@cosmicdrift/kumiko-samples 0.393.0 → 0.395.0

package/packages/bundled-features/src/inbound-mail-foundation/handlers/attach-message-content.write.ts

@@ -0,0 +1,184 @@
+// attach-message-content — stores the content of a message that was imported as snippet only, after
+// the supervisor re-downloaded it. Appends one content-fetched event on the existing stream; no
+// thread rollup, no new message row. A header-only import from quarantine takes its content the
+// same way. Nested dispatches skip the pre-transaction upload and store in their own transaction.
+
+import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { ConflictError, failNotFound, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import type {
+  BeforeTransactionContext,
+  BeforeTransactionResult,
+  WriteResult,
+} from "@cosmicdrift/kumiko-types/handlers";
+import * as z from "zod";
+import { inboundMessageAggregateId } from "../aggregate-id.ts";
+import {
+  INBOUND_MESSAGE_AGGREGATE_TYPE,
+  INBOUND_MESSAGE_CONTENT_FETCHED_EVENT_QN,
+  INBOUND_MESSAGE_RECEIVED_EVENT_QN,
+  type InboundContentState,
+  type InboundMessageContentFetchedEventPayload,
+} from "../events.ts";
+import { inboundMessagesProjectionTable } from "../projection.ts";
+import {
+  finalizePreparedContent,
+  type PreparedInboundContent,
+  prepareInboundContent,
+} from "./ingest-message-prepare.ts";
+import {
+  contentStateOf,
+  encryptMessageBodyText,
+  inboundContentPayloadShape,
+  MESSAGE_LOCK_NAMESPACE,
+  storeInboundMessageContent,
+} from "./message-content.ts";
+
+export const attachMessageContentSchema = z.object({
+  accountId: z.uuid(),
+  providerMessageId: z.string().min(1).max(500),
+  /** "unavailable" is terminal: the mail is gone from the server or cannot be parsed. */
+  outcome: z.enum(["fetched", "unavailable"]),
+  ...inboundContentPayloadShape,
+});
+
+type AttachMessageContentPayload = z.infer<typeof attachMessageContentSchema>;
+
+const COMPLETE: InboundContentState = "complete";
+
+function hasContentAlready(events: readonly { type: string; payload: unknown }[]): boolean {
+  return events.some((e) => {
+    if (e.type === INBOUND_MESSAGE_CONTENT_FETCHED_EVENT_QN) return true;
+    const state = z.object({ contentState: z.string() }).safeParse(e.payload);
+    return state.success && state.data.contentState === COMPLETE;
+  });
+}
+
+const receivedOwnerSchema = z.object({ ownerUserId: z.string().nullable() });
+
+function ownerUserIdOfStream(events: readonly { type: string; payload: unknown }[]): string | null {
+  const received = events.find((e) => e.type === INBOUND_MESSAGE_RECEIVED_EVENT_QN);
+  const parsed = receivedOwnerSchema.safeParse(received?.payload);
+  return parsed.success ? parsed.data.ownerUserId : null;
+}
+
+// Read before the transaction, so it can only skip work: a row that already shows attached content
+// spares parallel refetches the upload. The event check under the message lock stays authoritative.
+async function showsAttachedContent(
+  db: BeforeTransactionContext["db"],
+  messageAggId: string,
+): Promise<boolean> {
+  const [row] = await db.selectMany(
+    inboundMessagesProjectionTable,
+    { id: messageAggId },
+    { fields: ["contentState", "contentUnavailableReason"] },
+  );
+  if (row === undefined) return false;
+  if (row["contentState"] === COMPLETE) return true;
+  // "quarantined" is the header-only import still waiting for its content.
+  return row["contentState"] === "unavailable" && row["contentUnavailableReason"] !== "quarantined";
+}
+
+function contentInputOf(payload: AttachMessageContentPayload, messageAggId: string) {
+  return {
+    accountId: payload.accountId,
+    messageAggId,
+    bodyRef: "",
+    rawMime: payload.rawMime,
+    bodyHtml: payload.bodyHtml,
+    attachments: payload.attachments,
+    skippedAttachments: payload.skippedAttachments,
+  };
+}
+
+async function contentEventPayloadOf(
+  payload: AttachMessageContentPayload,
