@shipfox/api-integration-jira 11.0.0 → 12.1.0

package/src/core/install.test.ts

@@ -1,3 +1,4 @@
+import {type JiraInstallationLock, withJiraInstallationLock} from '#db/installations.js';
 import {
   JiraOfflineAccessNotGrantedError,
   JiraPendingSelectionNotFoundError,
@@ -19,6 +20,8 @@ function createParams() {
     getAccessibleResources: vi.fn(),
     getMyself: vi.fn().mockResolvedValue({accountId: 'account-1'}),
     refreshAccessToken: vi.fn(),
+    registerDynamicWebhook: vi.fn(),
+    deleteDynamicWebhook: vi.fn(),
   };
   const tokenStore = {storeTokens: vi.fn().mockResolvedValue(undefined)};
   const pendingStore = {
@@ -29,6 +32,12 @@ function createParams() {
   const connectJiraInstallation = vi
     .fn()
     .mockResolvedValue({id: 'connection-1', workspaceId, provider: 'jira'});
+  const registerJiraWebhook = vi.fn().mockImplementation(async ({onRegistrationSuccess}) => {
+    await onRegistrationSuccess?.({});
+  });
+  const markConnectionActive = vi.fn().mockResolvedValue(undefined);
+  const markConnectionError = vi.fn().mockResolvedValue(undefined);
+  const withJiraInstallationLock: JiraInstallationLock = async (_key, fn) => fn();
   return {
     workspaceId,
     state,
@@ -36,6 +45,10 @@ function createParams() {
     tokenStore,
     pendingStore,
     connectJiraInstallation,
+    registerJiraWebhook,
+    markConnectionActive,
+    markConnectionError,
+    withJiraInstallationLock,
     code: 'code',
     sessionUserId: 'user-1',
     sessionMemberships: [],
@@ -66,6 +79,7 @@ describe('Jira OAuth installation', () => {
     expect(params.tokenStore.storeTokens).toHaveBeenCalledWith(
       expect.objectContaining({connectionId: 'connection-1', refreshToken: 'refresh'}),
     );
+    expect(params.markConnectionActive).toHaveBeenCalledWith({connectionId: 'connection-1'});
   });
 
