@shipfox/api-integration-jira 10.2.0 → 12.0.0

package/dist/core/webhook-processor.js

@@ -0,0 +1,137 @@
+import { Buffer } from 'node:buffer';
+import { createHash } from 'node:crypto';
+import { jiraWebhookEnvelopeSchema } from '@shipfox/api-integration-jira-dto';
+import { decodeWebhookBody } from '@shipfox/api-integration-spi';
+import { extractBearerToken } from '@shipfox/node-fastify';
+import { verifyHs256 } from '@shipfox/node-jwt';
+import { logger } from '@shipfox/node-opentelemetry';
+import { z } from 'zod';
+import { config } from '#config.js';
+import { handleJiraWebhook, isJiraInstallationUsable } from '#core/webhook.js';
+import { getJiraInstallationByConnectionId } from '#db/installations.js';
+const JIRA_PROVIDER = 'jira';
+const jiraWebhookJwtClaimsSchema = z.object({
+    iat: z.number().int(),
+    exp: z.number().int()
+}).passthrough();
+export function createJiraWebhookProcessor(options) {
+    return {
+        process: (request)=>processJiraWebhookRequest(options, request)
+    };
+}
+async function processJiraWebhookRequest(options, request) {
+    if (request.route_id !== 'jira') {
+        throw new Error(`Jira processor cannot process ${request.route_id} requests`);
+    }
+    const rawBody = Buffer.from(decodeWebhookBody(request.body));
+    const deliveryId = jiraDeliveryId(request, rawBody);
+    const authorization = request.headers.authorization;
+    if (!authorization) return invalidAuthorization(deliveryId);
+    const token = extractBearerToken(authorization);
+    if (!token) return invalidAuthorization(deliveryId);
+    try {
+        await verifyHs256({
+            token,
+            secret: config.JIRA_OAUTH_CLIENT_SECRET,
+            schema: jiraWebhookJwtClaimsSchema,
+            verificationTime: new Date(request.received_at)
+        });
+    } catch (error) {
+        logger().warn({
+            deliveryId,
+            errName: error instanceof Error ? error.name : typeof error
+        }, 'Jira webhook authorization verification failed');
+        return invalidAuthorization(deliveryId);
+    }
+    let rawPayload;
+    try {
+        rawPayload = JSON.parse(rawBody.toString('utf8'));
+    } catch (error) {
+        logger().warn({
+            deliveryId,
+            err: error
+        }, 'Jira webhook payload JSON parse failed');
+        return {
+            outcome: 'discarded',
+            reason: 'malformed_payload',
+            deliveryId
+        };
+    }
+    const payload = jiraWebhookEnvelopeSchema.safeParse(rawPayload);
+    if (!payload.success) {
+        await recordDeliveryOnly(options, deliveryId);
+        return {
+            outcome: 'discarded',
+            reason: 'unsupported_event',
+            deliveryId
+        };
+    }
+    const connectionId = request.path_parameters.connection_id;
+    const connection = await options.getIntegrationConnectionById(connectionId);
+    if (!connection || connection.provider !== JIRA_PROVIDER || connection.lifecycleStatus !== 'active') {
+        return await discardUnavailableConnection(options, deliveryId);
+    }
+    const installation = await (options.getJiraInstallationByConnectionId ?? getJiraInstallationByConnectionId)(connectionId);
+    if (!isJiraInstallationUsable(installation) || !hasMatchingWebhookId(payload.data, installation.webhookIds)) {
+        return await discardUnavailableConnection(options, deliveryId);
+    }
+    const result = await options.coreDb().transaction(async (tx)=>handleJiraWebhook({
+            tx,
+            deliveryId,
+            receivedAt: request.received_at,
+            rawPayload: payload.data,
+            cloudId: installation.cloudId,
+            connection: connection,
+            authorizingAccountId: installation.authorizingAccountId,
+            publishIntegrationEventReceived: options.publishIntegrationEventReceived,
+            recordDeliveryOnly: options.recordDeliveryOnly
+        }));
+    if (result === 'duplicate') return {
+        outcome: 'duplicate',
+        deliveryId
+    };
+    if (result === 'discarded') return {
+        outcome: 'discarded',
+        reason: 'unsupported_event',
+        deliveryId
+    };
+    return {
+        outcome: 'processed',
+        deliveryId
+    };
+}
+function invalidAuthorization(deliveryId) {
+    return {
+        outcome: 'discarded',
+        reason: 'invalid_signature',
+        deliveryId
+    };
+}
+function jiraDeliveryId(request, rawBody) {
+    const connectionId = request.path_parameters.connection_id;
+    const jiraIdentifier = request.headers['x-atlassian-webhook-identifier'];
+    if (jiraIdentifier) return `${connectionId}:${jiraIdentifier}`;
+    return createHash('sha256').update(connectionId).update('\0').update(rawBody).digest('hex');
+}
+async function recordDeliveryOnly(options, deliveryId) {
+    await options.coreDb().transaction(async (tx)=>{
+        await options.recordDeliveryOnly({
+            tx,
+            provider: JIRA_PROVIDER,
+            deliveryId
+        });
+    });
+}
+async function discardUnavailableConnection(options, deliveryId) {
+    await recordDeliveryOnly(options, deliveryId);
+    return {
+        outcome: 'discarded',
+        reason: 'connection_unavailable',
+        deliveryId
+    };
+}
+function hasMatchingWebhookId(payload, storedWebhookIds) {
+    return payload.matchedWebhookIds?.some((webhookId)=>storedWebhookIds.includes(webhookId)) === true;
+}
+
+//# sourceMappingURL=webhook-processor.js.map