+  content: Awaited<ReturnType<typeof storeInboundMessageContent>> | undefined,
+  tenantId: Parameters<typeof encryptMessageBodyText>[0],
+  messageAggId: string,
+  ownerUserId: string | null,
+): Promise<InboundMessageContentFetchedEventPayload> {
+  const fetched = payload.outcome === "fetched";
+  return {
+    accountId: payload.accountId,
+    ownerUserId,
+    bodyRef: content?.bodyRef ?? "",
+    bodyText: await encryptMessageBodyText(tenantId, messageAggId, fetched ? payload.bodyText : ""),
+    bodyTextTruncated: fetched && payload.bodyTextTruncated,
+    attachmentFileIds: content?.attachmentFileIds ?? [],
+    skippedAttachments: content?.skippedAttachments ?? [],
+    contentState: content
+      ? contentStateOf({
+          bodyText: payload.bodyText,
+          hasOriginal: payload.rawMime !== undefined || payload.bodyHtml !== undefined,
+          contentStorage: content.contentStorage,
+        })
+      : "unavailable",
+    contentUnavailableReason: !content
+      ? "gone_from_server"
+      : content.contentStorage === "unavailable"
+        ? "no_file_storage"
+        : null,
+  };
+}
+
+export const attachMessageContentHandler = defineWriteHandler({
+  name: "attach-message-content",
+  schema: attachMessageContentSchema,
+  access: { roles: ["SystemAdmin"] },
+  agent: { expose: false },
+  description:
+    "Stores the full text, original and attachments of an already imported snippet-only or quarantined mail, or marks its content as unavailable when the provider no longer has it; called by the sync supervisor, a second call for the same mail is a no-op.",
+  beforeTransactionWhenNested: "skip",
+  beforeTransaction: async (
+    event,
+    ctx,
+  ): Promise<BeforeTransactionResult<PreparedInboundContent | undefined>> => {
+    const { payload } = event;
+    if (payload.outcome !== "fetched") return { isSuccess: true, data: undefined };
+    const messageAggId = inboundMessageAggregateId(payload.accountId, payload.providerMessageId);
+    if (await showsAttachedContent(ctx.db, messageAggId))
+      return { isSuccess: true, data: undefined };
+    return prepareInboundContent(ctx, contentInputOf(payload, messageAggId));
+  },
+  handler: async (event, ctx): Promise<WriteResult<{ readonly duplicate: boolean }>> => {
+    const { payload } = event;
+    const prepared: PreparedInboundContent | undefined = event.prepared;
+    const tenantId = event.user.tenantId;
+    const messageAggId = inboundMessageAggregateId(payload.accountId, payload.providerMessageId);
+
+    await ctx.db.advisoryXactLock(MESSAGE_LOCK_NAMESPACE, messageAggId);
+    const events = await ctx.events.load(messageAggId);
+    if (events.length === 0) return failNotFound("inbound-message", messageAggId);
+    if (hasContentAlready(events)) {
+      return { isSuccess: true as const, data: { duplicate: true as const } };
+    }
+
+    const content =
+      payload.outcome !== "fetched"
+        ? undefined
+        : prepared
+          ? await finalizePreparedContent(ctx, prepared)
+          : await storeInboundMessageContent(ctx, contentInputOf(payload, messageAggId));
+    const eventPayload = await contentEventPayloadOf(
+      payload,
+      content,
+      tenantId,
+      messageAggId,
+      ownerUserIdOfStream(events),
+    );
+    const appended = await ctx.events.tryAppend({
+      aggregateId: messageAggId,
+      aggregateType: INBOUND_MESSAGE_AGGREGATE_TYPE,
+      type: INBOUND_MESSAGE_CONTENT_FETCHED_EVENT_QN,
+      payload: eventPayload,
+      headers: { providerMessageId: payload.providerMessageId, outcome: payload.outcome },
+    });
+    // Losing the version race must roll back the stored attachments instead of reporting success.
+    if (!appended.ok) {
+      return writeFailure(
+        new ConflictError({ message: "inbound message content changed concurrently" }),
+      );
+    }
+    return { isSuccess: true as const, data: { duplicate: false as const } };
+  },
+});

