fix: use triggering origin for notification links (#6628)

* take baseurl if saved on event

* refactor: make es mocks reusable

* Revert "refactor: make es mocks reusable"

This reverts commit 434ce12a6a.

* make messages testable

* test asset url

* fmt

* fmt

* simplify notification.Start

* test url combinations

* support init code added

* support password changed

* support reset pw

* support user domain claimed

* support add pwless login

* support verify phone

* Revert "support verify phone"

This reverts commit e40503303e.

* save trigger origin from ctx

* add ready for review check

* camel

* test email otp

* fix variable naming

* fix DefaultOTPEmailURLV2

* Revert "fix DefaultOTPEmailURLV2"

This reverts commit fa34d4d2a8.

* fix email otp challenged test

* fix email otp challenged test

* pass origin in login and gateway requests

* take origin from header

* take x-forwarded if present

* Update internal/notification/handlers/queries.go

Co-authored-by: Tim Möhlmann <tim+github@zitadel.com>

* Update internal/notification/handlers/commands.go

Co-authored-by: Tim Möhlmann <tim+github@zitadel.com>

* move origin header to ctx if available

* generate

* cleanup

* use forwarded header

* support X-Forwarded-* headers

* standardize context handling

* fix linting

---------

Co-authored-by: Tim Möhlmann <tim+github@zitadel.com>

internal/notification/types/domain_claimed.go

@@ -1,15 +1,17 @@
 package types
 
 import (
+	"context"
 	"strings"
 
+	http_utils "github.com/zitadel/zitadel/internal/api/http"
 	"github.com/zitadel/zitadel/internal/api/ui/login"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/query"
 )
 
-func (notify Notify) SendDomainClaimed(user *query.NotifyUser, origin, username string) error {
-	url := login.LoginLink(origin, user.ResourceOwner)
+func (notify Notify) SendDomainClaimed(ctx context.Context, user *query.NotifyUser, username string) error {
+	url := login.LoginLink(http_utils.ComposedOrigin(ctx), user.ResourceOwner)
 	index := strings.LastIndex(user.LastEmail, "@")
 	args := make(map[string]interface{})
 	args["TempUsername"] = username

internal/notification/types/email_verification_code.go

@@ -1,17 +1,19 @@
 package types
 
 import (
+	"context"
 	"strings"
 
+	http_utils "github.com/zitadel/zitadel/internal/api/http"
 	"github.com/zitadel/zitadel/internal/api/ui/login"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/query"
 )
 
-func (notify Notify) SendEmailVerificationCode(user *query.NotifyUser, origin, code string, urlTmpl string) error {
+func (notify Notify) SendEmailVerificationCode(ctx context.Context, user *query.NotifyUser, code string, urlTmpl string) error {
 	var url string
 	if urlTmpl == "" {
-		url = login.MailVerificationLink(origin, user.ID, code, user.ResourceOwner)
+		url = login.MailVerificationLink(http_utils.ComposedOrigin(ctx), user.ID, code, user.ResourceOwner)
 	} else {
 		var buf strings.Builder
 		if err := domain.RenderConfirmURLTemplate(&buf, urlTmpl, user.ID, code, user.ResourceOwner); err != nil {

internal/notification/types/email_verification_code_test.go

@@ -1,11 +1,13 @@
 package types
 
 import (
+	"context"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	http_utils "github.com/zitadel/zitadel/internal/api/http"
 	"github.com/zitadel/zitadel/internal/domain"
 	caos_errs "github.com/zitadel/zitadel/internal/errors"
 	"github.com/zitadel/zitadel/internal/query"
@@ -78,7 +80,7 @@ func TestNotify_SendEmailVerificationCode(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			got, notify := mockNotify()
-			err := notify.SendEmailVerificationCode(tt.args.user, tt.args.origin, tt.args.code, tt.args.urlTmpl)
+			err := notify.SendEmailVerificationCode(http_utils.WithComposedOrigin(context.Background(), tt.args.origin), tt.args.user, tt.args.code, tt.args.urlTmpl)
 			require.ErrorIs(t, err, tt.wantErr)
 			assert.Equal(t, tt.want, got)
 		})

internal/notification/types/init_code.go

@@ -1,13 +1,16 @@
 package types
 
 import (
+	"context"
+
+	http_utils "github.com/zitadel/zitadel/internal/api/http"
 	"github.com/zitadel/zitadel/internal/api/ui/login"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/query"
 )
 