   it('stores a multi-site grant until the selected site completes', async () => {
@@ -126,4 +140,169 @@ describe('Jira OAuth installation', () => {
       handleJiraSiteSelection({...mismatchedSite, cloudId: 'cloud-1'}),
     ).rejects.toBeInstanceOf(JiraSiteSelectionMismatchError);
   });
+
+  it('marks the connection in error while retaining state when registration fails', async () => {
+    const params = createParams();
+    params.jira.getAccessibleResources.mockResolvedValue([
+      {
+        cloudId: 'cloud-1',
+        name: 'Acme',
+        url: 'https://acme.atlassian.net',
+        scopes: ['read:jira-work'],
+      },
+    ]);
+    const registrationError = new Error('Jira rejected the webhook');
+    params.registerJiraWebhook.mockRejectedValue(registrationError);
+    await expect(handleJiraCallback(params)).rejects.toBe(registrationError);
+    expect(params.tokenStore.storeTokens).toHaveBeenCalled();
+    expect(params.disconnectJiraInstallation).not.toHaveBeenCalled();
+    expect(params.markConnectionError).toHaveBeenCalledWith({connectionId: 'connection-1'});
+  });
+
+  it('does not overwrite an existing installation when token storage fails', async () => {
+    const params = createParams();
+    params.jira.getAccessibleResources.mockResolvedValue([
+      {
+        cloudId: 'cloud-1',
+        name: 'Acme',
+        url: 'https://acme.atlassian.net',
+        scopes: ['read:jira-work'],
+      },
+    ]);
+    const existing = {
+      id: 'connection-1',
+      workspaceId: params.workspaceId,
+      provider: 'jira',
+    } as const;
+    params.getExistingJiraConnection.mockResolvedValue(existing);
+    const storageError = new Error('secret storage unavailable');
+    params.tokenStore.storeTokens.mockRejectedValue(storageError);
+    params.markConnectionError
+      .mockRejectedValueOnce(new Error('database unavailable'))
+      .mockResolvedValueOnce(undefined);
+
+    await expect(handleJiraCallback(params)).rejects.toBe(storageError);
+
+    expect(params.connectJiraInstallation).not.toHaveBeenCalled();
+    expect(params.markConnectionError).toHaveBeenCalledTimes(2);
+    expect(params.markConnectionError).toHaveBeenNthCalledWith(1, {connectionId: existing.id});
+    expect(params.markConnectionError).toHaveBeenNthCalledWith(2, {connectionId: existing.id});
+    expect(params.disconnectJiraInstallation).not.toHaveBeenCalled();
+  });
+
+  it('falls back to a second error-state write when the registration callback cannot persist it', async () => {
+    const params = createParams();
+    params.jira.getAccessibleResources.mockResolvedValue([
+      {
+        cloudId: 'cloud-1',
+        name: 'Acme',
+        url: 'https://acme.atlassian.net',
+        scopes: ['read:jira-work'],
+      },
+    ]);
+    const registrationError = new Error('Jira rejected the webhook');
+    params.registerJiraWebhook.mockImplementation(async ({onRegistrationFailure}) => {
+      await onRegistrationFailure?.({});
+      throw registrationError;
+    });
+    params.markConnectionError
+      .mockRejectedValueOnce(new Error('database unavailable'))
+      .mockResolvedValueOnce(undefined);
+
+    await expect(handleJiraCallback(params)).rejects.toBe(registrationError);
+
+    expect(params.markConnectionError).toHaveBeenCalledTimes(2);
+    expect(params.markConnectionError).toHaveBeenNthCalledWith(1, {connectionId: 'connection-1'});
+    expect(params.markConnectionError).toHaveBeenNthCalledWith(2, {connectionId: 'connection-1'});
+  });
+
+  it('serializes the complete same-site replacement before allowing another callback to proceed', async () => {
+    const first = createParams();
+    const second = createParams();
+    second.workspaceId = first.workspaceId;
+    second.state = signJiraInstallState({workspaceId: first.workspaceId, userId: 'user-1'});
+    const sites = [
+      {
+        cloudId: 'cloud-1',
+        name: 'Acme',
+        url: 'https://acme.atlassian.net',
+        scopes: ['read:jira-work'],
+      },
+    ];
+    const connection = {id: 'connection-1', workspaceId: first.workspaceId, provider: 'jira'};
+    const getExisting = vi.fn().mockResolvedValue(undefined);
+    const connect = vi.fn().mockResolvedValue(connection);
+    const storeTokens = vi.fn().mockResolvedValue(undefined);
+    const register = vi.fn();
+    const events: string[] = [];
+    let releaseFirstRegistration!: () => void;
+    const firstRegistrationReady = new Promise<void>((resolve) => {
+      releaseFirstRegistration = resolve;
+    });
+
+    first.jira.getAccessibleResources.mockResolvedValue(sites);
+    second.jira.getAccessibleResources.mockResolvedValue(sites);
+    first.jira.getMyself.mockResolvedValue({accountId: 'account-1'});
+    second.jira.getMyself.mockResolvedValue({accountId: 'account-2'});
+    first.jira.exchangeAuthorizationCode.mockResolvedValue({
+      accessToken: 'access-1',
+      refreshToken: 'refresh-1',
+      scopes: [],
+    });
+    second.jira.exchangeAuthorizationCode.mockResolvedValue({
+      accessToken: 'access-2',
+      refreshToken: 'refresh-2',
+      scopes: [],
+    });
+    getExisting.mockImplementation(() => {
+      events.push('get-existing');
+      return Promise.resolve(connect.mock.calls.length > 0 ? connection : undefined);
+    });
+    connect.mockImplementation((input) => {
+      events.push(`connect:${input.authorizingAccountId}`);
+      return Promise.resolve(connection);
+    });
+    storeTokens.mockImplementation(({accessToken}) => {
+      events.push(`store:${accessToken}`);
+      return Promise.resolve();
+    });
+    register.mockImplementation(async ({accessToken, onRegistrationSuccess}) => {
+      events.push(`register:${accessToken}`);
+      if (accessToken === 'access-1') await firstRegistrationReady;
+      await onRegistrationSuccess?.({});
+    });
+
+    for (const params of [first, second]) {
+      params.getExistingJiraConnection = getExisting;
+      params.connectJiraInstallation = connect;
+      params.tokenStore.storeTokens = storeTokens;
+      params.registerJiraWebhook = register;
+    }
+
+    first.withJiraInstallationLock = withJiraInstallationLock;
+    second.withJiraInstallationLock = withJiraInstallationLock;
+
+    const firstCallback = handleJiraCallback(first);
+    await vi.waitFor(() =>
+      expect(register).toHaveBeenCalledWith(expect.objectContaining({accessToken: 'access-1'})),
+    );
+    const secondCallback = handleJiraCallback(second);
+    await Promise.resolve();
+    expect(getExisting).toHaveBeenCalledTimes(1);
+
+    releaseFirstRegistration();
+    await expect(firstCallback).resolves.toMatchObject({id: 'connection-1'});
+    await expect(secondCallback).resolves.toMatchObject({id: 'connection-1'});
+
+    expect(events).toEqual([
+      'get-existing',
+      'connect:account-1',
+      'store:access-1',
+      'register:access-1',
+      'get-existing',
+      'store:access-2',
+      'connect:account-2',
+      'register:access-2',
+    ]);
+  });
 });

