@shipfox/api-integration-core 12.1.1 → 12.3.0

package/src/db/connections.test.ts

@@ -1,5 +1,7 @@
+import {INTEGRATION_CONNECTION_AVAILABLE} from '@shipfox/api-integration-core-dto';
 import {upsertGithubInstallation} from '@shipfox/api-integration-github';
 import {ConnectionSlugConflictError} from '@shipfox/api-integration-spi';
+import {sql} from 'drizzle-orm';
 import {IntegrationConnectionAlreadyExistsError} from '#core/errors.js';
 import {
   createIntegrationConnection,
@@ -13,6 +15,16 @@ import {
   upsertIntegrationConnection,
 } from './connections.js';
 import {db} from './db.js';
+import {integrationsOutbox} from './schema/outbox.js';
+
+function connectionEvents(connectionId: string) {
+  return db()
+    .select()
+    .from(integrationsOutbox)
+    .where(
+      sql`${integrationsOutbox.eventType} = ${INTEGRATION_CONNECTION_AVAILABLE} AND ${integrationsOutbox.payload}->>'connectionId' = ${connectionId}`,
+    );
+}
 
 describe('integration connection queries', () => {
   let workspaceId: string;
@@ -41,6 +53,31 @@ describe('integration connection queries', () => {
     expect(second.id).toBe(first.id);
     expect(second.displayName).toBe('Renamed Debug');
     expect(second.slug).toBe('gitea_owner');
+    expect(await connectionEvents(first.id)).toHaveLength(1);
+  });
+
+  it('publishes availability when an upsert activates an existing connection', async () => {
+    const connection = await upsertIntegrationConnection({
+      workspaceId,
+      provider: 'linear',
+      externalAccountId: 'linear-acme',
+      slug: 'linear_acme',
+      displayName: 'Linear Acme',
+      lifecycleStatus: 'disabled',
+    });
+
+    expect(await connectionEvents(connection.id)).toHaveLength(0);
+
+    await upsertIntegrationConnection({
+      workspaceId,
+      provider: 'linear',
+      externalAccountId: 'linear-acme',
+      slug: 'linear_acme',
+      displayName: 'Linear Acme',
+      lifecycleStatus: 'active',
+    });
+
+    expect(await connectionEvents(connection.id)).toHaveLength(1);
   });
 
   it('allows multiple same-provider connections when external account differs', async () => {
@@ -148,6 +185,7 @@ describe('integration connection queries', () => {
     expect(connections).toHaveLength(1);
     expect(connections[0]?.id).toBe(first.id);
     expect(connections[0]?.displayName).toBe('Stripe');
+    expect(await connectionEvents(first.id)).toHaveLength(1);
   });
 
   it('reports slug collisions separately from duplicate external accounts', async () => {
@@ -252,6 +290,51 @@ describe('integration connection queries', () => {
     expect(updated?.lifecycleStatus).toBe('disabled');
     const reloaded = await getIntegrationConnectionById(connection.id);
     expect(reloaded?.lifecycleStatus).toBe('disabled');
+    expect(await connectionEvents(connection.id)).toHaveLength(1);
+  });
+
+  it('publishes availability when a disabled connection becomes active', async () => {
+    const connection = await upsertIntegrationConnection({
+      workspaceId,
+      provider: 'linear',
+      externalAccountId: 'linear-acme',
+      slug: 'linear_acme',
+      displayName: 'Linear Acme',
+      lifecycleStatus: 'disabled',
+    });
+
+    expect(await connectionEvents(connection.id)).toHaveLength(0);
+
+    await updateIntegrationConnectionLifecycleStatus({
+      id: connection.id,
+      lifecycleStatus: 'active',
+    });
+
+    const events = await connectionEvents(connection.id);
+    expect(events).toHaveLength(1);
+    expect(events[0]?.payload).toEqual({
+      provider: 'linear',
+      workspaceId,
+      connectionId: connection.id,
+      slug: 'linear_acme',
+    });
+  });
+
+  it('does not republish availability when an active connection stays active', async () => {
+    const connection = await upsertIntegrationConnection({
+      workspaceId,
+      provider: 'linear',
+      externalAccountId: 'linear-acme',
+      slug: 'linear_acme',
+      displayName: 'Linear Acme',
+    });
+
+    await updateIntegrationConnectionLifecycleStatus({
+      id: connection.id,
+      lifecycleStatus: 'active',
+    });
+
+    expect(await connectionEvents(connection.id)).toHaveLength(1);
   });
 
