AshHooks.Endpoint

Copy Markdown View Source

Configures an Ash resource as an outbound webhook destination, including its enable/disable state and references to signing secrets.

use Ash.Resource,
  data_layer: AshSqlite.DataLayer,
  extensions: [AshHooks.Endpoint]

# Map a declared :active boolean instead of injecting :status.
endpoint do
  status_attribute :active
  enabled_values [true]
  disabled_value false
end

The extension injects url, status (:enabled | :disabled), and four secret references (secret_ref required, previous_secret_ref / legacy_secret_ref / legacy_previous_secret_ref for rotation and the legacy envelope). All four are AshHooks.Endpoint.SecretRef. The type rejects secret-shaped literals (whsec_ / whsk_ / whpk_ prefixed material) at cast, on every write path including consumer-defined actions: secrets live behind consumer callbacks; store references to those secrets in the endpoint rows.

With status_attribute set, the extension uses that attribute instead of injecting status. The dispatcher skips endpoints whose mapped value is outside enabled_values, and the 410 auto-disable flips the mapped attribute to disabled_value. The mapped attribute must be declared by the consumer (fail-closed at compile).

The dispatcher skips non-enabled endpoints entirely (no delivery row). URL casting checks the scheme, metadata hostnames, and literal IP addresses on every write path. Send-time validation resolves hostnames and rejects nonpublic addresses; the HTTP adapter pins the validated connection address.

Govern read access to target URLs and secret references with your own resource policies. The package does not inject read policies.

Policy obligation: protect the injected :disable action wherever you expose it to application callers. The 410 rule uses it as a system write (authorize?: false). A permissive resource policy can otherwise allow callers to disable endpoints. See AshHooks.OutboundDelivery for the delivery ledger's action policy requirements.

endpoint

Configuration of this resource as the outbound webhook endpoint.

Options

NameTypeDefaultDocs
status_attributeatomThe consumer's enable/disable attribute the package maps onto (e.g. active). When set, status is not injected — the mapped attribute is the one durable switch: the dispatcher skips endpoints whose value is outside enabled_values, and the 410 auto-disable sets it to disabled_value. The attribute must be declared in the resource's own attributes block (not another extension's injection), and enabled_values/disabled_value must be spelled out explicitly — fail-closed at compile.
enabled_valueslist(any)Required with status_attribute: the mapped attribute's values that make the endpoint deliverable (e.g. [true]). A defaulted list against a boolean or custom-enum switch would silently match nothing — zero deliveries, no error — so the mapping refuses to compile without it.
disabled_valueanyREQUIRED with status_attribute: the value the injected :disable action (and the 410 auto-disable) writes to the mapped attribute (e.g. false).