package/src/core/install.ts

@@ -4,6 +4,7 @@ import {logger} from '@shipfox/node-opentelemetry';
 import type {JiraAccessibleResource, JiraApiClient, JiraAuthorization} from '#api/client.js';
 import type {JiraPendingSelectionStore} from '#core/pending.js';
 import type {JiraTokenStore} from '#core/tokens.js';
+import {type JiraInstallationLock, withJiraInstallationLock} from '#db/installations.js';
 import {
   JiraInstallationAlreadyLinkedError,
   JiraInstallStateActorMismatchError,
@@ -46,6 +47,17 @@ export interface HandleJiraCallbackParams {
   connectJiraInstallation(
     input: ConnectJiraInstallationInput,
   ): Promise<IntegrationConnection<'jira'>>;
+  registerJiraWebhook(input: {
+    connectionId: string;
+    cloudId: string;
+    accessToken: string;
+    withRegistrationLock?: JiraInstallationLock;
+    onRegistrationSuccess: (input: {tx?: unknown}) => Promise<void>;
+    onRegistrationFailure: (input: {tx?: unknown}) => Promise<void>;
+  }): Promise<void>;
+  withJiraInstallationLock?: JiraInstallationLock;
+  markConnectionActive(input: {connectionId: string; tx?: unknown}): Promise<void>;
+  markConnectionError(input: {connectionId: string; tx?: unknown}): Promise<void>;
   disconnectJiraInstallation(input: {connectionId: string}): Promise<void>;
 }
 