package/dist/core/webhook-processor.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/webhook-processor.ts"],"sourcesContent":["import {Buffer} from 'node:buffer';\nimport {createHash} from 'node:crypto';\nimport {\n  type JiraWebhookEnvelopeDto,\n  jiraWebhookEnvelopeSchema,\n} from '@shipfox/api-integration-jira-dto';\nimport {\n  decodeWebhookBody,\n  type GetIntegrationConnectionByIdFn,\n  type PublishIntegrationEventReceivedFn,\n  type RecordDeliveryOnlyFn,\n  type StoredWebhookRequest,\n  type WebhookProcessingResult,\n} from '@shipfox/api-integration-spi';\nimport {extractBearerToken} from '@shipfox/node-fastify';\nimport {verifyHs256} from '@shipfox/node-jwt';\nimport {logger} from '@shipfox/node-opentelemetry';\nimport type {NodePgDatabase} from 'drizzle-orm/node-postgres';\nimport {z} from 'zod';\nimport {config} from '#config.js';\nimport {handleJiraWebhook, isJiraInstallationUsable} from '#core/webhook.js';\nimport {getJiraInstallationByConnectionId} from '#db/installations.js';\n\nconst JIRA_PROVIDER = 'jira';\nconst jiraWebhookJwtClaimsSchema = z\n  .object({iat: z.number().int(), exp: z.number().int()})\n  .passthrough();\n\nexport interface CreateJiraWebhookProcessorOptions {\n  coreDb: () => NodePgDatabase<Record<string, unknown>>;\n  publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;\n  recordDeliveryOnly: RecordDeliveryOnlyFn;\n  getIntegrationConnectionById: GetIntegrationConnectionByIdFn;\n  getJiraInstallationByConnectionId?: typeof getJiraInstallationByConnectionId;\n}\n\nexport interface JiraWebhookProcessor {\n  process(request: StoredWebhookRequest): Promise<WebhookProcessingResult>;\n}\n\nexport function createJiraWebhookProcessor(\n  options: CreateJiraWebhookProcessorOptions,\n): JiraWebhookProcessor {\n  return {process: (request) => processJiraWebhookRequest(options, request)};\n}\n\nasync function processJiraWebhookRequest(\n  options: CreateJiraWebhookProcessorOptions,\n  request: StoredWebhookRequest,\n): Promise<WebhookProcessingResult> {\n  if (request.route_id !== 'jira') {\n    throw new Error(`Jira processor cannot process ${request.route_id} requests`);\n  }\n\n  const rawBody = Buffer.from(decodeWebhookBody(request.body));\n  const deliveryId = jiraDeliveryId(request, rawBody);\n  const authorization = request.headers.authorization;\n  if (!authorization) return invalidAuthorization(deliveryId);\n\n  const token = extractBearerToken(authorization);\n  if (!token) return invalidAuthorization(deliveryId);\n\n  try {\n    await verifyHs256({\n      token,\n      secret: config.JIRA_OAUTH_CLIENT_SECRET,\n      schema: jiraWebhookJwtClaimsSchema,\n      verificationTime: new Date(request.received_at),\n    });\n  } catch (error) {\n    logger().warn(\n      {deliveryId, errName: error instanceof Error ? error.name : typeof error},\n      'Jira webhook authorization verification failed',\n    );\n    return invalidAuthorization(deliveryId);\n  }\n\n  let rawPayload: unknown;\n  try {\n    rawPayload = JSON.parse(rawBody.toString('utf8'));\n  } catch (error) {\n    logger().warn({deliveryId, err: error}, 'Jira webhook payload JSON parse failed');\n    return {outcome: 'discarded', reason: 'malformed_payload', deliveryId};\n  }\n\n  const payload = jiraWebhookEnvelopeSchema.safeParse(rawPayload);\n  if (!payload.success) {\n    await recordDeliveryOnly(options, deliveryId);\n    return {outcome: 'discarded', reason: 'unsupported_event', deliveryId};\n  }\n\n  const connectionId = request.path_parameters.connection_id;\n  const connection = await options.getIntegrationConnectionById(connectionId);\n  if (\n    !connection ||\n    connection.provider !== JIRA_PROVIDER ||\n    connection.lifecycleStatus !== 'active'\n  ) {\n    return await discardUnavailableConnection(options, deliveryId);\n  }\n  const installation = await (\n    options.getJiraInstallationByConnectionId ?? getJiraInstallationByConnectionId\n  )(connectionId);\n  if (\n    !isJiraInstallationUsable(installation) ||\n    !hasMatchingWebhookId(payload.data, installation.webhookIds)\n  ) {\n    return await discardUnavailableConnection(options, deliveryId);\n  }\n\n  const result = await options.coreDb().transaction(async (tx) =>\n    handleJiraWebhook({\n      tx,\n      deliveryId,\n      receivedAt: request.received_at,\n      rawPayload: payload.data,\n      cloudId: installation.cloudId,\n      connection: connection as typeof connection & {provider: 'jira'},\n      authorizingAccountId: installation.authorizingAccountId,\n      publishIntegrationEventReceived: options.publishIntegrationEventReceived,\n      recordDeliveryOnly: options.recordDeliveryOnly,\n    }),\n  );\n\n  if (result === 'duplicate') return {outcome: 'duplicate', deliveryId};\n  if (result === 'discarded')\n    return {outcome: 'discarded', reason: 'unsupported_event', deliveryId};\n  return {outcome: 'processed', deliveryId};\n}\n\nfunction invalidAuthorization(deliveryId: string): WebhookProcessingResult {\n  return {outcome: 'discarded', reason: 'invalid_signature', deliveryId};\n}\n\nfunction jiraDeliveryId(request: StoredWebhookRequest, rawBody: Uint8Array): string {\n  const connectionId = request.path_parameters.connection_id;\n  const jiraIdentifier = request.headers['x-atlassian-webhook-identifier'];\n  if (jiraIdentifier) return `${connectionId}:${jiraIdentifier}`;\n  return createHash('sha256').update(connectionId).update('\\0').update(rawBody).digest('hex');\n}\n\nasync function recordDeliveryOnly(\n  options: Pick<CreateJiraWebhookProcessorOptions, 'coreDb' | 'recordDeliveryOnly'>,\n  deliveryId: string,\n): Promise<void> {\n  await options.coreDb().transaction(async (tx) => {\n    await options.recordDeliveryOnly({tx, provider: JIRA_PROVIDER, deliveryId});\n  });\n}\n\nasync function discardUnavailableConnection(\n  options: Pick<CreateJiraWebhookProcessorOptions, 'coreDb' | 'recordDeliveryOnly'>,\n  deliveryId: string,\n): Promise<WebhookProcessingResult> {\n  await recordDeliveryOnly(options, deliveryId);\n  return {outcome: 'discarded', reason: 'connection_unavailable', deliveryId};\n}\n\nfunction hasMatchingWebhookId(\n  payload: JiraWebhookEnvelopeDto,\n  storedWebhookIds: number[],\n): boolean {\n  return (\n    payload.matchedWebhookIds?.some((webhookId) => storedWebhookIds.includes(webhookId)) === true\n  );\n}\n"],"names":["Buffer","createHash","jiraWebhookEnvelopeSchema","decodeWebhookBody","extractBearerToken","verifyHs256","logger","z","config","handleJiraWebhook","isJiraInstallationUsable","getJiraInstallationByConnectionId","JIRA_PROVIDER","jiraWebhookJwtClaimsSchema","object","iat","number","int","exp","passthrough","createJiraWebhookProcessor","options","process","request","processJiraWebhookRequest","route_id","Error","rawBody","from","body","deliveryId","jiraDeliveryId","authorization","headers","invalidAuthorization","token","secret","JIRA_OAUTH_CLIENT_SECRET","schema","verificationTime","Date","received_at","error","warn","errName","name","rawPayload","JSON","parse","toString","err","outcome","reason","payload","safeParse","success","recordDeliveryOnly","connectionId","path_parameters","connection_id","connection","getIntegrationConnectionById","provider","lifecycleStatus","discardUnavailableConnection","installation","hasMatchingWebhookId","data","webhookIds","result","coreDb","transaction","tx","receivedAt","cloudId","authorizingAccountId","publishIntegrationEventReceived","jiraIdentifier","update","digest","storedWebhookIds","matchedWebhookIds","some","webhookId","includes"],"mappings":"AAAA,SAAQA,MAAM,QAAO,cAAc;AACnC,SAAQC,UAAU,QAAO,cAAc;AACvC,SAEEC,yBAAyB,QACpB,oCAAoC;AAC3C,SACEC,iBAAiB,QAMZ,+BAA+B;AACtC,SAAQC,kBAAkB,QAAO,wBAAwB;AACzD,SAAQC,WAAW,QAAO,oBAAoB;AAC9C,SAAQC,MAAM,QAAO,8BAA8B;AAEnD,SAAQC,CAAC,QAAO,MAAM;AACtB,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,iBAAiB,EAAEC,wBAAwB,QAAO,mBAAmB;AAC7E,SAAQC,iCAAiC,QAAO,uBAAuB;AAEvE,MAAMC,gBAAgB;AACtB,MAAMC,6BAA6BN,EAChCO,MAAM,CAAC;IAACC,KAAKR,EAAES,MAAM,GAAGC,GAAG;IAAIC,KAAKX,EAAES,MAAM,GAAGC,GAAG;AAAE,GACpDE,WAAW;AAcd,OAAO,SAASC,2BACdC,OAA0C;IAE1C,OAAO;QAACC,SAAS,CAACC,UAAYC,0BAA0BH,SAASE;IAAQ;AAC3E;AAEA,eAAeC,0BACbH,OAA0C,EAC1CE,OAA6B;IAE7B,IAAIA,QAAQE,QAAQ,KAAK,QAAQ;QAC/B,MAAM,IAAIC,MAAM,CAAC,8BAA8B,EAAEH,QAAQE,QAAQ,CAAC,SAAS,CAAC;IAC9E;IAEA,MAAME,UAAU3B,OAAO4B,IAAI,CAACzB,kBAAkBoB,QAAQM,IAAI;IAC1D,MAAMC,aAAaC,eAAeR,SAASI;IAC3C,MAAMK,gBAAgBT,QAAQU,OAAO,CAACD,aAAa;IACnD,IAAI,CAACA,eAAe,OAAOE,qBAAqBJ;IAEhD,MAAMK,QAAQ/B,mBAAmB4B;IACjC,IAAI,CAACG,OAAO,OAAOD,qBAAqBJ;IAExC,IAAI;QACF,MAAMzB,YAAY;YAChB8B;YACAC,QAAQ5B,OAAO6B,wBAAwB;YACvCC,QAAQzB;YACR0B,kBAAkB,IAAIC,KAAKjB,QAAQkB,WAAW;QAChD;IACF,EAAE,OAAOC,OAAO;QACdpC,SAASqC,IAAI,CACX;YAACb;YAAYc,SAASF,iBAAiBhB,QAAQgB,MAAMG,IAAI,GAAG,OAAOH;QAAK,GACxE;QAEF,OAAOR,qBAAqBJ;IAC9B;IAEA,IAAIgB;IACJ,IAAI;QACFA,aAAaC,KAAKC,KAAK,CAACrB,QAAQsB,QAAQ,CAAC;IAC3C,EAAE,OAAOP,OAAO;QACdpC,SAASqC,IAAI,CAAC;YAACb;YAAYoB,KAAKR;QAAK,GAAG;QACxC,OAAO;YAACS,SAAS;YAAaC,QAAQ;YAAqBtB;QAAU;IACvE;IAEA,MAAMuB,UAAUnD,0BAA0BoD,SAAS,CAACR;IACpD,IAAI,CAACO,QAAQE,OAAO,EAAE;QACpB,MAAMC,mBAAmBnC,SAASS;QAClC,OAAO;YAACqB,SAAS;YAAaC,QAAQ;YAAqBtB;QAAU;IACvE;IAEA,MAAM2B,eAAelC,QAAQmC,eAAe,CAACC,aAAa;IAC1D,MAAMC,aAAa,MAAMvC,QAAQwC,4BAA4B,CAACJ;IAC9D,IACE,CAACG,cACDA,WAAWE,QAAQ,KAAKlD,iBACxBgD,WAAWG,eAAe,KAAK,UAC/B;QACA,OAAO,MAAMC,6BAA6B3C,SAASS;IACrD;IACA,MAAMmC,eAAe,MAAM,AACzB5C,CAAAA,QAAQV,iCAAiC,IAAIA,iCAAgC,EAC7E8C;IACF,IACE,CAAC/C,yBAAyBuD,iBAC1B,CAACC,qBAAqBb,QAAQc,IAAI,EAAEF,aAAaG,UAAU,GAC3D;QACA,OAAO,MAAMJ,6BAA6B3C,SAASS;IACrD;IAEA,MAAMuC,SAAS,MAAMhD,QAAQiD,MAAM,GAAGC,WAAW,CAAC,OAAOC,KACvD/D,kBAAkB;YAChB+D;YACA1C;YACA2C,YAAYlD,QAAQkB,WAAW;YAC/BK,YAAYO,QAAQc,IAAI;YACxBO,SAAST,aAAaS,OAAO;YAC7Bd,YAAYA;YACZe,sBAAsBV,aAAaU,oBAAoB;YACvDC,iCAAiCvD,QAAQuD,+BAA+B;YACxEpB,oBAAoBnC,QAAQmC,kBAAkB;QAChD;IAGF,IAAIa,WAAW,aAAa,OAAO;QAAClB,SAAS;QAAarB;IAAU;IACpE,IAAIuC,WAAW,aACb,OAAO;QAAClB,SAAS;QAAaC,QAAQ;QAAqBtB;IAAU;IACvE,OAAO;QAACqB,SAAS;QAAarB;IAAU;AAC1C;AAEA,SAASI,qBAAqBJ,UAAkB;IAC9C,OAAO;QAACqB,SAAS;QAAaC,QAAQ;QAAqBtB;IAAU;AACvE;AAEA,SAASC,eAAeR,OAA6B,EAAEI,OAAmB;IACxE,MAAM8B,eAAelC,QAAQmC,eAAe,CAACC,aAAa;IAC1D,MAAMkB,iBAAiBtD,QAAQU,OAAO,CAAC,iCAAiC;IACxE,IAAI4C,gBAAgB,OAAO,GAAGpB,aAAa,CAAC,EAAEoB,gBAAgB;IAC9D,OAAO5E,WAAW,UAAU6E,MAAM,CAACrB,cAAcqB,MAAM,CAAC,MAAMA,MAAM,CAACnD,SAASoD,MAAM,CAAC;AACvF;AAEA,eAAevB,mBACbnC,OAAiF,EACjFS,UAAkB;IAElB,MAAMT,QAAQiD,MAAM,GAAGC,WAAW,CAAC,OAAOC;QACxC,MAAMnD,QAAQmC,kBAAkB,CAAC;YAACgB;YAAIV,UAAUlD;YAAekB;QAAU;IAC3E;AACF;AAEA,eAAekC,6BACb3C,OAAiF,EACjFS,UAAkB;IAElB,MAAM0B,mBAAmBnC,SAASS;IAClC,OAAO;QAACqB,SAAS;QAAaC,QAAQ;QAA0BtB;IAAU;AAC5E;AAEA,SAASoC,qBACPb,OAA+B,EAC/B2B,gBAA0B;IAE1B,OACE3B,QAAQ4B,iBAAiB,EAAEC,KAAK,CAACC,YAAcH,iBAAiBI,QAAQ,CAACD,gBAAgB;AAE7F"}

