@shipfox/api-integration-core 12.1.1 → 12.3.0

package/src/index.ts

@@ -267,13 +267,18 @@ export async function createIntegrationsContext(
       {
         taskQueue: INTEGRATIONS_MAINTENANCE_TASK_QUEUE,
         workflowsPath: maintenanceWorkflowsPath,
-        activities: createIntegrationsMaintenanceActivities,
+        activities: () => createIntegrationsMaintenanceActivities({registry}),
         workflows: [
           {
             name: 'pruneWebhookDeliveriesCron',
             id: 'integrations-prune-webhook-deliveries',
             cronSchedule: '0 3 * * *',
           },
+          {
+            name: 'cleanupIntegrationSecretsCron',
+            id: 'integrations-cleanup-secret-namespaces',
+            cronSchedule: '*/5 * * * *',
+          },
         ],
       },
       ...parts.flatMap((part) => part.workers ?? []),

package/src/presentation/routes/manage-connections.test.ts

@@ -1,4 +1,7 @@
+import {createIntegrationProviderRegistry} from '#core/providers/registry.js';
+import {processIntegrationSecretCleanups} from '#core/secret-cleanup.js';
 import {getIntegrationConnectionById, upsertIntegrationConnection} from '#db/connections.js';
+import {listIntegrationSecretCleanups} from '#db/secret-cleanups.js';
 import {createTestApp, sourceProvider, useIntegrationRouteTest} from '#test/route-utils.js';
 
 describe('PATCH /integration-connections/:connectionId', () => {
@@ -111,6 +114,7 @@ describe('DELETE /integration-connections/:connectionId', () => {
   });
 
   it('runs provider cleanup hooks while retaining ownership of the core row', async () => {
+    const deleteConnectionRemoteResources = vi.fn(() => Promise.resolve(undefined));
     const deleteConnectionRecords = vi.fn(() => Promise.resolve());
     const deleteConnectionSecrets = vi.fn(() => Promise.resolve());
     const app = await createTestApp([
@@ -118,6 +122,7 @@ describe('DELETE /integration-connections/:connectionId', () => {
         provider: 'slack',
         displayName: 'Slack',
         adapters: {},
+        deleteConnectionRemoteResources,
         deleteConnectionRecords,
         deleteConnectionSecrets,
       }),
@@ -137,6 +142,7 @@ describe('DELETE /integration-connections/:connectionId', () => {
     });
 
     expect(res.statusCode).toBe(204);
+    expect(deleteConnectionRemoteResources).toHaveBeenCalledWith(connection);
     expect(deleteConnectionRecords).toHaveBeenCalledWith(connection, {
       tx: expect.anything(),
     });
@@ -144,6 +150,103 @@ describe('DELETE /integration-connections/:connectionId', () => {
     await expect(getIntegrationConnectionById(connection.id)).resolves.toBeUndefined();
   });
 