@@ -136,23 +148,23 @@ async function verifyClaims(
   return claims;
 }
 
-async function resolveJiraSite(
+function resolveJiraSite(
   params: Omit<HandleJiraCallbackParams, 'code'> & {
     authorization: JiraAuthorization;
     site: JiraAccessibleResource;
     claims: {workspaceId: string; userId: string};
   },
 ): Promise<IntegrationConnection<'jira'>> {
-  const existing = await params.getExistingJiraConnection({cloudId: params.site.cloudId});
-  if (existing && existing.workspaceId !== params.claims.workspaceId)
-    throw new JiraInstallationAlreadyLinkedError(params.site.cloudId);
-  let connectionId: string | undefined;
-  try {
+  const withInstallationLock = params.withJiraInstallationLock ?? withJiraInstallationLock;
+  return withInstallationLock(params.site.cloudId, async () => {
+    const existing = await params.getExistingJiraConnection({cloudId: params.site.cloudId});
+    if (existing && existing.workspaceId !== params.claims.workspaceId)
+      throw new JiraInstallationAlreadyLinkedError(params.site.cloudId);
     const identity = await params.jira.getMyself({
       accessToken: params.authorization.accessToken,
       cloudId: params.site.cloudId,
     });
-    const connection = await params.connectJiraInstallation({
+    const installationInput = {
       workspaceId: params.claims.workspaceId,
       cloudId: params.site.cloudId,
       siteUrl: params.site.url,
@@ -161,19 +173,52 @@ async function resolveJiraSite(
       scopes: params.site.scopes,
       tokenExpiresAt: params.authorization.expiresAt ?? null,
       displayName: `Jira ${params.site.name}`,
-    });
-    connectionId = connection.id;
-    await params.tokenStore.storeTokens({
-      connectionId: connection.id,
-      accessToken: params.authorization.accessToken,
-      refreshToken: params.authorization.refreshToken,
-      editedBy: params.claims.userId,
-    });
+    };
+    let connection = existing;
+    try {
+      if (!connection) connection = await params.connectJiraInstallation(installationInput);
+      await params.tokenStore.storeTokens({
+        connectionId: connection.id,
+        accessToken: params.authorization.accessToken,
+        refreshToken: params.authorization.refreshToken,
+        editedBy: params.claims.userId,
+      });
+      if (existing) connection = await params.connectJiraInstallation(installationInput);
+    } catch (error) {
+      if (existing) {
+        const markedError = await bestEffortMarkConnectionError(params, existing.id);
+        if (!markedError) await bestEffortMarkConnectionError(params, existing.id);
+      } else if (connection) {
+        await bestEffortDisconnect(params, connection.id);
+      }
+      throw error;
+    }
+
+    let registrationFailureHandled = false;
+    try {
+      await params.registerJiraWebhook({
+        connectionId: connection.id,
+        cloudId: params.site.cloudId,
+        accessToken: params.authorization.accessToken,
+        withRegistrationLock: async (_lockKey, fn) => fn(),
+        onRegistrationSuccess: async ({tx}) => {
+          await params.markConnectionActive(connectionLifecycleInput(connection.id, tx));
+        },
+        onRegistrationFailure: async ({tx}) => {
+          registrationFailureHandled = await bestEffortMarkConnectionError(
+            params,
+            connection.id,
+            tx,
+          );
+        },
+      });
+    } catch (error) {
+      if (!registrationFailureHandled) await bestEffortMarkConnectionError(params, connection.id);
+      throw error;
+    }
+
     return connection;
-  } catch (error) {
-    if (connectionId && !existing) await bestEffortDisconnect(params, connectionId);
-    throw error;
-  }
+  });
 }
 
 async function bestEffortDisconnect(
@@ -189,3 +234,24 @@ async function bestEffortDisconnect(
     );
   }
 }
+
+async function bestEffortMarkConnectionError(
+  params: Pick<HandleJiraCallbackParams, 'markConnectionError'>,
+  connectionId: string,
+  tx?: unknown,
+): Promise<boolean> {
+  try {
+    await params.markConnectionError(connectionLifecycleInput(connectionId, tx));
+    return true;
+  } catch (error) {
+    logger().warn(
+      {err: error, connectionId},
+      'Jira connection error-state update failed after webhook registration rejection',
+    );
+    return false;
+  }
+}
+
+function connectionLifecycleInput(connectionId: string, tx?: unknown) {
+  return tx === undefined ? {connectionId} : {connectionId, tx};
+}

package/src/core/tokens-refresh.test.ts

@@ -1,20 +1,22 @@
-const {getInstallation, updateExpiry, withRefreshLock} = vi.hoisted(() => ({
+const {getInstallation, updateExpiry, withRefreshLock, withRefreshLockAndWait} = vi.hoisted(() => ({
   getInstallation: vi.fn(),
   updateExpiry: vi.fn(),
   withRefreshLock: vi.fn(async (_connectionId: string, fn: () => Promise<string>) => ({
     acquired: true as const,
     value: await fn(),
   })),
+  withRefreshLockAndWait: vi.fn(async (_connectionId: string, fn: () => Promise<void>) => fn()),
 }));
 