package/dist/core/webhook-registration.d.ts

@@ -0,0 +1,26 @@
+import type { JiraApiClient } from '#api/client.js';
+import { getJiraInstallationByConnectionId, type JiraInstallationLock, updateJiraInstallationWebhook } from '#db/installations.js';
+export declare const JIRA_WEBHOOK_TTL_MS: number;
+export interface RegisterJiraWebhookParams {
+    jira: Pick<JiraApiClient, 'registerDynamicWebhook' | 'deleteDynamicWebhook'>;
+    connectionId: string;
+    cloudId: string;
+    accessToken: string;
+    webhookUrl: string;
+    now?: () => Date;
+    getInstallation?: typeof getJiraInstallationByConnectionId;
+    updateInstallation?: typeof updateJiraInstallationWebhook;
+    withRegistrationLock?: JiraInstallationLock;
+    onRegistrationSuccess?: (input: {
+        tx?: unknown;
+    }) => Promise<void>;
+    onRegistrationFailure?: (input: {
+        tx?: unknown;
+    }) => Promise<void>;
+}
+/** Register Jira's curated webhook and replace local metadata as one serialized state transition. */
+export declare function registerJiraWebhook(params: RegisterJiraWebhookParams): Promise<{
+    webhookId: number;
+    webhookExpiresAt: Date;
+}>;
+//# sourceMappingURL=webhook-registration.d.ts.map

package/dist/core/webhook-registration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-registration.d.ts","sourceRoot":"","sources":["../../src/core/webhook-registration.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAClD,OAAO,EACL,iCAAiC,EACjC,KAAK,oBAAoB,EACzB,6BAA6B,EAE9B,MAAM,sBAAsB,CAAC;AAE9B,eAAO,MAAM,mBAAmB,QAA2B,CAAC;AAE5D,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,wBAAwB,GAAG,sBAAsB,CAAC,CAAC;IAC7E,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,eAAe,CAAC,EAAE,OAAO,iCAAiC,CAAC;IAC3D,kBAAkB,CAAC,EAAE,OAAO,6BAA6B,CAAC;IAC1D,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,qBAAqB,CAAC,EAAE,CAAC,KAAK,EAAE;QAAC,EAAE,CAAC,EAAE,OAAO,CAAA;KAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,qBAAqB,CAAC,EAAE,CAAC,KAAK,EAAE;QAAC,EAAE,CAAC,EAAE,OAAO,CAAA;KAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,qGAAqG;AACrG,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,IAAI,CAAA;CAAC,CAAC,CA8FtD"}

