feat: pass proxy url to admission webhook (#2718)

wilsonrivera · web-flow · commit bcb4ed34ed78 · 2026-04-01T14:05:25.000-04:00
diff --git a/controlplane/package.json b/controlplane/package.json
@@ -77,6 +77,7 @@
     "fastify-plugin": "^4.5.1",
     "fastify-raw-body": "^4.3.0",
     "graphql": "^16.9.0",
+    "http-proxy-agent": "8.0.0",
     "https-proxy-agent": "8.0.0",
     "ioredis": "^5.4.1",
     "isomorphic-dompurify": "^2.33.0",
diff --git a/controlplane/src/core/bufservices/contract/createContract.ts b/controlplane/src/core/bufservices/contract/createContract.ts
@@ -207,6 +207,7 @@ export function createContract(
           disableResolvabilityValidation: req.disableResolvabilityValidation,
         },
         federatedGraphs: [{ ...contractGraph, contract }],
+        webhookProxyUrl: opts.webhookProxyUrl,
       });
 
       compositionErrors.push(...composition.compositionErrors);
diff --git a/controlplane/src/core/bufservices/contract/updateContract.ts b/controlplane/src/core/bufservices/contract/updateContract.ts
@@ -156,6 +156,7 @@ export function updateContract(
         disableResolvabilityValidation: req.disableResolvabilityValidation,
         ignoreExternalKeys,
       },
+      webhookProxyUrl: opts.webhookProxyUrl,
     });
 
     const compositionErrors: PlainMessage<CompositionError>[] = [];
@@ -187,6 +188,7 @@ export function updateContract(
           },
         },
       ],
+      webhookProxyUrl: opts.webhookProxyUrl,
     });
 
     compositionErrors.push(...composition.compositionErrors);
diff --git a/controlplane/src/core/bufservices/feature-flag/createFeatureFlag.ts b/controlplane/src/core/bufservices/feature-flag/createFeatureFlag.ts
@@ -216,6 +216,7 @@ export function createFeatureFlag(
           ignoreExternalKeys: ignoreExternalKeysFeature?.enabled ?? false,
         },
         federatedGraphs,
+        webhookProxyUrl: opts.webhookProxyUrl,
       });
 
       compositionErrors.push(...composition.compositionErrors);
diff --git a/controlplane/src/core/bufservices/feature-flag/deleteFeatureFlag.ts b/controlplane/src/core/bufservices/feature-flag/deleteFeatureFlag.ts
@@ -149,6 +149,7 @@ export function deleteFeatureFlag(
           ignoreExternalKeys: ignoreExternalKeysFeature?.enabled ?? false,
         },
         federatedGraphs,
+        webhookProxyUrl: opts.webhookProxyUrl,
       });
 
       compositionErrors.push(...composition.compositionErrors);
diff --git a/controlplane/src/core/bufservices/feature-flag/enableFeatureFlag.ts b/controlplane/src/core/bufservices/feature-flag/enableFeatureFlag.ts
@@ -132,6 +132,7 @@ export function enableFeatureFlag(
           ignoreExternalKeys: ignoreExternalKeysFeature?.enabled ?? false,
         },
         federatedGraphs,
+        webhookProxyUrl: opts.webhookProxyUrl,
       });
 
       compositionErrors.push(...composition.compositionErrors);
diff --git a/controlplane/src/core/bufservices/feature-flag/updateFeatureFlag.ts b/controlplane/src/core/bufservices/feature-flag/updateFeatureFlag.ts
@@ -187,6 +187,7 @@ export function updateFeatureFlag(
           ignoreExternalKeys: ignoreExternalKeysFeature?.enabled ?? false,
         },
         federatedGraphs: allFederatedGraphsToCompose,
+        webhookProxyUrl: opts.webhookProxyUrl,
       });
 