   it('returns undefined when updating the lifecycle status of an unknown connection', async () => {
@@ -310,5 +393,12 @@ describe('integration connection queries', () => {
 
     const connections = await listIntegrationConnections({workspaceId});
     expect(connections).toHaveLength(0);
+    const events = await db()
+      .select()
+      .from(integrationsOutbox)
+      .where(
+        sql`${integrationsOutbox.eventType} = ${INTEGRATION_CONNECTION_AVAILABLE} AND ${integrationsOutbox.payload}->>'workspaceId' = ${workspaceId}`,
+      );
+    expect(events).toHaveLength(0);
   });
 });

package/src/db/connections.ts

@@ -1,5 +1,10 @@
-import {CONNECTION_SLUG_MAX_LENGTH} from '@shipfox/api-integration-core-dto';
+import {
+  CONNECTION_SLUG_MAX_LENGTH,
+  INTEGRATION_CONNECTION_AVAILABLE,
+  type IntegrationsEventMap,
+} from '@shipfox/api-integration-core-dto';
 import {ConnectionSlugConflictError} from '@shipfox/api-integration-spi';
+import {writeOutboxEvent} from '@shipfox/node-outbox';
 import {and, eq} from 'drizzle-orm';
 import type {
   IntegrationConnection,
@@ -9,6 +14,7 @@ import type {IntegrationProviderKind} from '#core/entities/provider.js';
 import {IntegrationConnectionAlreadyExistsError} from '#core/errors.js';
 import {db} from './db.js';
 import {integrationConnections, toIntegrationConnection} from './schema/connections.js';
+import {integrationsOutbox} from './schema/outbox.js';
 
 type IntegrationDb = ReturnType<typeof db>;
 type IntegrationTx = Parameters<Parameters<IntegrationDb['transaction']>[0]>[0];
@@ -26,9 +32,13 @@ export async function upsertIntegrationConnection(
   params: UpsertIntegrationConnectionParams,
   options: {tx?: IntegrationDb | IntegrationTx | undefined} = {},
 ): Promise<IntegrationConnection> {
-  const executor = options.tx ?? db();
+  if (options.tx === undefined) {
+    return await db().transaction((tx) => upsertIntegrationConnection(params, {tx}));
+  }
+
+  const executor = options.tx;
   const now = new Date();
-  const [row] = await executor
+  let [row] = await executor
     .insert(integrationConnections)
     .values({
       workspaceId: params.workspaceId,
@@ -38,22 +48,52 @@ export async function upsertIntegrationConnection(
       displayName: params.displayName,
       lifecycleStatus: params.lifecycleStatus ?? 'active',
     })
-    .onConflictDoUpdate({
+    .onConflictDoNothing({
       target: [
         integrationConnections.workspaceId,
         integrationConnections.provider,
         integrationConnections.externalAccountId,
       ],
-      set: {
+    })
+    .returning();
+
+  let becameAvailable = row?.lifecycleStatus === 'active';
+  if (!row) {
+    const [existing] = await executor
+      .select({
+        id: integrationConnections.id,
+        lifecycleStatus: integrationConnections.lifecycleStatus,
+      })
+      .from(integrationConnections)
+      .where(
+        and(
+          eq(integrationConnections.workspaceId, params.workspaceId),
+          eq(integrationConnections.provider, params.provider),
+          eq(integrationConnections.externalAccountId, params.externalAccountId),
+        ),
+      )
+      .limit(1)
+      .for('update');
+    if (!existing) throw new Error('Integration connection upsert conflict row was not found');
+
+    [row] = await executor
+      .update(integrationConnections)
+      .set({
         displayName: params.displayName,
         lifecycleStatus: params.lifecycleStatus ?? 'active',
         updatedAt: now,
-      },
-    })
-    .returning();
+      })
+      .where(eq(integrationConnections.id, existing.id))
+      .returning();
+    becameAvailable = existing.lifecycleStatus !== 'active' && row?.lifecycleStatus === 'active';
+  }
 