package/dist/core/webhook-registration.js

@@ -0,0 +1,165 @@
+import { logger } from '@shipfox/node-opentelemetry';
+import { getJiraInstallationByConnectionId, updateJiraInstallationWebhook, withJiraInstallationLock } from '#db/installations.js';
+export const JIRA_WEBHOOK_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+/** Register Jira's curated webhook and replace local metadata as one serialized state transition. */ export async function registerJiraWebhook(params) {
+    const withRegistrationLock = params.withRegistrationLock ?? withJiraInstallationLock;
+    let callbackFailed = false;
+    let registeredWebhookId;
+    let previous;
+    let metadataPersisted = false;
+    let cleanupSupersededWebhooks;
+    let result;
+    try {
+        result = await withRegistrationLock(params.cloudId, async ()=>{
+            try {
+                const getInstallation = params.getInstallation ?? getJiraInstallationByConnectionId;
+                previous = await getInstallation(params.connectionId);
+                const registration = await params.jira.registerDynamicWebhook({
+                    accessToken: params.accessToken,
+                    cloudId: params.cloudId,
+                    url: params.webhookUrl
+                });
+                registeredWebhookId = registration.webhookId;
+                const now = params.now ?? (()=>new Date());
+                const webhookExpiresAt = new Date(now().getTime() + JIRA_WEBHOOK_TTL_MS);
+                const updateInstallation = params.updateInstallation ?? updateJiraInstallationWebhook;
+                const updateInput = {
+                    connectionId: params.connectionId,
+                    webhookIds: [
+                        ...new Set([
+                            registration.webhookId,
+                            ...previous?.webhookIds ?? []
+                        ])
+                    ],
+                    webhookExpiresAt
+                };
+                const installation = await updateInstallation(updateInput);
+                if (!installation) throw new Error('Jira webhook registration lost its installation record');
+                metadataPersisted = true;
+                await params.onRegistrationSuccess?.({});
+                cleanupSupersededWebhooks = ()=>finishSupersededWebhookCleanup(params, previous, registration.webhookId, webhookExpiresAt);
+                return {
+                    webhookId: registration.webhookId,
+                    webhookExpiresAt
+                };
+            } catch (error) {
+                callbackFailed = true;
+                if (registeredWebhookId !== undefined) {
+                    const deleted = await deleteNewWebhookAfterPersistenceFailure(params, registeredWebhookId);
+                    if (metadataPersisted || !deleted) {
+                        await restorePreviousWebhookMetadata(params, previous, deleted ? undefined : registeredWebhookId);
+                    }
+                } else if (metadataPersisted) {
+                    await restorePreviousWebhookMetadata(params, previous);
+                }
+                await bestEffortRegistrationFailure(params);
+                throw error;
+            }
+        });
+    } catch (error) {
+        if (!callbackFailed) {
+            if (registeredWebhookId !== undefined) {
+                const deleted = await deleteNewWebhookAfterPersistenceFailure(params, registeredWebhookId);
+                if (metadataPersisted || !deleted) {
+                    await restorePreviousWebhookMetadata(params, previous, deleted ? undefined : registeredWebhookId);
+                }
+            } else if (metadataPersisted) {
+                await restorePreviousWebhookMetadata(params, previous);
+            }
+            await bestEffortRegistrationFailure(params);
+        }
+        throw error;
+    }
+    if (cleanupSupersededWebhooks) {
+        try {
+            await withRegistrationLock(params.cloudId, cleanupSupersededWebhooks);
+        } catch (error) {
+            logger().warn({
+                err: error,
+                connectionId: params.connectionId
+            }, 'Jira superseded webhook cleanup persistence failed');
+        }
+    }
+    return result;
+}
+async function finishSupersededWebhookCleanup(params, previous, registeredWebhookId, webhookExpiresAt) {
+    const supersededWebhookIds = (previous?.webhookIds ?? []).filter((webhookId)=>webhookId !== registeredWebhookId);
+    if (supersededWebhookIds.length === 0) return;
+    const failedCleanupIds = [];
+    for (const webhookId of supersededWebhookIds){
+        try {
+            await params.jira.deleteDynamicWebhook({
+                accessToken: params.accessToken,
+                cloudId: params.cloudId,
+                webhookId
+            });
+        } catch (error) {
+            failedCleanupIds.push(webhookId);
+            logger().warn({
+                err: error,
+                connectionId: params.connectionId,
+                webhookId
+            }, 'Jira superseded webhook cleanup failed');
+        }
+    }
+    const retainedWebhookIds = [
+        registeredWebhookId,
+        ...failedCleanupIds
+    ];
+    const updateInstallation = params.updateInstallation ?? updateJiraInstallationWebhook;
+    const cleanupMetadata = await updateInstallation({
+        connectionId: params.connectionId,
+        webhookIds: retainedWebhookIds,
+        webhookExpiresAt
+    });
+    if (!cleanupMetadata) throw new Error('Jira webhook cleanup metadata persistence returned no installation');
+}
+async function bestEffortRegistrationFailure(params) {
+    try {
+        await params.onRegistrationFailure?.({});
+    } catch (error) {
+        logger().warn({
+            err: error,
+            connectionId: params.connectionId
+        }, 'Jira connection error-state update failed after webhook registration rejection');
+    }
+}
+async function restorePreviousWebhookMetadata(params, previous, retainedWebhookId) {
+    try {
+        const updateInstallation = params.updateInstallation ?? updateJiraInstallationWebhook;
+        await updateInstallation({
+            connectionId: params.connectionId,
+            webhookIds: [
+                ...retainedWebhookId === undefined ? [] : [
+                    retainedWebhookId
+                ],
+                ...(previous?.webhookIds ?? []).filter((webhookId)=>webhookId !== retainedWebhookId)
+            ],
+            webhookExpiresAt: previous?.webhookExpiresAt ?? null
+        });
+    } catch (error) {
+        logger().warn({
+            err: error,
+            connectionId: params.connectionId
+        }, 'Jira webhook metadata restoration failed after registration rejection');
+    }
+}
+async function deleteNewWebhookAfterPersistenceFailure(params, webhookId) {
+    try {
+        await params.jira.deleteDynamicWebhook({
+            accessToken: params.accessToken,
+            cloudId: params.cloudId,
+            webhookId
+        });
+        return true;
+    } catch (cleanupError) {
+        logger().warn({
+            err: cleanupError,
+            connectionId: params.connectionId,
+            webhookId
+        }, 'Jira webhook cleanup failed after metadata persistence rejection');
+        return false;
+    }
+}
+
+//# sourceMappingURL=webhook-registration.js.map

