fix(ashby): repair broken idempotency dedup and clarify duplicate-webhook errors

waleedlatif1 · waleedlatif1 · commit 3faf8fc197b4 · 2026-07-08T14:31:54.000-07:00
extractIdempotencyId looked for a webhookActionId field that does not
exist anywhere in Ashby's webhook payload schema (confirmed against the
live OpenAPI spec), so every delivery — including Ashby's own retries —
got a fresh random dedup key and could re-execute workflows. Derive the
key from the affected resource's id plus its updatedAt/decidedAt instead.

Also surface a clear, actionable message when Ashby's webhook.create
rejects a request as a duplicate (seen repeatedly in production logs,
where the outbox retried the same failing subscription for ~23 minutes
before dead-lettering) instead of the generic API error passthrough.

Also add the interview stage `type` field to trigger outputs (present
in Ashby's schema, useful for a stage-change trigger) and fix the
employmentType description to match Ashby's actual enum values.
diff --git a/apps/sim/lib/webhooks/providers/ashby.test.ts b/apps/sim/lib/webhooks/providers/ashby.test.ts
@@ -0,0 +1,156 @@
+/**
+ * @vitest-environment node
+ */
+import crypto from 'crypto'
+import { createMockRequest } from '@sim/testing'
+import { describe, expect, it } from 'vitest'
+import { ashbyHandler } from '@/lib/webhooks/providers/ashby'
+
+describe('ashbyHandler', () => {
+  describe('verifyAuth', () => {
+    const secret = 'test-secret-token'
+    const rawBody = JSON.stringify({ action: 'ping', data: { webhookActionType: 'ping' } })
+    const signature = `sha256=${crypto.createHmac('sha256', secret).update(rawBody, 'utf8').digest('hex')}`
+
+    it('returns 401 when secretToken is missing', () => {
+      const request = createMockRequest('POST', JSON.parse(rawBody), {
+        'ashby-signature': signature,
+      })
+      const res = ashbyHandler.verifyAuth!({
+        request: request as any,
+        rawBody,
+        requestId: 'r1',
+        providerConfig: {},
+        webhook: {},
+        workflow: {},
+      })
+      expect(res?.status).toBe(401)
+    })
+
+    it('returns 401 when signature header is missing', () => {
+      const request = createMockRequest('POST', JSON.parse(rawBody), {})
+      const res = ashbyHandler.verifyAuth!({
+        request: request as any,
+        rawBody,
+        requestId: 'r1',
+        providerConfig: { secretToken: secret },
+        webhook: {},
+        workflow: {},
+      })
+      expect(res?.status).toBe(401)
+    })
+
+    it('returns 401 when signature is invalid', () => {
+      const request = createMockRequest('POST', JSON.parse(rawBody), {
+        'ashby-signature': 'sha256=deadbeef',
+      })
+      const res = ashbyHandler.verifyAuth!({
+        request: request as any,
+        rawBody,
+        requestId: 'r1',
+        providerConfig: { secretToken: secret },
+        webhook: {},
+        workflow: {},
+      })
+      expect(res?.status).toBe(401)
+    })
+
+    it('returns null when signature is valid', () => {
+      const request = createMockRequest('POST', JSON.parse(rawBody), {
+        'ashby-signature': signature,
+      })
+      const res = ashbyHandler.verifyAuth!({
+        request: request as any,
+        rawBody,
+        requestId: 'r1',
+        providerConfig: { secretToken: secret },
+        webhook: {},
+        workflow: {},
+      })
+      expect(res).toBeNull()
+    })
+  })
+
+  describe('matchEvent', () => {
+    it('rejects ping events', async () => {
+      const matched = await ashbyHandler.matchEvent!({
+        webhook: { id: 'w1' } as any,
+        body: { action: 'ping', data: { webhookActionType: 'ping' } },
+        requestId: 'r1',
+        providerConfig: { triggerId: 'ashby_application_submit' },
+      } as any)
+      expect(matched).toBe(false)
+    })
+
+    it('matches when action equals the configured trigger event', async () => {
+      const matched = await ashbyHandler.matchEvent!({
+        webhook: { id: 'w1' } as any,
+        body: { action: 'applicationSubmit', data: {} },
+        requestId: 'r1',
+        providerConfig: { triggerId: 'ashby_application_submit' },
+      } as any)
+      expect(matched).toBe(true)
+    })
+
+    it('rejects when action does not match the configured trigger event', async () => {
+      const matched = await ashbyHandler.matchEvent!({
+        webhook: { id: 'w1' } as any,
+        body: { action: 'jobCreate', data: {} },
+        requestId: 'r1',
+        providerConfig: { triggerId: 'ashby_application_submit' },
+      } as any)
+      expect(matched).toBe(false)
+    })
+  })
+
+  describe('formatInput', () => {
+    it('spreads data fields to the top level alongside action', async () => {
+      const result = await ashbyHandler.formatInput!({
+        body: {
+          action: 'applicationSubmit',
+          data: { application: { id: 'app-1', status: 'Active' } },
+        },
+      } as any)
+      expect(result.input).toEqual({
+        action: 'applicationSubmit',
+        application: { id: 'app-1', status: 'Active' },
+      })
+    })
+  })
+
+  describe('extractIdempotencyId', () => {
+    it('derives a stable key from application id + updatedAt', () => {
+      const body = {
+        action: 'candidateStageChange',
+        data: { application: { id: 'app-1', updatedAt: '2026-01-01T00:00:00Z' } },
+      }
+      expect(ashbyHandler.extractIdempotencyId!(body)).toBe(
+        'ashby:candidateStageChange:app-1:2026-01-01T00:00:00Z'
+      )
+      // identical retried delivery produces the same key
+      expect(ashbyHandler.extractIdempotencyId!({ ...body })).toBe(
+        ashbyHandler.extractIdempotencyId!(body)
+      )
+    })
+
+    it('derives a key from candidate id for candidateDelete', () => {
+      const body = { action: 'candidateDelete', data: { candidate: { id: 'cand-1' } } }
+      expect(ashbyHandler.extractIdempotencyId!(body)).toBe('ashby:candidateDelete:cand-1')
+    })
+
+    it('derives a key from job id for jobCreate', () => {
+      const body = { action: 'jobCreate', data: { job: { id: 'job-1' } } }
+      expect(ashbyHandler.extractIdempotencyId!(body)).toBe('ashby:jobCreate:job-1')
+    })
+
+    it('derives a key from offer id + decidedAt for offerCreate', () => {
+      const body = { action: 'offerCreate', data: { offer: { id: 'offer-1', decidedAt: null } } }
+      expect(ashbyHandler.extractIdempotencyId!(body)).toBe('ashby:offerCreate:offer-1:')
+    })
+
+    it('returns null when no recognizable resource is present', () => {
+      expect(ashbyHandler.extractIdempotencyId!({ action: 'ping', data: {} })).toBeNull()
+      expect(ashbyHandler.extractIdempotencyId!({})).toBeNull()
+    })
+  })
+})
diff --git a/apps/sim/lib/webhooks/providers/ashby.ts b/apps/sim/lib/webhooks/providers/ashby.ts
@@ -35,11 +35,35 @@ function validateAshbySignature(secretToken: string, signature: string, body: st
 }
 
 export const ashbyHandler: WebhookProviderHandler = {
+  /**
+   * Ashby webhook payloads carry no delivery/event id (confirmed against the
+   * live OpenAPI spec — every webhookType only has `action` + `data`), so we
+   * derive a stable key from the affected resource's id plus its
+   * `updatedAt`/`createdAt` (when present) to distinguish a retried delivery
+   * of the same event from a genuinely new one.
