Webhooks module

src/Modules/Webhooks/
├── Modules.Webhooks/                            ~1,100 LoC
│   ├── WebhooksModule.cs                        IModule — order 400
│   ├── Domain/
│   │   ├── WebhookSubscription.cs               Tenant-scoped, IsActive flag
│   │   └── WebhookDelivery.cs                   Per-attempt row, immutable
│   ├── Data/WebhookDbContext.cs                 Schema: webhooks
│   ├── Services/
│   │   ├── WebhookFanoutHandler<TEvent>.cs      Open-generic event bridge
│   │   ├── WebhookDispatchJob.cs                Hangfire job, HMAC + retry
│   │   ├── WebhookDispatcher.cs                 EnqueueAsync into Hangfire
│   │   ├── WebhookDeliveryService.cs            One-shot delivery (test endpoint)
│   │   ├── WebhookSecretProtector.cs            DataProtection encrypt/decrypt
│   │   └── WebhookPayloadSigner.cs              HMAC-SHA256 hex
│   └── Features/v1/                             5 endpoints
└── Modules.Webhooks.Contracts/                  Commands, queries, DTOs

// src/Modules/Webhooks/Modules.Webhooks/Services/WebhookFanoutHandler.cs (simplified)

public sealed class WebhookFanoutHandler<TEvent> : IIntegrationEventHandler<TEvent>
    where TEvent : IIntegrationEvent
{
    // ctor injects WebhookDbContext, IWebhookDispatcher, IEventSerializer,
    // IMultiTenantContextAccessor<AppTenantInfo>, ILogger

    public async Task HandleAsync(TEvent @event, CancellationToken ct = default)
    {
        if (string.IsNullOrWhiteSpace(@event.TenantId)) return;   // skip platform-wide events

        // Install the tenant context for the subscription read, restore the previous one after.
        var prev = _tenantContextAccessor.MultiTenantContext;
        try
        {
            var info = new AppTenantInfo(@event.TenantId, @event.TenantId);
            ((IMultiTenantContextSetter)_tenantContextAccessor).MultiTenantContext =
                new MultiTenantContext<AppTenantInfo>(info);

            var eventType = typeof(TEvent).Name;
            var subscriptions = await _db.Subscriptions
                .AsNoTracking()
                .Where(s => s.IsActive)
                .ToListAsync(ct).ConfigureAwait(false);

            var matching = subscriptions.Where(s => s.MatchesEvent(eventType)).ToList();
            if (matching.Count == 0) return;

            var payload = _serializer.Serialize(@event);
            foreach (var subscription in matching)
                await _dispatcher
                    .EnqueueAsync(@event.TenantId, subscription.Id, eventType, payload, ct)
                    .ConfigureAwait(false);   // one bad enqueue is caught + logged, fan-out continues
        }
        finally
        {
            ((IMultiTenantContextSetter)_tenantContextAccessor).MultiTenantContext = prev;
        }
    }
}

services.AddScoped(typeof(IIntegrationEventHandler<>), typeof(WebhookFanoutHandler<>));

// src/Modules/Webhooks/Modules.Webhooks/Services/WebhookDispatchJob.cs (simplified)

public sealed class WebhookDispatchJob
{
    // ctor injects IServiceScopeFactory, IHttpClientFactory, IWebhookSecretProtector, ILogger

    // 4 retries after the initial attempt → up to 5 total. Backoff: 30s, 2m, 10m, 1h.
    [AutomaticRetry(Attempts = 4, DelaysInSeconds = new[] { 30, 120, 600, 3600 },
                    OnAttemptsExceeded = AttemptsExceededAction.Fail)]
    public async Task DispatchAsync(
        Guid subscriptionId, string tenantId, string eventType, string payloadJson,
        PerformContext? context, CancellationToken ct)
    {
        // Fresh scope: set the tenant context FIRST, then resolve WebhookDbContext so its
        // Finbuckle filter sees a real TenantInfo (same pattern as SqlAuditSink).
        using var scope = _scopeFactory.CreateScope();
        /* resolve tenant from store, set IMultiTenantContextSetter, load subscription */

        var attemptNumber = (context?.GetJobParameter<int?>("RetryCount") ?? 0) + 1;
        var delivery = WebhookDelivery.Create(subscriptionId, eventType, payloadJson, attemptNumber);

        using var content = new StringContent(payloadJson, Encoding.UTF8,
            new MediaTypeHeaderValue("application/json"));
        var signingSecret = _secretProtector.Unprotect(subscription.SecretHash);  // decrypt at sign time
        if (!string.IsNullOrEmpty(signingSecret))
            content.Headers.Add("X-Webhook-Signature", WebhookPayloadSigner.Sign(payloadJson, signingSecret));
        content.Headers.Add("X-Webhook-Event", eventType);
        content.Headers.Add("X-Webhook-Delivery-Id", delivery.Id.ToString());

        var response = await _httpClientFactory.CreateClient("Webhooks")
            .PostAsync(new Uri(subscription.Url), content, ct).ConfigureAwait(false);
        delivery.RecordResult((int)response.StatusCode, response.IsSuccessStatusCode, null);
        /* save delivery row */

        if (response.IsSuccessStatusCode) return;
        if (IsTransient((int)response.StatusCode))
            throw new WebhookDeliveryFailedException(/* … */);   // throw → Hangfire retries
        // Permanent client error (4xx other than 408/429) — log it, give up, no exception.
    }

    private static bool IsTransient(int statusCode) =>
        statusCode >= 500 || statusCode == 408 || statusCode == 429;
}

public static bool VerifyWebhook(string body, string signatureHeader, string secret)
{
    if (string.IsNullOrEmpty(signatureHeader) || !signatureHeader.StartsWith("sha256=", StringComparison.Ordinal))
        return false;
    var expected = signatureHeader["sha256=".Length..];
    using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
    var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(body));
    var actual = Convert.ToHexStringLower(hash);
    return CryptographicOperations.FixedTimeEquals(
        Encoding.ASCII.GetBytes(expected),
        Encoding.ASCII.GetBytes(actual));
}