package/dist/core/webhook-registration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/webhook-registration.ts"],"sourcesContent":["import {logger} from '@shipfox/node-opentelemetry';\nimport type {JiraApiClient} from '#api/client.js';\nimport {\n  getJiraInstallationByConnectionId,\n  type JiraInstallationLock,\n  updateJiraInstallationWebhook,\n  withJiraInstallationLock,\n} from '#db/installations.js';\n\nexport const JIRA_WEBHOOK_TTL_MS = 30 * 24 * 60 * 60 * 1000;\n\nexport interface RegisterJiraWebhookParams {\n  jira: Pick<JiraApiClient, 'registerDynamicWebhook' | 'deleteDynamicWebhook'>;\n  connectionId: string;\n  cloudId: string;\n  accessToken: string;\n  webhookUrl: string;\n  now?: () => Date;\n  getInstallation?: typeof getJiraInstallationByConnectionId;\n  updateInstallation?: typeof updateJiraInstallationWebhook;\n  withRegistrationLock?: JiraInstallationLock;\n  onRegistrationSuccess?: (input: {tx?: unknown}) => Promise<void>;\n  onRegistrationFailure?: (input: {tx?: unknown}) => Promise<void>;\n}\n\n/** Register Jira's curated webhook and replace local metadata as one serialized state transition. */\nexport async function registerJiraWebhook(\n  params: RegisterJiraWebhookParams,\n): Promise<{webhookId: number; webhookExpiresAt: Date}> {\n  const withRegistrationLock = params.withRegistrationLock ?? withJiraInstallationLock;\n  let callbackFailed = false;\n  let registeredWebhookId: number | undefined;\n  let previous: Awaited<ReturnType<typeof getJiraInstallationByConnectionId>>;\n  let metadataPersisted = false;\n  let cleanupSupersededWebhooks: (() => Promise<void>) | undefined;\n  let result: {webhookId: number; webhookExpiresAt: Date};\n  try {\n    result = await withRegistrationLock(params.cloudId, async () => {\n      try {\n        const getInstallation = params.getInstallation ?? getJiraInstallationByConnectionId;\n        previous = await getInstallation(params.connectionId);\n        const registration = await params.jira.registerDynamicWebhook({\n          accessToken: params.accessToken,\n          cloudId: params.cloudId,\n          url: params.webhookUrl,\n        });\n        registeredWebhookId = registration.webhookId;\n        const now = params.now ?? (() => new Date());\n        const webhookExpiresAt = new Date(now().getTime() + JIRA_WEBHOOK_TTL_MS);\n\n        const updateInstallation = params.updateInstallation ?? updateJiraInstallationWebhook;\n        const updateInput = {\n          connectionId: params.connectionId,\n          webhookIds: [...new Set([registration.webhookId, ...(previous?.webhookIds ?? [])])],\n          webhookExpiresAt,\n        };\n        const installation = await updateInstallation(updateInput);\n        if (!installation)\n          throw new Error('Jira webhook registration lost its installation record');\n        metadataPersisted = true;\n        await params.onRegistrationSuccess?.({});\n\n        cleanupSupersededWebhooks = () =>\n          finishSupersededWebhookCleanup(\n            params,\n            previous,\n            registration.webhookId,\n            webhookExpiresAt,\n          );\n        return {webhookId: registration.webhookId, webhookExpiresAt};\n      } catch (error) {\n        callbackFailed = true;\n        if (registeredWebhookId !== undefined) {\n          const deleted = await deleteNewWebhookAfterPersistenceFailure(\n            params,\n            registeredWebhookId,\n          );\n          if (metadataPersisted || !deleted) {\n            await restorePreviousWebhookMetadata(\n              params,\n              previous,\n              deleted ? undefined : registeredWebhookId,\n            );\n          }\n        } else if (metadataPersisted) {\n          await restorePreviousWebhookMetadata(params, previous);\n        }\n        await bestEffortRegistrationFailure(params);\n        throw error;\n      }\n    });\n  } catch (error) {\n    if (!callbackFailed) {\n      if (registeredWebhookId !== undefined) {\n        const deleted = await deleteNewWebhookAfterPersistenceFailure(params, registeredWebhookId);\n        if (metadataPersisted || !deleted) {\n          await restorePreviousWebhookMetadata(\n            params,\n            previous,\n            deleted ? undefined : registeredWebhookId,\n          );\n        }\n      } else if (metadataPersisted) {\n        await restorePreviousWebhookMetadata(params, previous);\n      }\n      await bestEffortRegistrationFailure(params);\n    }\n    throw error;\n  }\n\n  if (cleanupSupersededWebhooks) {\n    try {\n      await withRegistrationLock(params.cloudId, cleanupSupersededWebhooks);\n    } catch (error) {\n      logger().warn(\n        {err: error, connectionId: params.connectionId},\n        'Jira superseded webhook cleanup persistence failed',\n      );\n    }\n  }\n\n  return result;\n}\n\nasync function finishSupersededWebhookCleanup(\n  params: RegisterJiraWebhookParams,\n  previous: Awaited<ReturnType<typeof getJiraInstallationByConnectionId>>,\n  registeredWebhookId: number,\n  webhookExpiresAt: Date,\n): Promise<void> {\n  const supersededWebhookIds = (previous?.webhookIds ?? []).filter(\n    (webhookId) => webhookId !== registeredWebhookId,\n  );\n  if (supersededWebhookIds.length === 0) return;\n\n  const failedCleanupIds: number[] = [];\n  for (const webhookId of supersededWebhookIds) {\n    try {\n      await params.jira.deleteDynamicWebhook({\n        accessToken: params.accessToken,\n        cloudId: params.cloudId,\n        webhookId,\n      });\n    } catch (error) {\n      failedCleanupIds.push(webhookId);\n      logger().warn(\n        {err: error, connectionId: params.connectionId, webhookId},\n        'Jira superseded webhook cleanup failed',\n      );\n    }\n  }\n\n  const retainedWebhookIds = [registeredWebhookId, ...failedCleanupIds];\n  const updateInstallation = params.updateInstallation ?? updateJiraInstallationWebhook;\n  const cleanupMetadata = await updateInstallation({\n    connectionId: params.connectionId,\n    webhookIds: retainedWebhookIds,\n    webhookExpiresAt,\n  });\n  if (!cleanupMetadata)\n    throw new Error('Jira webhook cleanup metadata persistence returned no installation');\n}\n\nasync function bestEffortRegistrationFailure(params: RegisterJiraWebhookParams): Promise<void> {\n  try {\n    await params.onRegistrationFailure?.({});\n  } catch (error) {\n    logger().warn(\n      {err: error, connectionId: params.connectionId},\n      'Jira connection error-state update failed after webhook registration rejection',\n    );\n  }\n}\n\nasync function restorePreviousWebhookMetadata(\n  params: RegisterJiraWebhookParams,\n  previous: Awaited<ReturnType<typeof getJiraInstallationByConnectionId>>,\n  retainedWebhookId?: number,\n): Promise<void> {\n  try {\n    const updateInstallation = params.updateInstallation ?? updateJiraInstallationWebhook;\n    await updateInstallation({\n      connectionId: params.connectionId,\n      webhookIds: [\n        ...(retainedWebhookId === undefined ? [] : [retainedWebhookId]),\n        ...(previous?.webhookIds ?? []).filter((webhookId) => webhookId !== retainedWebhookId),\n      ],\n      webhookExpiresAt: previous?.webhookExpiresAt ?? null,\n    });\n  } catch (error) {\n    logger().warn(\n      {err: error, connectionId: params.connectionId},\n      'Jira webhook metadata restoration failed after registration rejection',\n    );\n  }\n}\n\nasync function deleteNewWebhookAfterPersistenceFailure(\n  params: RegisterJiraWebhookParams,\n  webhookId: number,\n): Promise<boolean> {\n  try {\n    await params.jira.deleteDynamicWebhook({\n      accessToken: params.accessToken,\n      cloudId: params.cloudId,\n      webhookId,\n    });\n    return true;\n  } catch (cleanupError) {\n    logger().warn(\n      {err: cleanupError, connectionId: params.connectionId, webhookId},\n      'Jira webhook cleanup failed after metadata persistence rejection',\n    );\n    return false;\n  }\n}\n"],"names":["logger","getJiraInstallationByConnectionId","updateJiraInstallationWebhook","withJiraInstallationLock","JIRA_WEBHOOK_TTL_MS","registerJiraWebhook","params","withRegistrationLock","callbackFailed","registeredWebhookId","previous","metadataPersisted","cleanupSupersededWebhooks","result","cloudId","getInstallation","connectionId","registration","jira","registerDynamicWebhook","accessToken","url","webhookUrl","webhookId","now","Date","webhookExpiresAt","getTime","updateInstallation","updateInput","webhookIds","Set","installation","Error","onRegistrationSuccess","finishSupersededWebhookCleanup","error","undefined","deleted","deleteNewWebhookAfterPersistenceFailure","restorePreviousWebhookMetadata","bestEffortRegistrationFailure","warn","err","supersededWebhookIds","filter","length","failedCleanupIds","deleteDynamicWebhook","push","retainedWebhookIds","cleanupMetadata","onRegistrationFailure","retainedWebhookId","cleanupError"],"mappings":"AAAA,SAAQA,MAAM,QAAO,8BAA8B;AAEnD,SACEC,iCAAiC,EAEjCC,6BAA6B,EAC7BC,wBAAwB,QACnB,uBAAuB;AAE9B,OAAO,MAAMC,sBAAsB,KAAK,KAAK,KAAK,KAAK,KAAK;AAgB5D,mGAAmG,GACnG,OAAO,eAAeC,oBACpBC,MAAiC;IAEjC,MAAMC,uBAAuBD,OAAOC,oBAAoB,IAAIJ;IAC5D,IAAIK,iBAAiB;IACrB,IAAIC;IACJ,IAAIC;IACJ,IAAIC,oBAAoB;IACxB,IAAIC;IACJ,IAAIC;IACJ,IAAI;QACFA,SAAS,MAAMN,qBAAqBD,OAAOQ,OAAO,EAAE;YAClD,IAAI;gBACF,MAAMC,kBAAkBT,OAAOS,eAAe,IAAId;gBAClDS,WAAW,MAAMK,gBAAgBT,OAAOU,YAAY;gBACpD,MAAMC,eAAe,MAAMX,OAAOY,IAAI,CAACC,sBAAsB,CAAC;oBAC5DC,aAAad,OAAOc,WAAW;oBAC/BN,SAASR,OAAOQ,OAAO;oBACvBO,KAAKf,OAAOgB,UAAU;gBACxB;gBACAb,sBAAsBQ,aAAaM,SAAS;gBAC5C,MAAMC,MAAMlB,OAAOkB,GAAG,IAAK,CAAA,IAAM,IAAIC,MAAK;gBAC1C,MAAMC,mBAAmB,IAAID,KAAKD,MAAMG,OAAO,KAAKvB;gBAEpD,MAAMwB,qBAAqBtB,OAAOsB,kBAAkB,IAAI1B;gBACxD,MAAM2B,cAAc;oBAClBb,cAAcV,OAAOU,YAAY;oBACjCc,YAAY;2BAAI,IAAIC,IAAI;4BAACd,aAAaM,SAAS;+BAAMb,UAAUoB,cAAc,EAAE;yBAAE;qBAAE;oBACnFJ;gBACF;gBACA,MAAMM,eAAe,MAAMJ,mBAAmBC;gBAC9C,IAAI,CAACG,cACH,MAAM,IAAIC,MAAM;gBAClBtB,oBAAoB;gBACpB,MAAML,OAAO4B,qBAAqB,GAAG,CAAC;gBAEtCtB,4BAA4B,IAC1BuB,+BACE7B,QACAI,UACAO,aAAaM,SAAS,EACtBG;gBAEJ,OAAO;oBAACH,WAAWN,aAAaM,SAAS;oBAAEG;gBAAgB;YAC7D,EAAE,OAAOU,OAAO;gBACd5B,iBAAiB;gBACjB,IAAIC,wBAAwB4B,WAAW;oBACrC,MAAMC,UAAU,MAAMC,wCACpBjC,QACAG;oBAEF,IAAIE,qBAAqB,CAAC2B,SAAS;wBACjC,MAAME,+BACJlC,QACAI,UACA4B,UAAUD,YAAY5B;oBAE1B;gBACF,OAAO,IAAIE,mBAAmB;oBAC5B,MAAM6B,+BAA+BlC,QAAQI;gBAC/C;gBACA,MAAM+B,8BAA8BnC;gBACpC,MAAM8B;YACR;QACF;IACF,EAAE,OAAOA,OAAO;QACd,IAAI,CAAC5B,gBAAgB;YACnB,IAAIC,wBAAwB4B,WAAW;gBACrC,MAAMC,UAAU,MAAMC,wCAAwCjC,QAAQG;gBACtE,IAAIE,qBAAqB,CAAC2B,SAAS;oBACjC,MAAME,+BACJlC,QACAI,UACA4B,UAAUD,YAAY5B;gBAE1B;YACF,OAAO,IAAIE,mBAAmB;gBAC5B,MAAM6B,+BAA+BlC,QAAQI;YAC/C;YACA,MAAM+B,8BAA8BnC;QACtC;QACA,MAAM8B;IACR;IAEA,IAAIxB,2BAA2B;QAC7B,IAAI;YACF,MAAML,qBAAqBD,OAAOQ,OAAO,EAAEF;QAC7C,EAAE,OAAOwB,OAAO;YACdpC,SAAS0C,IAAI,CACX;gBAACC,KAAKP;gBAAOpB,cAAcV,OAAOU,YAAY;YAAA,GAC9C;QAEJ;IACF;IAEA,OAAOH;AACT;AAEA,eAAesB,+BACb7B,MAAiC,EACjCI,QAAuE,EACvED,mBAA2B,EAC3BiB,gBAAsB;IAEtB,MAAMkB,uBAAuB,AAAClC,CAAAA,UAAUoB,cAAc,EAAE,AAAD,EAAGe,MAAM,CAC9D,CAACtB,YAAcA,cAAcd;IAE/B,IAAImC,qBAAqBE,MAAM,KAAK,GAAG;IAEvC,MAAMC,mBAA6B,EAAE;IACrC,KAAK,MAAMxB,aAAaqB,qBAAsB;QAC5C,IAAI;YACF,MAAMtC,OAAOY,IAAI,CAAC8B,oBAAoB,CAAC;gBACrC5B,aAAad,OAAOc,WAAW;gBAC/BN,SAASR,OAAOQ,OAAO;gBACvBS;YACF;QACF,EAAE,OAAOa,OAAO;YACdW,iBAAiBE,IAAI,CAAC1B;YACtBvB,SAAS0C,IAAI,CACX;gBAACC,KAAKP;gBAAOpB,cAAcV,OAAOU,YAAY;gBAAEO;YAAS,GACzD;QAEJ;IACF;IAEA,MAAM2B,qBAAqB;QAACzC;WAAwBsC;KAAiB;IACrE,MAAMnB,qBAAqBtB,OAAOsB,kBAAkB,IAAI1B;IACxD,MAAMiD,kBAAkB,MAAMvB,mBAAmB;QAC/CZ,cAAcV,OAAOU,YAAY;QACjCc,YAAYoB;QACZxB;IACF;IACA,IAAI,CAACyB,iBACH,MAAM,IAAIlB,MAAM;AACpB;AAEA,eAAeQ,8BAA8BnC,MAAiC;IAC5E,IAAI;QACF,MAAMA,OAAO8C,qBAAqB,GAAG,CAAC;IACxC,EAAE,OAAOhB,OAAO;QACdpC,SAAS0C,IAAI,CACX;YAACC,KAAKP;YAAOpB,cAAcV,OAAOU,YAAY;QAAA,GAC9C;IAEJ;AACF;AAEA,eAAewB,+BACblC,MAAiC,EACjCI,QAAuE,EACvE2C,iBAA0B;IAE1B,IAAI;QACF,MAAMzB,qBAAqBtB,OAAOsB,kBAAkB,IAAI1B;QACxD,MAAM0B,mBAAmB;YACvBZ,cAAcV,OAAOU,YAAY;YACjCc,YAAY;mBACNuB,sBAAsBhB,YAAY,EAAE,GAAG;oBAACgB;iBAAkB;mBAC3D,AAAC3C,CAAAA,UAAUoB,cAAc,EAAE,AAAD,EAAGe,MAAM,CAAC,CAACtB,YAAcA,cAAc8B;aACrE;YACD3B,kBAAkBhB,UAAUgB,oBAAoB;QAClD;IACF,EAAE,OAAOU,OAAO;QACdpC,SAAS0C,IAAI,CACX;YAACC,KAAKP;YAAOpB,cAAcV,OAAOU,YAAY;QAAA,GAC9C;IAEJ;AACF;AAEA,eAAeuB,wCACbjC,MAAiC,EACjCiB,SAAiB;IAEjB,IAAI;QACF,MAAMjB,OAAOY,IAAI,CAAC8B,oBAAoB,CAAC;YACrC5B,aAAad,OAAOc,WAAW;YAC/BN,SAASR,OAAOQ,OAAO;YACvBS;QACF;QACA,OAAO;IACT,EAAE,OAAO+B,cAAc;QACrBtD,SAAS0C,IAAI,CACX;YAACC,KAAKW;YAActC,cAAcV,OAAOU,YAAY;YAAEO;QAAS,GAChE;QAEF,OAAO;IACT;AACF"}

