Category: bug
Problem
src/webhooks/webhooks.service.ts remove(id, merchantId) (lines 44-46): const webhook = await this.webhooksRepo.findOne({ where: { id, merchantId } }); if (webhook) await this.webhooksRepo.remove(webhook); — if no matching webhook is found (wrong id, or the id belongs to another merchant), the method returns undefined without throwing anything, and the controller (src/webhooks/webhooks.controller.ts remove()) returns whatever that is with a 200-ish response.
Impact
Contradicts the controller's own @ApiNotFoundResponse({ description: 'Webhook not found' }) documentation — callers get a success-shaped response for a delete that didn't happen, e.g. when probing another merchant's webhook id, making it hard to distinguish "deleted" from "nothing happened".
Suggested fix
Throw NotFoundException('Webhook not found') when webhook is null/undefined, matching the documented contract.
Category: bug
Problem
src/webhooks/webhooks.service.ts
remove(id, merchantId)(lines 44-46):const webhook = await this.webhooksRepo.findOne({ where: { id, merchantId } }); if (webhook) await this.webhooksRepo.remove(webhook);— if no matching webhook is found (wrong id, or the id belongs to another merchant), the method returnsundefinedwithout throwing anything, and the controller (src/webhooks/webhooks.controller.tsremove()) returns whatever that is with a 200-ish response.Impact
Contradicts the controller's own
@ApiNotFoundResponse({ description: 'Webhook not found' })documentation — callers get a success-shaped response for a delete that didn't happen, e.g. when probing another merchant's webhook id, making it hard to distinguish "deleted" from "nothing happened".Suggested fix
Throw
NotFoundException('Webhook not found')whenwebhookis null/undefined, matching the documented contract.