webhook feature tracker

[ShaunSHamilton]

Following on from: #53560

• webhook event is only emitted on /modern-challenge-completed
  • Should this be added to other endpoints?
  • Should this emit a {"event": "<endpoint/event name>"}
• webhook failures are ignored
  • Should we stop emitting after x failures?
  • Should we notify the Camper about failures?
  • Should we just log failures to Sentry for monitoring?
• user.points is sent regardless of Camper's privacy settings
  • Campers are made aware when they set up the hook, but should this be changed?
• webhooks urls are restricted to a whitelist
  • If we are happy with the feature, should we change this to a blacklist to prevent us DOSing ourselves? (e.g. disallow api.freecodecamp.org)

[naomi-lgbt]

I'm assuming this is a wishlist for full release, not MVP, so...

Going item by item:

• Yes, we should emit other events. I'd say anything that triggers an update to the user object should be an event that emits - but that a user who adds/edits a webhook should be able to pick which events (re: github webhooks)
• There should be a header in webhook events yes, something like X-FreeCodeCamp-Activity: modern-challenge-completed that a server consuming the hook could use to filter types.
• We should stop emitting after a failure threshold, yeah. Not sure how we'd want to do it. I've seen some that stop emitting after the first failure, I've seen some that do a back-off-and-retry strategy and stop emitting after 4 attempts, and I've seen some that just go on and on until they haven't had an OK status in 30 days.
• Yes, we should notify the camper in the webhook settings' UI.
• No, we should not pipe user webhook failures to Sentry.
• We should send whatever is relevant in the payload for that event type. If a camper has subscribed to challenge completion events, we should just send the challenge completed information.
• Webhook URLs realistically should not be limited. Instead, the URL should be validated on submit to be a live URL - I, personally, prefer to see a HEAD request return a 200 OK status.