integration.job-application-webhook-resend-managed

Managed Resend job-application webhook

Runnable allowlisted composition for app.job-application-api. It verifies the raw signed Resend webhook, resolves an HMAC deployment alias with the dedicated webhook database role, fetches Resend Receiving content only after authorization, scans every attachment, stores sanitized content through the candidate-scoped object store, and creates an opaque verification challenge.

Set JOB_APPLICATION_RESEND_WEBHOOK_MODULE to @lssm-tech/integration.job-application-webhook-resend-managed. The composition requires explicit database, route-key, Resend, attachment-host, and allowlisted dependency-module settings. The dependency module supplies candidate-scoped encrypted object storage and malware scanning. No permissive scanner fallback is provided.

Use separate JOB_APPLICATION_RESEND_WEBHOOK_DATABASE_URL and JOB_APPLICATION_RESEND_WEBHOOK_DATABASE_ROLE=job_application_webhook credentials; do not reuse the API runtime connection.

Webhook ingress never opens verification links or submits OTPs. Those effects remain default-off and run only after an authorized account-verification command is claimed by the fenced job-application worker.