package/packages/bundled-features/src/inbound-mail-foundation/handlers/connect-account.write.ts

@@ -1,4 +1,4 @@
-// connect-account — A tenant admin connects a mailbox. Creates the
+// connect-account — A tenant admin connects a mailbox (a member's personal one goes through the provider form, which dispatches here as the system user). Creates the
 // mail-account stream (aggregateId = random uuid = accountId =
 // secret-slot key for the IMAP password/OAuth refresh token).
 //
@@ -11,15 +11,28 @@
 //     and switches to auth_error via update-account on failure—the connect
 //     stays fast and offline-capable (the test result arrives asynchronously
 //     as a status transition).
+//   - No second account for one address: a live or disconnected address is
+//     refused (409 reasons in InboundMailConnectErrors); only a disconnected or
+//     sign-in-failed OAuth mailbox is reopened in place, keeping its account id and cursor.
+//     The reopen returns the existing id and changes nothing yet; the callback re-arms it.
 
 import {
   configuredPiiSubjectKms,
   encryptPiiFieldValues,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { failUnprocessable } from "@cosmicdrift/kumiko-framework/errors";
+import {
+  failUnprocessable,
+  UnprocessableError,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { InboundMailAccountStatuses, InboundMailAuthMethods } from "../constants.ts";
+import {
+  InboundMailAccountStatuses,
+  InboundMailAuthMethods,
+  InboundMailConnectErrors,
+  InboundMailFoundationHandlers,
+} from "../constants.ts";
 import { MAIL_ACCOUNT_PII_FIELDS, mailAccountEntity } from "../entities.ts";
 import {
   MAIL_ACCOUNT_AGGREGATE_TYPE,
@@ -27,91 +40,131 @@ import {
   type MailAccountEventHeaders,
   type MailAccountEventPayload,
 } from "../events.ts";
+import { accessRolesOf, type InboundMailRoles } from "../mail-roles.ts";
+import { connectConflictOf, findMailboxByAddress } from "./account-address.ts";
 
-export const connectAccountSchema = z.object({
-  /** Provider key registered with the extension ("imap",
-   *  "m365-graph", "gmail-rest"). */
-  provider: z.string().min(1).max(50),
-  authMethod: z.enum([
-    InboundMailAuthMethods.password,
-    InboundMailAuthMethods.xoauth2,
-    InboundMailAuthMethods.oauth,
-  ]),
-  displayName: z.string().trim().max(200),
-  /** Mailbox address in plaintext; it is encrypted here. */
-  address: z.string().min(1).max(320),
-  /** "shared" = shared across the tenant (info@) · "user" = the caller's
-   *  personal mailbox (ownerUserId is taken from the session, never from
-   *  the payload—preventing claims on another user's mailbox). */
-  scope: z.enum(["shared", "user"]),
-  /** Only for the programmatic OAuth callback path (SystemAdmin): there,
-   *  the dispatcher user is a SystemUser and the actual owner is in the
-   *  HMAC-verified state. Tenant callers must not set this field (the
-   *  handler prevents claims on another user's mailbox). */
-  ownerUserIdOverride: z.string().max(36).nullable().optional(),
-});
+export const connectAccountSchema = z
+  .object({
+    /** Provider key registered with the extension ("imap",
+     *  "m365-graph", "gmail-rest"). */
+    provider: z.string().min(1).max(50),
+    authMethod: z.enum([
+      InboundMailAuthMethods.password,
+      InboundMailAuthMethods.xoauth2,
+      InboundMailAuthMethods.oauth,
+    ]),
+    displayName: z.string().trim().max(200),
+    /** Mailbox address in plaintext; it is encrypted here. */
+    address: z.string().min(1).max(320),
+    /** "shared" = shared across the tenant (info@) · "user" = the caller's
+     *  personal mailbox (ownerUserId is taken from the session, never from
+     *  the payload—preventing claims on another user's mailbox). */
+    scope: z.enum(["shared", "user"]),
+    /** Only for the programmatic OAuth callback path (SystemAdmin): there,
+     *  the dispatcher user is a SystemUser and the actual owner is in the
+     *  HMAC-verified state. Tenant callers must not set this field (the
+     *  handler prevents claims on another user's mailbox). */
+    ownerUserIdOverride: z.string().max(36).nullable().optional(),
+  })
+  // trustedAuthservId is deliberately not accepted here: it decides which Authentication-Results header
+  // is believed, so it only changes through set-trusted-authserv-id.
+  .strict();
 type ConnectAccountPayload = z.infer<typeof connectAccountSchema>;
 