 vi.mock('#db/installations.js', () => ({
   getJiraInstallationByConnectionId: getInstallation,
   updateJiraInstallationTokenExpiry: updateExpiry,
   withJiraRefreshLock: withRefreshLock,
+  withJiraRefreshLockAndWait: withRefreshLockAndWait,
 }));
 
 import {JiraIntegrationProviderError, JiraTokenUnrefreshableError} from './errors.js';
-import {createJiraTokenStore} from './tokens.js';
+import {createJiraTokenStore, type JiraConnectionResolverResult} from './tokens.js';
 
 function createStore() {
   const values = new Map<string, string>();
@@ -30,16 +32,29 @@ function createStore() {
     refreshAccessToken: vi.fn(),
     getAccessibleResources: vi.fn(),
     getMyself: vi.fn(),
+    registerDynamicWebhook: vi.fn(),
+    deleteDynamicWebhook: vi.fn(),
   };
   const markConnectionError = vi.fn().mockResolvedValue(undefined);
   const connectionId = crypto.randomUUID();
+  const workspaceId = crypto.randomUUID();
+  const resolveConnection = vi.fn().mockResolvedValue({workspaceId, lifecycleStatus: 'active'});
   const store = createJiraTokenStore({
-    resolveConnection: vi.fn().mockResolvedValue({workspaceId: crypto.randomUUID()}),
+    resolveConnection,
     secrets,
     client,
     markConnectionError,
   });
-  return {client, connectionId, markConnectionError, secrets, store, values};
+  return {
+    client,
+    connectionId,
+    markConnectionError,
+    resolveConnection,
+    secrets,
+    store,
+    values,
+    workspaceId,
+  };
 }
 
 describe('Jira token refresh', () => {
@@ -50,6 +65,7 @@ describe('Jira token refresh', () => {
       acquired: true,
       value: await fn(),
     }));
+    withRefreshLockAndWait.mockImplementation(async (_connectionId, fn) => fn());
   });
 
   it('rotates and persists both tokens when the access token expires', async () => {
@@ -85,6 +101,209 @@ describe('Jira token refresh', () => {
     expect(markConnectionError).toHaveBeenCalledWith({connectionId});
   });
 