+  it('runs prepared remote cleanup after the local deletion commits', async () => {
+    const events: string[] = [];
+    const deleteConnectionRemoteResources = vi.fn(() => {
+      events.push('prepare');
+      return Promise.resolve(async () => {
+        events.push('remote');
+        await expect(getIntegrationConnectionById(connection.id)).resolves.toBeUndefined();
+      });
+    });
+    const deleteConnectionRecords = vi.fn(() => {
+      events.push('records');
+      return Promise.resolve();
+    });
+    const deleteConnectionSecrets = vi.fn(() => {
+      events.push('secrets');
+      return Promise.resolve();
+    });
+    const app = await createTestApp([
+      sourceProvider({
+        provider: 'slack',
+        displayName: 'Slack',
+        adapters: {},
+        deleteConnectionRemoteResources,
+        deleteConnectionRecords,
+        deleteConnectionSecrets,
+      }),
+    ]);
+    const connection = await upsertIntegrationConnection({
+      workspaceId: context.workspaceId,
+      provider: 'slack',
+      externalAccountId: 'T123',
+      slug: 'slack_acme',
+      displayName: 'Slack Acme',
+    });
+
+    const res = await app.inject({
+      method: 'DELETE',
+      url: `/integration-connections/${connection.id}`,
+      headers: {authorization: 'Bearer user'},
+    });
+
+    expect(res.statusCode).toBe(204);
+    expect(events).toEqual(['prepare', 'records', 'remote', 'secrets']);
+    await expect(getIntegrationConnectionById(connection.id)).resolves.toBeUndefined();
+  });
+
+  it('holds the provider deletion lock across local and remote cleanup', async () => {
+    const events: string[] = [];
+    const withConnectionDeletionLock = vi.fn(
+      async (_connection: unknown, fn: () => Promise<void>) => {
+        events.push('lock-enter');
+        await fn();
+        events.push('lock-exit');
+      },
+    );
+    const app = await createTestApp([
+      sourceProvider({
+        provider: 'slack',
+        displayName: 'Slack',
+        adapters: {},
+        withConnectionDeletionLock,
+        deleteConnectionRemoteResources: vi.fn(() => {
+          events.push('prepare');
+          return Promise.resolve(() => {
+            events.push('remote');
+            return Promise.resolve();
+          });
+        }),
+        deleteConnectionRecords: vi.fn(() => {
+          events.push('records');
+          return Promise.resolve();
+        }),
+        deleteConnectionSecrets: vi.fn(() => {
+          events.push('secrets');
+          return Promise.resolve();
+        }),
+      }),
+    ]);
+    const connection = await upsertIntegrationConnection({
+      workspaceId: context.workspaceId,
+      provider: 'slack',
+      externalAccountId: 'T123',
+      slug: 'slack_acme',
+      displayName: 'Slack Acme',
+    });
+
+    const res = await app.inject({
+      method: 'DELETE',
+      url: `/integration-connections/${connection.id}`,
+      headers: {authorization: 'Bearer user'},
+    });
+
+    expect(res.statusCode).toBe(204);
+    expect(events).toEqual(['lock-enter', 'prepare', 'records', 'remote', 'secrets', 'lock-exit']);
+    expect(withConnectionDeletionLock).toHaveBeenCalledWith(connection, expect.any(Function));
+  });
+
   it('keeps the connection when provider record cleanup fails', async () => {
     const deleteConnectionSecrets = vi.fn(() => Promise.resolve());
     const app = await createTestApp([
@@ -176,6 +279,68 @@ describe('DELETE /integration-connections/:connectionId', () => {
     expect(deleteConnectionSecrets).not.toHaveBeenCalled();
   });
 
+  it('continues connection deletion when remote cleanup preparation fails', async () => {
+    const deleteConnectionRemoteResources = vi.fn(() =>
+      Promise.reject(new Error('remote cleanup failed')),
+    );
+    const app = await createTestApp([
+      sourceProvider({
+        provider: 'slack',
+        displayName: 'Slack',
+        adapters: {},
+        deleteConnectionRemoteResources,
+      }),
+    ]);
+    const connection = await upsertIntegrationConnection({
+      workspaceId: context.workspaceId,
+      provider: 'slack',
+      externalAccountId: 'T123',
+      slug: 'slack_acme',
+      displayName: 'Slack Acme',
+    });
+
+    const res = await app.inject({
+      method: 'DELETE',
+      url: `/integration-connections/${connection.id}`,
+      headers: {authorization: 'Bearer user'},
+    });
+
+    expect(res.statusCode).toBe(204);
+    expect(deleteConnectionRemoteResources).toHaveBeenCalledWith(connection);
+    await expect(getIntegrationConnectionById(connection.id)).resolves.toBeUndefined();
+  });
+
+  it('continues connection deletion when post-commit remote cleanup fails', async () => {
+    const deleteConnectionRemoteResources = vi.fn(() =>
+      Promise.resolve(() => Promise.reject(new Error('remote cleanup failed'))),
+    );
+    const app = await createTestApp([
+      sourceProvider({
+        provider: 'slack',
+        displayName: 'Slack',
+        adapters: {},
+        deleteConnectionRemoteResources,
+      }),
+    ]);
+    const connection = await upsertIntegrationConnection({
+      workspaceId: context.workspaceId,
+      provider: 'slack',
+      externalAccountId: 'T123',
+      slug: 'slack_acme',
+      displayName: 'Slack Acme',
+    });
+
+    const res = await app.inject({
+      method: 'DELETE',
+      url: `/integration-connections/${connection.id}`,
+      headers: {authorization: 'Bearer user'},
+    });
+
+    expect(res.statusCode).toBe(204);
+    expect(deleteConnectionRemoteResources).toHaveBeenCalledWith(connection);
+    await expect(getIntegrationConnectionById(connection.id)).resolves.toBeUndefined();
+  });
+
   it('deletes the connection when provider secret cleanup fails after commit', async () => {
     const app = await createTestApp([
       sourceProvider({
@@ -201,6 +366,73 @@ describe('DELETE /integration-connections/:connectionId', () => {
 