-export const connectAccountHandler: WriteHandlerDef = {
-  name: "connect-account",
-  schema: connectAccountSchema,
-  access: { roles: ["SystemAdmin", "TenantAdmin"] },
-  description:
-    "Registers a mailbox for the tenant (provider, auth method, display name, encrypted address, shared or personal) and returns the new accountId that also keys its credential slot; use it to start a mail connection, credentials and the first connection test happen outside this call.",
-  handler: async (event, ctx) => {
-    // @cast-boundary engine-payload — dispatcher-zod-validated payload
-    const payload = event.payload as ConnectAccountPayload;
-    const tenantId = event.user.tenantId;
-    const accountId = crypto.randomUUID();
+export function createConnectAccountHandler({ adminRoles }: InboundMailRoles): WriteHandlerDef {
+  return {
+    name: "connect-account",
+    schema: connectAccountSchema,
+    access: { roles: accessRolesOf(InboundMailFoundationHandlers.connectAccount, adminRoles) },
+    // Connects a mailbox, like disconnect-account (risk high), which the model must not trigger on its own.
+    agent: { expose: false },
+    description:
+      "Registers a mailbox for the tenant (provider, auth method, display name, encrypted address, shared or personal) and returns the new accountId that also keys its credential slot; use it to start a mail connection, credentials and the first connection test happen outside this call.",
+    handler: async (event, ctx) => {
+      // @cast-boundary engine-payload — dispatcher-zod-validated payload
+      const payload = event.payload as ConnectAccountPayload;
+      const tenantId = event.user.tenantId;
+      const accountId = crypto.randomUUID();
+
+      if (payload.ownerUserIdOverride !== undefined && !event.user.roles.includes("SystemAdmin")) {
+        return failUnprocessable("owner_override_requires_system_admin");
+      }
+      const ownerUserId =
+        payload.ownerUserIdOverride !== undefined
+          ? payload.ownerUserIdOverride
+          : payload.scope === "user"
+            ? event.user.id
+            : null;
 
-    if (payload.ownerUserIdOverride !== undefined && !event.user.roles.includes("SystemAdmin")) {
-      return failUnprocessable("owner_override_requires_system_admin");
-    }
-    const ownerUserId =
-      payload.ownerUserIdOverride !== undefined
-        ? payload.ownerUserIdOverride
-        : payload.scope === "user"
-          ? event.user.id
-          : null;
+      const existing = await findMailboxByAddress(ctx, tenantId, payload.address);
+      if (existing) {
+        const matched = connectConflictOf(existing, {
+          authMethod: payload.authMethod,
+          provider: payload.provider,
+          ownerUserId,
+        });
+        // Only the OAuth callback (it passes ownerUserIdOverride) reopens: it stores the fresh token and
+        // only then switches the account on via reactivate-account. Everyone else gets the plain conflict.
+        const conflict =
+          matched === "reopen_in_place" && payload.ownerUserIdOverride === undefined
+            ? existing.status === InboundMailAccountStatuses.disconnected
+              ? "address_disconnected"
+              : "already_connected"
+            : matched;
+        if (conflict === "reopen_in_place") {
+          return {
+            isSuccess: true as const,
+            data: { accountId: existing.id, reconnected: true as const },
+          };
+        }
+        const { reason, i18nKey } =
+          conflict === "address_disconnected"
+            ? InboundMailConnectErrors.addressDisconnected
+            : InboundMailConnectErrors.addressAlreadyConnected;
+        return writeFailure(new UnprocessableError(reason, { i18nKey }));
+      }
 
-    // PII-encrypt the address before the append. This is the only write path to
-    // the stream, so it covers both the event log and the projection.
-    const piiKms = configuredPiiSubjectKms();
-    const plainPii = { tenantId, address: payload.address };
-    const encryptedFields = piiKms
-      ? await encryptPiiFieldValues(
-          plainPii,
-          mailAccountEntity,
-          MAIL_ACCOUNT_PII_FIELDS,
-          piiKms,
-          { requestId: `inbound-mail-foundation:connect-account:${accountId}`, tenantId },
-          { tenantId, entityName: MAIL_ACCOUNT_AGGREGATE_TYPE },
-        )
-      : plainPii;
+      // PII-encrypt the address before the append. This is the only write path to
+      // the stream, so it covers both the event log and the projection.
+      const piiKms = configuredPiiSubjectKms();
+      const plainPii = { tenantId, address: payload.address };
+      const encryptedFields = piiKms
+        ? await encryptPiiFieldValues(
+            plainPii,
+            mailAccountEntity,
+            MAIL_ACCOUNT_PII_FIELDS,
+            piiKms,
+            { requestId: `inbound-mail-foundation:connect-account:${accountId}`, tenantId },
+            { tenantId, entityName: MAIL_ACCOUNT_AGGREGATE_TYPE },
+          )
+        : plainPii;
 
