Send a webhook for every change a person makes to a record

Events are {resource}.created, .updated, .deleted and .restored for content,
the inbox, redirects, repositories and media, taken from the audit log so the
two agree on what happened. Subscriptions take wildcards. Users, tokens,
webhooks and settings are never sent, nor what the application does by
itself; the inbox's own words only with personal data enabled.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Http/Requests/Api/V1/WebhookRequest.php

@@ -6,8 +6,8 @@ namespace App\Http\Requests\Api\V1;
 
 use App\Models\Webhook;
 use App\Rules\PublicHttpsUrl;
+use Closure;
 use Illuminate\Foundation\Http\FormRequest;
-use Illuminate\Validation\Rule;
 
 class WebhookRequest extends FormRequest
 {
@@ -36,7 +36,15 @@ class WebhookRequest extends FormRequest
                 new PublicHttpsUrl,
             ],
             'events' => [$sometimes, 'array', 'min:1'],
-            'events.*' => ['string', 'distinct', Rule::in(['*', ...Webhook::EVENTS])],
+            'events.*' => [
+                'string',
+                'distinct',
+                function (string $attribute, mixed $value, Closure $fail): void {
+                    if (! is_string($value) || ! Webhook::isSubscribable($value)) {
+                        $fail(__('rules.webhooks.event', ['event' => (string) (is_scalar($value) ? $value : '')]));
+                    }
+                },
+            ],
             'secret' => [$creating ? 'sometimes' : 'prohibited', 'nullable', 'string', 'min:16', 'max:255'],
             'rotate_secret' => [$creating ? 'prohibited' : 'sometimes', 'boolean'],
             'include_personal_data' => ['sometimes', 'boolean'],