Reject a webhook wait_time over the 5 minute cap in the node editor

[AmishaBisht]

Companion to glific/glific#5638 (issue glific/glific#5633). Backend-side, an async webhook node can now set its own await window via wait_time in the webhook body, capped at 5 minutes.

Why

Without this, an over-cap value is only caught at publish, as a Warning, after the backend has already silently clamped it. So the node behaves differently from what the author typed, and they find out late — or never, if they only ever test in the simulator.

What

Adds an isWaitTimeWithinCap() validator in webhook/helpers.ts and wires it into the body's existing validation in WebhookRouterForm:

updates.body = validate('POST body', keys.body, [isValidJson(), isWaitTimeWithinCap()]);

mergeForm folds body failures into the form's valid flag and handleSave gates on it, so this both shows the message under the body field (same place as "Not a valid JSON") and blocks Ok until it's fixed. Stronger than the backend warning: the bad value can't be saved at all.

Behaviour

Body	Result
{"wait_time": 240} / "240" / 300	accepted
no wait_time key	accepted
{"wait_time": ""} — what the body template ships	accepted, means "use the webhook's default"
{"wait_time": 600}	wait_time cannot be more than 300 seconds (5 minutes)
0, -30, "abc", "60s", 12.5	wait_time must be a whole number of seconds greater than 0
{}, [], true	wait_time must be a number of seconds
undecodable body	silent — isValidJson() already reports it, no double error

Testing

New webhook/helpers.test.ts — 9 tests covering the table above plus that the entry value is returned unchanged. All webhook suites pass: 4 suites, 19 tests, 15 snapshots. Prettier clean. tsc --noEmit reports no errors in the changed files (the repo has 36 pre-existing TS7018 errors in other test files, untouched).

Note for the reviewer

isValidJson() just above has a latent bug — no return when JSON.parse succeeds on a non-object ("123", true), so it falls through to undefined, and validate() then reads .failures off it. Not touched here, but worth a separate fix. The new validator is written total to avoid the same trap.

Release path

This needs a published @glific/flow-editor version and a bump of the pin in glific-frontend (currently 1.43.0-14) before NGOs see it.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: fbf4464c-4c38-4ed7-b84a-b81a3b325ecd

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}