     expect(res.statusCode).toBe(204);
     await expect(getIntegrationConnectionById(connection.id)).resolves.toBeUndefined();
+    await expect(
+      listIntegrationSecretCleanups({connectionId: connection.id}),
+    ).resolves.toMatchObject([
+      {
+        provider: 'slack',
+        connectionId: connection.id,
+        attemptCount: 1,
+        leaseToken: null,
+      },
+    ]);
+  });
+
+  it('retries provider secret cleanup from a durable post-commit record', async () => {
+    const deleteConnectionSecrets = vi
+      .fn<() => Promise<void>>()
+      .mockRejectedValueOnce(new Error('transient cleanup failure'))
+      .mockResolvedValue(undefined);
+    const provider = sourceProvider({
+      provider: 'slack',
+      displayName: 'Slack',
+      adapters: {},
+      deleteConnectionSecrets,
+    });
+    const app = await createTestApp([provider]);
+    const connection = await upsertIntegrationConnection({
+      workspaceId: context.workspaceId,
+      provider: 'slack',
+      externalAccountId: 'T123',
+      slug: 'slack_acme',
+      displayName: 'Slack Acme',
+    });
+
+    const res = await app.inject({
+      method: 'DELETE',
+      url: `/integration-connections/${connection.id}`,
+      headers: {authorization: 'Bearer user'},
+    });
+
+    const pending = await listIntegrationSecretCleanups({connectionId: connection.id});
+    expect(res.statusCode).toBe(204);
+    expect(pending).toHaveLength(1);
+    expect(pending[0]).toMatchObject({
+      workspaceId: context.workspaceId,
+      provider: 'slack',
+      connectionId: connection.id,
+      attemptCount: 1,
+      leaseToken: null,
+    });
+
+    const result = await processIntegrationSecretCleanups({
+      registry: createIntegrationProviderRegistry([provider]),
+      connectionId: connection.id,
+      now: new Date(Date.now() + 5 * 60 * 1_000),
+      limit: 1,
+    });
+
+    expect(result).toEqual({
+      claimed: 1,
+      completed: 1,
+      failed: 0,
+      unavailable: 0,
+      unacknowledged: 0,
+    });
+    await expect(listIntegrationSecretCleanups({connectionId: connection.id})).resolves.toEqual([]);
+    expect(deleteConnectionSecrets).toHaveBeenCalledTimes(2);
+    expect(deleteConnectionSecrets).toHaveBeenNthCalledWith(1, connection);
+    expect(deleteConnectionSecrets).toHaveBeenNthCalledWith(2, connection);
   });
 
   it('deletes an unregistered provider connection without provider cleanup', async () => {

