

[KnorpelSenf]

LGTM