fix: api key prefix rename, revoke fix, and webhook validation

Rename API key prefix from asn_ to asa_, fix key revoke by aligning
response property names with frontend interface, and add server/client
validation to prevent enabling webhooks without a URL.

1 files changed, 20 insertions, 1 deletions

diff --git a/apps/web/app/api/webhook-config/route.ts b/apps/web/app/api/webhook-config/route.ts
index 049f4f3..bd38d0f 100644
--- a/apps/web/app/api/webhook-config/route.ts
+++ b/apps/web/app/api/webhook-config/route.ts
@@ -91,10 +91,29 @@ export async function PUT(request: Request) {
   }
 
   if (typeof body.webhookEnabled === "boolean") {
-    updates.webhook_enabled = body.webhookEnabled
     if (body.webhookEnabled) {
+      const { data: currentProfile } = await adminClient
+        .from("user_profiles")
+        .select("webhook_url")
+        .eq("id", user.id)
+        .single()
+
+      const effectiveUrl =
+        typeof body.webhookUrl === "string"
+          ? body.webhookUrl.trim()
+          : currentProfile?.webhook_url
+
+      if (!effectiveUrl) {
+        return NextResponse.json(
+          { error: "cannot enable webhooks without a url" },
+          { status: 400 }
+        )
+      }
+
       updates.webhook_consecutive_failures = 0
     }
+
+    updates.webhook_enabled = body.webhookEnabled
   }
 
   if (Object.keys(updates).length === 0) {