+   */
   extractIdempotencyId(body: unknown): string | null {
     const obj = body as Record<string, unknown>
-    const webhookActionId = obj.webhookActionId
-    if (typeof webhookActionId === 'string' && webhookActionId) {
-      return `ashby:${webhookActionId}`
+    const action = typeof obj.action === 'string' ? obj.action : undefined
+    const data = obj.data as Record<string, unknown> | undefined
+    if (!action || !data) return null
+
+    const application = data.application as Record<string, unknown> | undefined
+    const candidate = data.candidate as Record<string, unknown> | undefined
+    const job = data.job as Record<string, unknown> | undefined
+    const offer = data.offer as Record<string, unknown> | undefined
+
+    if (application?.id) {
+      return `ashby:${action}:${application.id}:${application.updatedAt ?? ''}`
+    }
+    if (offer?.id) {
+      return `ashby:${action}:${offer.id}:${offer.decidedAt ?? ''}`
+    }
+    if (candidate?.id) {
+      return `ashby:${action}:${candidate.id}`
+    }
+    if (job?.id) {
+      return `ashby:${action}:${job.id}`
     }
     return null
   },
@@ -185,6 +209,13 @@ export const ashbyHandler: WebhookProviderHandler = {
         } else if (ashbyResponse.status === 403) {
           userFriendlyMessage =
             'Access denied. Please ensure your Ashby API Key has the apiKeysWrite permission.'
+        } else if (/duplicate webhook/i.test(errorMessage)) {
+          // Ashby has no webhook.list endpoint, so a lost externalId (e.g. a
+          // prior attempt succeeded in Ashby but we failed to persist the
+          // result) can't be self-healed by looking the webhook up — the
+          // user must remove the stale one in Ashby before retrying.
+          userFriendlyMessage =
+            'A webhook for this URL and event already exists in Ashby. This usually happens when a previous save succeeded in Ashby but Sim failed to record it. Delete the duplicate webhook under Ashby Settings > API/Webhooks, then re-save this trigger.'
         } else if (errorMessage && errorMessage !== 'Unknown Ashby API error') {
           userFriendlyMessage = `Ashby error: ${errorMessage}`
         }
diff --git a/apps/sim/triggers/ashby/utils.ts b/apps/sim/triggers/ashby/utils.ts
@@ -144,6 +144,10 @@ export function buildApplicationSubmitOutputs(): Record<string, TriggerOutput> {
       currentInterviewStage: {
         id: { type: 'string', description: 'Current interview stage UUID' },
         title: { type: 'string', description: 'Current interview stage title' },
+        type: {
+          type: 'string',
+          description: 'Current interview stage type (e.g., Lead, Applied, Interview, Offer)',
+        },
       },
       job: {
         id: { type: 'string', description: 'Job UUID' },
@@ -181,6 +185,10 @@ export function buildCandidateStageChangeOutputs(): Record<string, TriggerOutput
       currentInterviewStage: {
         id: { type: 'string', description: 'Current interview stage UUID' },
         title: { type: 'string', description: 'Current interview stage title' },
+        type: {
+          type: 'string',
+          description: 'Current interview stage type (e.g., Lead, Applied, Interview, Offer)',
+        },
       },
       job: {
         id: { type: 'string', description: 'Job UUID' },
@@ -213,6 +221,10 @@ export function buildCandidateHireOutputs(): Record<string, TriggerOutput> {
       currentInterviewStage: {
         id: { type: 'string', description: 'Current interview stage UUID' },
         title: { type: 'string', description: 'Current interview stage title' },
+        type: {
+          type: 'string',
+          description: 'Current interview stage type (e.g., Lead, Applied, Interview, Offer)',
+        },
       },
       job: {
         id: { type: 'string', description: 'Job UUID' },
@@ -262,7 +274,7 @@ export function buildJobCreateOutputs(): Record<string, TriggerOutput> {
       status: { type: 'string', description: 'Job status (Open, Closed, Draft, Archived)' },
       employmentType: {
         type: 'string',
-        description: 'Employment type (Full-time, Part-time, etc.)',
+        description: 'Employment type (FullTime, PartTime, Intern, Contract)',
       },
     },
   } as Record<string, TriggerOutput>
