Repository navigation
feat(convex): webhook-driven sandbox state sync - #83
Conversation
Signed-off-by: Mislav Ivanda <mislavivanda454@gmail.com>
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 12 files
This PR changes authentication, authorization, or input validation. Ultrareviews find 2.4x more serious bugs than standard reviews. Comment @cubic-dev-ai ultrareview to run one.
Fix all with cubic | Re-trigger cubic
…writes - validate the parsed payload is an object and that id, newState and the timestamp are non-empty strings; signed-but-malformed deliveries get 400 instead of crashing the action or failing argument validation - every API-observed state write (upsertSandbox, setSandboxError) stamps remoteUpdatedAt, so a late webhook event older than state already pulled from the API is discarded rather than overwriting it - live script asserts CONVEX_SITE_URL is present instead of failing with an opaque URL parse error Signed-off-by: Mislav Ivanda <mislavivanda454@gmail.com>
There was a problem hiding this comment.
All reported issues were addressed across 4 files (changes from recent commits).
Requires human review: Auto-approval blocked because this review re-detected 1 unresolved issue already reported by Cubic.
View guided diff | Turn on auto-fix | Re-trigger cubic
|
Verified end-to-end with real Daytona webhook deliveries (in addition to unit tests and the live suite):
Also confirmed along the way: webhook events are per-organization, so the endpoint must live in the same org as the API key the component uses (worth knowing when debugging "no events arrive"). |
…et is shown Both confirmed during the real-delivery test: the endpoint must live in the API key's organization, and the signing secret is on the endpoint's details page in the Webhooks table. Signed-off-by: Mislav Ivanda <mislavivanda454@gmail.com>
Signed-off-by: Mislav Ivanda <mislavivanda454@gmail.com>
This branch was successfully deployed
1 participant
Summary by cubic
Adds webhook-driven sandbox state sync so records update in real time when Daytona changes sandboxes on its own (auto-stop, auto-archive, auto-delete), instead of lagging until
refreshSandboxis called. The feature is opt-in and off by default.sandbox.state.updateddeliveries to the component's webhook route (mounted viahttpPrefix) and applies them to tracked sandbox records.DAYTONA_WEBHOOK_SECRETisn't passed down, and returns 400 on signed-but-malformed payloads instead of crashing.remoteUpdatedAttimestamp — which API-observed writes also stamp, so a webhook can't overwrite newer state; events for untracked sandboxes and non-state events are acknowledged and ignored.DAYTONA_WEBHOOK_SECRETon your deployment, pass it down in the app config, and point a Daytona webhook endpoint (in the same organization as yourDAYTONA_API_KEY) athttps://<deployment>.convex.site/daytona/webhook.Written for commit b545691. Summary will update on new commits.