package/src/presentation/routes/manage-connections.ts

@@ -6,12 +6,14 @@ import {
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
 import type {IntegrationProviderRegistry} from '#core/providers/registry.js';
+import {processIntegrationSecretCleanups} from '#core/secret-cleanup.js';
 import {
   deleteIntegrationConnection,
   getIntegrationConnectionById,
   updateIntegrationConnectionLifecycleStatus,
 } from '#db/connections.js';
 import {db} from '#db/db.js';
+import {enqueueIntegrationSecretCleanup} from '#db/secret-cleanups.js';
 import {toIntegrationConnectionDto} from '#presentation/dto/integrations.js';
 
 const connectionParamsSchema = z.object({
@@ -75,6 +77,7 @@ export function createDeleteIntegrationConnectionRoute(registry: IntegrationProv
         .list()
         .find((candidate) => candidate.provider === connection.provider);
       const hasCleanupHooks =
+        provider?.deleteConnectionRemoteResources !== undefined ||
         provider?.deleteConnectionRecords !== undefined ||
         provider?.deleteConnectionSecrets !== undefined;
       if (!hasCleanupHooks) {
@@ -83,17 +86,48 @@ export function createDeleteIntegrationConnectionRoute(registry: IntegrationProv
           'Deleting integration connection without provider cleanup',
         );
       }
-      await db().transaction(async (tx) => {
-        await provider?.deleteConnectionRecords?.(connection, {tx});
-        await deleteIntegrationConnection({id: connection.id}, {tx});
-      });
-      try {
-        await provider?.deleteConnectionSecrets?.(connection);
-      } catch (error) {
-        request.log.error(
-          {connectionId: connection.id, provider: connection.provider, err: error},
-          'Integration connection secret cleanup failed after connection deletion',
-        );
+      const deleteConnection = async (): Promise<void> => {
+        let deleteRemoteResources: (() => Promise<void>) | undefined;
+        try {
+          deleteRemoteResources = await provider?.deleteConnectionRemoteResources?.(connection);
+        } catch (error) {
+          request.log.error(
+            {connectionId: connection.id, provider: connection.provider, err: error},
+            'Integration connection remote cleanup preparation failed',
+          );
+        }
+        await db().transaction(async (tx) => {
+          await provider?.deleteConnectionRecords?.(connection, {tx});
+          await enqueueIntegrationSecretCleanup({connection}, {tx});
+          await deleteIntegrationConnection({id: connection.id}, {tx});
+        });
+        try {
+          await deleteRemoteResources?.();
+        } catch (error) {
+          request.log.error(
+            {connectionId: connection.id, provider: connection.provider, err: error},
+            'Integration connection remote cleanup failed after deletion',
+          );
+        }
+        try {
+          await processIntegrationSecretCleanups({
+            registry,
+            connectionId: connection.id,
+            connection,
+            limit: 1,
+          });
+        } catch (error) {
+          // The durable cleanup row survives, so a later sweep retries this connection.
+          request.log.error(
+            {connectionId: connection.id, provider: connection.provider, err: error},
+            'Integration connection secret cleanup failed after connection deletion',
+          );
+        }
+      };
+      if (provider?.withConnectionDeletionLock) {
+        await provider.withConnectionDeletionLock(connection, deleteConnection);
+      } else {
+        await deleteConnection();
       }
       reply.status(204);
     },

package/src/providers/jira.test.ts

@@ -1,16 +1,65 @@
 import {
   getJiraInstallationByConnectionId,
   upsertJiraInstallation,
+  withJiraRefreshLock,
 } from '@shipfox/api-integration-jira';
 import {runMigrations} from '@shipfox/node-drizzle';
 import {getIntegrationConnectionById, upsertIntegrationConnection} from '#db/connections.js';
+import {db} from '#db/db.js';
+import {createTestApp, useIntegrationRouteTest} from '#test/route-utils.js';
 
 describe('jiraProviderModule', () => {
+  const context = useIntegrationRouteTest();
+
   afterEach(() => {
     vi.unstubAllEnvs();
     vi.resetModules();
   });
 