-func (notify Notify) SendUserInitCode(user *query.NotifyUser, origin, code string) error {
-	url := login.InitUserLink(origin, user.ID, user.PreferredLoginName, code, user.ResourceOwner, user.PasswordSet)
+func (notify Notify) SendUserInitCode(ctx context.Context, user *query.NotifyUser, code string) error {
+	url := login.InitUserLink(http_utils.ComposedOrigin(ctx), user.ID, user.PreferredLoginName, code, user.ResourceOwner, user.PasswordSet)
 	args := make(map[string]interface{})
 	args["Code"] = code
 	return notify(url, args, domain.InitCodeMessageType, true)

internal/notification/types/json.go

@@ -1,40 +0,0 @@
-package types
-
-import (
-	"context"
-
-	"github.com/zitadel/zitadel/internal/eventstore"
-	"github.com/zitadel/zitadel/internal/notification/channels/fs"
-	"github.com/zitadel/zitadel/internal/notification/channels/log"
-	"github.com/zitadel/zitadel/internal/notification/channels/webhook"
-	"github.com/zitadel/zitadel/internal/notification/messages"
-	"github.com/zitadel/zitadel/internal/notification/senders"
-)
-
-func handleJSON(
-	ctx context.Context,
-	webhookConfig webhook.Config,
-	getFileSystemProvider func(ctx context.Context) (*fs.Config, error),
-	getLogProvider func(ctx context.Context) (*log.Config, error),
-	serializable interface{},
-	triggeringEvent eventstore.Event,
-	successMetricName,
-	failureMetricName string,
-) error {
-	message := &messages.JSON{
-		Serializable:    serializable,
-		TriggeringEvent: triggeringEvent,
-	}
-	channelChain, err := senders.JSONChannels(
-		ctx,
-		webhookConfig,
-		getFileSystemProvider,
-		getLogProvider,
-		successMetricName,
-		failureMetricName,
-	)
-	if err != nil {
-		return err
-	}
-	return channelChain.HandleMessage(message)
-}

internal/notification/types/notification.go

@@ -5,11 +5,10 @@ import (
 
 	"github.com/zitadel/zitadel/internal/eventstore"
 	"github.com/zitadel/zitadel/internal/i18n"
-	"github.com/zitadel/zitadel/internal/notification/channels/fs"
-	"github.com/zitadel/zitadel/internal/notification/channels/log"
 	"github.com/zitadel/zitadel/internal/notification/channels/smtp"
 	"github.com/zitadel/zitadel/internal/notification/channels/twilio"
 	"github.com/zitadel/zitadel/internal/notification/channels/webhook"
+	"github.com/zitadel/zitadel/internal/notification/senders"
 	"github.com/zitadel/zitadel/internal/notification/templates"
 	"github.com/zitadel/zitadel/internal/query"
 )
@@ -21,19 +20,20 @@ type Notify func(
 	allowUnverifiedNotificationChannel bool,
 ) error
 
+type ChannelChains interface {
+	Email(context.Context) (*senders.Chain, *smtp.Config, error)
+	SMS(context.Context) (*senders.Chain, *twilio.Config, error)
+	Webhook(context.Context, webhook.Config) (*senders.Chain, error)
+}
+
 func SendEmail(
 	ctx context.Context,
+	channels ChannelChains,
 	mailhtml string,
 	translator *i18n.Translator,
 	user *query.NotifyUser,
-	emailConfig func(ctx context.Context) (*smtp.Config, error),
-	getFileSystemProvider func(ctx context.Context) (*fs.Config, error),
-	getLogProvider func(ctx context.Context) (*log.Config, error),
 	colors *query.LabelPolicy,
-	assetsPrefix string,
 	triggeringEvent eventstore.Event,
-	successMetricName,
-	failureMetricName string,
 ) Notify {
 	return func(
 		url string,
@@ -42,39 +42,30 @@ func SendEmail(
 		allowUnverifiedNotificationChannel bool,
 	) error {
 		args = mapNotifyUserToArgs(user, args)
-		data := GetTemplateData(translator, args, assetsPrefix, url, messageType, user.PreferredLanguage.String(), colors)
+		data := GetTemplateData(ctx, translator, args, url, messageType, user.PreferredLanguage.String(), colors)
 		template, err := templates.GetParsedTemplate(mailhtml, data)
 		if err != nil {
 			return err
 		}
 		return generateEmail(
 			ctx,
+			channels,
 			user,
 			data.Subject,
 			template,
-			emailConfig,
-			getFileSystemProvider,
-			getLogProvider,
 			allowUnverifiedNotificationChannel,
 			triggeringEvent,
-			successMetricName,
-			failureMetricName,
 		)
 	}
 }
 