       compositionErrors.push(...composition.compositionErrors);
diff --git a/controlplane/src/core/bufservices/federated-graph/createFederatedGraph.ts b/controlplane/src/core/bufservices/federated-graph/createFederatedGraph.ts
@@ -237,6 +237,7 @@ export function createFederatedGraph(
           ignoreExternalKeys: ignoreExternalKeysFeature?.enabled ?? false,
         },
         federatedGraphs: [federatedGraph],
+        webhookProxyUrl: opts.webhookProxyUrl,
       });
 
       compositionErrors.push(...composition.compositionErrors);
diff --git a/controlplane/src/core/bufservices/federated-graph/migrateFromApollo.ts b/controlplane/src/core/bufservices/federated-graph/migrateFromApollo.ts
@@ -166,6 +166,7 @@ export function migrateFromApollo(
           disableResolvabilityValidation: true,
           ignoreExternalKeys: ignoreExternalKeysFeature?.enabled ?? false,
         },
+        webhookProxyUrl: opts.webhookProxyUrl,
       });
     });
 
diff --git a/controlplane/src/core/bufservices/federated-graph/moveFederatedGraph.ts b/controlplane/src/core/bufservices/federated-graph/moveFederatedGraph.ts
@@ -126,6 +126,8 @@ export function moveFederatedGraph(
           jwtSecret: opts.admissionWebhookJWTSecret,
         },
         opts.chClient!,
+        undefined,
+        opts.webhookProxyUrl,
       );
 
       const allDeploymentErrors: PlainMessage<DeploymentError>[] = [];
@@ -164,6 +166,8 @@ export function moveFederatedGraph(
             jwtSecret: opts.admissionWebhookJWTSecret,
           },
           opts.chClient!,
+          undefined,
+          opts.webhookProxyUrl,
         );
 
         allCompositionErrors.push(...contractErrors);
diff --git a/controlplane/src/core/bufservices/federated-graph/updateFederatedGraph.ts b/controlplane/src/core/bufservices/federated-graph/updateFederatedGraph.ts
@@ -139,6 +139,7 @@ export function updateFederatedGraph(
       targetId: federatedGraph.targetId,
       unsetLabelMatchers: req.unsetLabelMatchers,
       updatedBy: authContext.userId,
+      webhookProxyUrl: opts.webhookProxyUrl,
     });
 
     if (result?.deploymentErrors) {
diff --git a/controlplane/src/core/bufservices/graph/recomposeGraph.ts b/controlplane/src/core/bufservices/graph/recomposeGraph.ts
@@ -91,6 +91,7 @@ export function recomposeGraph(
           ignoreExternalKeys,
         },
         federatedGraphs: [graph],
+        webhookProxyUrl: opts.webhookProxyUrl,
       });
 
     sendOrgWebhooks({
diff --git a/controlplane/src/core/bufservices/graph/setGraphRouterCompatibilityVersion.ts b/controlplane/src/core/bufservices/graph/setGraphRouterCompatibilityVersion.ts
@@ -153,6 +153,7 @@ export function setGraphRouterCompatibilityVersion(
           ignoreExternalKeys: ignoreExternalKeysFeature?.enabled ?? false,
         },
         federatedGraphs: [federatedGraph],
+        webhookProxyUrl: opts.webhookProxyUrl,
       });
 
       if (composition.compositionErrors.length > 0) {
diff --git a/controlplane/src/core/bufservices/monograph/publishMonograph.ts b/controlplane/src/core/bufservices/monograph/publishMonograph.ts
@@ -156,6 +156,8 @@ export function publishMonograph(
           webhookJWTSecret: opts.admissionWebhookJWTSecret,
         },
         opts.chClient!,
+        undefined,
+        opts.webhookProxyUrl,
       );
 
     for (const graph of updatedFederatedGraphs) {
diff --git a/controlplane/src/core/bufservices/monograph/updateMonograph.ts b/controlplane/src/core/bufservices/monograph/updateMonograph.ts
@@ -151,6 +151,7 @@ export function updateMonograph(
         admissionWebhookURL: req.admissionWebhookURL,
         admissionWebhookSecret: req.admissionWebhookSecret,
         chClient: opts.chClient!,
+        webhookProxyUrl: opts.webhookProxyUrl,
       });
 
