From 96325ab9d285775073b2550498263cae8e1f551b Mon Sep 17 00:00:00 2001
From: Tofik Hasanov <annexcies@gmail.com>
Date: Fri, 1 May 2026 21:02:01 -0400
Subject: [PATCH] fix(pentest): forward create notification fields

---
 .../hooks/use-penetration-tests.test.tsx      | 24 +++++++++++++++++++
 .../hooks/use-penetration-tests.ts            |  5 +++-
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/apps/app/src/app/(app)/[orgId]/security/penetration-tests/hooks/use-penetration-tests.test.tsx b/apps/app/src/app/(app)/[orgId]/security/penetration-tests/hooks/use-penetration-tests.test.tsx
index c46bd7780..ee7089970 100644
--- a/apps/app/src/app/(app)/[orgId]/security/penetration-tests/hooks/use-penetration-tests.test.tsx
+++ b/apps/app/src/app/(app)/[orgId]/security/penetration-tests/hooks/use-penetration-tests.test.tsx
@@ -231,6 +231,30 @@ describe('use-penetration-tests hooks', () => {
     expect(requestBody.checks).toEqual(['discovery', 'xss']);
   });
 
+  it('posts webhook and notification fields when creating a report', async () => {
+    fetchMock.mockResolvedValueOnce(
+      createJsonResponse({
+        id: 'run_notifications',
+        status: 'provisioning',
+      }),
+    );
+
+    const { result } = renderHook(() => useCreatePenetrationTest('org_123'), { wrapper });
+
+    await act(async () => {
+      await result.current.createReport({
+        targetUrl: 'https://app.example.com',
+        webhookUrl: 'https://hooks.example.com/pentest',
+        notificationEmail: 'security@example.com',
+      });
+    });
+
+    const init = fetchMock.mock.calls[0][1] as RequestInit;
+    const requestBody = JSON.parse((init.body ?? '{}') as string);
+    expect(requestBody.webhookUrl).toBe('https://hooks.example.com/pentest');
+    expect(requestBody.notificationEmail).toBe('security@example.com');
+  });
+
   it('supports creating a report without repository URL for black-box mode', async () => {
     fetchMock.mockResolvedValueOnce(
       createJsonResponse({
diff --git a/apps/app/src/app/(app)/[orgId]/security/penetration-tests/hooks/use-penetration-tests.ts b/apps/app/src/app/(app)/[orgId]/security/penetration-tests/hooks/use-penetration-tests.ts
index ab695f29f..4359d717e 100644
--- a/apps/app/src/app/(app)/[orgId]/security/penetration-tests/hooks/use-penetration-tests.ts
+++ b/apps/app/src/app/(app)/[orgId]/security/penetration-tests/hooks/use-penetration-tests.ts
@@ -331,6 +331,8 @@ export function useCreatePenetrationTest(organizationId: string): UseCreatePenet
             repoUrl: payload.repoUrl,
             pipelineTesting: payload.pipelineTesting,
             testMode: payload.testMode,
+            webhookUrl: payload.webhookUrl,
+            notificationEmail: payload.notificationEmail,
             scanDepth: payload.scanDepth,
             evidenceLevel: payload.evidenceLevel,
             checks: payload.checks,
@@ -364,7 +366,8 @@ export function useCreatePenetrationTest(organizationId: string): UseCreatePenet
           error: null,
           failedReason: null,
           temporalUiUrl: null,
-          webhookUrl: null,
+          webhookUrl: payload.webhookUrl ?? null,
+          notificationEmail: payload.notificationEmail ?? null,
           scanDepth: payload.scanDepth,
           evidenceLevel: payload.evidenceLevel,
           checks: payload.checks,