 func SendSMSTwilio(
 	ctx context.Context,
+	channels ChannelChains,
 	translator *i18n.Translator,
 	user *query.NotifyUser,
-	twilioConfig func(ctx context.Context) (*twilio.Config, error),
-	getFileSystemProvider func(ctx context.Context) (*fs.Config, error),
-	getLogProvider func(ctx context.Context) (*log.Config, error),
 	colors *query.LabelPolicy,
-	assetsPrefix string,
 	triggeringEvent eventstore.Event,
-	successMetricName,
-	failureMetricName string,
 ) Notify {
 	return func(
 		url string,
@@ -83,18 +74,14 @@ func SendSMSTwilio(
 		allowUnverifiedNotificationChannel bool,
 	) error {
 		args = mapNotifyUserToArgs(user, args)
-		data := GetTemplateData(translator, args, assetsPrefix, url, messageType, user.PreferredLanguage.String(), colors)
+		data := GetTemplateData(ctx, translator, args, url, messageType, user.PreferredLanguage.String(), colors)
 		return generateSms(
 			ctx,
+			channels,
 			user,
 			data.Text,
-			twilioConfig,
-			getFileSystemProvider,
-			getLogProvider,
 			allowUnverifiedNotificationChannel,
 			triggeringEvent,
-			successMetricName,
-			failureMetricName,
 		)
 	}
 }
@@ -102,23 +89,17 @@ func SendSMSTwilio(
 func SendJSON(
 	ctx context.Context,
 	webhookConfig webhook.Config,
-	getFileSystemProvider func(ctx context.Context) (*fs.Config, error),
-	getLogProvider func(ctx context.Context) (*log.Config, error),
+	channels ChannelChains,
 	serializable interface{},
 	triggeringEvent eventstore.Event,
-	successMetricName,
-	failureMetricName string,
 ) Notify {
 	return func(_ string, _ map[string]interface{}, _ string, _ bool) error {
-		return handleJSON(
+		return handleWebhook(
 			ctx,
 			webhookConfig,
-			getFileSystemProvider,
-			getLogProvider,
+			channels,
 			serializable,
 			triggeringEvent,
-			successMetricName,
-			failureMetricName,
 		)
 	}
 }

internal/notification/types/otp.go

@@ -1,27 +1,31 @@
 package types
 
 import (
+	"context"
 	"time"
 
+	http_utils "github.com/zitadel/zitadel/internal/api/http"
+
+	"github.com/zitadel/zitadel/internal/api/authz"
+
 	"github.com/zitadel/zitadel/internal/domain"
-	"github.com/zitadel/zitadel/internal/query"
 )
 
-func (notify Notify) SendOTPSMSCode(requestedDomain, origin, code string, expiry time.Duration) error {
-	args := otpArgs(code, origin, requestedDomain, expiry)
+func (notify Notify) SendOTPSMSCode(ctx context.Context, code string, expiry time.Duration) error {
+	args := otpArgs(ctx, code, expiry)
 	return notify("", args, domain.VerifySMSOTPMessageType, false)
 }
 
-func (notify Notify) SendOTPEmailCode(user *query.NotifyUser, url, requestedDomain, origin, code string, expiry time.Duration) error {
-	args := otpArgs(code, origin, requestedDomain, expiry)
+func (notify Notify) SendOTPEmailCode(ctx context.Context, url, code string, expiry time.Duration) error {
+	args := otpArgs(ctx, code, expiry)
 	return notify(url, args, domain.VerifyEmailOTPMessageType, false)
 }
 
