backend: implement webhook delivery system for card view and contact-save events

[ShantKhatri]

Summary

Product doc section 5.12 specifies Webhooks that notify external systems when a card is viewed or a contact is saved. Design and implement the full webhook delivery system including registration, signing, retries, and logs.

Context

This is foundational infrastructure for the Public API and third-party integration story. It requires careful design for reliability, security (payload signing), and observability.

Tasks

• design Prisma schema:
  • WebhookEndpoint: id, userId, url, secret (encrypted), events: string[], isActive, createdAt.
  • WebhookDelivery: id, endpointId, eventType, payload: JSON, status (pending/success/failed), responseCode, attempts, nextRetryAt, createdAt.
• create apps/backend/src/routes/webhooks.ts:
  • POST /api/webhooks — register an endpoint (max 5 per user).
  • GET /api/webhooks — list user's endpoints.
  • DELETE /api/webhooks/:id — remove endpoint.
  • GET /api/webhooks/:id/deliveries — paginated delivery log.
• create apps/backend/src/utils/webhookDispatch.ts:
  • dispatchWebhook(userId, event, payload) — finds active endpoints for user+event, creates WebhookDelivery rows, and enqueues delivery.
  • Signs payload with HMAC-SHA256 using the endpoint secret: X-DevCard-Signature: sha256=<hex>.
  • Delivers via node-fetch / axios with 5s timeout.
  • Retry with exponential backoff: 3 retries at 30s, 5min, 30min.
• hook dispatch into: card view event (in public.ts) and contact save event.
• write tests for: endpoint registration, signature generation, delivery retry logic.

Acceptance Criteria

• external endpoints receive signed POST requests when events fire.
• delivery log shows attempt history.
• failed deliveries are retried with backoff.
• users can rotate the webhook secret.

Difficulty

senior — requires distributed job design, cryptographic signing, retry logic, and multi-tenant isolation.

[Dipti45sktech]

Hi @ShantKhatri, I'd like to work on this if you could assign it to me.
I'll start by adding the WebhookEndpoint and WebhookDelivery models to the Prisma schema, then build the four REST routes in webhooks.ts for managing endpoints. After that I'll implement webhookDispatch.ts with HMAC-SHA256 signing hooked into the card view and contact-save events, with exponential backoff retries (30s → 5min → 30min) and full test coverage.
Thankyou.

[ShantKhatri]

@Dipti45sktech It's recommended to start with a good first issue.