feat(todoist): app-level webhooks for realtime sync

[KrisBraun]

Problem

Todoist webhooks are configured once at the app level (a single callback URL in the App Console) — every authorized user's events arrive at that one URL. The connector's old setupWebhook called network.createWebhook(), which mints a per-connection/hook/<token> URL, stored it, and never registered it with Todoist. So nothing ever called it, the signing secret (webhook_secret_<id>) was never stored (making the in-connector HMAC check dead code), and — since the connector has no polling fallback — a Todoist connection imported once on enable and then went stale forever.

Change

App-level webhook delivery, matching the Unipile (/hook/messaging) pattern:

• onChannelEnabled registers the webhook callback via callbacks.createFromParent(this.onWebhook, channel.id) and stores it under webhook_callback_<projectId>.
• The API worker's new /hook/todoist route (separate core PR) verifies Todoist's X-Todoist-Hmac-SHA256 signature with the server-only app client secret, then dispatches by event_data.project_id → channel → this stored callback.
• onWebhook now receives the route-parsed { eventName, eventData }; the dead in-connector signature verification and the now-unused verifyWebhookSignature helper are removed. The Network tool stays (it's the api.todoist.com fetch allowlist).
• onChannelDisabled clears webhook_callback_<id>.

No behavior change to the seven handled events (item:added/updated/completed/uncompleted/deleted, note:added/updated).

Testing

• pnpm build ✓, plot lint ✓, vitest 5/5 ✓ (on latest origin/main).
• No changeset (connector change, not twister/).

Pairs with the core PR that adds the /hook/todoist route. Merge order doesn't matter for compilation (no cross-import), but realtime sync only works once both ship and the Todoist App Console webhook URL is set to https://api.plot.day/hook/todoist.

🤖 Generated with Claude Code

[KrisBraun]

Problem

Todoist webhooks are configured once at the app level (a single callback URL in the App Console) — every authorized user's events arrive at that one URL. The connector's old setupWebhook called network.createWebhook(), which mints a per-connection/hook/<token> URL, stored it, and never registered it with Todoist. So nothing ever called it, the signing secret (webhook_secret_<id>) was never stored (making the in-connector HMAC check dead code), and — since the connector has no polling fallback — a Todoist connection imported once on enable and then went stale forever.

Change

App-level webhook delivery, matching the Unipile (/hook/messaging) pattern:

• onChannelEnabled registers the webhook callback via callbacks.createFromParent(this.onWebhook, channel.id) and stores it under webhook_callback_<projectId>.
• The API worker's new /hook/todoist route (separate core PR) verifies Todoist's X-Todoist-Hmac-SHA256 signature with the server-only app client secret, then dispatches by event_data.project_id → channel → this stored callback.
• onWebhook now receives the route-parsed { eventName, eventData }; the dead in-connector signature verification and the now-unused verifyWebhookSignature helper are removed. The Network tool stays (it's the api.todoist.com fetch allowlist).
• onChannelDisabled clears webhook_callback_<id>.

No behavior change to the seven handled events (item:added/updated/completed/uncompleted/deleted, note:added/updated).

Testing

• pnpm build ✓, plot lint ✓, vitest 5/5 ✓ (on latest origin/main).
• No changeset (connector change, not twister/).

Pairs with the core PR that adds the /hook/todoist route. Merge order doesn't matter for compilation (no cross-import), but realtime sync only works once both ship and the Todoist App Console webhook URL is set to https://api.plot.day/hook/todoist.

🤖 Generated with Claude Code

[KrisBraun]

Problem

Todoist webhooks are configured once at the app level (a single callback URL in the App Console) — every authorized user's events arrive at that one URL. The connector's old setupWebhook called network.createWebhook(), which mints a per-connection/hook/<token> URL, stored it, and never registered it with Todoist. So nothing ever called it, the signing secret (webhook_secret_<id>) was never stored (making the in-connector HMAC check dead code), and — since the connector has no polling fallback — a Todoist connection imported once on enable and then went stale forever.

Change

App-level webhook delivery, matching the Unipile (/hook/messaging) pattern:

• onChannelEnabled registers the webhook callback via callbacks.createFromParent(this.onWebhook, channel.id) and stores it under webhook_callback_<projectId>.
• The API worker's new /hook/todoist route (separate core PR) verifies Todoist's X-Todoist-Hmac-SHA256 signature with the server-only app client secret, then dispatches by event_data.project_id → channel → this stored callback.
• onWebhook now receives the route-parsed { eventName, eventData }; the dead in-connector signature verification and the now-unused verifyWebhookSignature helper are removed. The Network tool stays (it's the api.todoist.com fetch allowlist).
• onChannelDisabled clears webhook_callback_<id>.