       await subgraphRepo.update(
@@ -174,6 +175,8 @@ export function updateMonograph(
           webhookJWTSecret: opts.admissionWebhookJWTSecret,
         },
         opts.chClient!,
+        undefined,
+        opts.webhookProxyUrl,
       );
 
       await auditLogRepo.addAuditLog({
diff --git a/controlplane/src/core/bufservices/proposal/createProposal.ts b/controlplane/src/core/bufservices/proposal/createProposal.ts
@@ -394,6 +394,7 @@ export function createProposal(
       contractRepo,
       graphCompostionRepo,
       opts.chClient,
+      opts.webhookProxyUrl,
     );
 
     const {
@@ -446,6 +447,7 @@ export function createProposal(
         opts.billingDefaultPlanId,
         opts.webhookProxyUrl,
       ),
+      webhookProxyUrl: opts.webhookProxyUrl,
     });
 
     if (checkId) {
diff --git a/controlplane/src/core/bufservices/proposal/updateProposal.ts b/controlplane/src/core/bufservices/proposal/updateProposal.ts
@@ -463,6 +463,7 @@ export function updateProposal(
         contractRepo,
         graphCompostionRepo,
         opts.chClient,
+        opts.webhookProxyUrl,
       );
 
       const {
@@ -515,6 +516,7 @@ export function updateProposal(
           opts.billingDefaultPlanId,
           opts.webhookProxyUrl,
         ),
+        webhookProxyUrl: opts.webhookProxyUrl,
       });
 
       if (checkId) {
diff --git a/controlplane/src/core/bufservices/subgraph/checkSubgraphSchema.ts b/controlplane/src/core/bufservices/subgraph/checkSubgraphSchema.ts
@@ -300,6 +300,7 @@ export function checkSubgraphSchema(
         ignoreExternalKeys,
       },
       webhookService,
+      webhookProxyUrl: opts.webhookProxyUrl,
     });
 
     // Extract variables from checkResult
@@ -471,6 +472,7 @@ export function checkSubgraphSchema(
           ignoreExternalKeys,
         },
         webhookService,
+        webhookProxyUrl: opts.webhookProxyUrl,
       });
 
       await schemaCheckRepo.addLinkedSchemaCheck({
diff --git a/controlplane/src/core/bufservices/subgraph/deleteFederatedSubgraph.ts b/controlplane/src/core/bufservices/subgraph/deleteFederatedSubgraph.ts
@@ -190,6 +190,7 @@ export function deleteFederatedSubgraph(
             ignoreExternalKeys: ignoreExternalKeysFeature?.enabled ?? false,
           },
           federatedGraphs: affectedFederatedGraphs,
+          webhookProxyUrl: opts.webhookProxyUrl,
         });
 
         // Re-fetch the federated graphs to get the updated composedSchemaVersionId
diff --git a/controlplane/src/core/bufservices/subgraph/fixSubgraphSchema.ts b/controlplane/src/core/bufservices/subgraph/fixSubgraphSchema.ts
@@ -44,6 +44,7 @@ export function fixSubgraphSchema(
       contractRepo,
       graphCompositionRepo,
       opts.chClient,
+      opts.webhookProxyUrl,
     );
 
     req.namespace = req.namespace || DefaultNamespace;
diff --git a/controlplane/src/core/bufservices/subgraph/moveSubgraph.ts b/controlplane/src/core/bufservices/subgraph/moveSubgraph.ts
@@ -130,6 +130,7 @@ export function moveSubgraph(
               disableResolvabilityValidation: req.disableResolvabilityValidation,
               ignoreExternalKeys: ignoreExternalKeysFeature?.enabled ?? false,
             },
+            opts.webhookProxyUrl,
           );
 
         await auditLogRepo.addAuditLog({
diff --git a/controlplane/src/core/bufservices/subgraph/publishFederatedSubgraph.ts b/controlplane/src/core/bufservices/subgraph/publishFederatedSubgraph.ts
@@ -605,6 +605,7 @@ export function publishFederatedSubgraph(
           disableResolvabilityValidation: req.disableResolvabilityValidation,
           ignoreExternalKeys: ignoreExternalKeysFeature?.enabled ?? false,
         },
+        opts.webhookProxyUrl,
       );
 
