refactor(tiktok): align webhook routing with shared dispatcher

[BillLeoutsakosvl346]

Summary

• route TikTok app webhooks by the standard routingKey lookup and shared dispatcher
• remove TikTok-specific ingress jobs, target workers, and async-job registrations
• migrate existing deployments to routing_key with workspace/account verification
• retain a temporary null-routing-key fallback and supporting index for safe rolling deployment
• remove low-signal assertion-only tests while preserving behavioral coverage

Why

TikTok previously used provider-specific background ingress and target-resolution infrastructure. This aligns it with the established Slack-style shared-app webhook architecture while preserving authentication, filtering, idempotency, account isolation, and queued workflow execution.

The temporary fallback handles registrations written by old pods after the migration runs. A follow-up contract PR can remove that fallback and index after one full rollout and final backfill.

Validation

• 16 focused TikTok/Slack/shared suites: 175 tests
• independent validate-trigger and validate-integration review: clean approval
• type-check, format, lint, strict API validation
• client, tool-registry, and monorepo boundary checks
• migration safety plus isolated valid/malformed/foreign/fresh-database validation
• git diff --check

No trigger options, tool behavior, OAuth scopes, webhook payloads, or user-facing fields change.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 4, 2026 10:32pm

[cursor]

PR Summary

Medium Risk
Webhook fan-out now runs in the request path instead of durable ingress jobs, so latency, concurrency, and retry semantics depend on the shared dispatcher behaving like Slack under load and partial failures.

Overview
TikTok app webhook deliveries no longer enqueue tiktok-webhook-ingress background jobs or paginate targets through credential/account joins. The /api/webhooks/tiktok handler now resolves workflows with findWebhooksByRoutingKey on user_openid and fans out with dispatchResolvedWebhookTarget, matching the shared Slack-style app webhook path. Failed dispatches or lookup errors still return 503 so TikTok can retry.

Deploy now derives TikTok routingKey from the connected account’s open_id (stripping the stored UUID suffix) and stores providerConfig.credentialId, with validation when the account identity is missing or malformed. Credential deletion deactivates TikTok webhook rows bound via providerConfig.credentialId, alongside existing Slack handling.

The tiktok-webhook-ingress job type, Trigger task mapping, ingress/target modules, and their tests are removed. Migration 0282 drops the obsolete webhook_tiktok_credential_id_idx index. Several assertion-only tests are deleted; route/deploy/deactivation coverage is expanded.

^{Reviewed by Cursor Bugbot for commit 8d40ee4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

The PR replaces TikTok-specific ingress and target-resolution jobs with the shared routing-key webhook dispatcher while retaining rollout compatibility through a routing-key migration.

• Routes verified TikTok events by user_openid and returns a retryable response when lookup or dispatch fails.
• Migrates existing TikTok registrations to routing_key with account and workspace validation.
• Removes the obsolete TikTok ingress jobs, target workers, and async-job registrations.
• Deactivates TikTok webhook registrations when their bound credential is removed.

Confidence Score: 5/5

The PR appears safe to merge.

The previously reported failed-dispatch issue is fixed: every failed shared-dispatch outcome is counted and causes a retryable 503 response, while intentionally ignored outcomes remain acknowledged.

Important Files Changed

Filename	Overview
apps/sim/app/api/webhooks/tiktok/route.ts	Replaces provider-specific durable ingress with shared routing-key lookup and dispatch, and now returns 503 when any target dispatch fails.
apps/sim/lib/webhooks/deploy.ts	Persists the TikTok account open ID as the shared dispatcher routing key while retaining the temporary legacy fallback.
apps/sim/lib/credentials/deletion.ts	Extends credential cleanup to deactivate TikTok registrations bound through provider configuration.
packages/db/migrations/0282_tiktok_routing_key.sql	Backfills validated TikTok routing keys and adds the temporary fallback index needed during rolling deployment.
packages/db/schema.ts	Aligns the webhook schema indexes with TikTok routing-key lookup and rollout fallback behavior.

Sequence Diagram

sequenceDiagram
  participant TikTok
  participant Route as TikTok webhook route
  participant DB as Webhook lookup
  participant Dispatcher as Shared dispatcher
  participant Queue as Webhook execution queue

  TikTok->>Route: Signed event
  Route->>Route: Verify signature and envelope
  Route->>DB: Find targets by user_openid + provider
  DB-->>Route: Active workflow targets
  loop Each target
    Route->>Dispatcher: Dispatch resolved target
    Dispatcher->>Queue: Enqueue webhook execution
    Dispatcher-->>Route: queued / ignored / failed
  end
  alt Any dispatch failed
    Route-->>TikTok: 503 retryable response
  else All targets accepted or ignored
    Route-->>TikTok: 200 OK
  end

Loading

_{Reviews (2): Last reviewed commit: "refactor(tiktok): remove rollout compati..." | Re-trigger Greptile}

[BillLeoutsakosvl346]

@greptile

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit df6065e. Configure here.}