package/dist/core/webhook.d.ts

@@ -0,0 +1,18 @@
+import type { JiraWebhookEnvelopeDto } from '@shipfox/api-integration-jira-dto';
+import type { IntegrationConnection, IntegrationTx, PublishIntegrationEventReceivedFn, RecordDeliveryOnlyFn } from '@shipfox/api-integration-spi';
+import type { JiraInstallation } from '#db/installations.js';
+export interface HandleJiraWebhookParams {
+    tx: IntegrationTx;
+    deliveryId: string;
+    receivedAt: string;
+    rawPayload: JiraWebhookEnvelopeDto;
+    cloudId: string;
+    connection: IntegrationConnection<'jira'>;
+    authorizingAccountId: string;
+    publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;
+    recordDeliveryOnly: RecordDeliveryOnlyFn;
+}
+export type HandleJiraWebhookResult = 'published' | 'duplicate' | 'discarded';
+export declare function handleJiraWebhook(params: HandleJiraWebhookParams): Promise<HandleJiraWebhookResult>;
+export declare function isJiraInstallationUsable(installation: JiraInstallation | undefined): installation is JiraInstallation;
+//# sourceMappingURL=webhook.d.ts.map

package/dist/core/webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../src/core/webhook.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,sBAAsB,EAAC,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EACV,qBAAqB,EACrB,aAAa,EACb,iCAAiC,EACjC,oBAAoB,EACrB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,sBAAsB,CAAC;AAI3D,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,aAAa,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,sBAAsB,CAAC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC1C,oBAAoB,EAAE,MAAM,CAAC;IAC7B,+BAA+B,EAAE,iCAAiC,CAAC;IACnE,kBAAkB,EAAE,oBAAoB,CAAC;CAC1C;AAED,MAAM,MAAM,uBAAuB,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,CAAC;AAE9E,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,uBAAuB,CAAC,CA0BlC;AAWD,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,gBAAgB,GAAG,SAAS,GACzC,YAAY,IAAI,gBAAgB,CAElC"}