     // if this subgraph is part of a proposal, mark the proposal subgraph as published
diff --git a/controlplane/src/core/bufservices/subgraph/updateSubgraph.ts b/controlplane/src/core/bufservices/subgraph/updateSubgraph.ts
@@ -220,6 +220,7 @@ export function updateSubgraph(
           disableResolvabilityValidation: req.disableResolvabilityValidation,
           ignoreExternalKeys: ignoreExternalKeysFeature?.enabled ?? false,
         },
+        opts.webhookProxyUrl,
       );
 
     await auditLogRepo.addAuditLog({
diff --git a/controlplane/src/core/composition/composer.ts b/controlplane/src/core/composition/composer.ts
@@ -145,6 +145,7 @@ export class Composer {
     private contractRepo: ContractRepository,
     private graphCompositionRepository: GraphCompositionRepository,
     private chClient?: ClickHouseClient,
+    private proxyUrl?: string,
   ) {}
 
   composeRouterConfigWithFeatureFlags({
@@ -266,6 +267,7 @@ export class Composer {
             this.logger,
             admissionWebhookURL,
             admissionWebhookSecret,
+            this.proxyUrl,
           );
           const resp = await admissionWebhookController.validateConfig(
             {
diff --git a/controlplane/src/core/repositories/FederatedGraphRepository.ts b/controlplane/src/core/repositories/FederatedGraphRepository.ts
@@ -203,6 +203,7 @@ export class FederatedGraphRepository {
     readme?: string;
     unsetAdmissionWebhookURL?: boolean;
     unsetLabelMatchers?: boolean;
+    webhookProxyUrl?: string;
   }): Promise<
     | {
         compositionErrors: PlainMessage<CompositionError>[];
@@ -329,6 +330,7 @@ export class FederatedGraphRepository {
           actorId: data.updatedBy,
           chClient: data.chClient,
           compositionOptions: data.compositionOptions,
+          webhookProxyUrl: data.webhookProxyUrl,
         });
 
         return {
@@ -362,6 +364,7 @@ export class FederatedGraphRepository {
     },
     chClient: ClickHouseClient,
     compositionOptions?: CompositionOptions,
+    webhookProxyUrl?: string,
   ): Promise<{
     compositionErrors: PlainMessage<CompositionError>[];
     deploymentErrors: PlainMessage<DeploymentError>[];
@@ -422,6 +425,7 @@ export class FederatedGraphRepository {
           chClient,
           compositionOptions,
           federatedGraphs: [movedContractGraph],
+          webhookProxyUrl,
         });
 
         return {
@@ -441,6 +445,7 @@ export class FederatedGraphRepository {
         },
         chClient,
         compositionOptions,
+        webhookProxyUrl,
       });
 
       return {
@@ -1503,6 +1508,7 @@ export class FederatedGraphRepository {
     chClient,
     blobStorage,
     federatedGraphs,
+    webhookProxyUrl,
   }: {
     actorId: string;
     admissionConfig: {
@@ -1513,6 +1519,7 @@ export class FederatedGraphRepository {
     chClient: ClickHouseClient;
     federatedGraphs: FederatedGraphDTO[];
     compositionOptions?: CompositionOptions;
+    webhookProxyUrl?: string;
   }) => {
     return this.db.transaction(async (tx) => {
       const subgraphRepo = new SubgraphRepository(this.logger, tx, this.organizationId);
@@ -1528,6 +1535,7 @@ export class FederatedGraphRepository {
         contractRepo,
         graphCompositionRepo,
         chClient,
+        webhookProxyUrl,
       );
 
