@shipfox/api-integration-core 12.2.0 → 12.4.0

package/src/providers/jira.ts

@@ -25,19 +25,26 @@ async function loadJiraModuleParts(
   options: Parameters<IntegrationProviderModule['load']>[0] = {},
 ): Promise<IntegrationModuleParts> {
   const {
+    createJiraApiClient,
     createJiraIntegrationProvider,
     createJiraMaintenanceWorker,
     createJiraPendingSelectionStore,
     createJiraTokenStore,
     db: jiraDb,
+    deregisterJiraWebhooks,
     deleteJiraInstallationByConnectionId,
     disconnectJiraInstallation: disconnectJiraInstallationRecords,
     getJiraInstallationByCloudId,
+    getJiraInstallationByConnectionId,
     jiraSecretsNamespace,
+    jiraWebhookUrl,
     migrationsPath,
+    prepareJiraWebhookDeregistration,
     upsertJiraInstallation,
     withJiraRefreshLockAndWait,
+    withJiraWebhookRegistrationLock,
   } = await import('@shipfox/api-integration-jira');
+  const jira = createJiraApiClient();
 
   async function getExistingJiraConnection(input: {
     cloudId: string;
@@ -94,19 +101,40 @@ async function loadJiraModuleParts(
     );
   }
 
-  async function disconnectJiraInstallation(input: {connectionId: string}): Promise<void> {
-    await disconnectJiraInstallationRecords<IntegrationTx>({
-      connectionId: input.connectionId,
-      getConnection: getIntegrationConnectionById,
-      deleteSecrets: (params) =>
-        options.secrets?.jira?.deleteSecrets({
-          ...params,
-          namespace: jiraNamespaceSuffix(params.namespace),
-        }) ?? Promise.resolve(0),
-      transaction: (fn) => db().transaction((tx) => fn(tx)),
-      deleteConnection: (params, transactionOptions) =>
-        deleteIntegrationConnection({id: params.connectionId}, transactionOptions),
-    });
+  async function disconnectJiraInstallation(input: {
+    connectionId: string;
+    lockAlreadyHeld?: boolean | undefined;
+  }): Promise<void> {
+    const disconnect = () =>
+      disconnectJiraInstallationRecords<IntegrationTx>({
+        connectionId: input.connectionId,
+        getConnection: getIntegrationConnectionById,
+        deleteSecrets: (params) =>
+          options.secrets?.jira?.deleteSecrets({
+            ...params,
+            namespace: jiraNamespaceSuffix(params.namespace),
+          }) ?? Promise.resolve(0),
+        deregisterWebhooks: () =>
+          deregisterJiraWebhooks({
+            connectionId: input.connectionId,
+            getInstallation: getJiraInstallationByConnectionId,
+            tokenStore,
+            jira,
+          }),
+        transaction: (fn) => db().transaction((tx) => fn(tx)),
+        deleteConnection: (params, transactionOptions) =>
+          deleteIntegrationConnection({id: params.connectionId}, transactionOptions),
+      });
+    if (input.lockAlreadyHeld) {
+      await disconnect();
+      return;
+    }
+    const installation = await getJiraInstallationByConnectionId(input.connectionId);
+    if (!installation) {
+      await disconnect();
+      return;
+    }
+    await withJiraWebhookRegistrationLock(installation.cloudId, disconnect);
   }
 
   const fallbackSecrets: JiraSecretsStore & JiraPendingSelectionSecretsStore = {
@@ -134,6 +162,7 @@ async function loadJiraModuleParts(
       }
     : fallbackSecrets;
   const tokenStore = createJiraTokenStore({
+    client: jira,
     resolveConnection: getIntegrationConnectionById,
     secrets,
     markConnectionError: async ({connectionId}) => {
@@ -146,8 +175,25 @@ async function loadJiraModuleParts(
   const pendingStore = createJiraPendingSelectionStore({secrets});
 
   const integrationProvider = createJiraIntegrationProvider({
+    jira,
     agentTools: {tokenStore},
     cleanup: {
+      deleteConnectionRemoteResources: async (connection) => {
+        return await prepareJiraWebhookDeregistration({
+          connectionId: connection.id,
+          getInstallation: getJiraInstallationByConnectionId,
+          tokenStore,
+          jira,
+        });
+      },
+      withConnectionDeletionLock: async (connection, fn) => {
+        const installation = await getJiraInstallationByConnectionId(connection.id);
+        if (!installation) {
+          await fn();
+          return;
+        }
+        await withJiraWebhookRegistrationLock(installation.cloudId, fn);
+      },
       deleteConnectionRecords: async (connection, {tx}) => {
         await deleteJiraInstallationByConnectionId(connection.id, {tx});
       },
@@ -199,8 +245,10 @@ async function loadJiraModuleParts(
     provider: integrationProvider,
     workers: [
       createJiraMaintenanceWorker({
+        jira,
         tokenStore,
         resolveConnection: getIntegrationConnectionById,
+        webhookUrlForConnection: jiraWebhookUrl,
       }),
     ],
     webhookProcessors: integrationProvider.webhookProcessors,

package/src/temporal/activities/index.ts

@@ -1,7 +1,17 @@
+import {Context} from '@temporalio/activity';
+import type {IntegrationProviderRegistry} from '#core/providers/registry.js';
+import {processIntegrationSecretCleanups} from '#core/secret-cleanup.js';
 import {pruneWebhookDeliveriesActivity} from './prune-webhook-deliveries.js';
 
