fix(webhooks): test url must be based on next public app url

[icecrasher321]

Summary

Was incorrectly falling back to origin rather than next public app url.

Type of Change

• Bug fix

Testing

Manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
sim	Ready	Preview	Comment	Oct 10, 2025 7:00pm

1 Skipped Deployment

Project	Deployment	Preview	Comments	Updated (UTC)
docs	Skipped			Oct 10, 2025 7:00pm

[greptile-apps]

Greptile Overview

Summary

Fixed webhook test URL generation to always use the configured public app URL instead of falling back to the request origin in production environments.

Key Changes:

• Removed conditional logic that used request.url.origin for non-localhost environments
• Now requires NEXT_PUBLIC_APP_URL to be configured and returns 500 error if missing
• Ensures webhook test URLs are always publicly accessible, regardless of internal routing or proxy configurations

Impact:
This fix prevents issues where webhook test URLs might contain internal or load balancer URLs instead of the proper public-facing URL, which would cause the URLs to be inaccessible when shared externally.

Confidence Score: 5/5

• This PR is safe to merge with no identified risks
• The change is a straightforward bug fix that improves correctness by ensuring webhook test URLs always use the public app URL. The added validation (checking for NEXT_PUBLIC_APP_URL existence) is a good defensive measure. No logical errors, security issues, or breaking changes detected.
• No files require special attention

Important Files Changed

File Analysis

Filename	Score	Overview
apps/sim/app/api/webhooks/[id]/test-url/route.ts	5/5	Fixed webhook test URL generation to always use NEXT_PUBLIC_APP_URL instead of request origin, ensuring correct public URL in production environments

Sequence Diagram

sequenceDiagram
    participant User
    participant Frontend
    participant TestUrlAPI as test-url route
    participant TokenService as signTestWebhookToken
    participant TestWebhookAPI as test webhook route
    
    User->>Frontend: Click Generate Test URL
    Frontend->>TestUrlAPI: POST with webhook ID
    
    TestUrlAPI->>TestUrlAPI: Authenticate user
    TestUrlAPI->>TestUrlAPI: Check permissions
    TestUrlAPI->>TestUrlAPI: Validate config
    
    TestUrlAPI->>TokenService: Sign token with TTL
    TokenService-->>TestUrlAPI: JWT token
    
    TestUrlAPI->>TestUrlAPI: Construct public URL
    
    TestUrlAPI-->>Frontend: URL and expiry
    Frontend-->>User: Display test URL
    
    Note over User: Share URL externally
    
    User->>TestWebhookAPI: POST webhook payload
    TestWebhookAPI->>TestWebhookAPI: Verify token
    TestWebhookAPI->>TestWebhookAPI: Execute in test mode

Loading

_{1 file reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}