-    const eventPayload: MailAccountEventPayload = {
-      provider: payload.provider,
-      authMethod: payload.authMethod,
-      ownerUserId,
-      displayName: payload.displayName,
-      address: encryptedFields.address,
-      // The account is active upon connection; the supervisor picks it up on
-      // the next tick and downgrades it when credentials fail.
-      status: InboundMailAccountStatuses.active,
-      watchState: "idle",
-    };
-    const headers: MailAccountEventHeaders = {
-      providerName: payload.provider,
-      reason: "connect_flow",
-    };
-    await ctx.events.unsafeAppend({
-      aggregateId: accountId,
-      aggregateType: MAIL_ACCOUNT_AGGREGATE_TYPE,
-      type: MAIL_ACCOUNT_CONNECTED_EVENT_QN,
-      payload: eventPayload,
-      headers,
-    });
+      const eventPayload: MailAccountEventPayload = {
+        provider: payload.provider,
+        authMethod: payload.authMethod,
+        ownerUserId,
+        displayName: payload.displayName,
+        address: encryptedFields.address,
+        // The account is active upon connection; the supervisor picks it up on
+        // the next tick and downgrades it when credentials fail.
+        status: InboundMailAccountStatuses.active,
+        watchState: "idle",
+        lastError: null,
+        trustedAuthservId: null,
+      };
+      const headers: MailAccountEventHeaders = {
+        providerName: payload.provider,
+        reason: "connect_flow",
+      };
+      await ctx.events.unsafeAppend({
+        aggregateId: accountId,
+        aggregateType: MAIL_ACCOUNT_AGGREGATE_TYPE,
+        type: MAIL_ACCOUNT_CONNECTED_EVENT_QN,
+        payload: eventPayload,
+        headers,
+      });
 
-    return { isSuccess: true as const, data: { accountId } };
-  },
-};
+      return { isSuccess: true as const, data: { accountId, reconnected: false as const } };
+    },
+  };
+}

package/packages/bundled-features/src/inbound-mail-foundation/handlers/disconnect-account.write.ts

@@ -1,72 +1,92 @@
 // disconnect-account — A TenantAdmin disconnects a mailbox. The stream is retained
 // for audit history, the status becomes disconnected, and the watch supervisor
-// skips the account starting with the next tick. Secret cleanup (IMAP password/
-// refresh token in the accountId slot) is handled by the caller flow; this handler
-// does not touch the secrets path.
+// skips the account starting with the next tick. The credential secret (IMAP password/
+// refresh token in the accountId slot) is deleted in the same transaction, so a
+// disconnected mailbox cannot be re-armed with a stale credential.
 //
 // Idempotent: disconnecting an already disconnected account is a success no-op
 // with no second event, making double-clicks and retries safe.
 
+import { requireSecretsContext } from "@cosmicdrift/kumiko-bundled-features/secrets";
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { failNotFound } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { InboundMailAccountStatuses } from "../constants.ts";
+import { InboundMailAccountStatuses, inboundCredentialSecretKey } from "../constants.ts";
 import {
   MAIL_ACCOUNT_AGGREGATE_TYPE,
   MAIL_ACCOUNT_DISCONNECTED_EVENT_QN,
   type MailAccountEventHeaders,
   type MailAccountEventPayload,
 } from "../events.ts";
+import type { InboundMailRoles } from "../mail-roles.ts";
 import { loadCurrentMailAccountPayload } from "./account-state.ts";
 
 export const disconnectAccountSchema = z.object({
   accountId: z.uuid(),
   reason: z.string().min(1).max(100).default("tenant_admin"),
 });
+const CREDENTIAL_DELETE_REASON =
+  "the credential secret is deleted on the request transaction so a failed disconnect leaves the secret in place and the account status stays consistent with it";
+
 type DisconnectAccountPayload = z.infer<typeof disconnectAccountSchema>;
 