package/dist/core/webhook.js

@@ -0,0 +1,38 @@
+const JIRA_PROVIDER = 'jira';
+export async function handleJiraWebhook(params) {
+    if (isSelfAuthoredEvent(params.rawPayload, params.authorizingAccountId)) {
+        await params.recordDeliveryOnly({
+            tx: params.tx,
+            provider: JIRA_PROVIDER,
+            deliveryId: params.deliveryId
+        });
+        return 'discarded';
+    }
+    const payload = {
+        ...params.rawPayload,
+        cloudId: params.cloudId
+    };
+    const result = await params.publishIntegrationEventReceived({
+        tx: params.tx,
+        event: {
+            provider: JIRA_PROVIDER,
+            source: params.connection.slug,
+            event: params.rawPayload.webhookEvent,
+            workspaceId: params.connection.workspaceId,
+            connectionId: params.connection.id,
+            connectionName: params.connection.displayName,
+            deliveryId: params.deliveryId,
+            receivedAt: params.receivedAt,
+            payload
+        }
+    });
+    return result.published ? 'published' : 'duplicate';
+}
+function isSelfAuthoredEvent(payload, authorizingAccountId) {
+    return (payload.webhookEvent === 'comment_created' || payload.webhookEvent === 'comment_updated' || payload.webhookEvent === 'jira:issue_updated') && payload.user.accountId === authorizingAccountId;
+}
+export function isJiraInstallationUsable(installation) {
+    return installation?.status === 'installed';
+}
+
+//# sourceMappingURL=webhook.js.map

package/dist/core/webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/webhook.ts"],"sourcesContent":["import type {JiraWebhookEnvelopeDto} from '@shipfox/api-integration-jira-dto';\nimport type {\n  IntegrationConnection,\n  IntegrationTx,\n  PublishIntegrationEventReceivedFn,\n  RecordDeliveryOnlyFn,\n} from '@shipfox/api-integration-spi';\nimport type {JiraInstallation} from '#db/installations.js';\n\nconst JIRA_PROVIDER = 'jira';\n\nexport interface HandleJiraWebhookParams {\n  tx: IntegrationTx;\n  deliveryId: string;\n  receivedAt: string;\n  rawPayload: JiraWebhookEnvelopeDto;\n  cloudId: string;\n  connection: IntegrationConnection<'jira'>;\n  authorizingAccountId: string;\n  publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;\n  recordDeliveryOnly: RecordDeliveryOnlyFn;\n}\n\nexport type HandleJiraWebhookResult = 'published' | 'duplicate' | 'discarded';\n\nexport async function handleJiraWebhook(\n  params: HandleJiraWebhookParams,\n): Promise<HandleJiraWebhookResult> {\n  if (isSelfAuthoredEvent(params.rawPayload, params.authorizingAccountId)) {\n    await params.recordDeliveryOnly({\n      tx: params.tx,\n      provider: JIRA_PROVIDER,\n      deliveryId: params.deliveryId,\n    });\n    return 'discarded';\n  }\n\n  const payload = {...params.rawPayload, cloudId: params.cloudId};\n  const result = await params.publishIntegrationEventReceived({\n    tx: params.tx,\n    event: {\n      provider: JIRA_PROVIDER,\n      source: params.connection.slug,\n      event: params.rawPayload.webhookEvent,\n      workspaceId: params.connection.workspaceId,\n      connectionId: params.connection.id,\n      connectionName: params.connection.displayName,\n      deliveryId: params.deliveryId,\n      receivedAt: params.receivedAt,\n      payload,\n    },\n  });\n  return result.published ? 'published' : 'duplicate';\n}\n\nfunction isSelfAuthoredEvent(payload: JiraWebhookEnvelopeDto, authorizingAccountId: string) {\n  return (\n    (payload.webhookEvent === 'comment_created' ||\n      payload.webhookEvent === 'comment_updated' ||\n      payload.webhookEvent === 'jira:issue_updated') &&\n    payload.user.accountId === authorizingAccountId\n  );\n}\n\nexport function isJiraInstallationUsable(\n  installation: JiraInstallation | undefined,\n): installation is JiraInstallation {\n  return installation?.status === 'installed';\n}\n"],"names":["JIRA_PROVIDER","handleJiraWebhook","params","isSelfAuthoredEvent","rawPayload","authorizingAccountId","recordDeliveryOnly","tx","provider","deliveryId","payload","cloudId","result","publishIntegrationEventReceived","event","source","connection","slug","webhookEvent","workspaceId","connectionId","id","connectionName","displayName","receivedAt","published","user","accountId","isJiraInstallationUsable","installation","status"],"mappings":"AASA,MAAMA,gBAAgB;AAgBtB,OAAO,eAAeC,kBACpBC,MAA+B;IAE/B,IAAIC,oBAAoBD,OAAOE,UAAU,EAAEF,OAAOG,oBAAoB,GAAG;QACvE,MAAMH,OAAOI,kBAAkB,CAAC;YAC9BC,IAAIL,OAAOK,EAAE;YACbC,UAAUR;YACVS,YAAYP,OAAOO,UAAU;QAC/B;QACA,OAAO;IACT;IAEA,MAAMC,UAAU;QAAC,GAAGR,OAAOE,UAAU;QAAEO,SAAST,OAAOS,OAAO;IAAA;IAC9D,MAAMC,SAAS,MAAMV,OAAOW,+BAA+B,CAAC;QAC1DN,IAAIL,OAAOK,EAAE;QACbO,OAAO;YACLN,UAAUR;YACVe,QAAQb,OAAOc,UAAU,CAACC,IAAI;YAC9BH,OAAOZ,OAAOE,UAAU,CAACc,YAAY;YACrCC,aAAajB,OAAOc,UAAU,CAACG,WAAW;YAC1CC,cAAclB,OAAOc,UAAU,CAACK,EAAE;YAClCC,gBAAgBpB,OAAOc,UAAU,CAACO,WAAW;YAC7Cd,YAAYP,OAAOO,UAAU;YAC7Be,YAAYtB,OAAOsB,UAAU;YAC7Bd;QACF;IACF;IACA,OAAOE,OAAOa,SAAS,GAAG,cAAc;AAC1C;AAEA,SAAStB,oBAAoBO,OAA+B,EAAEL,oBAA4B;IACxF,OACE,AAACK,CAAAA,QAAQQ,YAAY,KAAK,qBACxBR,QAAQQ,YAAY,KAAK,qBACzBR,QAAQQ,YAAY,KAAK,oBAAmB,KAC9CR,QAAQgB,IAAI,CAACC,SAAS,KAAKtB;AAE/B;AAEA,OAAO,SAASuB,yBACdC,YAA0C;IAE1C,OAAOA,cAAcC,WAAW;AAClC"}

package/dist/db/installations.d.ts

@@ -1,3 +1,5 @@
+export type JiraInstallationLock = <T>(lockKey: string, fn: () => Promise<T>) => Promise<T>;
+export declare function withJiraInstallationLock<T>(lockKey: string, fn: () => Promise<T>): Promise<T>;
 export type JiraInstallationStatus = 'installed' | 'revoked';
 export interface JiraInstallation {
     id: string;
@@ -31,6 +33,11 @@ export interface UpdateJiraInstallationTokenExpiryParams {
     tokenExpiresAt: Date | null;
     scopes?: string[] | undefined;
 }
+export interface UpdateJiraInstallationWebhookParams {
+    connectionId: string;
+    webhookIds: number[];
+    webhookExpiresAt: Date | null;
+}
 export declare function upsertJiraInstallation(params: UpsertJiraInstallationParams, options?: {
     tx?: unknown;
 }): Promise<JiraInstallation>;
@@ -40,6 +47,9 @@ export declare function getJiraInstallationByCloudId(cloudId: string, options?:
 export declare function updateJiraInstallationTokenExpiry(params: UpdateJiraInstallationTokenExpiryParams, options?: {
     tx?: unknown;
 }): Promise<JiraInstallation | undefined>;
+export declare function updateJiraInstallationWebhook(params: UpdateJiraInstallationWebhookParams, options?: {
+    tx?: unknown;
+}): Promise<JiraInstallation | undefined>;
 export declare function deleteJiraInstallationByConnectionId(connectionId: string, options?: {
     tx?: unknown;
 }): Promise<boolean>;
@@ -50,6 +60,7 @@ export type JiraRefreshLockResult<T> = {
     acquired: false;
 };
 export declare function withJiraRefreshLock<T>(connectionId: string, fn: () => Promise<T>): Promise<JiraRefreshLockResult<T>>;
+export declare function withJiraWebhookRegistrationLock<T>(lockKey: string, fn: (tx?: unknown) => Promise<T>): Promise<T>;
 export declare function getJiraInstallationByConnectionId(connectionId: string, options?: {
     tx?: unknown;
 }): Promise<JiraInstallation | undefined>;