-func otpArgs(code, origin, requestedDomain string, expiry time.Duration) map[string]interface{} {
+func otpArgs(ctx context.Context, code string, expiry time.Duration) map[string]interface{} {
 	args := make(map[string]interface{})
 	args["OTP"] = code
-	args["Origin"] = origin
-	args["Domain"] = requestedDomain
+	args["Origin"] = http_utils.ComposedOrigin(ctx)
+	args["Domain"] = authz.GetInstance(ctx).RequestedDomain()
 	args["Expiry"] = expiry
 	return args
 }

internal/notification/types/password_change.go

@@ -1,13 +1,16 @@
 package types
 
 import (
+	"context"
+
+	http_utils "github.com/zitadel/zitadel/internal/api/http"
 	"github.com/zitadel/zitadel/internal/api/ui/console"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/query"
 )
 
-func (notify Notify) SendPasswordChange(user *query.NotifyUser, origin string) error {
-	url := console.LoginHintLink(origin, user.PreferredLoginName)
+func (notify Notify) SendPasswordChange(ctx context.Context, user *query.NotifyUser) error {
+	url := console.LoginHintLink(http_utils.ComposedOrigin(ctx), user.PreferredLoginName)
 	args := make(map[string]interface{})
 	return notify(url, args, domain.PasswordChangeMessageType, true)
 }

internal/notification/types/password_code.go

@@ -1,17 +1,19 @@
 package types
 
 import (
+	"context"
 	"strings"
 
+	http_utils "github.com/zitadel/zitadel/internal/api/http"
 	"github.com/zitadel/zitadel/internal/api/ui/login"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/query"
 )
 
-func (notify Notify) SendPasswordCode(user *query.NotifyUser, origin, code, urlTmpl string) error {
+func (notify Notify) SendPasswordCode(ctx context.Context, user *query.NotifyUser, code, urlTmpl string) error {
 	var url string
 	if urlTmpl == "" {
-		url = login.InitPasswordLink(origin, user.ID, code, user.ResourceOwner)
+		url = login.InitPasswordLink(http_utils.ComposedOrigin(ctx), user.ID, code, user.ResourceOwner)
 	} else {
 		var buf strings.Builder
 		if err := domain.RenderConfirmURLTemplate(&buf, urlTmpl, user.ID, code, user.ResourceOwner); err != nil {

internal/notification/types/passwordless_registration_link.go

@@ -1,17 +1,19 @@
 package types
 
 import (
+	"context"
 	"strings"
 
+	http_utils "github.com/zitadel/zitadel/internal/api/http"
 	"github.com/zitadel/zitadel/internal/api/ui/login"
 	"github.com/zitadel/zitadel/internal/domain"
 	"github.com/zitadel/zitadel/internal/query"
 )
 
-func (notify Notify) SendPasswordlessRegistrationLink(user *query.NotifyUser, origin, code, codeID, urlTmpl string) error {
+func (notify Notify) SendPasswordlessRegistrationLink(ctx context.Context, user *query.NotifyUser, code, codeID, urlTmpl string) error {
 	var url string
 	if urlTmpl == "" {
-		url = domain.PasswordlessInitCodeLink(origin+login.HandlerPrefix+login.EndpointPasswordlessRegistration, user.ID, user.ResourceOwner, codeID, code)
+		url = domain.PasswordlessInitCodeLink(http_utils.ComposedOrigin(ctx)+login.HandlerPrefix+login.EndpointPasswordlessRegistration, user.ID, user.ResourceOwner, codeID, code)
 	} else {
 		var buf strings.Builder
 		if err := domain.RenderPasskeyURLTemplate(&buf, urlTmpl, user.ID, user.ResourceOwner, codeID, code); err != nil {
@@ -19,6 +21,5 @@ func (notify Notify) SendPasswordlessRegistrationLink(user *query.NotifyUser, or
 		}
 		url = buf.String()
 	}
-
 	return notify(url, nil, domain.PasswordlessRegistrationMessageType, true)
 }

