@shipfox/api-integration-github 5.0.0 → 7.0.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-integration-github",
   "license": "MIT",
-  "version": "5.0.0",
+  "version": "7.0.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -27,13 +27,13 @@
     "ky": "^2.0.0",
     "octokit": "^5.0.3",
     "zod": "^4.4.3",
-    "@shipfox/api-auth-context": "5.0.0",
-    "@shipfox/api-integration-core-dto": "5.0.0",
-    "@shipfox/api-integration-github-dto": "5.0.0",
-    "@shipfox/api-workspaces": "5.0.0",
+    "@shipfox/api-auth-context": "6.0.0",
+    "@shipfox/api-integration-core-dto": "6.0.0",
+    "@shipfox/api-integration-github-dto": "6.0.0",
+    "@shipfox/api-workspaces": "7.0.1",
     "@shipfox/config": "1.2.2",
-    "@shipfox/node-drizzle": "0.3.1",
-    "@shipfox/node-fastify": "0.2.3",
+    "@shipfox/node-drizzle": "0.3.2",
+    "@shipfox/node-fastify": "0.2.4",
     "@shipfox/node-postgres": "0.4.2",
     "@shipfox/node-opentelemetry": "0.5.2"
   },
@@ -44,6 +44,7 @@
     "fastify-type-provider-zod": "^6.0.0",
     "fishery": "^2.4.0",
     "@shipfox/biome": "1.8.2",
+    "@shipfox/depcruise": "1.0.2",
     "@shipfox/swc": "1.2.6",
     "@shipfox/ts-config": "1.3.8",
     "@shipfox/typescript": "1.1.7",
@@ -53,6 +54,7 @@
     "build": "shipfox-swc",
     "check": "shipfox-biome-check",
     "check:fix": "shipfox-biome-check --write",
+    "depcruise": "shipfox-depcruise",
     "test": "shipfox-vitest-run",
     "test:watch": "shipfox-vitest-watch",
     "type": "shipfox-tsc-check",

