fix(gateway): resolve download_event_id timing bug

[FredericoAndrade]

Problem

download_event_id was always null in intake webhook payloads, causing Make.com's Airtable search formula to evaluate as {WP Event ID} = (empty string) and fail with a 422.

Root cause: The JS submitted intake first, then redirected the browser to the download token URL. The redirect event was logged server-side only after the browser navigation — after intake had already been enqueued. find_redirect_id() always returned null because the redirect row didn't exist yet.

Additionally, WebhookDispatcher had no ORDER BY, so intake could be sent to Make.com before the download webhook even if they were enqueued at the same time.

Fixes

JS sequencing (gateway-modal.js)

• handleIntakeSubmit() now fetches the download URL via ?format=json first
• The server logs the redirect event and returns {url, event_id}
• JS submits intake with download_event_id: event_id, then redirects to file URL
• External downloads skip the JSON fetch (no token to redeem)

PHP: download event_id in JSON response (class-download-controller.php)

• Added last_event_id property set as a side effect of get_file_url()
• handle() includes event_id in the ?format=json response
• No change to resolve() signature or existing tests

PHP: intake accepts event_id from caller (class-intake-controller.php)

• submit() now accepts ?int $download_event_id = null (default keeps tests passing)
• Replaces the always-null DownloadEventRepository::find_redirect_id() DB lookup
• JS passes the reliable event_id obtained from the download fetch

Webhook ordering (class-webhook-dispatcher.php)

• Added ORDER BY id ASC to dispatch_pending() query
• Download webhook (lower ID, enqueued first) always delivered to Make.com before intake

Make.com: no scenario changes needed

The intake webhook now reliably carries download_event_id, so the existing M24 search formula {WP Event ID} = {{1.download_event_id}} will work correctly.

Test plan

• All 202 PHPUnit tests pass (composer test)
• PHPCS clean (composer lint)
• Deploy to production (rsync + dispatch_pending trigger)
• Full end-to-end: download a gated resource → verify download_event_id is non-null in intake webhook payload → verify Make.com updates Downloads record correctly

🤖 Generated with Claude Code