feat: inbound webhooks — public ingest endpoints

core.inbound_hooks (migration 00013): POST /api/v1/hooks/<token> accepts
external events. event mode republishes as inbound.received through the
signed dispatcher + realtime; job mode triggers a scheduled-job run with
the received body as payload. Optional X-Primora-Signature HMAC verify.
Dashboard card on the Integrations page.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/backend/internal/database/db/inbound_hooks.sql.go

@@ -0,0 +1,173 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.29.0
+// source: inbound_hooks.sql
+
+package db
+
+import (
+	"context"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgtype"
+)
+
+const createInboundHook = `-- name: CreateInboundHook :one
+INSERT INTO core.inbound_hooks (project_id, name, token, mode, job_id, secret, enabled)
+VALUES ($1, $2, $3, $4, $5, $6, $7)
+RETURNING id, project_id, name, token, mode, job_id, secret, enabled, last_received_at, created_at, updated_at
+`
+
+type CreateInboundHookParams struct {
+	ProjectID uuid.UUID   `json:"project_id"`
+	Name      string      `json:"name"`
+	Token     string      `json:"token"`
+	Mode      string      `json:"mode"`
+	JobID     pgtype.UUID `json:"job_id"`
+	Secret    []byte      `json:"secret"`
+	Enabled   bool        `json:"enabled"`
+}
+
+func (q *Queries) CreateInboundHook(ctx context.Context, arg CreateInboundHookParams) (CoreInboundHook, error) {
+	row := q.db.QueryRow(ctx, createInboundHook,
+		arg.ProjectID,
+		arg.Name,
+		arg.Token,
+		arg.Mode,
+		arg.JobID,
+		arg.Secret,
+		arg.Enabled,
+	)
+	var i CoreInboundHook
+	err := row.Scan(
+		&i.ID,
+		&i.ProjectID,
+		&i.Name,
+		&i.Token,
+		&i.Mode,
+		&i.JobID,
+		&i.Secret,
+		&i.Enabled,
+		&i.LastReceivedAt,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const deleteInboundHook = `-- name: DeleteInboundHook :exec
+DELETE FROM core.inbound_hooks
+WHERE id = $1 AND project_id = $2
+`
+
+type DeleteInboundHookParams struct {
+	ID        uuid.UUID `json:"id"`
+	ProjectID uuid.UUID `json:"project_id"`
+}
+
+func (q *Queries) DeleteInboundHook(ctx context.Context, arg DeleteInboundHookParams) error {
+	_, err := q.db.Exec(ctx, deleteInboundHook, arg.ID, arg.ProjectID)
+	return err
+}
+
+const getInboundHook = `-- name: GetInboundHook :one
+SELECT id, project_id, name, token, mode, job_id, secret, enabled, last_received_at, created_at, updated_at FROM core.inbound_hooks
+WHERE id = $1 AND project_id = $2
+`
+
+type GetInboundHookParams struct {
+	ID        uuid.UUID `json:"id"`
+	ProjectID uuid.UUID `json:"project_id"`
+}
+
+func (q *Queries) GetInboundHook(ctx context.Context, arg GetInboundHookParams) (CoreInboundHook, error) {
+	row := q.db.QueryRow(ctx, getInboundHook, arg.ID, arg.ProjectID)
+	var i CoreInboundHook
+	err := row.Scan(
+		&i.ID,
+		&i.ProjectID,
+		&i.Name,
+		&i.Token,
+		&i.Mode,
+		&i.JobID,
+		&i.Secret,
+		&i.Enabled,
+		&i.LastReceivedAt,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const getInboundHookByToken = `-- name: GetInboundHookByToken :one
+SELECT id, project_id, name, token, mode, job_id, secret, enabled, last_received_at, created_at, updated_at FROM core.inbound_hooks
+WHERE token = $1
+`
+
+func (q *Queries) GetInboundHookByToken(ctx context.Context, token string) (CoreInboundHook, error) {
+	row := q.db.QueryRow(ctx, getInboundHookByToken, token)
+	var i CoreInboundHook
+	err := row.Scan(
+		&i.ID,
+		&i.ProjectID,
+		&i.Name,
+		&i.Token,
+		&i.Mode,
+		&i.JobID,
+		&i.Secret,
+		&i.Enabled,
+		&i.LastReceivedAt,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const listInboundHooks = `-- name: ListInboundHooks :many
+SELECT id, project_id, name, token, mode, job_id, secret, enabled, last_received_at, created_at, updated_at FROM core.inbound_hooks
+WHERE project_id = $1
+ORDER BY name
+`
+
+func (q *Queries) ListInboundHooks(ctx context.Context, projectID uuid.UUID) ([]CoreInboundHook, error) {
+	rows, err := q.db.Query(ctx, listInboundHooks, projectID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []CoreInboundHook
+	for rows.Next() {
+		var i CoreInboundHook
+		if err := rows.Scan(
+			&i.ID,
+			&i.ProjectID,
+			&i.Name,
+			&i.Token,
+			&i.Mode,
+			&i.JobID,
+			&i.Secret,
+			&i.Enabled,
+			&i.LastReceivedAt,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const touchInboundHook = `-- name: TouchInboundHook :exec
+UPDATE core.inbound_hooks
+SET last_received_at = NOW()
+WHERE id = $1
+`
+
+func (q *Queries) TouchInboundHook(ctx context.Context, id uuid.UUID) error {
+	_, err := q.db.Exec(ctx, touchInboundHook, id)
+	return err
+}

apps/backend/internal/database/db/models.go

@@ -255,6 +255,20 @@ type CoreEvent struct {
 	Ts          pgtype.Timestamptz `json:"ts"`
 }
 