package/src/core/webhook-processor.test.ts

@@ -0,0 +1,166 @@
+import {createHmac, randomUUID} from 'node:crypto';
+import {
+  createStoredWebhookRequest,
+  decodeWebhookBody,
+  type IntegrationConnection,
+} from '@shipfox/api-integration-core-dto';
+import {db} from '#db/db.js';
+import {githubInstallations} from '#db/schema/installations.js';
+import {githubInstallationFactory} from '#test/index.js';
+import {createGithubWebhookProcessor} from './webhook-processor.js';
+
+const WEBHOOK_SECRET = 'test-webhook-secret';
+
+function fakeConnection(id: string): IntegrationConnection {
+  return {
+    id,
+    workspaceId: randomUUID(),
+    provider: 'github',
+    externalAccountId: '123',
+    slug: 'github_shipfox',
+    displayName: 'GitHub shipfox',
+    lifecycleStatus: 'active',
+    createdAt: new Date(),
+    updatedAt: new Date(),
+  };
+}
+
+function signedInstallationRequest(deliveryId: string, installationId: number) {
+  const body = Buffer.from(JSON.stringify({action: 'deleted', installation: {id: installationId}}));
+  return createStoredWebhookRequest({
+    requestId: randomUUID(),
+    routeId: 'github',
+    receivedAt: new Date().toISOString(),
+    rawQueryString: '',
+    headers: {
+      'x-github-delivery': deliveryId,
+      'x-github-event': 'installation',
+      'x-hub-signature-256': `sha256=${createHmac('sha256', WEBHOOK_SECRET).update(body).digest('hex')}`,
+    },
+    body,
+  });
+}
+
+describe('GitHub webhook processor', () => {
+  beforeEach(async () => {
+    await db().delete(githubInstallations);
+  });
+
+  it('discards a stored request with an invalid signature before opening a transaction', async () => {
+    const coreDb = vi.fn();
+    const processor = createGithubWebhookProcessor({
+      coreDb,
+      publishIntegrationEventReceived: vi.fn(),
+      publishSourcePush: vi.fn(),
+      recordDeliveryOnly: vi.fn(),
+      getIntegrationConnectionById: vi.fn(),
+    });
+    const request = createStoredWebhookRequest({
+      requestId: randomUUID(),
+      routeId: 'github',
+      receivedAt: new Date().toISOString(),
+      rawQueryString: '',
+      headers: {
+        'x-github-delivery': randomUUID(),
+        'x-github-event': 'push',
+        'x-hub-signature-256': 'sha256=not-a-valid-signature',
+      },
+      body: Buffer.from('{}'),
+    });
+
+    const result = await processor.process(request);
+
+    expect(result).toMatchObject({outcome: 'discarded', reason: 'invalid_signature'});
+    expect(coreDb).not.toHaveBeenCalled();
+  });
+
+  it('discards a stored request missing required provider headers', async () => {
+    const processor = createGithubWebhookProcessor({
+      coreDb: vi.fn(),
+      publishIntegrationEventReceived: vi.fn(),
+      publishSourcePush: vi.fn(),
+      recordDeliveryOnly: vi.fn(),
+      getIntegrationConnectionById: vi.fn(),
+    });
+    const request = createStoredWebhookRequest({
+      requestId: randomUUID(),
+      routeId: 'github',
+      receivedAt: new Date().toISOString(),
+      rawQueryString: '',
+      headers: {},
+      body: Buffer.from('{}'),
+    });
+
+    const result = await processor.process(request);
+
+    expect(result).toEqual({outcome: 'discarded', reason: 'missing_required_input'});
+  });
+
+  it('preserves the signed raw body from a stored request before reporting malformed JSON', async () => {
+    const rawBody = Buffer.from('{"message":"h\u00e9llo"');
+    const request = createStoredWebhookRequest({
+      requestId: randomUUID(),
+      routeId: 'github',
+      receivedAt: new Date().toISOString(),
+      rawQueryString: '',
+      headers: {
+        'x-github-delivery': randomUUID(),
+        'x-github-event': 'push',
+        'x-hub-signature-256': `sha256=${createHmac('sha256', WEBHOOK_SECRET).update(rawBody).digest('hex')}`,
+      },
+      body: rawBody,
+    });
+    const processor = createGithubWebhookProcessor({
+      coreDb: () =>
+        ({transaction: (callback: (tx: unknown) => Promise<unknown>) => callback({})}) as never,
+      publishIntegrationEventReceived: vi.fn(),
+      publishSourcePush: vi.fn(),
+      recordDeliveryOnly: vi.fn(),
+      getIntegrationConnectionById: vi.fn(),
+    });
+
+    const result = await processor.process(request);
+
+    expect(Buffer.from(decodeWebhookBody(request.body))).toEqual(rawBody);
+    expect(result).toMatchObject({outcome: 'discarded', reason: 'malformed_payload'});
+  });
+
+  it('retries credential cleanup after the delivery transaction commits', async () => {
+    const installationId = 8412;
+    const connectionId = randomUUID();
+    const connection = fakeConnection(connectionId);
+    const deliveryId = randomUUID();
+    await githubInstallationFactory.create({
+      connectionId,
+      installationId: String(installationId),
+    });
+    const publishIntegrationEventReceived = vi
+      .fn()
+      .mockResolvedValueOnce({published: true})
+      .mockResolvedValueOnce({published: false});
+    const deleteInstallationTokenSecret = vi
+      .fn()
+      .mockRejectedValueOnce(new Error('secret store unavailable'))
+      .mockResolvedValueOnce(1);
+    const processor = createGithubWebhookProcessor({
+      coreDb: db,
+      publishIntegrationEventReceived,
+      publishSourcePush: vi.fn(),
+      recordDeliveryOnly: vi.fn(),
+      getIntegrationConnectionById: vi.fn(() => Promise.resolve(connection)),
+      deleteInstallationTokenSecret,
+    });
+    const request = signedInstallationRequest(deliveryId, installationId);
+
+    const firstAttempt = processor.process(request);
+    await expect(firstAttempt).rejects.toThrow('secret store unavailable');
+    const retryResult = await processor.process(request);
+
+    expect(retryResult).toEqual({outcome: 'duplicate', deliveryId});
+    expect(deleteInstallationTokenSecret).toHaveBeenCalledTimes(2);
+    expect(deleteInstallationTokenSecret).toHaveBeenLastCalledWith({
+      workspaceId: connection.workspaceId,
+      installationId,
+    });
+  });
+});

