Skip to content

fix: restore legacy callback on completed signatures - #9423

Closed
vitormattos wants to merge 1 commit into
mainfrom
fix/legacy-callback-completion
Closed

vitormattos wants to merge 1 commit into
mainfrom
fix/legacy-callback-completion

Conversation

@vitormattos

@vitormattos vitormattos commented Nov 9, 2026 •

Copy link
Copy Markdown
Member

Superseded by #9426. The LibreSign 16 development line will remove the proprietary callback transport rather than repair it. The existing native Nextcloud completion event and Webhook Listeners replace delivery; integrators retrieve PDFs separately with authorization.


Regression reproduced in disposable Nextcloud 36 / LibreSign main

With the existing implementation, a genuine unauthenticated browser signing produced a Signed PDF and a native SigningRequestCompletedEvent webhook, but the legacy per-request callback received no HTTP POST.

SignedCallbackListener checked getUpdatedFields()['signed'] on a LibreSign File entity. This field does not exist; completion is represented by FileStatus::SIGNED. The listener therefore skipped the callback.

Focused change

  • Dispatch the legacy callback after the file reaches FileStatus::SIGNED; ignore partial signatures and unrelated events.
  • Add named PHPUnit cases for ready, partial, complete, and unrelated events.
  • Preserve the native Nextcloud event and all request/payload contracts.

Runtime evidence (isolated, synthetic)

  • Before: 1 completed document, 0 legacy HTTP receipts, 1 native authenticated completion event.
  • After: new external signer signed anonymously in Chrome, signing API HTTP 200; receiver accepted 1 legacy HTTP POST, multipart with uuid, status, and file (265,017 bytes), and 1 native completion POST.
  • Focused PHPunit: 4 tests / 4 assertions passed (PHP 8.5 runtime).
  • PHP CS Fixer dry run on changed files: 0 fixable files.
  • PHP syntax checks and git diff --check: passed.
  • Full CI pending; no merge/deploy authorized.
  • Lab source and sanitized evidence: /home/username/projects/libresign-external-homolog-20261109/runtime/evidence/ (host Poland; no secrets in PR).

Caveat: this fix deliberately restores callbacks only when the document is fully signed; it is not a new aggregate webhook or a per-signature callback contract.

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
@github-actions

github-actions Bot commented Nov 9, 2026

Copy link
Copy Markdown
Contributor

Code Metrics Report

main (7154513) #9423 (6a9a30f) +/-
Coverage 76.1% 76.2% +0.0%
Test Execution Time 2s 1s -1s
Details
  |                     | main (7154513) | #9423 (6a9a30f) |  +/-  |
  |---------------------|----------------|-----------------|-------|
+ | Coverage            |          76.1% |           76.2% | +0.0% |
  |   Files             |            499 |             499 |     0 |
  |   Lines             |          28577 |           28577 |     0 |
+ |   Covered           |          21775 |           21781 |    +6 |
+ | Test Execution Time |             2s |              1s |   -1s |

Code coverage of files in pull request scope (0.0% → 100.0%, patch 100.0%)

Files Coverage +/- Patch Coverage Status
lib/Listener/SignedCallbackListener.php 100.0% +100.0% 100.0% modified

Reported by octocov

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant