fix: persist webhook health state

Author: ramtamilselvan

backend/src/services/enterprise/webhook-system.ts

@@ -849,6 +849,7 @@ export class WebhookSystem {
     }
 
     this.deliveries.set(delivery.deliveryId, delivery);
+    await this.persistWebhookHealth(webhook);
     await this.persistDelivery(delivery);
   }
 
@@ -1114,6 +1115,36 @@ export class WebhookSystem {
     }
   }
 
+  private async persistWebhookHealth(webhook: RegisteredWebhook): Promise<void> {
+    try {
+      await prisma.webhook.update({
+        where: { id: webhook.id },
+        data: {
+          failureCount: webhook.health.consecutiveFailures,
+          lastStatusCode: webhook.health.lastStatusCode,
+          ...(webhook.health.lastSuccessAt
+            ? { lastDeliveredAt: new Date(webhook.health.lastSuccessAt) }
+            : {}),
+          ...(webhook.health.disabled ? { status: 'DISABLED' as const } : {}),
+        },
+      });
+
+      await this.persistWebhookConfig(webhook.id, {
+        description: webhook.description,
+        metadata: webhook.metadata,
+        batchDelivery: webhook.batchDelivery,
+        batchIntervalMs: webhook.batchIntervalMs,
+        headers: webhook.headers,
+        health: webhook.health,
+      });
+    } catch (error) {
+      logger.error('webhook_health_persist_failed', {
+        webhookId: webhook.id,
+        error: error instanceof Error ? error.message : 'Unknown error',
+      });
+    }
+  }
+
   private async getWebhookForClient(
     webhookId: string,
     clientId: string,

backend/test/webhook-system-persistence.test.ts

@@ -561,6 +561,56 @@ describe('WebhookSystem persistence', () => {
     }
   });
 
+  it('persists webhook auto-disable state after repeated failures', async () => {
+    process.env.NODE_ENV = 'production';
+    process.env.WEBHOOK_SECRET_ENCRYPTION_KEY = Buffer.alloc(32, 9).toString('base64');
+    mockWebhookFindMany.mockResolvedValue([
+      {
+        id: 'wh-auto-disable',
+        organizationId: 'org-1',
+        url: 'https://hooks.zeroid.example/private',
+        secret: encryptWebhookSecretForTest('s'.repeat(64)),
+        events: ['credential.issued'],
+        status: 'ACTIVE',
+        failureCount: 9,
+        lastDeliveredAt: null,
+        lastStatusCode: 500,
+        createdAt: new Date('2026-04-21T00:00:00.000Z'),
+        updatedAt: new Date('2026-04-21T00:00:00.000Z'),
+      },
+    ]);
+    mockWebhookDeliveryUpsert.mockResolvedValue({});
+    const dnsSpy = jest.spyOn(dns, 'lookup').mockResolvedValue([
+      { address: '127.0.0.1', family: 4 },
+    ]);
+
+    try {
+      const deliveryIds = await webhookSystem.emit('credential.issued', {
+        credentialId: 'cred-1',
+      }, 'org-1');
+
+      expect(deliveryIds).toHaveLength(1);
+      expect(mockWebhookUpdate).toHaveBeenCalledWith(expect.objectContaining({
+        where: { id: 'wh-auto-disable' },
+        data: expect.objectContaining({
+          failureCount: 10,
+          lastStatusCode: 0,
+          status: 'DISABLED',
+        }),
+      }));
+      expect(JSON.parse(redisStore['enterprise:webhook-config:wh-auto-disable'] as string)).toMatchObject({
+        health: expect.objectContaining({
+          consecutiveFailures: 10,
+          disabled: true,
+        }),
+      });
+    } finally {
+      dnsSpy.mockRestore();
+      process.env.NODE_ENV = 'test';
+      delete process.env.WEBHOOK_SECRET_ENCRYPTION_KEY;
+    }
+  });
+
   it('pins vetted DNS address during production webhook delivery', async () => {
     process.env.NODE_ENV = 'production';
     process.env.WEBHOOK_SECRET_ENCRYPTION_KEY = Buffer.alloc(32, 9).toString('base64');
@@ -700,6 +750,14 @@ describe('WebhookSystem persistence', () => {
         success: true,
       }),
     }));
+    expect(mockWebhookUpdate).toHaveBeenCalledWith(expect.objectContaining({
+      where: { id: 'wh-deliver' },
+      data: expect.objectContaining({
+        failureCount: 0,
+        lastDeliveredAt: expect.any(Date),
+        lastStatusCode: 200,
+      }),
+    }));
     fetchSpy.mockRestore();
   });