   if (!row) throw new Error('Integration connection upsert returned no rows');
-  return toIntegrationConnection(row);
+  const connection = toIntegrationConnection(row);
+  if (becameAvailable) {
+    await writeConnectionAvailableEvent(executor, connection);
+  }
+  return connection;
 }
 
 export interface CreateIntegrationConnectionParams {
@@ -100,7 +140,11 @@ export async function createIntegrationConnection(
   params: CreateIntegrationConnectionParams,
   options: {tx?: IntegrationDb | IntegrationTx | undefined} = {},
 ): Promise<IntegrationConnection> {
-  const executor = options.tx ?? db();
+  if (options.tx === undefined) {
+    return await db().transaction((tx) => createIntegrationConnection(params, {tx}));
+  }
+
+  const executor = options.tx;
   let rows: (typeof integrationConnections.$inferSelect)[];
   try {
     rows = await executor
@@ -130,7 +174,11 @@ export async function createIntegrationConnection(
 
   const row = rows[0];
   if (!row) throw new Error('Integration connection insert returned no rows');
-  return toIntegrationConnection(row);
+  const connection = toIntegrationConnection(row);
+  if (connection.lifecycleStatus === 'active') {
+    await writeConnectionAvailableEvent(executor, connection);
+  }
+  return connection;
 }
 
 export interface ResolveUniqueConnectionSlugParams {
@@ -225,19 +273,50 @@ export async function updateIntegrationConnectionLifecycleStatus(
   params: UpdateIntegrationConnectionLifecycleStatusParams,
   options: {tx?: IntegrationDb | IntegrationTx | undefined} = {},
 ): Promise<IntegrationConnection | undefined> {
-  const executor = options.tx ?? db();
+  if (options.tx === undefined) {
+    return await db().transaction((tx) => updateIntegrationConnectionLifecycleStatus(params, {tx}));
+  }
+
+  const executor = options.tx;
+  const [existing] = await executor
+    .select({lifecycleStatus: integrationConnections.lifecycleStatus})
+    .from(integrationConnections)
+    .where(eq(integrationConnections.id, params.id))
+    .limit(1)
+    .for('update');
+  if (!existing) return undefined;
+
   const [row] = await executor
     .update(integrationConnections)
     .set({lifecycleStatus: params.lifecycleStatus, updatedAt: new Date()})
     .where(eq(integrationConnections.id, params.id))
     .returning();
   if (!row) return undefined;
-  return toIntegrationConnection(row);
+  const connection = toIntegrationConnection(row);
+  if (existing.lifecycleStatus !== 'active' && connection.lifecycleStatus === 'active') {
+    await writeConnectionAvailableEvent(executor, connection);
+  }
+  return connection;
 }
 
 export type UpdateIntegrationConnectionLifecycleStatusFn =
   typeof updateIntegrationConnectionLifecycleStatus;
 