+  async function createJiraCleanupFixture() {
+    vi.stubEnv('INTEGRATIONS_ENABLE_JIRA_PROVIDER', 'true');
+    vi.resetModules();
+    const deleteSecrets = vi.fn(() => Promise.resolve(2));
+    const scopedSecrets = {
+      getSecret: vi.fn(() => Promise.resolve(null)),
+      setSecrets: vi.fn(() => Promise.resolve()),
+      deleteSecrets,
+    };
+    const {createPostgresClient} = await import('@shipfox/node-postgres');
+    createPostgresClient();
+    const {loadEnabledProviderModules} = await import('#providers/modules.js');
+    const parts = await loadEnabledProviderModules({
+      secrets: {jira: scopedSecrets, deleteSecrets},
+    });
+    const jiraPart = parts.find((part) => part.provider.provider === 'jira');
+    if (!jiraPart?.database) throw new Error('Jira provider database is not configured');
+    const cloudId = crypto.randomUUID();
+
+    await runMigrations(
+      jiraPart.database.db(),
+      jiraPart.database.migrationsPath,
+      `__drizzle_migrations_${jiraPart.database.databaseNamespace}`,
+    );
+    const connection = await upsertIntegrationConnection({
+      workspaceId: context.workspaceId,
+      provider: 'jira',
+      externalAccountId: cloudId,
+      slug: 'jira_acme',
+      displayName: 'Jira Acme',
+    });
+    await upsertJiraInstallation({
+      connectionId: connection.id,
+      cloudId,
+      siteUrl: 'https://acme.atlassian.net',
+      siteName: 'Acme',
+      authorizingAccountId: 'user-1',
+      scopes: ['read:jira-work'],
+      status: 'installed',
+    });
+
+    return {connection, deleteSecrets, jiraPart, cloudId};
+  }
+
   it('loads its database descriptor and persists a core connection with its Jira installation', async () => {
     vi.stubEnv('INTEGRATIONS_ENABLE_JIRA_PROVIDER', 'true');
     vi.resetModules();
@@ -59,4 +108,88 @@ describe('jiraProviderModule', () => {
       cloudId,
     });
   });
+
+  it('waits for refresh before deleting tokens and allowing a reinstall', async () => {
+    const {cloudId, connection, deleteSecrets, jiraPart} = await createJiraCleanupFixture();
+    const app = await createTestApp([jiraPart.provider]);
+
+    let releaseRefreshLock!: () => void;
+    let refreshLockEntered!: () => void;
+    const refreshLockReady = new Promise<void>((resolve) => {
+      refreshLockEntered = resolve;
+    });
+    const refreshLockReleased = new Promise<void>((resolve) => {
+      releaseRefreshLock = resolve;
+    });
+    const refreshLock = withJiraRefreshLock(connection.id, async () => {
+      refreshLockEntered();
+      await refreshLockReleased;
+    });
+    await refreshLockReady;
+
+    const deletion = app.inject({
+      method: 'DELETE',
+      url: `/integration-connections/${connection.id}`,
+      headers: {authorization: 'Bearer user'},
+    });
+
+    await vi.waitFor(async () => {
+      await expect(getIntegrationConnectionById(connection.id)).resolves.toBeUndefined();
+    });
+    let res!: Awaited<ReturnType<typeof app.inject>>;
+    try {
+      expect(deleteSecrets).not.toHaveBeenCalled();
+    } finally {
+      releaseRefreshLock();
+      await expect(refreshLock).resolves.toMatchObject({acquired: true});
+      res = await deletion;
+    }
+
+    expect(res.statusCode).toBe(204);
+    await expect(getIntegrationConnectionById(connection.id)).resolves.toBeUndefined();
+    await expect(getJiraInstallationByConnectionId(connection.id)).resolves.toBeUndefined();
+    expect(deleteSecrets).toHaveBeenCalledWith({
+      workspaceId: context.workspaceId,
+      namespace: connection.id,
+    });
+
+    const replacement = await upsertIntegrationConnection({
+      workspaceId: context.workspaceId,
+      provider: 'jira',
+      externalAccountId: cloudId,
+      slug: 'jira_acme_again',
+      displayName: 'Jira Acme',
+    });
+    await upsertJiraInstallation({
+      connectionId: replacement.id,
+      cloudId,
+      siteUrl: 'https://acme.atlassian.net',
+      siteName: 'Acme',
+      authorizingAccountId: 'user-1',
+      scopes: ['read:jira-work'],
+      status: 'installed',
+    });
+
+    await expect(getJiraInstallationByConnectionId(replacement.id)).resolves.toMatchObject({
+      cloudId,
+    });
+  });
+
+  it('rolls back provider record cleanup when its transaction fails', async () => {
+    const {connection, jiraPart} = await createJiraCleanupFixture();
+
+    await expect(
+      db().transaction(async (tx) => {
+        await jiraPart.provider.deleteConnectionRecords?.(connection, {tx});
+        throw new Error('transaction failed');
+      }),
+    ).rejects.toThrow('transaction failed');
+
+    await expect(getIntegrationConnectionById(connection.id)).resolves.toMatchObject({
+      id: connection.id,
+    });
+    await expect(getJiraInstallationByConnectionId(connection.id)).resolves.toMatchObject({
+      connectionId: connection.id,
+    });
+  });
 });

