[GH-ISSUE #590] feat: Add local webhook receiver (asc webhooks serve) #164

New issue

Closed

opened 2026-02-26 21:33:51 +03:00 by kerem · 0 comments

kerem commented

2026-02-26 21:33:51 +03:00

Owner

Originally created by @rudrankriyam on GitHub (Feb 17, 2026).
Original GitHub issue: https://github.com/rudrankriyam/App-Store-Connect-CLI/issues/590

Summary

Add a local webhook receiver so developers can test App Store Connect webhooks and drive automation locally.

Proposed command:

asc webhooks serve [flags]

Why this matters

Today, webhook work is awkward:

you must deploy a server somewhere to test deliveries
debugging payloads is slow
it’s hard to iterate on “when event X happens, run automation Y”

A local receiver makes webhook development fast and scriptable.

Current state (verified)

asc webhooks management exists (list/create/update/delete, deliveries, redeliver, ping).
No asc webhooks serve command exists.

Proposed UX

Serve

# Start a local receiver
asc webhooks serve --port 8787

# Write each delivery to a file (one JSON per event)
asc webhooks serve --port 8787 --dir ./webhook-events

# (Optional) execute a command per received event
asc webhooks serve --port 8787 --exec "./scripts/on-webhook.sh"

Flags (proposal):

--host (default 127.0.0.1)
--port (default 8787)
--dir (optional; write events to files, atomic writes, reject symlinks)
--exec (optional; execute a command with event JSON on stdin)
--output json|text (default text for “server started”, but payload handling should be JSON)

Notes:

No interactive prompts.
Never prints secrets.

Request handling

Accept POST webhook payloads.
Always respond quickly with 2xx after validation/parsing.
Log a one-line summary per event (event type, timestamp, id).

Security / validation

If App Store Connect webhooks support signature/secret validation, add it as opt-in:

--verify + ASC_WEBHOOK_SECRET (or similar)

If not feasible, still provide best-effort validation:

JSON parse
size limits (avoid huge bodies)

Test plan (TDD-first)

unit tests for handler:
- parses JSON, enforces size limits
- file writing is deterministic + safe
- --exec passes payload on stdin
cmdtests:
- --port validation
- server starts and handles a synthetic POST

Acceptance criteria

asc webhooks serve --help exists and is self-documenting.
Events can be written to disk safely and deterministically.
Optional --exec works without leaking secrets.
make test passes.

Originally created by @rudrankriyam on GitHub (Feb 17, 2026). Original GitHub issue: https://github.com/rudrankriyam/App-Store-Connect-CLI/issues/590 ## Summary Add a local webhook receiver so developers can test App Store Connect webhooks and drive automation locally. Proposed command: ```bash asc webhooks serve [flags] ``` ## Why this matters Today, webhook work is awkward: - you must deploy a server somewhere to test deliveries - debugging payloads is slow - it’s hard to iterate on “when event X happens, run automation Y” A local receiver makes webhook development fast and scriptable. ## Current state (verified) - `asc webhooks` management exists (list/create/update/delete, deliveries, redeliver, ping). - No `asc webhooks serve` command exists. ## Proposed UX ### Serve ```bash # Start a local receiver asc webhooks serve --port 8787 # Write each delivery to a file (one JSON per event) asc webhooks serve --port 8787 --dir ./webhook-events # (Optional) execute a command per received event asc webhooks serve --port 8787 --exec "./scripts/on-webhook.sh" ``` Flags (proposal): - `--host` (default `127.0.0.1`) - `--port` (default `8787`) - `--dir` (optional; write events to files, atomic writes, reject symlinks) - `--exec` (optional; execute a command with event JSON on stdin) - `--output json|text` (default text for “server started”, but payload handling should be JSON) Notes: - No interactive prompts. - Never prints secrets. ### Request handling - Accept POST webhook payloads. - Always respond quickly with 2xx after validation/parsing. - Log a one-line summary per event (event type, timestamp, id). ## Security / validation If App Store Connect webhooks support signature/secret validation, add it as *opt-in*: - `--verify` + `ASC_WEBHOOK_SECRET` (or similar) If not feasible, still provide best-effort validation: - JSON parse - size limits (avoid huge bodies) ## Test plan (TDD-first) - [ ] unit tests for handler: - [ ] parses JSON, enforces size limits - [ ] file writing is deterministic + safe - [ ] `--exec` passes payload on stdin - [ ] cmdtests: - [ ] `--port` validation - [ ] server starts and handles a synthetic POST ## Acceptance criteria - [ ] `asc webhooks serve --help` exists and is self-documenting. - [ ] Events can be written to disk safely and deterministically. - [ ] Optional `--exec` works without leaking secrets. - [ ] `make test` passes.