feat: user-scoped webhook endpoint for multi-tenant isolation

Adds POST /api/webhooks/u/{user_id}/{path} — a user-scoped webhook
endpoint that filters the routine lookup by user_id, preventing
cross-user webhook triggering when paths collide.

The existing /api/webhooks/{path} endpoint remains unchanged for
backward compatibility in single-user deployments.

Changes:
- get_webhook_routine_by_path gains user_id: Option<&str> param
- Both postgres and libsql implementations add AND user_id = ? filter
  when user_id is provided
- New webhook_trigger_user_scoped_handler extracts (user_id, path)
  from URL and passes to shared fire_webhook_inner logic
- Route registered on public router (webhooks are called by external
  services that can't send bearer tokens)

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

src/channels/web/handlers/webhooks.rs

@@ -54,10 +54,37 @@ fn validate_webhook_secret(
 ///
 /// This endpoint is **public** (no gateway auth token required) but protected
 /// by the per-routine webhook secret sent via the `X-Webhook-Secret` header.
+///
+/// **Single-user/backward-compatible**: looks up routines by path across all
+/// users. For multi-tenant isolation, use the user-scoped endpoint at
+/// `/api/webhooks/u/{user_id}/{path}` instead.
 pub async fn webhook_trigger_handler(
     State(state): State<Arc<GatewayState>>,
     Path(path): Path<String>,
     headers: HeaderMap,
+) -> Result<Json<serde_json::Value>, (StatusCode, String)> {
+    fire_webhook_inner(state, &path, None, &headers).await
+}
+
+/// Handle incoming webhook POST to `/api/webhooks/u/{user_id}/{path}`.
+///
+/// User-scoped variant for multi-tenant deployments. The `user_id` in the URL
+/// restricts the routine lookup to that user only, preventing cross-user
+/// webhook triggering even when paths collide.
+pub async fn webhook_trigger_user_scoped_handler(
+    State(state): State<Arc<GatewayState>>,
+    Path((user_id, path)): Path<(String, String)>,
+    headers: HeaderMap,
+) -> Result<Json<serde_json::Value>, (StatusCode, String)> {
+    fire_webhook_inner(state, &path, Some(&user_id), &headers).await
+}
+
+/// Shared webhook logic for both scoped and unscoped endpoints.
+async fn fire_webhook_inner(
+    state: Arc<GatewayState>,
+    path: &str,
+    user_id: Option<&str>,
+    headers: &HeaderMap,
 ) -> Result<Json<serde_json::Value>, (StatusCode, String)> {
     // Rate limit check
     if !state.webhook_rate_limiter.check() {
@@ -72,9 +99,9 @@ pub async fn webhook_trigger_handler(
         "Database not available".to_string(),
     ))?;
 
-    // Targeted query instead of loading all routines
+    // Targeted query — when user_id is provided, restrict to that user's routines
     let routine = store
-        .get_webhook_routine_by_path(&path)
+        .get_webhook_routine_by_path(path, user_id)
         .await
         .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?
         .ok_or((
@@ -99,7 +126,7 @@ pub async fn webhook_trigger_handler(
         ))?
     };
 
-    let run_id = engine.fire_webhook(routine.id, &path).await.map_err(|e| {
+    let run_id = engine.fire_webhook(routine.id, path).await.map_err(|e| {
         let status = match &e {
             crate::error::RoutineError::NotFound { .. } => StatusCode::NOT_FOUND,
             crate::error::RoutineError::Disabled { .. }

src/channels/web/server.rs

@@ -412,6 +412,11 @@ pub async fn start_server(
         .route(
             "/api/webhooks/{path}",
             post(crate::channels::web::handlers::webhooks::webhook_trigger_handler),
+        )
+        // User-scoped webhook endpoint for multi-tenant isolation
+        .route(
+            "/api/webhooks/u/{user_id}/{path}",
+            post(crate::channels::web::handlers::webhooks::webhook_trigger_user_scoped_handler),
         );
 
     // Protected routes (require auth)

src/db/libsql/routines.rs

@@ -530,10 +530,24 @@ impl RoutineStore for LibSqlBackend {
     async fn get_webhook_routine_by_path(
         &self,
         path: &str,
+        user_id: Option<&str>,
     ) -> Result<Option<Routine>, DatabaseError> {
         let conn = self.connect().await?;
-        let mut rows = conn
-            .query(
+        let mut rows = if let Some(uid) = user_id {
+            conn.query(
+                &format!(
+                    "SELECT {} FROM routines WHERE enabled = 1 AND trigger_type = 'webhook' \
+                     AND user_id = ?2 \
+                     AND (json_extract(trigger_config, '$.path') = ?1 \
+                     OR (json_extract(trigger_config, '$.path') IS NULL AND CAST(id AS TEXT) = ?1))",
+                    ROUTINE_COLUMNS
+                ),
+                params![path, uid],
+            )
+            .await
+            .map_err(|e| DatabaseError::Query(e.to_string()))?
+        } else {
+            conn.query(
                 &format!(
                     "SELECT {} FROM routines WHERE enabled = 1 AND trigger_type = 'webhook' \
                      AND (json_extract(trigger_config, '$.path') = ?1 \
@@ -543,7 +557,8 @@ impl RoutineStore for LibSqlBackend {
                 params![path],
             )
             .await
-            .map_err(|e| DatabaseError::Query(e.to_string()))?;
+            .map_err(|e| DatabaseError::Query(e.to_string()))?
+        };
 
         match rows
             .next()

src/db/mod.rs

@@ -545,6 +545,7 @@ pub trait RoutineStore: Send + Sync {
     async fn get_webhook_routine_by_path(
         &self,
         path: &str,
+        user_id: Option<&str>,
     ) -> Result<Option<Routine>, DatabaseError>;
 
     /// List routine runs that were dispatched as full_job but have not yet

src/db/postgres.rs

@@ -529,8 +529,9 @@ impl RoutineStore for PgBackend {
     async fn get_webhook_routine_by_path(
         &self,
         path: &str,
+        user_id: Option<&str>,
     ) -> Result<Option<Routine>, DatabaseError> {
-        self.store.get_webhook_routine_by_path(path).await
+        self.store.get_webhook_routine_by_path(path, user_id).await
     }
 
     async fn list_dispatched_routine_runs(&self) -> Result<Vec<RoutineRun>, DatabaseError> {

src/history/store.rs

@@ -1162,15 +1162,25 @@ impl Store {
     pub async fn get_webhook_routine_by_path(
         &self,
         path: &str,
+        user_id: Option<&str>,
     ) -> Result<Option<Routine>, DatabaseError> {
         let conn = self.conn().await?;
-        let row = conn
-            .query_opt(
+        let row = if let Some(uid) = user_id {
+            conn.query_opt(
+                "SELECT * FROM routines WHERE enabled AND trigger_type = 'webhook' \
+                 AND user_id = $2 \
+                 AND (trigger_config->>'path' = $1 OR (trigger_config->>'path' IS NULL AND id::text = $1))",
+                &[&path, &uid],
+            )
+            .await?
+        } else {
+            conn.query_opt(
                 "SELECT * FROM routines WHERE enabled AND trigger_type = 'webhook' \
                  AND (trigger_config->>'path' = $1 OR (trigger_config->>'path' IS NULL AND id::text = $1))",
                 &[&path],
             )
-            .await?;
+            .await?
+        };
         row.as_ref().map(row_to_routine).transpose()
     }