@shipfox/api-integration-core 4.0.0 → 5.0.0

package/src/providers/linear.ts

@@ -32,9 +32,11 @@ async function loadLinearModuleParts(
     createLinearE2eRoutes,
     createLinearIntegrationProvider,
     config: linearConfig,
+    deleteLinearInstallationByConnectionId,
     disconnectLinearInstallation: disconnectLinearInstallationRecords,
     getLinearInstallationByOrganizationId,
     db: linearDb,
+    linearSecretsNamespace,
     migrationsPath: linearMigrationsPath,
     upsertLinearInstallation,
   } = await import('@shipfox/api-integration-linear');
@@ -137,6 +139,18 @@ async function loadLinearModuleParts(
   return {
     provider: createLinearIntegrationProvider({
       agentTools: {tokenStore, endpoint: linearConfig.LINEAR_MCP_ENDPOINT},
+      cleanup: {
+        deleteConnectionRecords: async (connection, {tx}) => {
+          await deleteLinearInstallationByConnectionId(connection.id, {tx});
+        },
+        deleteConnectionSecrets: async (connection) => {
+          // Scoped secrets accept the provider-local suffix, after this helper validates its prefix.
+          await (options.secrets?.linear?.deleteSecrets({
+            workspaceId: connection.workspaceId,
+            namespace: linearNamespaceSuffix(linearSecretsNamespace(connection.id)),
+          }) ?? Promise.resolve());
+        },
+      },
       routes: {
         tokenStore,
         getExistingLinearConnection,

package/src/providers/slack.test.ts

@@ -4,8 +4,12 @@ import {
 } from '@shipfox/api-integration-slack';
 import {runMigrations} from '@shipfox/node-drizzle';
 import {getIntegrationConnectionById, upsertIntegrationConnection} from '#db/connections.js';
+import {db} from '#db/db.js';
+import {createTestApp, useIntegrationRouteTest} from '#test/route-utils.js';
 
 describe('slackProviderModule', () => {
+  const context = useIntegrationRouteTest();
+
   afterEach(() => {
     vi.unstubAllEnvs();
     vi.resetModules();
@@ -54,4 +58,139 @@ describe('slackProviderModule', () => {
       teamId,
     });
   });
+
+  it('deletes the installation and token through the generic route before allowing a reinstall', async () => {
+    vi.stubEnv('INTEGRATIONS_ENABLE_SLACK_PROVIDER', 'true');
+    vi.resetModules();
+    const deleteSecrets = vi.fn(() => Promise.resolve(1));
+    const scopedSecrets = {
+      getSecret: vi.fn(() => Promise.resolve(null)),
+      setSecrets: vi.fn(() => Promise.resolve()),
+      deleteSecrets,
+    };
+    const {createPostgresClient} = await import('@shipfox/node-postgres');
+    createPostgresClient();
+    const {loadEnabledProviderModules} = await import('#providers/modules.js');
+    const parts = await loadEnabledProviderModules({
+      secrets: {slack: scopedSecrets, deleteSecrets},
+    });
+    const slackPart = parts.find((part) => part.provider.provider === 'slack');
+    if (!slackPart?.database) throw new Error('Slack provider database is not configured');
+    const teamId = `T${crypto.randomUUID()}`;
+
+    await runMigrations(
+      slackPart.database.db(),
+      slackPart.database.migrationsPath,
+      slackPart.database.migrationsTableName,
+    );
+    const app = await createTestApp([slackPart.provider]);
+    const connection = await upsertIntegrationConnection({
+      workspaceId: context.workspaceId,
+      provider: 'slack',
+      externalAccountId: teamId,
+      slug: `slack_${teamId}`,
+      displayName: 'Slack Acme',
+    });
+    await upsertSlackInstallation({
+      connectionId: connection.id,
+      teamId,
+      teamName: 'Acme',
+      appId: 'A123',
+      botUserId: 'U123',
+      scopes: ['app_mentions:read'],
+      status: 'installed',
+    });
+
+    const res = await app.inject({
+      method: 'DELETE',
+      url: `/integration-connections/${connection.id}`,
+      headers: {authorization: 'Bearer user'},
+    });
+
+    expect(res.statusCode).toBe(204);
+    await expect(getIntegrationConnectionById(connection.id)).resolves.toBeUndefined();
+    await expect(getSlackInstallationByConnectionId(connection.id)).resolves.toBeUndefined();
+    expect(deleteSecrets).toHaveBeenCalledWith({
+      workspaceId: context.workspaceId,
+      namespace: connection.id,
+    });
+
+    const replacement = await upsertIntegrationConnection({
+      workspaceId: context.workspaceId,
+      provider: 'slack',
+      externalAccountId: teamId,
+      slug: `slack_${teamId}_again`,
+      displayName: 'Slack Acme',
+    });
+    await upsertSlackInstallation({
+      connectionId: replacement.id,
+      teamId,
+      teamName: 'Acme',
+      appId: 'A123',
+      botUserId: 'U123',
+      scopes: ['app_mentions:read'],
+      status: 'installed',
+    });
+
+    await expect(getSlackInstallationByConnectionId(replacement.id)).resolves.toMatchObject({
+      teamId,
+    });
+  });
+
+  it('rolls back provider record cleanup when its transaction fails', async () => {
+    vi.stubEnv('INTEGRATIONS_ENABLE_SLACK_PROVIDER', 'true');
+    vi.resetModules();
+    const deleteSecrets = vi.fn(() => Promise.resolve(1));
+    const scopedSecrets = {
+      getSecret: vi.fn(() => Promise.resolve(null)),
+      setSecrets: vi.fn(() => Promise.resolve()),
+      deleteSecrets,
+    };
+    const {createPostgresClient} = await import('@shipfox/node-postgres');
+    createPostgresClient();
+    const {loadEnabledProviderModules} = await import('#providers/modules.js');
+    const parts = await loadEnabledProviderModules({
+      secrets: {slack: scopedSecrets, deleteSecrets},
+    });
+    const slackPart = parts.find((part) => part.provider.provider === 'slack');
+    if (!slackPart?.database) throw new Error('Slack provider database is not configured');
+    const teamId = `T${crypto.randomUUID()}`;
+
+    await runMigrations(
+      slackPart.database.db(),
+      slackPart.database.migrationsPath,
+      slackPart.database.migrationsTableName,
+    );
+    const connection = await upsertIntegrationConnection({
+      workspaceId: context.workspaceId,
+      provider: 'slack',
+      externalAccountId: teamId,
+      slug: `slack_${teamId}`,
+      displayName: 'Slack Acme',
+    });
+    await upsertSlackInstallation({
+      connectionId: connection.id,
+      teamId,
+      teamName: 'Acme',
+      appId: 'A123',
+      botUserId: 'U123',
+      scopes: ['app_mentions:read'],
+      status: 'installed',
+    });
+
+    await expect(
+      db().transaction(async (tx) => {
+        await slackPart.provider.deleteConnectionRecords?.(connection, {tx});
+        throw new Error('transaction failed');
+      }),
+    ).rejects.toThrow('transaction failed');
+
+    await expect(getIntegrationConnectionById(connection.id)).resolves.toMatchObject({
+      id: connection.id,
+    });
+    await expect(getSlackInstallationByConnectionId(connection.id)).resolves.toMatchObject({
+      connectionId: connection.id,
+    });
+    expect(deleteSecrets).not.toHaveBeenCalled();
+  });
 });