+async function writeConnectionAvailableEvent(
+  executor: IntegrationDb | IntegrationTx,
+  connection: IntegrationConnection,
+): Promise<void> {
+  await writeOutboxEvent<IntegrationsEventMap>(executor, integrationsOutbox, {
+    type: INTEGRATION_CONNECTION_AVAILABLE,
+    payload: {
+      provider: connection.provider,
+      workspaceId: connection.workspaceId,
+      connectionId: connection.id,
+      slug: connection.slug,
+    },
+  });
+}
+
 export async function deleteIntegrationConnection(
   params: {id: string},
   options: {tx?: IntegrationDb | IntegrationTx | undefined} = {},

package/src/db/db.ts

@@ -2,10 +2,12 @@ import {drizzle, type NodePgDatabase} from '@shipfox/node-drizzle';
 import {pgClient} from '@shipfox/node-postgres';
 import {integrationConnections} from './schema/connections.js';
 import {integrationsOutbox} from './schema/outbox.js';
+import {integrationSecretCleanups} from './schema/secret-cleanups.js';
 import {integrationsWebhookDeliveries} from './schema/webhook-deliveries.js';
 
 export const schema = {
   integrationConnections,
+  integrationSecretCleanups,
   integrationsOutbox,
   integrationsWebhookDeliveries,
 };

package/src/db/schema/secret-cleanups.ts

@@ -0,0 +1,42 @@
+import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';
+import {index, integer, text, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';
+import type {IntegrationConnectionLifecycleStatus} from '#core/entities/connection.js';
+import {pgTable} from './common.js';
+
+export const integrationSecretCleanups = pgTable(
+  'secret_cleanups',
+  {
+    id: uuidv7PrimaryKey(),
+    workspaceId: uuid('workspace_id').notNull(),
+    provider: text('provider').notNull(),
+    connectionId: uuid('connection_id').notNull(),
+    externalAccountId: text('external_account_id').notNull(),
+    slug: text('slug').notNull(),
+    displayName: text('display_name').notNull(),
+    lifecycleStatus: text('lifecycle_status')
+      .$type<IntegrationConnectionLifecycleStatus>()
+      .notNull(),
+    connectionCreatedAt: timestamp('connection_created_at', {withTimezone: true}).notNull(),
+    connectionUpdatedAt: timestamp('connection_updated_at', {withTimezone: true}).notNull(),
+    attemptCount: integer('attempt_count').notNull().default(0),
+    nextAttemptAt: timestamp('next_attempt_at', {withTimezone: true}).notNull().defaultNow(),
+    leaseToken: uuid('lease_token'),
+    leaseExpiresAt: timestamp('lease_expires_at', {withTimezone: true}),
+    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),
+  },
+  (table) => [
+    uniqueIndex('integrations_secret_cleanups_provider_connection_unique').on(
+      table.provider,
+      table.connectionId,
+    ),
+    index('integrations_secret_cleanups_connection_id_idx').on(table.connectionId),
+    index('integrations_secret_cleanups_pending_idx').on(
+      table.nextAttemptAt,
+      table.createdAt,
+      table.id,
+    ),
+  ],
+);
+
+export type IntegrationSecretCleanupDb = typeof integrationSecretCleanups.$inferSelect;

