[Gospelsam019]

Summary

Compliance attestation expiry/revocation + webhook retry wiring and merchant config

What was solved

#959 — Add expiry and revocation for compliance-provider attestations

Extend the compliance contract so provider attestations carry expiry and revocation semantics: define how expired or withdrawn provider credentials affect existing attestations, emit events for expiration/revocation, and add tests covering both behaviors.

Addressed:

• Changed: abis/compliance.json
• Define contract behavior for how expired provider credentials affect existing compliance attestations (e.g., attestations become invalid/expired).
• Define contract behavior for how revoked/withdrawn provider credentials affect existing attestations.
• Emit events for expiration and revocation semantics.

#960 — Wire the retry queue into live webhook dispatch

Wire the existing retry/dead-letter webhook machinery into the live production webhook dispatch path so events flow through retries, backoff, dead-letter handling, and replay instead of single-attempt dispatch, with integration tests covering each behavior.

Addressed:

• Changed: backend/src/lib.rs, backend/src/main.rs
• Route production webhook events through the implemented retry and dead-letter path instead of single-attempt dispatch
• Integration tests must demonstrate retries
• Integration tests must demonstrate backoff

#961 — Deliver invoice lifecycle webhook events

Add merchant-configurable webhook delivery for invoice lifecycle events (created, paid, cancelled, refunded, expired), with defined payload schemas and integration tests covering each event.

Addressed:

• Changed: backend/src/handlers.rs, backend/src/routes/invoices.rs, backend/src/routes/cancel.rs, backend/src/lib.rs
• Emit webhook events for invoice lifecycle transitions: creation, payment, cancellation, refund, and expiry
• Allow merchants to configure webhook endpoints/subscriptions for these events
• Define and document payload schemas for each lifecycle event

#962 — Add merchant-scoped webhook configuration endpoints

Add merchant-scoped webhook configuration endpoints to the backend so each merchant can set its own callback URL and event subscriptions instead of relying solely on global webhook config. Authenticated APIs must validate, persist, and retrieve these per-merchant settings, following existing backend handler/routing/auth patterns.

Addressed:

• Changed: backend/src/handlers.rs, backend/src/routes/invoices.rs
• Provide authenticated endpoints to create/update and retrieve per-merchant webhook configuration (callback URL and subscribed events).
• Validate incoming merchant webhook settings (e.g., URL format, allowed event names) and reject invalid input.
• Persist merchant-scoped settings and return them on retrieval, distinct from global webhook configuration.

Changes

• abis/compliance.json (modify)
• backend/src/handlers.rs (modify)
• backend/src/main.rs (modify)
• backend/src/routes/cancel.rs (modify)
• backend/src/lib.rs (modify)
• backend/src/routes/invoices.rs (modify)

Approach

1. Add expiry and revocation for compliance-provider attestations #959 — Add expiry and revocation for compliance-provider attestations (Changed: abis/compliance.json)
2. Wire the retry queue into live webhook dispatch #960 — Wire the retry queue into live webhook dispatch (Changed: backend/src/lib.rs, backend/src/main.rs)
3. Deliver invoice lifecycle webhook events #961 — Deliver invoice lifecycle webhook events (Changed: backend/src/handlers.rs, backend/src/routes/invoices.rs, backend/src/routes/cancel.rs, backend/src/lib.rs)
4. Add merchant-scoped webhook configuration endpoints #962 — Add merchant-scoped webhook configuration endpoints (Changed: backend/src/handlers.rs, backend/src/routes/invoices.rs)

Issues

Closes #959
Closes #960
Closes #961
Closes #962

[drips-wave]

@Gospelsam019 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits