feat(wework): complete workspace issue and task workflow

backend/app/api/api.py

@@ -35,6 +35,7 @@
     openapi_responses,
     pet,
     project_automations,
+    project_incoming_hooks,
     projects,
     prompt_optimization,
     quota,
@@ -154,6 +155,16 @@
     prefix="/v1/cloud-projects",
     tags=["project-automations"],
 )
+api_router.include_router(
+    project_incoming_hooks.router,
+    prefix="/v1/cloud-projects",
+    tags=["project-incoming-hooks"],
+)
+api_router.include_router(
+    project_incoming_hooks.public_router,
+    prefix="/v1/incoming-hooks",
+    tags=["project-incoming-hooks"],
+)
 api_router.include_router(
     loop_item_executions.router,
     prefix="/v1/cloud-projects",

backend/app/api/endpoints/project_incoming_hooks.py

@@ -0,0 +1,125 @@
+# SPDX-FileCopyrightText: 2026 Weibo, Inc.
+# SPDX-License-Identifier: Apache-2.0
+
+"""Project incoming hook management and public ingestion endpoints."""
+
+from fastapi import APIRouter, Depends, Request, status
+from sqlalchemy.orm import Session
+
+from app.api.dependencies import get_db
+from app.core.security import get_current_user
+from app.models.delivery import ProjectIncomingHook
+from app.models.user import User
+from app.schemas.project_incoming_hook import (
+    ProjectIncomingHookCreate,
+    ProjectIncomingHookUpdate,
+    ProjectIncomingHookView,
+    ProjectIncomingReceipt,
+)
+from app.services.project_incoming_hooks import project_incoming_hook_service
+
+router = APIRouter()
+public_router = APIRouter()
+
+
+def _view(request: Request, hook: ProjectIncomingHook) -> ProjectIncomingHookView:
+    return ProjectIncomingHookView(
+        id=str(hook.id),
+        project_id=str(hook.cloud_project_id),
+        name=hook.name or "",
+        status=hook.status or "disabled",
+        webhook_url=str(
+            request.url_for("receive_project_incoming_hook", token=hook.public_id)
+        ),
+        version=hook.version,
+        created_at=hook.created_at,
+        updated_at=hook.updated_at,
+    )
+
+
+@router.get(
+    "/{project_id}/incoming-hooks",
+    response_model=list[ProjectIncomingHookView],
+)
+def list_incoming_hooks(
+    project_id: str,
+    request: Request,
+    db: Session = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+) -> list[ProjectIncomingHookView]:
+    return [
+        _view(request, hook)
+        for hook in project_incoming_hook_service.list(db, project_id, current_user.id)
+    ]
+
+
+@router.post(
+    "/{project_id}/incoming-hooks",
+    response_model=ProjectIncomingHookView,
+    status_code=status.HTTP_201_CREATED,
+)
+def create_incoming_hook(
+    project_id: str,
+    values: ProjectIncomingHookCreate,
+    request: Request,
+    db: Session = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+) -> ProjectIncomingHookView:
+    hook = project_incoming_hook_service.create(db, project_id, current_user.id, values)
+    return _view(request, hook)
+
+
+@router.patch(
+    "/{project_id}/incoming-hooks/{hook_id}",
+    response_model=ProjectIncomingHookView,
+)
+def update_incoming_hook(
+    project_id: str,
+    hook_id: str,
+    values: ProjectIncomingHookUpdate,
+    request: Request,
+    db: Session = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+) -> ProjectIncomingHookView:
+    hook = project_incoming_hook_service.update(
+        db, project_id, hook_id, current_user.id, values
+    )
+    return _view(request, hook)
+
+
+@router.post(
+    "/{project_id}/incoming-hooks/{hook_id}/rotate",
+    response_model=ProjectIncomingHookView,
+)
+def rotate_incoming_hook(
+    project_id: str,
+    hook_id: str,
+    request: Request,
+    db: Session = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+) -> ProjectIncomingHookView:
+    hook = project_incoming_hook_service.rotate(
+        db, project_id, hook_id, current_user.id
+    )
+    return _view(request, hook)
+
+
+@public_router.post(
+    "/{token}",
+    response_model=ProjectIncomingReceipt,
+    status_code=status.HTTP_202_ACCEPTED,
+    name="receive_project_incoming_hook",
+)
+async def receive_project_incoming_hook(
+    token: str,
+    request: Request,
+    db: Session = Depends(get_db),
+) -> ProjectIncomingReceipt:
+    result = await project_incoming_hook_service.receive(
+        db,
+        token,
+        await request.body(),
+        request.headers.get("content-type", ""),
+        request.headers,
+    )
+    return ProjectIncomingReceipt.model_validate(result)

