@bevel-software/platform-core-backend 0.3.1 → 0.3.2

package/src/modules/secrets-vault/__tests__/db-secrets-vault.oauth.test.ts

@@ -188,6 +188,45 @@ describe('DbSecretsVaultService — dead-grant detection on refresh', () => {
     expect(stored.tokens).toBeUndefined();
   });
 
+  it('a SUCCESSFUL refresh notifies mutation listeners with the row user (cache repair signal)', async () => {
+    const { db } = makeFakeDb([
+      [userRow()], // resolve row lookup
+      undefined, // refreshed-token persist
+    ]);
+    const svc = new DbSecretsVaultService(db, ENC_KEY, undefined, userScope);
+    const onMutation = vi.fn();
+    svc.onMutation(onMutation);
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async () =>
+        new Response(
+          JSON.stringify({ access_token: 'fresh-at', refresh_token: 'rt-2', expires_in: 3600 }),
+          { status: 200 },
+        ),
+      ),
+    );
+
+    await expect(svc.resolve('user-1', KEY)).resolves.toBe('fresh-at');
+    expect(onMutation).toHaveBeenCalledWith('user-1');
+  });
+
+  it('putSharedOAuthProvider notifies mutation listeners with null (shared → everyone)', async () => {
+    const { db } = makeFakeDb([undefined]); // provider upsert
+    const svc = new DbSecretsVaultService(db, ENC_KEY);
+    const onMutation = vi.fn();
+    svc.onMutation(onMutation);
+    await svc.putSharedOAuthProvider({
+      key: KEY,
+      provider: {
+        clientId: 'client-1',
+        authorizationUrl: 'https://idp.example.com/authorize',
+        tokenUrl: 'https://idp.example.com/token',
+        scopes: ['mcp.read'],
+      },
+    });
+    expect(onMutation).toHaveBeenCalledWith(null);
+  });
+
   it('a transient failure (network / 5xx) keeps the tokens and returns the stale one', async () => {
     for (const impl of [
       async () => new Response('bad gateway', { status: 502 }),

package/src/modules/secrets-vault/db-secrets-vault.service.ts

@@ -582,6 +582,10 @@ export class DbSecretsVaultService implements ISecretsVaultService {
       .update(secrets)
       .set({ valueEncrypted: this.crypto().encrypt(JSON.stringify(next)), updatedAt: new Date() })
       .where(and(eq(secrets.id, row.id), eq(secrets.valueEncrypted, row.valueEncrypted)));
+    // A successful refresh is a credential repair — notify so dependent caches
+    // (the MCP proxy's manual-failure memo) retry immediately. `row.userId` is
+    // null for a shared (admin-scope) row, which maps to "affects everyone".
+    this.notifyMutation(row.userId);
     return refreshed.access_token;
   }
 
@@ -609,6 +613,7 @@ export class DbSecretsVaultService implements ISecretsVaultService {
         targetWhere: isNull(secrets.userId),
         set: { kind: 'oauth', valueEncrypted, oauthMeta, updatedAt: new Date() },
       });
+    this.notifyMutation(null);
   }
 
   async getSharedOAuthProvider(key: string): Promise<OAuthProviderConfig | null> {