package/src/db/secret-cleanups.test.ts

@@ -0,0 +1,113 @@
+import {afterEach} from '@shipfox/vitest/vi';
+import {sql} from 'drizzle-orm';
+import {CLEANUP_SECRETS_ACTIVITY_TIMEOUT_MS} from '#temporal/constants.js';
+import {upsertIntegrationConnection} from './connections.js';
+import {db} from './db.js';
+import {
+  claimIntegrationSecretCleanups,
+  completeIntegrationSecretCleanup,
+  enqueueIntegrationSecretCleanup,
+  retryIntegrationSecretCleanup,
+} from './secret-cleanups.js';
+
+const now = new Date(Date.now() + 60 * 1_000);
+
+afterEach(async () => {
+  await db().execute(sql`TRUNCATE integrations_secret_cleanups CASCADE`);
+});
+
+describe('integration secret cleanup persistence', () => {
+  it('keeps the default lease longer than the cleanup activity timeout', async () => {
+    await createCleanupConnection();
+
+    const [claimed] = await claimIntegrationSecretCleanups({limit: 1, now});
+
+    if (!claimed?.leaseExpiresAt) throw new Error('Expected the cleanup to have a lease');
+    expect(claimed.leaseExpiresAt.getTime() - now.getTime()).toBeGreaterThan(
+      CLEANUP_SECRETS_ACTIVITY_TIMEOUT_MS,
+    );
+  });
+
+  it('claims a due row once and reclaims it after its lease expires', async () => {
+    const connection = await createCleanupConnection();
+    const [queued] = await claimIntegrationSecretCleanups({limit: 1, now, leaseDurationMs: 1_000});
+
+    expect(queued).toMatchObject({
+      connectionId: connection.id,
+      attemptCount: 1,
+      leaseToken: expect.any(String),
+    });
+    await expect(claimIntegrationSecretCleanups({limit: 1, now})).resolves.toEqual([]);
+
+    const wrongLeaseToken = crypto.randomUUID();
+    await expect(
+      completeIntegrationSecretCleanup({
+        id: queued?.id ?? '',
+        leaseToken: wrongLeaseToken,
+        now,
+      }),
+    ).resolves.toBe(false);
+    await expect(
+      retryIntegrationSecretCleanup({
+        id: queued?.id ?? '',
+        leaseToken: wrongLeaseToken,
+        delayMs: 1_000,
+        now,
+      }),
+    ).resolves.toBe(false);
+
+    const [reclaimed] = await claimIntegrationSecretCleanups({
+      limit: 1,
+      now: new Date(now.getTime() + 1_001),
+      leaseDurationMs: 1_000,
+    });
+    expect(reclaimed).toMatchObject({
+      id: queued?.id,
+      attemptCount: 2,
+      leaseToken: expect.any(String),
+    });
+
+    await expect(
+      completeIntegrationSecretCleanup({
+        id: reclaimed?.id ?? '',
+        leaseToken: reclaimed?.leaseToken ?? '',
+        now: new Date(now.getTime() + 1_001),
+      }),
+    ).resolves.toBe(true);
+  });
+
+  it('honors the batch limit and retry backoff', async () => {
+    await createCleanupConnection({externalAccountId: 'first'});
+    await createCleanupConnection({externalAccountId: 'second'});
+
+    const firstClaim = await claimIntegrationSecretCleanups({limit: 1, now});
+    expect(firstClaim).toHaveLength(1);
+    const first = firstClaim[0];
+    if (!first?.leaseToken) throw new Error('Expected the first cleanup to have a lease');
+
+    await expect(
+      retryIntegrationSecretCleanup({
+        id: first.id,
+        leaseToken: first.leaseToken,
+        delayMs: 5_000,
+        now,
+      }),
+    ).resolves.toBe(true);
+
+    const secondClaim = await claimIntegrationSecretCleanups({limit: 2, now});
+    expect(secondClaim).toHaveLength(1);
+    expect(secondClaim[0]?.id).not.toBe(first.id);
+  });
+});
+
+async function createCleanupConnection(overrides: {externalAccountId?: string} = {}) {
+  const connection = await upsertIntegrationConnection({
+    workspaceId: crypto.randomUUID(),
+    provider: 'slack',
+    externalAccountId: overrides.externalAccountId ?? crypto.randomUUID(),
+    slug: `slack_${crypto.randomUUID()}`,
+    displayName: 'Slack',
+  });
+  await enqueueIntegrationSecretCleanup({connection});
+  return connection;
+}