-export function createIntegrationsMaintenanceActivities() {
+export function createIntegrationsMaintenanceActivities(options: {
+  registry: IntegrationProviderRegistry;
+}) {
   return {
     pruneWebhookDeliveriesActivity,
+    cleanupIntegrationSecretsActivity: () =>
+      processIntegrationSecretCleanups({
+        registry: options.registry,
+        heartbeat: () => Context.current().heartbeat(),
+      }),
   };
 }

package/src/temporal/constants.ts

@@ -1,3 +1,5 @@
 export const INTEGRATIONS_MAINTENANCE_TASK_QUEUE = 'integrations-maintenance';
 
 export const WEBHOOK_DELIVERY_RETENTION_DAYS = 30;
+
+export const CLEANUP_SECRETS_ACTIVITY_TIMEOUT_MS = 5 * 60 * 1_000;

package/src/temporal/workflows/cleanup-integration-secrets-cron.ts

@@ -0,0 +1,20 @@
+import {log, proxyActivities} from '@temporalio/workflow';
+import type {createIntegrationsMaintenanceActivities} from '../activities/index.js';
+import {CLEANUP_SECRETS_ACTIVITY_TIMEOUT_MS} from '../constants.js';
+
+const {cleanupIntegrationSecretsActivity} = proxyActivities<
+  ReturnType<typeof createIntegrationsMaintenanceActivities>
+>({
+  startToCloseTimeout: CLEANUP_SECRETS_ACTIVITY_TIMEOUT_MS,
+  heartbeatTimeout: '1 minute',
+  // The activity records a per-row retry schedule. A later cron run retries the
+  // row without replaying the whole sweep in Temporal.
+  retry: {maximumAttempts: 1},
+});
+
+export async function cleanupIntegrationSecretsCron(): Promise<void> {
+  const result = await cleanupIntegrationSecretsActivity();
+  if (result.claimed > 0) {
+    log.info('Completed integration connection secret cleanup sweep', {...result});
+  }
+}

package/src/temporal/workflows/index.ts

@@ -1 +1,2 @@
+export {cleanupIntegrationSecretsCron} from './cleanup-integration-secrets-cron.js';
 export {pruneWebhookDeliveriesCron} from './prune-webhook-deliveries-cron.js';

package/test/env.ts

@@ -32,3 +32,6 @@ process.env.GITEA_BASE_URL = 'https://gitea.example.com';
 process.env.GITEA_SERVICE_USERNAME = 'shipfox-bot';
 process.env.GITEA_SERVICE_TOKEN = 'test-service-token';
 process.env.GITEA_WEBHOOK_SECRET = 'test-webhook-secret';
+process.env.SENTRY_APP_CLIENT_ID = 'test-client-id';
+process.env.SENTRY_APP_CLIENT_SECRET = 'test-client-secret';
+process.env.SENTRY_APP_SLUG = 'shipfox-test';

package/test/globalSetup.ts

@@ -15,6 +15,7 @@ export async function setup() {
   await runMigrations(db(), migrationsPath, '__drizzle_migrations_integrations');
   await runMigrations(githubDb(), githubMigrationsPath, '__drizzle_migrations_integrations_github');
   await db().execute(sql`TRUNCATE integrations_connections CASCADE`);
+  await db().execute(sql`TRUNCATE integrations_secret_cleanups CASCADE`);
   await db().execute(sql`TRUNCATE integrations_webhook_deliveries CASCADE`);
 
   closeDb();

package/test/route-utils.ts

@@ -6,7 +6,9 @@ import {
 } from '@shipfox/api-auth-context';
 import {type AuthMethod, ClientError, closeApp, createApp} from '@shipfox/node-fastify';
 import {afterEach, beforeEach} from '@shipfox/vitest/vi';
+import {sql} from 'drizzle-orm';
 import type {FastifyInstance, FastifyRequest} from 'fastify';
+import {db} from '#db/db.js';
 import {createIntegrationsModule, type IntegrationProvider} from '#index.js';
 
 let authenticatedMemberships: UserContextMembership[] = [];
@@ -95,6 +97,7 @@ export function useIntegrationRouteTest() {
 
   afterEach(async () => {
     await closeApp();
+    await db().execute(sql`TRUNCATE integrations_secret_cleanups CASCADE`);
   });
 
   return {

package/test/setup.ts

@@ -1,5 +1,10 @@
 import './env.js';
+import {closeDb as closeGiteaDb} from '@shipfox/api-integration-gitea';
 import {closeDb as closeGithubDb} from '@shipfox/api-integration-github';
+import {closeDb as closeJiraDb} from '@shipfox/api-integration-jira';
+import {closeDb as closeLinearDb} from '@shipfox/api-integration-linear';
+import {closeDb as closeSentryDb} from '@shipfox/api-integration-sentry';
+import {closeDb as closeSlackDb} from '@shipfox/api-integration-slack';
 import {closePostgresClient, createPostgresClient} from '@shipfox/node-postgres';
 import {afterAll, afterEach, beforeAll, vi} from '@shipfox/vitest/vi';
 import {closeDb} from '#db/db.js';
@@ -15,5 +20,12 @@ afterEach(() => {
 afterAll(async () => {
   closeDb();
   closeGithubDb();
+  // isolate:false shares provider module state across files, so every memoized
+  // Drizzle handle must be cleared before the shared pool is ended.
+  closeLinearDb();
+  closeSlackDb();
+  closeJiraDb();
+  closeSentryDb();
+  closeGiteaDb();
   await closePostgresClient();
 });