-export const disconnectAccountHandler: WriteHandlerDef = {
-  name: "disconnect-account",
-  schema: disconnectAccountSchema,
-  access: { roles: ["SystemAdmin", "TenantAdmin"] },
-  description:
-    "Puts a connected mailbox into the final disconnected state so the watch supervisor stops fetching it, keeping the stream for audit and requiring a fresh connect to resume; use it to stop mail ingestion for one mailbox.",
-  agent: { risk: "high" },
-  handler: async (event, ctx) => {
-    // @cast-boundary engine-payload — dispatcher-zod-validated payload
-    const payload = event.payload as DisconnectAccountPayload;
+export function createDisconnectAccountHandler({ adminRoles }: InboundMailRoles): WriteHandlerDef {
+  return {
+    name: "disconnect-account",
+    schema: disconnectAccountSchema,
+    access: { roles: [...adminRoles] },
+    description:
+      "Puts a connected mailbox into the final disconnected state so the watch supervisor stops fetching it, keeping the stream for audit and requiring a fresh connect to resume; use it to stop mail ingestion for one mailbox.",
+    agent: { risk: "high" },
+    escapeHatch: { grants: ["unsafeRaw"], reason: CREDENTIAL_DELETE_REASON },
+    handler: async (event, ctx) => {
+      // @cast-boundary engine-payload — dispatcher-zod-validated payload
+      const payload = event.payload as DisconnectAccountPayload;
 
-    const current = await loadCurrentMailAccountPayload(ctx, payload.accountId);
-    if (!current) {
-      return failNotFound("mail-account", payload.accountId);
-    }
-    if (current.status === InboundMailAccountStatuses.disconnected) {
-      return {
-        isSuccess: true as const,
-        data: { accountId: payload.accountId, alreadyDisconnected: true as const },
+      const current = await loadCurrentMailAccountPayload(ctx, payload.accountId);
+      if (!current) {
+        return failNotFound("mail-account", payload.accountId);
+      }
+      if (current.status === InboundMailAccountStatuses.disconnected) {
+        return {
+          isSuccess: true as const,
+          data: { accountId: payload.accountId, alreadyDisconnected: true as const },
+        };
+      }
+
+      const eventPayload: MailAccountEventPayload = {
+        ...current,
+        status: InboundMailAccountStatuses.disconnected,
+        watchState: "idle",
       };
-    }
+      const headers: MailAccountEventHeaders = {
+        providerName: current.provider,
+        reason: payload.reason,
+      };
+      await ctx.events.unsafeAppend({
+        aggregateId: payload.accountId,
+        aggregateType: MAIL_ACCOUNT_AGGREGATE_TYPE,
+        type: MAIL_ACCOUNT_DISCONNECTED_EVENT_QN,
+        payload: eventPayload,
+        headers,
+      });
 
-    const eventPayload: MailAccountEventPayload = {
-      ...current,
-      status: InboundMailAccountStatuses.disconnected,
-      watchState: "idle",
-    };
-    const headers: MailAccountEventHeaders = {
-      providerName: current.provider,
-      reason: payload.reason,
-    };
-    await ctx.events.unsafeAppend({
-      aggregateId: payload.accountId,
-      aggregateType: MAIL_ACCOUNT_AGGREGATE_TYPE,
-      type: MAIL_ACCOUNT_DISCONNECTED_EVENT_QN,
-      payload: eventPayload,
-      headers,
-    });
+      // Tests and apps without a secrets store have no credential to remove.
+      if (ctx.services.secrets) {
+        await requireSecretsContext(
+          { secrets: ctx.services.secrets, user: ctx.user },
+          "disconnect-account",
+        )
+          .withRunner(ctx.db.unsafeRaw())
+          .delete(event.user.tenantId, inboundCredentialSecretKey(payload.accountId), {
+            deletedBy: event.user.id,
+          });
+      }
 
-    return {
-      isSuccess: true as const,
-      data: { accountId: payload.accountId, alreadyDisconnected: false as const },
-    };
-  },
-};
+      return {
+        isSuccess: true as const,
+        data: { accountId: payload.accountId, alreadyDisconnected: false as const },
+      };
+    },
+  };
+}