internal/notification/types/passwordless_registration_link_test.go

@@ -1,11 +1,13 @@
 package types
 
 import (
+	"context"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	http_utils "github.com/zitadel/zitadel/internal/api/http"
 	"github.com/zitadel/zitadel/internal/domain"
 	caos_errs "github.com/zitadel/zitadel/internal/errors"
 	"github.com/zitadel/zitadel/internal/query"
@@ -80,7 +82,7 @@ func TestNotify_SendPasswordlessRegistrationLink(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			got, notify := mockNotify()
-			err := notify.SendPasswordlessRegistrationLink(tt.args.user, tt.args.origin, tt.args.code, tt.args.codeID, tt.args.urlTmpl)
+			err := notify.SendPasswordlessRegistrationLink(http_utils.WithComposedOrigin(context.Background(), tt.args.origin), tt.args.user, tt.args.code, tt.args.codeID, tt.args.urlTmpl)
 			require.ErrorIs(t, err, tt.wantErr)
 			assert.Equal(t, tt.want, got)
 		})

internal/notification/types/phone_verification_code.go

@@ -1,13 +1,15 @@
 package types
 
 import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/api/authz"
 	"github.com/zitadel/zitadel/internal/domain"
-	"github.com/zitadel/zitadel/internal/query"
 )
 
-func (notify Notify) SendPhoneVerificationCode(user *query.NotifyUser, origin, code, requestedDomain string) error {
+func (notify Notify) SendPhoneVerificationCode(ctx context.Context, code string) error {
 	args := make(map[string]interface{})
 	args["Code"] = code
-	args["Domain"] = requestedDomain
+	args["Domain"] = authz.GetInstance(ctx).RequestedDomain()
 	return notify("", args, domain.VerifyPhoneMessageType, true)
 }

internal/notification/types/templateData.go

@@ -1,15 +1,20 @@
 package types
 
 import (
+	"context"
 	"fmt"
 	"strings"
 
+	http_util "github.com/zitadel/zitadel/internal/api/http"
+
+	"github.com/zitadel/zitadel/internal/api/assets"
 	"github.com/zitadel/zitadel/internal/i18n"
 	"github.com/zitadel/zitadel/internal/notification/templates"
 	"github.com/zitadel/zitadel/internal/query"
 )
 
-func GetTemplateData(translator *i18n.Translator, translateArgs map[string]interface{}, assetsPrefix, href, msgType, lang string, policy *query.LabelPolicy) templates.TemplateData {
+func GetTemplateData(ctx context.Context, translator *i18n.Translator, translateArgs map[string]interface{}, href, msgType, lang string, policy *query.LabelPolicy) templates.TemplateData {
+	assetsPrefix := http_util.ComposedOrigin(ctx) + assets.HandlerPrefix
 	templateData := templates.TemplateData{
 		URL:             href,
 		PrimaryColor:    templates.DefaultPrimaryColor,
@@ -28,9 +33,6 @@ func GetTemplateData(translator *i18n.Translator, translateArgs map[string]inter
 	if policy.Light.FontColor != "" {
 		templateData.FontColor = policy.Light.FontColor
 	}
-	if assetsPrefix == "" {
-		return templateData
-	}
 	if policy.Light.LogoURL != "" {
 		templateData.LogoURL = fmt.Sprintf("%s/%s/%s", assetsPrefix, policy.ID, policy.Light.LogoURL)
 	}

internal/notification/types/user_email.go

@@ -6,26 +6,18 @@ import (
 
 	"github.com/zitadel/zitadel/internal/errors"
 	"github.com/zitadel/zitadel/internal/eventstore"
-	"github.com/zitadel/zitadel/internal/notification/channels/fs"
-	"github.com/zitadel/zitadel/internal/notification/channels/log"
-	"github.com/zitadel/zitadel/internal/notification/channels/smtp"
 	"github.com/zitadel/zitadel/internal/notification/messages"
-	"github.com/zitadel/zitadel/internal/notification/senders"
 	"github.com/zitadel/zitadel/internal/query"
 )
 