package/src/providers/jira.ts

@@ -25,16 +25,26 @@ async function loadJiraModuleParts(
   options: Parameters<IntegrationProviderModule['load']>[0] = {},
 ): Promise<IntegrationModuleParts> {
   const {
+    createJiraApiClient,
     createJiraIntegrationProvider,
     createJiraMaintenanceWorker,
     createJiraPendingSelectionStore,
     createJiraTokenStore,
     db: jiraDb,
+    deregisterJiraWebhooks,
+    deleteJiraInstallationByConnectionId,
     disconnectJiraInstallation: disconnectJiraInstallationRecords,
     getJiraInstallationByCloudId,
+    getJiraInstallationByConnectionId,
+    jiraSecretsNamespace,
+    jiraWebhookUrl,
     migrationsPath,
+    prepareJiraWebhookDeregistration,
     upsertJiraInstallation,
+    withJiraRefreshLockAndWait,
+    withJiraWebhookRegistrationLock,
   } = await import('@shipfox/api-integration-jira');
+  const jira = createJiraApiClient();
 
   async function getExistingJiraConnection(input: {
     cloudId: string;
@@ -91,19 +101,40 @@ async function loadJiraModuleParts(
     );
   }
 
-  async function disconnectJiraInstallation(input: {connectionId: string}): Promise<void> {
-    await disconnectJiraInstallationRecords<IntegrationTx>({
-      connectionId: input.connectionId,
-      getConnection: getIntegrationConnectionById,
-      deleteSecrets: (params) =>
-        options.secrets?.jira?.deleteSecrets({
-          ...params,
-          namespace: jiraNamespaceSuffix(params.namespace),
-        }) ?? Promise.resolve(0),
-      transaction: (fn) => db().transaction((tx) => fn(tx)),
-      deleteConnection: (params, transactionOptions) =>
-        deleteIntegrationConnection({id: params.connectionId}, transactionOptions),
-    });
+  async function disconnectJiraInstallation(input: {
+    connectionId: string;
+    lockAlreadyHeld?: boolean | undefined;
+  }): Promise<void> {
+    const disconnect = () =>
+      disconnectJiraInstallationRecords<IntegrationTx>({
+        connectionId: input.connectionId,
+        getConnection: getIntegrationConnectionById,
+        deleteSecrets: (params) =>
+          options.secrets?.jira?.deleteSecrets({
+            ...params,
+            namespace: jiraNamespaceSuffix(params.namespace),
+          }) ?? Promise.resolve(0),
+        deregisterWebhooks: () =>
+          deregisterJiraWebhooks({
+            connectionId: input.connectionId,
+            getInstallation: getJiraInstallationByConnectionId,
+            tokenStore,
+            jira,
+          }),
+        transaction: (fn) => db().transaction((tx) => fn(tx)),
+        deleteConnection: (params, transactionOptions) =>
+          deleteIntegrationConnection({id: params.connectionId}, transactionOptions),
+      });
+    if (input.lockAlreadyHeld) {
+      await disconnect();
+      return;
+    }
+    const installation = await getJiraInstallationByConnectionId(input.connectionId);
+    if (!installation) {
+      await disconnect();
+      return;
+    }
+    await withJiraWebhookRegistrationLock(installation.cloudId, disconnect);
   }
 