No behavior change to the seven handled events (item:added/updated/completed/uncompleted/deleted, note:added/updated).

Testing

• pnpm build ✓, plot lint ✓, vitest 5/5 ✓ (on latest origin/main).
• No changeset (connector change, not twister/).

Pairs with the core PR that adds the /hook/todoist route. Merge order doesn't matter for compilation (no cross-import), but realtime sync only works once both ship and the Todoist App Console webhook URL is set to https://api.plot.day/hook/todoist.

🤖 Generated with Claude Code

[KrisBraun]

Problem

Todoist webhooks are configured once at the app level (a single callback URL in the App Console) — every authorized user's events arrive at that one URL. The connector's old setupWebhook called network.createWebhook(), which mints a per-connection/hook/<token> URL, stored it, and never registered it with Todoist. So nothing ever called it, the signing secret (webhook_secret_<id>) was never stored (making the in-connector HMAC check dead code), and — since the connector has no polling fallback — a Todoist connection imported once on enable and then went stale forever.

Change

App-level webhook delivery, matching the Unipile (/hook/messaging) pattern:

• onChannelEnabled registers the webhook callback via callbacks.createFromParent(this.onWebhook, channel.id) and stores it under webhook_callback_<projectId>.
• The API worker's new /hook/todoist route (separate core PR) verifies Todoist's X-Todoist-Hmac-SHA256 signature with the server-only app client secret, then dispatches by event_data.project_id → channel → this stored callback.
• onWebhook now receives the route-parsed { eventName, eventData }; the dead in-connector signature verification and the now-unused verifyWebhookSignature helper are removed. The Network tool stays (it's the api.todoist.com fetch allowlist).
• onChannelDisabled clears webhook_callback_<id>.

No behavior change to the seven handled events (item:added/updated/completed/uncompleted/deleted, note:added/updated).

Testing

• pnpm build ✓, plot lint ✓, vitest 5/5 ✓ (on latest origin/main).
• No changeset (connector change, not twister/).

Pairs with the core PR that adds the /hook/todoist route. Merge order doesn't matter for compilation (no cross-import), but realtime sync only works once both ship and the Todoist App Console webhook URL is set to https://api.plot.day/hook/todoist.

🤖 Generated with Claude Code

[KrisBraun]

Problem

Todoist webhooks are configured once at the app level (a single callback URL in the App Console) — every authorized user's events arrive at that one URL. The connector's old setupWebhook called network.createWebhook(), which mints a per-connection/hook/<token> URL, stored it, and never registered it with Todoist. So nothing ever called it, the signing secret (webhook_secret_<id>) was never stored (making the in-connector HMAC check dead code), and — since the connector has no polling fallback — a Todoist connection imported once on enable and then went stale forever.

Change

App-level webhook delivery, matching the Unipile (/hook/messaging) pattern:

• onChannelEnabled registers the webhook callback via callbacks.createFromParent(this.onWebhook, channel.id) and stores it under webhook_callback_<projectId>.
• The API worker's new /hook/todoist route (separate core PR) verifies Todoist's X-Todoist-Hmac-SHA256 signature with the server-only app client secret, then dispatches by event_data.project_id → channel → this stored callback.
• onWebhook now receives the route-parsed { eventName, eventData }; the dead in-connector signature verification and the now-unused verifyWebhookSignature helper are removed. The Network tool stays (it's the api.todoist.com fetch allowlist).
• onChannelDisabled clears webhook_callback_<id>.

No behavior change to the seven handled events (item:added/updated/completed/uncompleted/deleted, note:added/updated).

Testing

• pnpm build ✓, plot lint ✓, vitest 5/5 ✓ (on latest origin/main).
• No changeset (connector change, not twister/).

Pairs with the core PR that adds the /hook/todoist route. Merge order doesn't matter for compilation (no cross-import), but realtime sync only works once both ship and the Todoist App Console webhook URL is set to https://api.plot.day/hook/todoist.

🤖 Generated with Claude Code

[KrisBraun]

Problem

Todoist webhooks are configured once at the app level (a single callback URL in the App Console) — every authorized user's events arrive at that one URL. The connector's old setupWebhook called network.createWebhook(), which mints a per-connection/hook/<token> URL, stored it, and never registered it with Todoist. So nothing ever called it, the signing secret (webhook_secret_<id>) was never stored (making the in-connector HMAC check dead code), and — since the connector has no polling fallback — a Todoist connection imported once on enable and then went stale forever.