package/dist/db/installations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"installations.d.ts","sourceRoot":"","sources":["../../src/db/installations.ts"],"names":[],"mappings":"AAWA,MAAM,MAAM,sBAAsB,GAAG,WAAW,GAAG,SAAS,CAAC;AAE7D,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,sBAAsB,CAAC;IAC/B,cAAc,EAAE,IAAI,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAClC,gBAAgB,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,CAAC;IAC3C,MAAM,EAAE,sBAAsB,CAAC;IAC/B,cAAc,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,CAAC;CAC1C;AAED,MAAM,WAAW,uCAAuC;IACtD,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,IAAI,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAC/B;AAKD,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,4BAA4B,EACpC,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,CAAC,CAiD3B;AAED,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CASvC;AAED,wBAAsB,iCAAiC,CACrD,MAAM,EAAE,uCAAuC,EAC/C,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAYvC;AAED,wBAAsB,oCAAoC,CACxD,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,OAAO,CAAC,CAMlB;AAED,MAAM,MAAM,qBAAqB,CAAC,CAAC,IAAI;IAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAC,GAAG;IAAC,QAAQ,EAAE,KAAK,CAAA;CAAC,CAAC;AAEtF,wBAAgB,mBAAmB,CAAC,CAAC,EACnC,YAAY,EAAE,MAAM,EACpB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAEnC;AAyBD,wBAAsB,iCAAiC,CACrD,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAUvC;AAED,wBAAsB,8BAA8B,CAClD,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAUvC;AAED,wBAAsB,2BAA2B,CAC/C,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CASvC"}
+{"version":3,"file":"installations.d.ts","sourceRoot":"","sources":["../../src/db/installations.ts"],"names":[],"mappings":"AAWA,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;AAM5F,wBAAsB,wBAAwB,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,cA2BtF;AAED,MAAM,MAAM,sBAAsB,GAAG,WAAW,GAAG,SAAS,CAAC;AAE7D,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,sBAAsB,CAAC;IAC/B,cAAc,EAAE,IAAI,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAClC,gBAAgB,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,CAAC;IAC3C,MAAM,EAAE,sBAAsB,CAAC;IAC/B,cAAc,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,CAAC;CAC1C;AAED,MAAM,WAAW,uCAAuC;IACtD,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,IAAI,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,mCAAmC;IAClD,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;CAC/B;AAKD,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,4BAA4B,EACpC,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,CAAC,CAkD3B;AAED,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CASvC;AAED,wBAAsB,iCAAiC,CACrD,MAAM,EAAE,uCAAuC,EAC/C,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAYvC;AAED,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,mCAAmC,EAC3C,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAYvC;AAED,wBAAsB,oCAAoC,CACxD,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,OAAO,CAAC,CAMlB;AAED,MAAM,MAAM,qBAAqB,CAAC,CAAC,IAAI;IAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAC,GAAG;IAAC,QAAQ,EAAE,KAAK,CAAA;CAAC,CAAC;AAEtF,wBAAgB,mBAAmB,CAAC,CAAC,EACnC,YAAY,EAAE,MAAM,EACpB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAEnC;AAED,wBAAgB,+BAA+B,CAAC,CAAC,EAC/C,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAC/B,OAAO,CAAC,CAAC,CAAC,CAEZ;AAyBD,wBAAsB,iCAAiC,CACrD,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAUvC;AAED,wBAAsB,8BAA8B,CAClD,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAUvC;AAED,wBAAsB,2BAA2B,CAC/C,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CASvC"}

package/dist/db/installations.js

@@ -1,13 +1,46 @@
 import { isUniqueViolation } from '@shipfox/node-drizzle';
-import { pgClient } from '@shipfox/node-postgres';
+import { pgClient, withPostgresSession } from '@shipfox/node-postgres';
 import { eq, sql } from 'drizzle-orm';
 import { JiraConnectionAlreadyLinkedError, JiraInstallationAlreadyLinkedError, JiraInstallationSiteMismatchError } from '#core/errors.js';
 import { db } from './db.js';
 import { jiraInstallations, toJiraInstallation } from './schema/installations.js';
+const JIRA_INSTALLATION_LOCK_RETRY_DELAY_MS = 100;
+const JIRA_INSTALLATION_LOCK_MAX_RETRY_DELAY_MS = 1_000;
+const JIRA_INSTALLATION_LOCK_TIMEOUT_MS = 30_000;
+export async function withJiraInstallationLock(lockKey, fn) {
+    const advisoryKey = `jira-installation:${lockKey}`;
+    const deadline = Date.now() + JIRA_INSTALLATION_LOCK_TIMEOUT_MS;
+    let retryDelayMs = JIRA_INSTALLATION_LOCK_RETRY_DELAY_MS;
+    while(true){
+        const attempt = await withPostgresSession(async (client)=>{
+            const lock = await client.query('SELECT pg_try_advisory_lock(hashtext($1)) AS acquired', [
+                advisoryKey
+            ]);
+            if (lock.rows[0]?.acquired !== true) return {
+                acquired: false
+            };
+            try {
+                return {
+                    acquired: true,
+                    value: await fn()
+                };
+            } finally{
+                await client.query('SELECT pg_advisory_unlock(hashtext($1))', [
+                    advisoryKey
+                ]);
+            }
+        });
+        if (attempt.acquired) return attempt.value;
+        if (Date.now() >= deadline) {
+            throw new Error(`Timed out waiting for Jira installation lock: ${lockKey}`);
+        }
+        await new Promise((resolve)=>setTimeout(resolve, retryDelayMs));
+        retryDelayMs = Math.min(retryDelayMs * 2, JIRA_INSTALLATION_LOCK_MAX_RETRY_DELAY_MS);
+    }
+}
 export async function upsertJiraInstallation(params, options = {}) {
     const executor = options.tx ?? db();
     const now = new Date();
-    const webhookIds = params.webhookIds ?? [];
     let row;
     try {
         [row] = await executor.insert(jiraInstallations).values({
@@ -17,7 +50,7 @@ export async function upsertJiraInstallation(params, options = {}) {
             siteName: params.siteName,
             authorizingAccountId: params.authorizingAccountId,
             scopes: params.scopes,
-            webhookIds,
+            webhookIds: params.webhookIds ?? [],
             webhookExpiresAt: params.webhookExpiresAt ?? null,
             status: params.status,
             tokenExpiresAt: params.tokenExpiresAt ?? null
@@ -30,8 +63,12 @@ export async function upsertJiraInstallation(params, options = {}) {
                 siteName: params.siteName,
                 authorizingAccountId: params.authorizingAccountId,
                 scopes: params.scopes,
-                webhookIds,
-                webhookExpiresAt: params.webhookExpiresAt ?? null,
+                ...params.webhookIds === undefined ? {} : {
+                    webhookIds: params.webhookIds
+                },
+                ...params.webhookExpiresAt === undefined ? {} : {
+                    webhookExpiresAt: params.webhookExpiresAt
+                },
                 status: params.status,
                 tokenExpiresAt: params.tokenExpiresAt ?? null,
                 updatedAt: now
@@ -66,6 +103,15 @@ export async function updateJiraInstallationTokenExpiry(params, options = {}) {
     }).where(eq(jiraInstallations.connectionId, params.connectionId)).returning();
     return row ? toJiraInstallation(row) : undefined;
 }
+export async function updateJiraInstallationWebhook(params, options = {}) {
+    const executor = options.tx ?? db();
+    const [row] = await executor.update(jiraInstallations).set({
+        webhookIds: params.webhookIds,
+        webhookExpiresAt: params.webhookExpiresAt,
+        updatedAt: new Date()
+    }).where(eq(jiraInstallations.connectionId, params.connectionId)).returning();
+    return row ? toJiraInstallation(row) : undefined;
+}
 export async function deleteJiraInstallationByConnectionId(connectionId, options = {}) {
     const executor = options.tx ?? db();
     const result = await executor.delete(jiraInstallations).where(eq(jiraInstallations.connectionId, connectionId));
@@ -74,6 +120,9 @@ export async function deleteJiraInstallationByConnectionId(connectionId, options
 export function withJiraRefreshLock(connectionId, fn) {
     return withJiraRefreshLockClient(connectionId, fn);
 }
+export function withJiraWebhookRegistrationLock(lockKey, fn) {
+    return withJiraInstallationLock(lockKey, ()=>fn());
+}
 async function withJiraRefreshLockClient(connectionId, fn) {
     const client = await pgClient().connect();
     let acquired = false;