Webhooks and Slack/Discord notifications #40

Problem

Teams live in Slack, Discord and ticketing tools. Today nothing leaves WordPress when an idea is submitted or an item moves status, so the team has to keep checking wp-admin. There are also no developer hooks for automation tools.

Proposal

Add outbound notifications and webhooks.

Events

• item.submitted (new pending idea)
• item.status_changed (with from/to)
• item.voted (throttled/aggregated, e.g. milestone: 10, 25, 50, 100 votes)
• comment.created
• item.released (changelog)

Destinations (Settings -> Integrations)

1. Generic webhook: URL, secret, per-event toggles. POST JSON with X-NiroRoadmap-Signature (HMAC-SHA256 of body using the secret) and an event ID for idempotency.
2. Slack incoming webhook with formatted blocks (title, link to edit screen, votes).
3. Discord webhook with embed.
4. Email to admin (already planned for submissions; unify here).
5. Zapier/Make/n8n work through the generic webhook; document it.

Reliability

• Send asynchronously (scheduled event / Action Scheduler if present), 10s timeout, retries with backoff (3 attempts), delivery log (last 50 deliveries with status code and response snippet) and a "Send test" button.
• Never block the user request on a remote call.
• SSRF safety: wp_http_validate_url, reject private/loopback IPs by default, use wp_safe_remote_post.

Developer hooks

• do_action( 'niroroadmap_event', $event, $payload ) fired for every event even when no integration is configured.
• niroroadmap_webhook_payload filter.

Acceptance criteria

• Each event produces one delivery per enabled destination.
• Payloads match a documented schema (add docs/webhooks.md).
• Signature verifies with the documented algorithm.
• Failures retry then log; admin can see them and resend.
• A slow or failing endpoint does not slow the site.
• Private network URLs are blocked unless a filter allows them.
• Secrets are stored as options and not echoed back in full in the UI.
• Disabling an event stops deliveries immediately.

Dependencies

Settings page. Submissions, comments, and changelog issues for their events.

Priority rationale

Low. Convenience/automation layer; ship after the events themselves exist.