Change

App-level webhook delivery, matching the Unipile (/hook/messaging) pattern:

• onChannelEnabled registers the webhook callback via callbacks.createFromParent(this.onWebhook, channel.id) and stores it under webhook_callback_<projectId>.
• The API worker's new /hook/todoist route (separate core PR) verifies Todoist's X-Todoist-Hmac-SHA256 signature with the server-only app client secret, then dispatches by event_data.project_id → channel → this stored callback.
• onWebhook now receives the route-parsed { eventName, eventData }; the dead in-connector signature verification and the now-unused verifyWebhookSignature helper are removed. The Network tool stays (it's the api.todoist.com fetch allowlist).
• onChannelDisabled clears webhook_callback_<id>.

No behavior change to the seven handled events (item:added/updated/completed/uncompleted/deleted, note:added/updated).

Testing

• pnpm build ✓, plot lint ✓, vitest 5/5 ✓ (on latest origin/main).
• No changeset (connector change, not twister/).

Pairs with the core PR that adds the /hook/todoist route. Merge order doesn't matter for compilation (no cross-import), but realtime sync only works once both ship and the Todoist App Console webhook URL is set to https://api.plot.day/hook/todoist.

🤖 Generated with Claude Code

[KrisBraun]

Problem

Todoist webhooks are configured once at the app level (a single callback URL in the App Console) — every authorized user's events arrive at that one URL. The connector's old setupWebhook called network.createWebhook(), which mints a per-connection/hook/<token> URL, stored it, and never registered it with Todoist. So nothing ever called it, the signing secret (webhook_secret_<id>) was never stored (making the in-connector HMAC check dead code), and — since the connector has no polling fallback — a Todoist connection imported once on enable and then went stale forever.

Change

App-level webhook delivery, matching the Unipile (/hook/messaging) pattern:

• onChannelEnabled registers the webhook callback via callbacks.createFromParent(this.onWebhook, channel.id) and stores it under webhook_callback_<projectId>.
• The API worker's new /hook/todoist route (separate core PR) verifies Todoist's X-Todoist-Hmac-SHA256 signature with the server-only app client secret, then dispatches by event_data.project_id → channel → this stored callback.
• onWebhook now receives the route-parsed { eventName, eventData }; the dead in-connector signature verification and the now-unused verifyWebhookSignature helper are removed. The Network tool stays (it's the api.todoist.com fetch allowlist).
• onChannelDisabled clears webhook_callback_<id>.

No behavior change to the seven handled events (item:added/updated/completed/uncompleted/deleted, note:added/updated).

Testing

• pnpm build ✓, plot lint ✓, vitest 5/5 ✓ (on latest origin/main).
• No changeset (connector change, not twister/).

Pairs with the core PR that adds the /hook/todoist route. Merge order doesn't matter for compilation (no cross-import), but realtime sync only works once both ship and the Todoist App Console webhook URL is set to https://api.plot.day/hook/todoist.

🤖 Generated with Claude Code

[KrisBraun]

Problem

Todoist webhooks are configured once at the app level (a single callback URL in the App Console) — every authorized user's events arrive at that one URL. The connector's old setupWebhook called network.createWebhook(), which mints a per-connection/hook/<token> URL, stored it, and never registered it with Todoist. So nothing ever called it, the signing secret (webhook_secret_<id>) was never stored (making the in-connector HMAC check dead code), and — since the connector has no polling fallback — a Todoist connection imported once on enable and then went stale forever.

Change

App-level webhook delivery, matching the Unipile (/hook/messaging) pattern:

• onChannelEnabled registers the webhook callback via callbacks.createFromParent(this.onWebhook, channel.id) and stores it under webhook_callback_<projectId>.
• The API worker's new /hook/todoist route (separate core PR) verifies Todoist's X-Todoist-Hmac-SHA256 signature with the server-only app client secret, then dispatches by event_data.project_id → channel → this stored callback.
• onWebhook now receives the route-parsed { eventName, eventData }; the dead in-connector signature verification and the now-unused verifyWebhookSignature helper are removed. The Network tool stays (it's the api.todoist.com fetch allowlist).
• onChannelDisabled clears webhook_callback_<id>.

No behavior change to the seven handled events (item:added/updated/completed/uncompleted/deleted, note:added/updated).

Testing

• pnpm build ✓, plot lint ✓, vitest 5/5 ✓ (on latest origin/main).
• No changeset (connector change, not twister/).

Pairs with the core PR that adds the /hook/todoist route. Merge order doesn't matter for compilation (no cross-import), but realtime sync only works once both ship and the Todoist App Console webhook URL is set to https://api.plot.day/hook/todoist.

🤖 Generated with Claude Code