fix(line): bound preverify webhook concurrency (#58199)

* fix(line): bound preverify webhook concurrency

* test(line): cover preauth release timing

* fix(line): release webhook preauth slots earlier

extensions/line/src/webhook-node.test.ts

@@ -286,6 +286,42 @@ describe("createLineNodeWebhookHandler", () => {
     );
   });
 
+  it("releases authenticated requests before event processing completes", async () => {
+    const rawBody = JSON.stringify({ events: [{ type: "message" }] });
+    let releaseAuthenticated!: () => void;
+    const bot = {
+      handleWebhook: vi.fn(
+        async () =>
+          await new Promise<void>((resolve) => {
+            releaseAuthenticated = resolve;
+          }),
+      ),
+    };
+    const onRequestAuthenticated = vi.fn();
+    const runtime = { log: vi.fn(), error: vi.fn(), exit: vi.fn() };
+    const handler = createLineNodeWebhookHandler({
+      channelSecret: SECRET,
+      bot,
+      runtime,
+      readBody: async () => rawBody,
+      onRequestAuthenticated,
+    });
+
+    const { res } = createRes();
+    const request = runSignedPost({ handler, rawBody, secret: SECRET, res });
+
+    await vi.waitFor(() => {
+      expect(onRequestAuthenticated).toHaveBeenCalledTimes(1);
+      expect(bot.handleWebhook).toHaveBeenCalledTimes(1);
+    });
+
+    expect(res.headersSent).toBe(false);
+    releaseAuthenticated();
+    await request;
+
+    expect(res.statusCode).toBe(200);
+  });
+
   it("returns 500 when event processing fails and does not acknowledge with 200", async () => {
     const rawBody = JSON.stringify({ events: [{ type: "message" }] });
     const { secret } = createPostWebhookTestHarness(rawBody);