Send a webhook for every change a person makes to a record

Events are {resource}.created, .updated, .deleted and .restored for content,
the inbox, redirects, repositories and media, taken from the audit log so the
two agree on what happened. Subscriptions take wildcards. Users, tokens,
webhooks and settings are never sent, nor what the application does by
itself; the inbox's own words only with personal data enabled.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Models/Webhook.php

@@ -10,6 +10,7 @@ use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Support\Str;
 
 /**
  * Somewhere to tell when something happens here.
@@ -21,7 +22,7 @@ class Webhook extends Model
     use HasFactory;
 
     /**
-     * What can be subscribed to. `*` is all of them.
+     * Events with a meaning of their own, whatever record they are about.
      */
     public const EVENTS = [
         'application.received',
@@ -31,6 +32,53 @@ class Webhook extends Model
         'review.returned',
     ];
 
+    /**
+     * Kinds of record whose every change can be subscribed to, as
+     * `{resource}.{action}`. Not users, tokens, webhooks or settings: those
+     * are the application's security, not its content, and do not leave it.
+     */
+    public const RESOURCES = [
+        'pages', 'categories', 'tags', 'projects', 'members', 'services',
+        'clients', 'testimonials', 'talks', 'technologies', 'calls',
+        'redirects', 'repositories', 'media', 'applications',
+    ];
+
+    public const ACTIONS = ['created', 'updated', 'deleted', 'restored'];
+
+    /**
+     * Every event that is ever sent.
+     *
+     * @return array<int, string>
+     */
+    public static function events(): array
+    {
+        $changes = [];
+
+        foreach (self::RESOURCES as $resource) {
+            foreach (self::ACTIONS as $action) {
+                $changes[] = "{$resource}.{$action}";
+            }
+        }
+
+        return [...self::EVENTS, ...$changes];
+    }
+
+    /**
+     * What a webhook may subscribe to: an event, `*`, everything about one
+     * kind of record (`projects.*`) or one action on any (`*.deleted`).
+     */
+    public static function isSubscribable(string $pattern): bool
+    {
+        if ($pattern === '*' || in_array($pattern, self::events(), true)) {
+            return true;
+        }
+
+        [$resource, $action] = array_pad(explode('.', $pattern, 2), 2, null);
+
+        return ($action === '*' && in_array($resource, self::RESOURCES, true))
+            || ($resource === '*' && in_array($action, self::ACTIONS, true));
+    }
+
     /**
      * Switched off after this many failed deliveries in a row, so a dead
      * endpoint does not keep a queue busy forever. Switching it back on is a
@@ -64,9 +112,13 @@ class Webhook extends Model
 
     public function listensTo(string $event): bool
     {
-        $events = $this->events ?? [];
+        foreach ($this->events ?? [] as $pattern) {
+            if ($pattern === $event || Str::is($pattern, $event)) {
+                return true;
+            }
+        }
 
-        return in_array('*', $events, true) || in_array($event, $events, true);
+        return false;
     }
 
     /**