backend/app/models/__init__.py

@@ -25,6 +25,8 @@
     LoopItemCollaborator,
     ProjectAutomationRule,
     ProjectAutomationRun,
+    ProjectIncomingEvent,
+    ProjectIncomingHook,
 )
 from app.models.dingtalk_doc import DingtalkSyncedNode
 from app.models.im_session import IMPrivateSession, IMSessionMode, IMSessionState
@@ -80,6 +82,8 @@
     "LoopItem",
     "LoopItemAttachment",
     "LoopItemCollaborator",
+    "ProjectIncomingEvent",
+    "ProjectIncomingHook",
     "ProjectAutomationRule",
     "ProjectAutomationRun",
     "Delivery",

backend/app/models/delivery.py

@@ -239,6 +239,18 @@ class ProjectAutomationRun(LoopNode):
     __mapper_args__ = {"polymorphic_identity": "automation_run"}
 
 
+class ProjectIncomingHook(LoopNode):
+    """An opaque project endpoint that turns external events into loop items."""
+
+    __mapper_args__ = {"polymorphic_identity": "incoming_hook"}
+
+
+class ProjectIncomingEvent(LoopNode):
+    """One deduplicated delivery received by a project incoming hook."""
+
+    __mapper_args__ = {"polymorphic_identity": "incoming_event"}
+
+
 class CloudProjectLocalBinding(LoopNode):
     __mapper_args__ = {"polymorphic_identity": "local_binding"}
 

backend/app/schemas/project_incoming_hook.py

@@ -0,0 +1,52 @@
+# SPDX-FileCopyrightText: 2026 Weibo, Inc.
+# SPDX-License-Identifier: Apache-2.0
+
+"""Schemas for deterministic project incoming hooks."""
+
+from datetime import datetime
+from typing import Literal
+
+from pydantic import BaseModel, ConfigDict, Field, field_validator
+
+IncomingHookStatus = Literal["active", "disabled"]
+
+
+class ProjectIncomingHookCreate(BaseModel):
+    name: str = Field(default="外部系统", min_length=1, max_length=100)
+
+    @field_validator("name")
+    @classmethod
+    def normalize_name(cls, value: str) -> str:
+        return value.strip()
+
+
+class ProjectIncomingHookUpdate(BaseModel):
+    name: str | None = Field(default=None, min_length=1, max_length=100)
+    status: IncomingHookStatus | None = None
+    version: int = Field(ge=1)
+
+    @field_validator("name")
+    @classmethod
+    def normalize_name(cls, value: str | None) -> str | None:
+        return value.strip() if value is not None else None
+
+
+class ProjectIncomingHookView(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: str
+    project_id: str
+    name: str
+    status: IncomingHookStatus
+    webhook_url: str
+    version: int
+    created_at: datetime
+    updated_at: datetime
+
+
+class ProjectIncomingReceipt(BaseModel):
+    status: Literal["created", "duplicate", "ignored", "failed"]
+    provider: str
+    event_id: str
+    loop_item_id: str | None = None
+    reason: str | None = None