package/src/core/webhook-processor.ts

@@ -0,0 +1,97 @@
+import {Buffer} from 'node:buffer';
+import {Webhooks} from '@octokit/webhooks';
+import {
+  decodeWebhookBody,
+  type GetIntegrationConnectionByIdFn,
+  type PublishIntegrationEventReceivedFn,
+  type PublishSourcePushFn,
+  type RecordDeliveryOnlyFn,
+  type StoredWebhookRequest,
+  type WebhookProcessingResult,
+} from '@shipfox/api-integration-core-dto';
+import {logger} from '@shipfox/node-opentelemetry';
+import type {NodePgDatabase} from 'drizzle-orm/node-postgres';
+import {config} from '#config.js';
+import {handleGithubEvent} from '#core/webhook.js';
+
+const DELIVERY_HEADER = 'x-github-delivery';
+const EVENT_HEADER = 'x-github-event';
+const SIGNATURE_HEADER = 'x-hub-signature-256';
+
+export interface CreateGithubWebhookProcessorOptions {
+  coreDb: () => NodePgDatabase<Record<string, unknown>>;
+  publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;
+  publishSourcePush: PublishSourcePushFn;
+  recordDeliveryOnly: RecordDeliveryOnlyFn;
+  getIntegrationConnectionById: GetIntegrationConnectionByIdFn;
+  deleteInstallationTokenSecret?:
+    | ((params: {workspaceId: string; installationId: number}) => Promise<unknown>)
+    | undefined;
+}
+
+export interface GithubWebhookProcessor {
+  process(request: StoredWebhookRequest): Promise<WebhookProcessingResult>;
+}
+
+export function createGithubWebhookProcessor(
+  options: CreateGithubWebhookProcessorOptions,
+): GithubWebhookProcessor {
+  const webhooks = new Webhooks({secret: config.GITHUB_APP_WEBHOOK_SECRET});
+  return {process: (request) => processGithubWebhookRequest(options, webhooks, request)};
+}
+
+async function processGithubWebhookRequest(
+  options: CreateGithubWebhookProcessorOptions,
+  webhooks: Webhooks,
+  request: StoredWebhookRequest,
+): Promise<WebhookProcessingResult> {
+  if (request.route_id !== 'github') {
+    throw new Error(`GitHub processor cannot process ${request.route_id} requests`);
+  }
+
+  const deliveryId = request.headers[DELIVERY_HEADER];
+  const event = request.headers[EVENT_HEADER];
+  const signature = request.headers[SIGNATURE_HEADER];
+  if (!deliveryId || !event || !signature) {
+    return {outcome: 'discarded', reason: 'missing_required_input'};
+  }
+
+  const rawBody = Buffer.from(decodeWebhookBody(request.body));
+  let verified: boolean;
+  try {
+    verified = await webhooks.verify(rawBody.toString('utf8'), signature);
+  } catch (error) {
+    logger().warn({deliveryId, err: error}, 'github webhook signature verification threw');
+    verified = false;
+  }
+  if (!verified) return {outcome: 'discarded', reason: 'invalid_signature', deliveryId};
+
+  let payload: unknown;
+  try {
+    payload = JSON.parse(rawBody.toString('utf8'));
+  } catch (error) {
+    logger().warn({deliveryId, err: error}, 'github webhook payload JSON parse failed');
+    return {outcome: 'discarded', reason: 'malformed_payload', deliveryId};
+  }
+
+  const result = await options.coreDb().transaction(async (tx) =>
+    handleGithubEvent({
+      tx,
+      deliveryId,
+      event,
+      payload,
+      publishIntegrationEventReceived: options.publishIntegrationEventReceived,
+      publishSourcePush: options.publishSourcePush,
+      recordDeliveryOnly: options.recordDeliveryOnly,
+      getIntegrationConnectionById: options.getIntegrationConnectionById,
+    }),
+  );
+
+  if (result.installationTokenCleanup && options.deleteInstallationTokenSecret) {
+    await options.deleteInstallationTokenSecret(result.installationTokenCleanup);
+  }
+
+  return result.outcome.startsWith('duplicate')
+    ? {outcome: 'duplicate', deliveryId}
+    : {outcome: 'processed', deliveryId};
+}

package/src/core/webhook.test.ts

@@ -299,70 +299,70 @@ describe('handleGithubEvent', () => {
     });
   });
 
-  it('requests cached installation token cleanup when the installation is deleted', async () => {
+  it('returns the cached installation token cleanup handle when the installation is deleted', async () => {
     const installationId = 7791;
     const connection = fakeConnection();
     await seedInstallation(installationId, connection.id);
     const handlers = deps({connection});
-    const deleteInstallationTokenSecret = vi.fn(() => Promise.resolve());
 
     const result = await handleGithubEvent({
       tx: db(),
       deliveryId: randomUUID(),
       event: 'installation',
       payload: {action: 'deleted', installation: {id: installationId}},
-      deleteInstallationTokenSecret,
       ...handlers,
     });
 
     expect(result.outcome).toBe('published-envelope');
-    expect(deleteInstallationTokenSecret).toHaveBeenCalledWith({
+    expect(result.installationTokenCleanup).toEqual({
       workspaceId: connection.workspaceId,
       installationId,
     });
   });
 