+  it('marks timeout failures as requiring reconnect because refresh state is unknown', async () => {
+    const {client, connectionId, markConnectionError, store} = createStore();
+    await store.storeTokens({connectionId, accessToken: 'access-0', refreshToken: 'refresh-0'});
+    client.refreshAccessToken.mockRejectedValue(
+      new JiraIntegrationProviderError('timeout', 'refresh timed out'),
+    );
+
+    const result = store.getAccessToken({connectionId});
+
+    await expect(result).rejects.toMatchObject({reason: 'timeout'});
+    expect(markConnectionError).toHaveBeenCalledWith({connectionId});
+  });
+
+  it('does not retry a refresh after the connection enters an error state', async () => {
+    const {client, connectionId, store} = createStore();
+    await store.storeTokens({connectionId, accessToken: 'access-0', refreshToken: 'refresh-0'});
+    client.refreshAccessToken.mockRejectedValue(
+      new JiraIntegrationProviderError('timeout', 'refresh timed out'),
+    );
+
+    await expect(store.getAccessToken({connectionId})).rejects.toMatchObject({reason: 'timeout'});
+
+    await expect(store.getAccessToken({connectionId})).rejects.toBeInstanceOf(
+      JiraTokenUnrefreshableError,
+    );
+    expect(client.refreshAccessToken).toHaveBeenCalledOnce();
+  });
+
+  it('allows a reconnect to clear the unknown refresh state', async () => {
+    const {client, connectionId, store} = createStore();
+    await store.storeTokens({connectionId, accessToken: 'access-0', refreshToken: 'refresh-0'});
+    client.refreshAccessToken.mockRejectedValue(
+      new JiraIntegrationProviderError('timeout', 'refresh timed out'),
+    );
+
+    await expect(store.getAccessToken({connectionId})).rejects.toMatchObject({reason: 'timeout'});
+
+    await store.storeTokens({connectionId, accessToken: 'access-1', refreshToken: 'refresh-1'});
+    getInstallation.mockResolvedValue({tokenExpiresAt: null});
+
+    await expect(store.getAccessToken({connectionId})).resolves.toBe('access-1');
+  });
+
+  it('ignores a terminal refresh result from before a reconnect', async () => {
+    const {client, connectionId, markConnectionError, store} = createStore();
+    await store.storeTokens({connectionId, accessToken: 'access-0', refreshToken: 'refresh-0'});
+    let rejectRefresh!: (error: unknown) => void;
+    client.refreshAccessToken.mockImplementation(
+      () =>
+        new Promise<never>((_resolve, reject) => {
+          rejectRefresh = reject;
+        }),
+    );
+
+    const staleRefresh = store.getAccessToken({connectionId});
+    await vi.waitFor(() => expect(client.refreshAccessToken).toHaveBeenCalledOnce());
+
+    await store.storeTokens({connectionId, accessToken: 'access-1', refreshToken: 'refresh-1'});
+    getInstallation.mockResolvedValue({tokenExpiresAt: null});
+    await expect(store.getAccessToken({connectionId})).resolves.toBe('access-1');
+
+    rejectRefresh(new JiraIntegrationProviderError('timeout', 'refresh timed out'));
+    await expect(staleRefresh).rejects.toMatchObject({reason: 'timeout'});
+    expect(markConnectionError).not.toHaveBeenCalled();
+    await expect(store.getAccessToken({connectionId})).resolves.toBe('access-1');
+  });
+
+  it('serializes connection error updates with reconnect credential writes', async () => {
+    const {client, connectionId, markConnectionError, store} = createStore();
+    await store.storeTokens({connectionId, accessToken: 'access-0', refreshToken: 'refresh-0'});
+    let releaseError!: () => void;
+    let errorStarted!: () => void;
+    const errorCanFinish = new Promise<void>((resolve) => {
+      releaseError = resolve;
+    });
+    const errorUpdateStarted = new Promise<void>((resolve) => {
+      errorStarted = resolve;
+    });
+    markConnectionError.mockImplementation(async () => {
+      errorStarted();
+      await errorCanFinish;
+    });
+    client.refreshAccessToken.mockRejectedValue(
+      new JiraIntegrationProviderError('access-denied', 'invalid grant'),
+    );
+
+    const staleRefresh = store.getAccessToken({connectionId});
+    await errorUpdateStarted;
+
+    let reconnectFinished = false;
+    const reconnect = store
+      .storeTokens({connectionId, accessToken: 'access-1', refreshToken: 'refresh-1'})
+      .then(() => {
+        reconnectFinished = true;
+      });
+    await Promise.resolve();
+    expect(reconnectFinished).toBe(false);
+
+    releaseError();
+    await expect(staleRefresh).rejects.toMatchObject({reason: 'access-denied'});