package/src/providers/slack.ts

@@ -14,7 +14,11 @@ import {
   upsertIntegrationConnection,
 } from '#db/connections.js';
 import {db} from '#db/db.js';
-import {publishIntegrationEventReceived, recordDeliveryOnly} from '#db/webhook-deliveries.js';
+import {
+  claimWebhookDelivery,
+  publishIntegrationEventReceived,
+  recordDeliveryOnly,
+} from '#db/webhook-deliveries.js';
 import {retryConnectionSlugCollision} from '#providers/connection-slug.js';
 import type {IntegrationModuleParts, IntegrationProviderModule} from '#providers/types.js';
 
@@ -32,9 +36,11 @@ async function loadSlackModuleParts(
     createSlackIntegrationProvider,
     createSlackTokenStore,
     db: slackDb,
+    deleteSlackInstallationByConnectionId,
     disconnectSlackInstallation: disconnectSlackInstallationRecords,
     getSlackInstallationByTeamId,
     migrationsPath: slackMigrationsPath,
+    slackSecretsNamespace,
     upsertSlackInstallation,
   } = await import('@shipfox/api-integration-slack');
 
@@ -135,12 +141,25 @@ async function loadSlackModuleParts(
   return {
     provider: createSlackIntegrationProvider({
       agentTools: {tokenStore},
+      cleanup: {
+        deleteConnectionRecords: async (connection, {tx}) => {
+          await deleteSlackInstallationByConnectionId(connection.id, {tx});
+        },
+        deleteConnectionSecrets: async (connection) => {
+          // Scoped secrets accept the provider-local suffix, after this helper validates its prefix.
+          await (options.secrets?.slack?.deleteSecrets({
+            workspaceId: connection.workspaceId,
+            namespace: slackNamespaceSuffix(slackSecretsNamespace(connection.id)),
+          }) ?? Promise.resolve());
+        },
+      },
       routes: {
         tokenStore,
         getExistingSlackConnection,
         connectSlackInstallation,
         disconnectSlackInstallation,
         coreDb: db,
+        claimWebhookDelivery,
         publishIntegrationEventReceived,
         recordDeliveryOnly,
         getIntegrationConnectionById,