-  it('does not clean up cached installation tokens for duplicate lifecycle deliveries', async () => {
+  it('keeps the cleanup handle for duplicate lifecycle deliveries', async () => {
     const installationId = 7792;
     const connection = fakeConnection();
     await seedInstallation(installationId, connection.id);
     const handlers = deps({connection, publishIntegrationEventReceivedResult: {published: false}});
-    const deleteInstallationTokenSecret = vi.fn(() => Promise.resolve());
 
     const result = await handleGithubEvent({
       tx: db(),
       deliveryId: randomUUID(),
       event: 'installation',
       payload: {action: 'suspend', installation: {id: installationId}},
-      deleteInstallationTokenSecret,
       ...handlers,
     });
 
     expect(result.outcome).toBe('duplicate-envelope');
-    expect(deleteInstallationTokenSecret).not.toHaveBeenCalled();
+    expect(result.installationTokenCleanup).toEqual({
+      workspaceId: connection.workspaceId,
+      installationId,
+    });
   });
 
-  it('does not fail lifecycle webhook handling when cached token cleanup fails', async () => {
+  it('returns the cleanup handle for a deletion delivered after the connection is disabled', async () => {
     const installationId = 7793;
-    const connection = fakeConnection();
+    const connection = fakeConnection({lifecycleStatus: 'disabled'});
     await seedInstallation(installationId, connection.id);
     const handlers = deps({connection});
-    const deleteInstallationTokenSecret = vi.fn(() => Promise.reject(new Error('store down')));
 
     const result = await handleGithubEvent({
       tx: db(),
       deliveryId: randomUUID(),
       event: 'installation',
       payload: {action: 'deleted', installation: {id: installationId}},
-      deleteInstallationTokenSecret,
       ...handlers,
     });
 
-    expect(result.outcome).toBe('published-envelope');
-    expect(deleteInstallationTokenSecret).toHaveBeenCalledWith({
-      workspaceId: connection.workspaceId,
-      installationId,
+    expect(result).toEqual({
+      outcome: 'inactive-connection',
+      installationTokenCleanup: {
+        workspaceId: connection.workspaceId,
+        installationId,
+      },
     });
+    expect(handlers.recordDeliveryOnly).toHaveBeenCalledTimes(1);
   });
 
   it('publishes a bare resource envelope when action is malformed', async () => {

package/src/core/webhook.ts

@@ -30,9 +30,6 @@ export interface HandleGithubEventParams {
   publishSourcePush: PublishSourcePushFn;
   recordDeliveryOnly: RecordDeliveryOnlyFn;
   getIntegrationConnectionById: GetIntegrationConnectionByIdFn;
-  deleteInstallationTokenSecret?:
-    | ((params: {workspaceId: string; installationId: number}) => Promise<unknown>)
-    | undefined;
 }
 
 export type HandleGithubEventOutcome =
@@ -47,13 +44,18 @@ export type HandleGithubEventOutcome =
   | 'inactive-connection'
   | 'no-installation-id';
 
+export interface HandleGithubEventResult {
+  outcome: HandleGithubEventOutcome;
+  installationTokenCleanup?: {workspaceId: string; installationId: number} | undefined;
+}
+
 function isBranchDeletion(after: string): boolean {
   return after === DELETED_BRANCH_SHA;
 }
 
 export async function handleGithubEvent(
   params: HandleGithubEventParams,
-): Promise<{outcome: HandleGithubEventOutcome}> {
+): Promise<HandleGithubEventResult> {
   const actionEnvelope = githubWebhookActionSchema.safeParse(params.payload);
   const action = actionEnvelope.success ? actionEnvelope.data.action : undefined;
   const installationEnvelope = githubWebhookInstallationSchema.safeParse(params.payload);
@@ -120,7 +122,13 @@ export async function handleGithubEvent(
       provider: GITHUB_SOURCE,
       deliveryId: params.deliveryId,
     });
-    return {outcome: 'inactive-connection'};
+    return withInstallationTokenCleanup(
+      {outcome: 'inactive-connection'},
+      params.event,
+      action,
+      connection.workspaceId,
+      installationId,
+    );
   }
 