+type CoreInboundHook struct {
+	ID             uuid.UUID          `json:"id"`
+	ProjectID      uuid.UUID          `json:"project_id"`
+	Name           string             `json:"name"`
+	Token          string             `json:"token"`
+	Mode           string             `json:"mode"`
+	JobID          pgtype.UUID        `json:"job_id"`
+	Secret         []byte             `json:"secret"`
+	Enabled        bool               `json:"enabled"`
+	LastReceivedAt pgtype.Timestamptz `json:"last_received_at"`
+	CreatedAt      pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt      pgtype.Timestamptz `json:"updated_at"`
+}
+
 type CoreIntegration struct {
 	ID              uuid.UUID          `json:"id"`
 	ProjectID       uuid.UUID          `json:"project_id"`

apps/backend/internal/database/db/querier.go

@@ -30,6 +30,7 @@ type Querier interface {
 	CreateCollection(ctx context.Context, arg CreateCollectionParams) (CoreCollection, error)
 	CreateDBConnection(ctx context.Context, arg CreateDBConnectionParams) (CoreDbConnection, error)
 	CreateDocument(ctx context.Context, arg CreateDocumentParams) (CoreDocument, error)
+	CreateInboundHook(ctx context.Context, arg CreateInboundHookParams) (CoreInboundHook, error)
 	CreateIntegration(ctx context.Context, arg CreateIntegrationParams) (CoreIntegration, error)
 	CreateInvitation(ctx context.Context, arg CreateInvitationParams) (CoreProjectInvitation, error)
 	CreateOrganization(ctx context.Context, arg CreateOrganizationParams) (CoreOrganization, error)
@@ -43,6 +44,7 @@ type Querier interface {
 	DeleteComponent(ctx context.Context, arg DeleteComponentParams) error
 	DeleteDBConnection(ctx context.Context, arg DeleteDBConnectionParams) (CoreDbConnection, error)
 	DeleteDocument(ctx context.Context, arg DeleteDocumentParams) error
+	DeleteInboundHook(ctx context.Context, arg DeleteInboundHookParams) error
 	DeleteIntegration(ctx context.Context, arg DeleteIntegrationParams) (CoreIntegration, error)
 	DeleteOrganizationByID(ctx context.Context, id uuid.UUID) (CoreOrganization, error)
 	DeletePendingInvitationByIDForOrganization(ctx context.Context, arg DeletePendingInvitationByIDForOrganizationParams) (CoreProjectInvitation, error)
@@ -65,6 +67,8 @@ type Querier interface {
 	GetDBConnectionByID(ctx context.Context, id uuid.UUID) (CoreDbConnection, error)
 	GetDBConnectionByName(ctx context.Context, arg GetDBConnectionByNameParams) (CoreDbConnection, error)
 	GetDocumentByID(ctx context.Context, arg GetDocumentByIDParams) (CoreDocument, error)
+	GetInboundHook(ctx context.Context, arg GetInboundHookParams) (CoreInboundHook, error)
+	GetInboundHookByToken(ctx context.Context, token string) (CoreInboundHook, error)
 	GetIntegrationByID(ctx context.Context, id uuid.UUID) (CoreIntegration, error)
 	GetInvitationByIDForOrganization(ctx context.Context, arg GetInvitationByIDForOrganizationParams) (CoreProjectInvitation, error)
 	GetInvitationByTokenHash(ctx context.Context, tokenHash string) (CoreProjectInvitation, error)
@@ -99,6 +103,7 @@ type Querier interface {
 	ListEnabledAlertRules(ctx context.Context) ([]CoreAlertRule, error)
 	ListErrorGroups(ctx context.Context, arg ListErrorGroupsParams) ([]ListErrorGroupsRow, error)
 	ListEvents(ctx context.Context, arg ListEventsParams) ([]ListEventsRow, error)
+	ListInboundHooks(ctx context.Context, projectID uuid.UUID) ([]CoreInboundHook, error)
 	ListIntegrations(ctx context.Context, projectID uuid.UUID) ([]CoreIntegration, error)
 	ListInvitationsForOrganization(ctx context.Context, organizationID uuid.UUID) ([]ListInvitationsForOrganizationRow, error)
 	ListOrganizationMembers(ctx context.Context, organizationID uuid.UUID) ([]ListOrganizationMembersRow, error)
@@ -138,6 +143,7 @@ type Querier interface {
 	SweepExpiredOrgAuditLogs(ctx context.Context) (int64, error)
 	SweepExpiredWebhookDeliveries(ctx context.Context) (int64, error)
 	TouchAPIKey(ctx context.Context, id uuid.UUID) error
+	TouchInboundHook(ctx context.Context, id uuid.UUID) error
 	UpdateAlertRule(ctx context.Context, arg UpdateAlertRuleParams) (CoreAlertRule, error)
 	UpdateBucketByID(ctx context.Context, arg UpdateBucketByIDParams) (CoreBucket, error)
 	UpdateCollection(ctx context.Context, arg UpdateCollectionParams) (CoreCollection, error)