Guard against empty webhook update, verify PUT body on wire

Two fresh-eyes findings on #1806:

1. `WebhookRequest.update_req` used to happily serialize
   `<tsRequest><webhook/></tsRequest>` when every updatable field on the
   WebhookItem was None. The server rejected that with a generic 400 the
   caller couldn't act on. Now raises ValueError up front with a message
   naming the four fields that would resolve it.

2. `test_update` verified the response-derived WebhookItem but never
   inspected the PUT body, so removing the `update_req` call in the
   endpoint would keep the test green. Added `m.last_request` assertions
   on the wire: name, isEnabled, url, and event tag all present in the
   PUT payload. This is the load-bearing endpoint<->factory contract check.

Also added test_update_rejects_empty_payload confirming the new guard
fires when nothing is set on the item.

28 passed on test_webhook.py.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: jacalata

tableauserverclient/server/request_factory.py

@@ -1414,6 +1414,21 @@ def create_req(self, xml_request: ET.Element, webhook_item: "WebhookItem") -> by
 
     @_tsrequest_wrapped
     def update_req(self, xml_request: ET.Element, webhook_item: "WebhookItem") -> bytes:
+        # Reject a no-op update up front. Without at least one updatable
+        # attribute set the payload is <tsRequest><webhook/></tsRequest>,
+        # which the server rejects with a generic 400 that gives the caller
+        # no idea what happened. Raise here with an actionable message.
+        if (
+            webhook_item.name is None
+            and webhook_item.is_enabled is None
+            and webhook_item._event is None
+            and webhook_item.url is None
+        ):
+            raise ValueError(
+                "WebhookItem has no updatable fields set; "
+                "at least one of name, is_enabled, event, or url must be provided."
+            )
+
         webhook = ET.SubElement(xml_request, "webhook")
         if webhook_item.name is not None:
             webhook.attrib["name"] = webhook_item.name

test/test_webhook.py

@@ -197,6 +197,19 @@ def test_update(server: TSC.Server) -> None:
 
         updated_webhook = server.webhooks.update(webhook_item)
 
+        # Verify the actual PUT body reached the wire with the caller's values.
+        # Without this, deleting the update_req call in the endpoint would still
+        # pass every response-derived assertion below (response is mocked and
+        # comes back verbatim). This is the load-bearing endpoint <-> factory
+        # contract check.
+        assert m.last_request is not None
+        assert m.last_request.method == "PUT"
+        body = m.last_request.text or ""
+        assert 'name="webhook-name-updated"' in body, body
+        assert 'isEnabled="true"' in body, body
+        assert 'url="https://updated-url.example.com/hook"' in body, body
+        assert "datasource-created" in body, body
+
         assert updated_webhook.id == "webhook-id"
         assert updated_webhook.name == "webhook-name-updated"
         assert updated_webhook.url == "https://updated-url.example.com/hook"
@@ -210,6 +223,19 @@ def test_update_missing_id(server: TSC.Server) -> None:
         server.webhooks.update(webhook_item)
 
 
+def test_update_rejects_empty_payload() -> None:
+    # A WebhookItem with no updatable fields set should raise up front rather
+    # than serializing to <tsRequest><webhook/></tsRequest> and letting the
+    # server return a generic 400. Uses update_req directly so the guard is
+    # exercised even before the endpoint sees the item.
+    from tableauserverclient.server.request_factory import RequestFactory
+
+    webhook_item = WebhookItem()
+    webhook_item._id = "webhook-id"  # has an id but nothing to update
+    with pytest.raises(ValueError, match="no updatable fields"):
+        RequestFactory.Webhook.update_req(webhook_item)
+
+
 def test_update_preserves_locally_set_fields_omitted_by_server(server: TSC.Server) -> None:
     """update should preserve locally-set fields that the server response omits.