   if (params.event === 'push') {
@@ -157,51 +165,28 @@ export async function handleGithubEvent(
     connection,
     event: eventName,
   });
-  if (result.outcome === 'published-envelope') {
-    await deleteInstallationTokenSecretBestEffort({
-      deleteInstallationTokenSecret: params.deleteInstallationTokenSecret,
-      event: params.event,
-      action,
-      deliveryId: params.deliveryId,
-      workspaceId: connection.workspaceId,
-      installationId,
-    });
-  }
-  return result;
+  return withInstallationTokenCleanup(
+    result,
+    params.event,
+    action,
+    connection.workspaceId,
+    installationId,
+  );
 }
 
 function shouldDeleteInstallationTokenSecret(event: string, action: string | undefined): boolean {
   return event === 'installation' && (action === 'deleted' || action === 'suspend');
 }
 
-async function deleteInstallationTokenSecretBestEffort(params: {
-  deleteInstallationTokenSecret:
-    | ((params: {workspaceId: string; installationId: number}) => Promise<unknown>)
-    | undefined;
-  event: string;
-  action: string | undefined;
-  deliveryId: string;
-  workspaceId: string;
-  installationId: number;
-}): Promise<void> {
-  if (!shouldDeleteInstallationTokenSecret(params.event, params.action)) return;
-
-  try {
-    await params.deleteInstallationTokenSecret?.({
-      workspaceId: params.workspaceId,
-      installationId: params.installationId,
-    });
-  } catch (error) {
-    logger().warn(
-      {
-        deliveryId: params.deliveryId,
-        installationId: params.installationId,
-        workspaceId: params.workspaceId,
-        error,
-      },
-      'github webhook installation token cleanup failed',
-    );
-  }
+function withInstallationTokenCleanup(
+  result: HandleGithubEventResult,
+  event: string,
+  action: string | undefined,
+  workspaceId: string,
+  installationId: number,
+): HandleGithubEventResult {
+  if (!shouldDeleteInstallationTokenSecret(event, action)) return result;
+  return {...result, installationTokenCleanup: {workspaceId, installationId}};
 }
 
 async function publishGithubPush(params: {

package/src/index.test.ts

@@ -0,0 +1,50 @@
+import {githubInstallationTokenNamespace} from '#api/installation-token-envelope.js';
+import {createGithubIntegrationProvider} from '#index.js';
+
+const {createProcessor, state} = vi.hoisted(() => {
+  const state: {processorOptions: unknown} = {processorOptions: undefined};
+  return {
+    state,
+    createProcessor: vi.fn((options: unknown) => {
+      state.processorOptions = options;
+      return {process: vi.fn()};
+    }),
+  };
+});
+
+vi.mock('#core/webhook-processor.js', () => ({
+  createGithubWebhookProcessor: createProcessor,
+}));
+
+describe('createGithubIntegrationProvider', () => {
+  it('shares installation-token cleanup with the direct and composed processors', async () => {
+    const deleteSecrets = vi.fn(() => Promise.resolve(1));
+    createGithubIntegrationProvider({
+      github: {} as never,
+      getExistingGithubConnection: vi.fn(() => Promise.resolve(undefined)),
+      connectGithubInstallation: vi.fn() as never,
+      coreDb: vi.fn() as never,
+      publishIntegrationEventReceived: vi.fn(() => Promise.resolve({published: false})),
+      publishSourcePush: vi.fn(() => Promise.resolve({published: false})),
+      recordDeliveryOnly: vi.fn(() => Promise.resolve()),
+      getIntegrationConnectionById: vi.fn(() => Promise.resolve(undefined)),
+      deleteSecrets,
+    });
+    const processorOptions = state.processorOptions as {
+      deleteInstallationTokenSecret: (params: {
+        workspaceId: string;
+        installationId: number;
+      }) => Promise<unknown>;
+    };
+
+    await processorOptions.deleteInstallationTokenSecret({
+      workspaceId: 'workspace-1',
+      installationId: 123,
+    });
+
+    expect(deleteSecrets).toHaveBeenCalledWith({
+      workspaceId: 'workspace-1',
+      namespace: githubInstallationTokenNamespace(123),
+    });
+  });
+});