package/src/db/secret-cleanups.ts

@@ -0,0 +1,209 @@
+import {and, asc, eq, gt, inArray, isNull, lte, or, sql} from 'drizzle-orm';
+import type {IntegrationConnection} from '#core/entities/connection.js';
+import {db} from './db.js';
+import {
+  type IntegrationSecretCleanupDb,
+  integrationSecretCleanups,
+} from './schema/secret-cleanups.js';
+
+// Keep the lease longer than cleanupIntegrationSecretsCron's 5-minute activity timeout so
+// a timed-out sweep cannot have its claimed rows reclaimed while it is still running.
+const DEFAULT_LEASE_DURATION_MS = 10 * 60 * 1_000;
+
+export interface EnqueueIntegrationSecretCleanupParams {
+  connection: IntegrationConnection;
+  now?: Date | undefined;
+}
+
+export interface IntegrationSecretCleanup {
+  id: string;
+  workspaceId: string;
+  provider: string;
+  connectionId: string;
+  externalAccountId: string;
+  slug: string;
+  displayName: string;
+  lifecycleStatus: IntegrationConnection['lifecycleStatus'];
+  connectionCreatedAt: Date;
+  connectionUpdatedAt: Date;
+  attemptCount: number;
+  nextAttemptAt: Date;
+  leaseToken: string | null;
+  leaseExpiresAt: Date | null;
+  createdAt: Date;
+  updatedAt: Date;
+}
+
+type IntegrationDb = ReturnType<typeof db>;
+type IntegrationTx = Parameters<Parameters<IntegrationDb['transaction']>[0]>[0];
+
+export async function enqueueIntegrationSecretCleanup(
+  params: EnqueueIntegrationSecretCleanupParams,
+  options: {tx?: IntegrationDb | IntegrationTx | undefined} = {},
+): Promise<void> {
+  const executor = options.tx ?? db();
+  await executor
+    .insert(integrationSecretCleanups)
+    .values({
+      workspaceId: params.connection.workspaceId,
+      provider: params.connection.provider,
+      connectionId: params.connection.id,
+      externalAccountId: params.connection.externalAccountId,
+      slug: params.connection.slug,
+      displayName: params.connection.displayName,
+      lifecycleStatus: params.connection.lifecycleStatus,
+      connectionCreatedAt: params.connection.createdAt,
+      connectionUpdatedAt: params.connection.updatedAt,
+      // Claims compare against the application clock, so the first due time must come
+      // from that clock too. A database clock even milliseconds ahead would otherwise
+      // hide the row from the sweep that runs right after this insert commits.
+      nextAttemptAt: params.now ?? new Date(),
+    })
+    .onConflictDoNothing({
+      target: [integrationSecretCleanups.provider, integrationSecretCleanups.connectionId],
+    });
+}
+
+export interface ClaimIntegrationSecretCleanupsParams {
+  limit: number;
+  connectionId?: string | undefined;
+  now?: Date | undefined;
+  leaseDurationMs?: number | undefined;
+}
+
+export async function claimIntegrationSecretCleanups(
+  params: ClaimIntegrationSecretCleanupsParams,
+): Promise<IntegrationSecretCleanup[]> {
+  if (!Number.isInteger(params.limit) || params.limit <= 0) {
+    throw new Error('Secret cleanup claim limit must be a positive integer');
+  }
+  const now = params.now ?? new Date();
+  const leaseDurationMs = params.leaseDurationMs ?? DEFAULT_LEASE_DURATION_MS;
+  if (!Number.isInteger(leaseDurationMs) || leaseDurationMs <= 0) {
+    throw new Error('Secret cleanup lease duration must be a positive integer');
+  }
+
+  return await db().transaction(async (tx) => {
+    const conditions = [
+      lte(integrationSecretCleanups.nextAttemptAt, now),
+      or(
+        isNull(integrationSecretCleanups.leaseExpiresAt),
+        lte(integrationSecretCleanups.leaseExpiresAt, now),
+      ),
+      ...(params.connectionId
+        ? [eq(integrationSecretCleanups.connectionId, params.connectionId)]