 func generateEmail(
 	ctx context.Context,
+	channels ChannelChains,
 	user *query.NotifyUser,
 	subject,
 	content string,
-	smtpConfig func(ctx context.Context) (*smtp.Config, error),
-	getFileSystemProvider func(ctx context.Context) (*fs.Config, error),
-	getLogProvider func(ctx context.Context) (*log.Config, error),
 	lastEmail bool,
 	triggeringEvent eventstore.Event,
-	successMetricName,
-	failureMetricName string,
 ) error {
 	content = html.UnescapeString(content)
 	message := &messages.Email{
@@ -37,23 +29,14 @@ func generateEmail(
 	if lastEmail {
 		message.Recipients = []string{user.LastEmail}
 	}
-
-	channelChain, err := senders.EmailChannels(
-		ctx,
-		smtpConfig,
-		getFileSystemProvider,
-		getLogProvider,
-		successMetricName,
-		failureMetricName,
-	)
+	emailChannels, _, err := channels.Email(ctx)
 	if err != nil {
 		return err
 	}
-
-	if channelChain.Len() == 0 {
+	if emailChannels.Len() == 0 {
 		return errors.ThrowPreconditionFailed(nil, "MAIL-83nof", "Errors.Notification.Channels.NotPresent")
 	}
-	return channelChain.HandleMessage(message)
+	return emailChannels.HandleMessage(message)
 }
 
 func mapNotifyUserToArgs(user *query.NotifyUser, args map[string]interface{}) map[string]interface{} {

internal/notification/types/user_phone.go

@@ -4,31 +4,26 @@ import (
 	"context"
 
 	"github.com/zitadel/logging"
-
 	"github.com/zitadel/zitadel/internal/errors"
 	"github.com/zitadel/zitadel/internal/eventstore"
-	"github.com/zitadel/zitadel/internal/notification/channels/fs"
-	"github.com/zitadel/zitadel/internal/notification/channels/log"
-	"github.com/zitadel/zitadel/internal/notification/channels/twilio"
 	"github.com/zitadel/zitadel/internal/notification/messages"
-	"github.com/zitadel/zitadel/internal/notification/senders"
 	"github.com/zitadel/zitadel/internal/query"
 )
 
 func generateSms(
 	ctx context.Context,
+	channels ChannelChains,
 	user *query.NotifyUser,
 	content string,
-	getTwilioProvider func(ctx context.Context) (*twilio.Config, error),
-	getFileSystemProvider func(ctx context.Context) (*fs.Config, error),
-	getLogProvider func(ctx context.Context) (*log.Config, error),
 	lastPhone bool,
 	triggeringEvent eventstore.Event,
-	successMetricName,
-	failureMetricName string,
 ) error {
 	number := ""
-	twilioConfig, err := getTwilioProvider(ctx)
+	smsChannels, twilioConfig, err := channels.SMS(ctx)
+	logging.OnError(err).Error("could not create sms channel")
+	if smsChannels.Len() == 0 {
+		return errors.ThrowPreconditionFailed(nil, "PHONE-w8nfow", "Errors.Notification.Channels.NotPresent")
+	}
 	if err == nil {
 		number = twilioConfig.SenderNumber
 	}
@@ -41,19 +36,5 @@ func generateSms(
 	if lastPhone {
 		message.RecipientPhoneNumber = user.LastPhone
 	}
-
-	channelChain, err := senders.SMSChannels(
-		ctx,
-		twilioConfig,
-		getFileSystemProvider,
-		getLogProvider,
-		successMetricName,
-		failureMetricName,
-	)
-	logging.OnError(err).Error("could not create sms channel")
-
-	if channelChain.Len() == 0 {
-		return errors.ThrowPreconditionFailed(nil, "PHONE-w8nfow", "Errors.Notification.Channels.NotPresent")
-	}
-	return channelChain.HandleMessage(message)
+	return smsChannels.HandleMessage(message)
 }

internal/notification/types/webhook.go

@@ -0,0 +1,27 @@
+package types
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/notification/channels/webhook"
+	"github.com/zitadel/zitadel/internal/notification/messages"
+)
+
+func handleWebhook(
+	ctx context.Context,
+	webhookConfig webhook.Config,
+	channels ChannelChains,
+	serializable interface{},
+	triggeringEvent eventstore.Event,
+) error {
+	message := &messages.JSON{
+		Serializable:    serializable,
+		TriggeringEvent: triggeringEvent,
+	}
+	webhookChannels, err := channels.Webhook(ctx, webhookConfig)
+	if err != nil {
+		return err
+	}
+	return webhookChannels.HandleMessage(message)
+}