+    await reconnect;
+    expect(markConnectionError).toHaveBeenCalledOnce();
+  });
+
+  it('waits for the shared refresh lock before storing reconnect credentials', async () => {
+    const {connectionId, store, values} = createStore();
+    let releaseLock!: () => void;
+    let lockStarted!: () => void;
+    const lockCanFinish = new Promise<void>((resolve) => {
+      releaseLock = resolve;
+    });
+    const lockEntered = new Promise<void>((resolve) => {
+      lockStarted = resolve;
+    });
+    withRefreshLockAndWait.mockImplementationOnce(async (_connectionId, fn) => {
+      lockStarted();
+      await lockCanFinish;
+      return fn();
+    });
+
+    const reconnect = store.storeTokens({
+      connectionId,
+      accessToken: 'access-1',
+      refreshToken: 'refresh-1',
+    });
+    await lockEntered;
+
+    expect(values.get('ACCESS_TOKEN')).toBeUndefined();
+    releaseLock();
+    await reconnect;
+    expect(values.get('ACCESS_TOKEN')).toBe('access-1');
+    expect(values.get('REFRESH_TOKEN')).toBe('refresh-1');
+    expect(withRefreshLockAndWait).toHaveBeenCalledWith(connectionId, expect.any(Function));
+  });
+
+  it('waits for reconnect credentials before starting another refresh', async () => {
+    const {client, connectionId, resolveConnection, secrets, store, values, workspaceId} =
+      createStore();
+    await store.storeTokens({connectionId, accessToken: 'access-0', refreshToken: 'refresh-0'});
+    let releaseConnection!: () => void;
+    let connectionStarted!: () => void;
+    const connectionCanFinish = new Promise<void>((resolve) => {
+      releaseConnection = resolve;
+    });
+    const connectionLookupStarted = new Promise<void>((resolve) => {
+      connectionStarted = resolve;
+    });
+    resolveConnection.mockImplementationOnce(async () => {
+      connectionStarted();
+      await connectionCanFinish;
+      return {workspaceId, lifecycleStatus: 'active'};
+    });
+    let releaseReconnect!: () => void;
+    let reconnectStarted!: () => void;
+    const reconnectCanFinish = new Promise<void>((resolve) => {
+      releaseReconnect = resolve;
+    });
+    const reconnectWriteStarted = new Promise<void>((resolve) => {
+      reconnectStarted = resolve;
+    });
+    secrets.setSecrets.mockImplementation(
+      async ({values: next}: {values: Record<string, string>}) => {
+        if (next.ACCESS_TOKEN === 'access-1') {
+          reconnectStarted();
+          await reconnectCanFinish;
+        }
+        for (const [key, value] of Object.entries(next)) values.set(key, value);
+      },
+    );
+
+    const accessToken = store.getAccessToken({connectionId});
+    await connectionLookupStarted;
+    const reconnect = store.storeTokens({
+      connectionId,
+      accessToken: 'access-1',
+      refreshToken: 'refresh-1',
+    });
+    await reconnectWriteStarted;
+
+    releaseConnection();
+    await Promise.resolve();
+    await Promise.resolve();
+    expect(client.refreshAccessToken).not.toHaveBeenCalled();
+
+    getInstallation.mockResolvedValue({tokenExpiresAt: null});
+    releaseReconnect();
+    await reconnect;
+    await expect(accessToken).resolves.toBe('access-1');
+    expect(client.refreshAccessToken).not.toHaveBeenCalled();
+  });
+
+  it('fails closed when a connection resolver omits its lifecycle status', async () => {
+    const {connectionId, resolveConnection, store} = createStore();
+    await store.storeTokens({connectionId, accessToken: 'access-0', refreshToken: 'refresh-0'});
+    resolveConnection.mockResolvedValue({
+      workspaceId: crypto.randomUUID(),
+    } as unknown as JiraConnectionResolverResult);
+
+    await expect(store.getAccessToken({connectionId})).rejects.toBeInstanceOf(
+      JiraTokenUnrefreshableError,
+    );
+  });
+
   it('requires a refresh token once the access token expires', async () => {
     const {connectionId, store} = createStore();
     await store.storeTokens({connectionId, accessToken: 'access-0'});

package/src/core/tokens.test.ts

@@ -17,7 +17,7 @@ function createConnectionContext() {
   const connectionId = crypto.randomUUID();
   const resolveConnection = vi
     .fn<(connectionId: string) => Promise<JiraConnectionResolverResult | undefined>>()
-    .mockResolvedValue({workspaceId});
+    .mockResolvedValue({workspaceId, lifecycleStatus: 'active'});
   const store = createJiraTokenStore({resolveConnection, secrets});
 
   return {workspaceId, connectionId, resolveConnection, store};