+        : []),
+    ];
+    const candidates = await tx
+      .select({id: integrationSecretCleanups.id})
+      .from(integrationSecretCleanups)
+      .where(and(...conditions))
+      .orderBy(
+        asc(integrationSecretCleanups.nextAttemptAt),
+        asc(integrationSecretCleanups.createdAt),
+        asc(integrationSecretCleanups.id),
+      )
+      .limit(params.limit)
+      .for('update', {skipLocked: true});
+    if (candidates.length === 0) return [];
+
+    const rows = await tx
+      .update(integrationSecretCleanups)
+      .set({
+        attemptCount: sql`${integrationSecretCleanups.attemptCount} + 1`,
+        leaseToken: sql`gen_random_uuid()`,
+        leaseExpiresAt: new Date(now.getTime() + leaseDurationMs),
+        updatedAt: now,
+      })
+      .where(
+        inArray(
+          integrationSecretCleanups.id,
+          candidates.map((candidate) => candidate.id),
+        ),
+      )
+      .returning();
+    return rows.map(toIntegrationSecretCleanup);
+  });
+}
+
+export async function completeIntegrationSecretCleanup(params: {
+  id: string;
+  leaseToken: string;
+  now?: Date | undefined;
+}): Promise<boolean> {
+  const now = params.now ?? new Date();
+  const result = await db()
+    .delete(integrationSecretCleanups)
+    .where(
+      and(
+        eq(integrationSecretCleanups.id, params.id),
+        eq(integrationSecretCleanups.leaseToken, params.leaseToken),
+        gt(integrationSecretCleanups.leaseExpiresAt, now),
+      ),
+    );
+  return (result.rowCount ?? 0) > 0;
+}
+
+export async function retryIntegrationSecretCleanup(params: {
+  id: string;
+  leaseToken: string;
+  delayMs: number;
+  now?: Date | undefined;
+}): Promise<boolean> {
+  if (!Number.isInteger(params.delayMs) || params.delayMs < 0) {
+    throw new Error('Secret cleanup retry delay must be a non-negative integer');
+  }
+  const now = params.now ?? new Date();
+  const result = await db()
+    .update(integrationSecretCleanups)
+    .set({
+      nextAttemptAt: new Date(now.getTime() + params.delayMs),
+      leaseToken: null,
+      leaseExpiresAt: null,
+      updatedAt: now,
+    })
+    .where(
+      and(
+        eq(integrationSecretCleanups.id, params.id),
+        eq(integrationSecretCleanups.leaseToken, params.leaseToken),
+        gt(integrationSecretCleanups.leaseExpiresAt, now),
+      ),
+    );
+  return (result.rowCount ?? 0) > 0;
+}
+
+export async function listIntegrationSecretCleanups(
+  params: {connectionId?: string | undefined} = {},
+): Promise<IntegrationSecretCleanup[]> {
+  const rows = await db()
+    .select()
+    .from(integrationSecretCleanups)
+    .where(
+      params.connectionId
+        ? eq(integrationSecretCleanups.connectionId, params.connectionId)
+        : undefined,
+    )
+    .orderBy(asc(integrationSecretCleanups.createdAt), asc(integrationSecretCleanups.id));
+  return rows.map(toIntegrationSecretCleanup);
+}
+
+function toIntegrationSecretCleanup(row: IntegrationSecretCleanupDb): IntegrationSecretCleanup {
+  return {
+    id: row.id,
+    workspaceId: row.workspaceId,
+    provider: row.provider,
+    connectionId: row.connectionId,
+    externalAccountId: row.externalAccountId,
+    slug: row.slug,
+    displayName: row.displayName,
+    lifecycleStatus: row.lifecycleStatus,
+    connectionCreatedAt: row.connectionCreatedAt,
+    connectionUpdatedAt: row.connectionUpdatedAt,
+    attemptCount: row.attemptCount,
+    nextAttemptAt: row.nextAttemptAt,
+    leaseToken: row.leaseToken,
+    leaseExpiresAt: row.leaseExpiresAt,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+  };
+}