       const allDeploymentErrors: PlainMessage<DeploymentError>[] = [];
diff --git a/controlplane/src/core/repositories/SchemaCheckRepository.ts b/controlplane/src/core/repositories/SchemaCheckRepository.ts
@@ -713,6 +713,7 @@ export class SchemaCheckRepository {
     chClient,
     skipProposalMatchCheck,
     webhookService,
+    webhookProxyUrl,
   }: {
     actorId: string;
     blobStorage: BlobStorage;
@@ -735,6 +736,7 @@ export class SchemaCheckRepository {
     chClient?: ClickHouseClient;
     skipProposalMatchCheck: boolean;
     webhookService: OrganizationWebhookService;
+    webhookProxyUrl?: string;
   }) {
     const breakingChanges: SchemaChange[] = [];
     const nonBreakingChanges: SchemaChange[] = [];
@@ -1451,6 +1453,7 @@ export class SchemaCheckRepository {
           ignoreExternalKeys,
         },
         webhookService,
+        webhookProxyUrl,
       });
 
       await this.addLinkedSchemaCheck({
diff --git a/controlplane/src/core/repositories/SubgraphRepository.ts b/controlplane/src/core/repositories/SubgraphRepository.ts
@@ -248,6 +248,7 @@ export class SubgraphRepository {
     },
     chClient: ClickHouseClient,
     compositionOptions?: CompositionOptions,
+    webhookProxyUrl?: string,
   ): Promise<{
     compositionErrors: PlainMessage<CompositionError>[];
     compositionWarnings: PlainMessage<CompositionWarning>[];
@@ -475,6 +476,7 @@ export class SubgraphRepository {
         chClient,
         compositionOptions,
         federatedGraphs: updatedFederatedGraphs.filter((g) => !g.contract),
+        webhookProxyUrl,
       });
 
       compositionErrors.push(...cErrors);
@@ -516,6 +518,7 @@ export class SubgraphRepository {
     },
     chClient: ClickHouseClient,
     compositionOptions?: CompositionOptions,
+    webhookProxyUrl?: string,
   ): Promise<{
     compositionErrors: PlainMessage<CompositionError>[];
     updatedFederatedGraphs: FederatedGraphDTO[];
@@ -568,6 +571,7 @@ export class SubgraphRepository {
         actorId: data.updatedBy,
         chClient,
         compositionOptions,
+        webhookProxyUrl,
       });
 
       // Re-fetch the federated graphs to get the updated composedSchemaVersionId
@@ -1863,6 +1867,7 @@ export class SubgraphRepository {
     newGraphQLSchema,
     compositionOptions,
     webhookService,
+    webhookProxyUrl,
   }: {
     actorId: string;
     blobStorage: BlobStorage;
@@ -1887,6 +1892,7 @@ export class SubgraphRepository {
     newGraphQLSchema?: GraphQLSchema;
     compositionOptions?: CompositionOptions;
     webhookService: OrganizationWebhookService;
+    webhookProxyUrl?: string;
   }): Promise<
     PlainMessage<CheckSubgraphSchemaResponse> & {
       hasClientTraffic: boolean;
@@ -2053,6 +2059,7 @@ export class SubgraphRepository {
       contractRepo,
       graphCompostionRepo,
       chClient,
+      webhookProxyUrl,
     );
 
     const checkSubgraphs = new Map<string, CheckSubgraph>();
diff --git a/controlplane/src/core/services/AdmissionWebhookController.ts b/controlplane/src/core/services/AdmissionWebhookController.ts
diff --git a/controlplane/src/core/webhooks/OrganizationWebhookService.ts b/controlplane/src/core/webhooks/OrganizationWebhookService.ts
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
