webhook: Add initial webhook plugin

[jcharum]

This initial plugin implementation is very simple. It does a bunch of simplifying things:

• Assumes POST.
• Assumes JSON request and response bodies.
• body and return are Any, so we won't get much typing help.

This is good enough to be used by a workflow with the description:

Post a body of the form { "message": "Hello from Lutra and Zapier!"} to the webhook https://hooks.zapier.com/hooks/catch/<elided>. Allow only the message to be customizable.

[jcharum]

This mostly exists as a proof-of-concept that what should work, straightforward webhook calling, works. I don't personally have any use cases I want to build out for myself, but I'm happy to help extend this plugin in whatever way is useful.

[bozhi]

Is there a reason why the body's type and return type is Any? I think the type checker will not catch any issues here and that seems a little problematic.

[jcharum]

In general, body and the return value are arbitrary data structures that can be encoded to and decoded from JSON, respectively. There are enough trade-offs around what that type should even be that Python does not provide one in the type hints of the standard library. See the discussion in this issue. The final comment summarizes nuances around type-checking. Given the nuance, particularly around invariance and mutability, and the generality of webhook calling, it's not obvious to me what trade-off to make.

Similarly, the json parameter and return value of .json() are Any, presumably for the same reasons.

Furthermore, plugins do not yet support unions, as unions are generally very prone to introduce ambiguity in deserialization, and there is no mechanism to disambiguate. The one that exists for built-in actions is pretty fragile and requires some relatively careful thinking, so I am resisting adding support to plugins until we have a very very good reason.

Do you have an example of a problem case, as I think a worked example would be useful to explore these trade-offs?

[jngiam]

it seems like zapier webhooks just use a secret url -- is that right?

[jcharum]

it seems like zapier webhooks just use a secret url -- is that right?

Yes. It's possible to make it a bit more secure by putting a condition on a field in the body in the zap.