package/src/index.ts

@@ -10,6 +10,7 @@ import type {GithubInstallationTokenProvider} from '#api/installation-token-prov
 import {deleteGithubInstallationTokenSecret} from '#api/installation-token-provider.js';
 import {GithubAgentToolsProvider} from '#core/agent-tools.js';
 import {GithubSourceControlProvider} from '#core/source-control.js';
+import {createGithubWebhookProcessor} from '#core/webhook-processor.js';
 import {closeDb, db} from '#db/db.js';
 import {getGithubInstallationByConnectionId} from '#db/installations.js';
 import {migrationsPath} from '#db/migrations.js';
@@ -49,6 +50,11 @@ export {handleGithubCallback} from '#core/install.js';
 export {signGithubInstallState, verifyGithubInstallState} from '#core/state.js';
 export type {HandleGithubEventOutcome} from '#core/webhook.js';
 export {handleGithubEvent} from '#core/webhook.js';
+export type {
+  CreateGithubWebhookProcessorOptions,
+  GithubWebhookProcessor,
+} from '#core/webhook-processor.js';
+export {createGithubWebhookProcessor} from '#core/webhook-processor.js';
 export type {GithubInstallation, UpsertGithubInstallationParams} from '#db/installations.js';
 export {
   getGithubInstallationByConnectionId,
@@ -77,6 +83,18 @@ export function createGithubIntegrationProvider(options: CreateGithubIntegration
   const getInstallationByConnectionId =
     options.getGithubInstallationByConnectionId ?? getGithubInstallationByConnectionId;
   const deleteSecrets = options.deleteSecrets;
+  const deleteInstallationTokenSecret = deleteSecrets
+    ? (params: {workspaceId: string; installationId: number}) =>
+        deleteGithubInstallationTokenSecret({
+          workspaceId: params.workspaceId,
+          installationId: params.installationId,
+          deleteSecrets,
+        })
+    : undefined;
+  const webhookProcessor = createGithubWebhookProcessor({
+    ...options,
+    deleteInstallationTokenSecret,
+  });
 
   return {
     provider: 'github' as const,
@@ -103,6 +121,9 @@ export function createGithubIntegrationProvider(options: CreateGithubIntegration
         github,
         getExistingGithubConnection: options.getExistingGithubConnection,
         connectGithubInstallation: options.connectGithubInstallation,
+        ...(options.requireActiveWorkspaceMembership
+          ? {requireActiveWorkspaceMembership: options.requireActiveWorkspaceMembership}
+          : {}),
       }),
       createGithubWebhookRoutes({
         coreDb: options.coreDb,
@@ -110,15 +131,10 @@ export function createGithubIntegrationProvider(options: CreateGithubIntegration
         publishSourcePush: options.publishSourcePush,
         recordDeliveryOnly: options.recordDeliveryOnly,
         getIntegrationConnectionById: options.getIntegrationConnectionById,
-        deleteInstallationTokenSecret: deleteSecrets
-          ? (params) =>
-              deleteGithubInstallationTokenSecret({
-                workspaceId: params.workspaceId,
-                installationId: params.installationId,
-                deleteSecrets,
-              })
-          : undefined,
+        deleteInstallationTokenSecret,
+        processor: webhookProcessor,
       }),
     ],
+    webhookProcessors: [{routeIds: ['github'] as const, processor: webhookProcessor}],
   };
 }

package/src/presentation/routes/install.test.ts

@@ -15,12 +15,7 @@ import type {ConnectGithubInstallationInput} from '#core/install.js';
 import {verifyGithubInstallState} from '#core/state.js';
 import {createGithubIntegrationProvider} from '#index.js';
 
-vi.mock('@shipfox/api-workspaces', () => ({
-  requireWorkspaceMembership: vi.fn(() => Promise.resolve()),
-}));
-
-const {requireWorkspaceMembership} = await import('@shipfox/api-workspaces');
-const requireWorkspaceMembershipMock = vi.mocked(requireWorkspaceMembership);
+const requireWorkspaceMembershipMock = vi.fn(() => Promise.resolve());
 let authenticatedMemberships: UserContextMembership[] = [];
 
 const fakeUserAuth: AuthMethod = {
@@ -111,6 +106,7 @@ async function createTestApp(options: CreateTestAppOptions = {}): Promise<Fastif
     publishSourcePush: vi.fn(() => Promise.resolve({published: false})),
     recordDeliveryOnly: vi.fn(() => Promise.resolve()),
     getIntegrationConnectionById: vi.fn(() => Promise.resolve(undefined)),
+    requireActiveWorkspaceMembership: requireWorkspaceMembershipMock,
   });
   const app = await createApp({
     auth: [fakeUserAuth],