   const fallbackSecrets: JiraSecretsStore & JiraPendingSelectionSecretsStore = {
@@ -131,6 +162,7 @@ async function loadJiraModuleParts(
       }
     : fallbackSecrets;
   const tokenStore = createJiraTokenStore({
+    client: jira,
     resolveConnection: getIntegrationConnectionById,
     secrets,
     markConnectionError: async ({connectionId}) => {
@@ -143,7 +175,38 @@ async function loadJiraModuleParts(
   const pendingStore = createJiraPendingSelectionStore({secrets});
 
   const integrationProvider = createJiraIntegrationProvider({
+    jira,
     agentTools: {tokenStore},
+    cleanup: {
+      deleteConnectionRemoteResources: async (connection) => {
+        return await prepareJiraWebhookDeregistration({
+          connectionId: connection.id,
+          getInstallation: getJiraInstallationByConnectionId,
+          tokenStore,
+          jira,
+        });
+      },
+      withConnectionDeletionLock: async (connection, fn) => {
+        const installation = await getJiraInstallationByConnectionId(connection.id);
+        if (!installation) {
+          await fn();
+          return;
+        }
+        await withJiraWebhookRegistrationLock(installation.cloudId, fn);
+      },
+      deleteConnectionRecords: async (connection, {tx}) => {
+        await deleteJiraInstallationByConnectionId(connection.id, {tx});
+      },
+      deleteConnectionSecrets: async (connection) => {
+        await withJiraRefreshLockAndWait(connection.id, async () => {
+          // Scoped secrets accept the provider-local suffix, after this helper validates its prefix.
+          await (options.secrets?.jira?.deleteSecrets({
+            workspaceId: connection.workspaceId,
+            namespace: jiraNamespaceSuffix(jiraSecretsNamespace(connection.id)),
+          }) ?? Promise.resolve());
+        });
+      },
+    },
     routes: {
       tokenStore,
       pendingStore,
@@ -182,8 +245,10 @@ async function loadJiraModuleParts(
     provider: integrationProvider,
     workers: [
       createJiraMaintenanceWorker({
+        jira,
         tokenStore,
         resolveConnection: getIntegrationConnectionById,
+        webhookUrlForConnection: jiraWebhookUrl,
       }),
     ],
     webhookProcessors: integrationProvider.webhookProcessors,

package/src/temporal/activities/index.ts

@@ -1,7 +1,17 @@
+import {Context} from '@temporalio/activity';
+import type {IntegrationProviderRegistry} from '#core/providers/registry.js';
+import {processIntegrationSecretCleanups} from '#core/secret-cleanup.js';
 import {pruneWebhookDeliveriesActivity} from './prune-webhook-deliveries.js';
 
-export function createIntegrationsMaintenanceActivities() {
+export function createIntegrationsMaintenanceActivities(options: {
+  registry: IntegrationProviderRegistry;
+}) {
   return {
     pruneWebhookDeliveriesActivity,
+    cleanupIntegrationSecretsActivity: () =>
+      processIntegrationSecretCleanups({
+        registry: options.registry,
+        heartbeat: () => Context.current().heartbeat(),
+      }),
   };
 }