feat: allow specifying webhook request headers

[wrn14897]

Address #1078

Ref: HDX-2225

[changeset-bot]

🦋 Changeset detected

Latest commit: 334a089

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@hyperdx/api	Patch
@hyperdx/app	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
hyperdx-v2-oss-app	Ready	Preview	Comment	Oct 23, 2025 9:17am

[claude]

PR Review: Allow specifying webhook request headers

✅ Overall Assessment: No critical issues found.

Positive Points:

• ✅ Strong security validation for HTTP headers (CRLF injection prevention, control character blocking)
• ✅ Comprehensive test coverage for validation edge cases
• ✅ Proper Zod schema validation on backend
• ✅ Frontend JSON parsing with error handling

Minor Recommendations (non-blocking):

1. Missing UPDATE endpoint validation → The webhooks router has no PATCH/PUT endpoint. If webhook updates are supported elsewhere, ensure the same header validation (httpHeaderNameValidator and httpHeaderValueValidator) is applied.

2. Frontend error handling enhancement → Consider extracting Zod error formatting logic into a reusable utility function (currently inline in TeamPage.tsx:758-771). This would help if similar error handling is needed elsewhere.

3. Documentation → Consider adding a comment in webhooks.ts:40-55 explaining that the validation follows RFC 7230 HTTP header field name/value specifications.

Test Coverage:

• ✅ Comprehensive tests for header name validation (empty, invalid chars, starts with number)
• ✅ Comprehensive tests for header value validation (CRLF, control chars, tabs, newlines)
• ✅ Valid header cases tested
• ✅ Integration test updated to verify headers are sent correctly

Ready to merge ✓

[github-actions]

E2E Test Results

✅ All tests passed • 26 passed • 3 skipped • 230s

Status	Count
✅ Passed	26
❌ Failed	0
⚠️ Flaky	0
⏭️ Skipped	3

View full report →