fix(webhooks): keep the pre-lookup steps in their original order

Hoisting the GET verification probe above the challenge handlers inverted the
order this route has always used. A challenge is the more specific answer — a
provider echoing a token it chose beats a generic "reachable" 200 — so when a
path has both pending at once, inverting them answers the wrong one.

Runs the challenge offer for every method before admission instead, which the
delivery path was repeating anyway, so the sequence is restored and each step
still happens once.

Author: waleedlatif1

apps/sim/app/api/webhooks/trigger/[path]/route.ts

@@ -38,25 +38,37 @@ type WebhookTriggerContract =
   | typeof webhookTriggerDeleteContract
 
 /**
- * Shared delivery entry point. Parses the path once, sheds load, and hands off — so a request is
- * parsed, challenged and looked up exactly once no matter which method it arrived on.
+ * Shared delivery entry point, running the steps that need no body — and therefore no load-shed
+ * ticket — before admission, in the order the `GET` route has always run them:
+ *
+ * 1. resolve the path,
+ * 2. offer the request to the provider challenge handlers,
+ * 3. on `GET`, answer a setup-time verification probe for a path that has no webhook row yet,
+ * 4. take a ticket and hand off to the delivery path.
+ *
+ * Steps 2 and 3 keep their relative order because a challenge is the more specific answer: a
+ * provider echoing a token it chose beats a generic "reachable" 200 when a path somehow has both
+ * pending at once.
  */
-function defineDeliveryRoute(
-  contract: WebhookTriggerContract,
-  beforeAdmission?: (
-    request: NextRequest,
-    requestId: string,
-    path: string
-  ) => Promise<NextResponse | null>
-) {
+function defineDeliveryRoute(contract: WebhookTriggerContract, probeBeforeLookup = false) {
   return withRouteHandler(async (request: NextRequest, context: RouteContext) => {
     const requestId = generateRequestId()
     const parsed = await parseRequest(contract, request, context)
     if (!parsed.success) return parsed.response
     const { path } = parsed.data.params
 
-    const earlyResponse = await beforeAdmission?.(request, requestId, path)
-    if (earlyResponse) return earlyResponse
+    const challenge = await handleProviderChallenges({}, request, requestId, path)
+    if (challenge) return challenge
+
+    if (probeBeforeLookup) {
+      const verification = await handlePreLookupWebhookVerification(
+        request.method,
+        undefined,
+        requestId,
+        path
+      )
+      if (verification) return verification
+    }
 
     const ticket = tryAdmit()
     if (!ticket) {
@@ -72,13 +84,11 @@ function defineDeliveryRoute(
 }
 
 /**
- * `GET` alone runs the pre-lookup verification probe before the webhook lookup, because a
- * provider validating a URL it has not been given a webhook for can only be answered there.
- * `handleWebhookDelivery` runs the same check for every method once the lookup comes back empty.
+ * `GET` alone probes before the lookup, because a provider validating a URL it has not been given
+ * a webhook for can only be answered there. `handleWebhookDelivery` runs the same check for every
+ * method once the lookup comes back empty.
  */
-export const GET = defineDeliveryRoute(webhookTriggerGetContract, (request, requestId, path) =>
-  handlePreLookupWebhookVerification(request.method, undefined, requestId, path)
-)
+export const GET = defineDeliveryRoute(webhookTriggerGetContract, true)
 
 export const POST = defineDeliveryRoute(webhookTriggerPostContract)
 
@@ -127,11 +137,6 @@ async function handleWebhookDelivery(
     ? Number(slackRequestTimestamp) * 1000
     : undefined
 
-  const earlyChallenge = await handleProviderChallenges({}, request, requestId, path)
-  if (earlyChallenge) {
-    return earlyChallenge
-  }
-
   const parseResult = await parseWebhookBody(request, requestId)
 
   // Check if parseWebhookBody returned an error response