@shipfox/api-integration-jira 12.0.0 → 12.1.0

package/dist/core/tokens.js

@@ -1,19 +1,49 @@
+import { logger } from '@shipfox/node-opentelemetry';
 import { createJiraApiClient } from '#api/client.js';
 import { JiraAccessTokenMissingError, JiraConnectionNotFoundError, JiraIntegrationProviderError, JiraTokenUnrefreshableError } from '#core/errors.js';
-import { getJiraInstallationByConnectionId, updateJiraInstallationTokenExpiry, withJiraRefreshLock } from '#db/installations.js';
+import { getJiraInstallationByConnectionId, updateJiraInstallationTokenExpiry, withJiraRefreshLock, withJiraRefreshLockAndWait } from '#db/installations.js';
 const ACCESS_TOKEN_KEY = 'ACCESS_TOKEN';
 const REFRESH_TOKEN_KEY = 'REFRESH_TOKEN';
 const TOKEN_REFRESH_MARGIN_MS = 5 * 60 * 1000;
-const tokenRefreshes = new Map();
 export function jiraSecretsNamespace(connectionId) {
     return `system/integrations/jira/${connectionId}`;
 }
 export function createJiraTokenStore(params) {
     const client = params.client ?? createJiraApiClient();
-    async function resolveWorkspaceId(connectionId) {
+    const tokenRefreshes = new Map();
+    const refreshStateUnknownConnections = new Set();
+    const credentialGenerations = new Map();
+    const credentialWriteQueues = new Map();
+    const currentCredentialGeneration = (connectionId)=>credentialGenerations.get(connectionId) ?? 0;
+    const advanceCredentialGeneration = (connectionId)=>{
+        const generation = currentCredentialGeneration(connectionId) + 1;
+        credentialGenerations.set(connectionId, generation);
+        return generation;
+    };
+    function withCredentialWrite(connectionId, operation) {
+        const previous = credentialWriteQueues.get(connectionId) ?? Promise.resolve();
+        const operationResult = previous.then(operation);
+        const completion = operationResult.then(()=>undefined, ()=>undefined);
+        credentialWriteQueues.set(connectionId, completion);
+        return operationResult.finally(()=>{
+            if (credentialWriteQueues.get(connectionId) === completion) {
+                credentialWriteQueues.delete(connectionId);
+            }
+        });
+    }
+    async function waitForCredentialWrites(connectionId) {
+        await credentialWriteQueues.get(connectionId);
+    }
+    async function resolveConnection(connectionId) {
         const connection = await params.resolveConnection(connectionId);
         if (!connection) throw new JiraConnectionNotFoundError(connectionId);
-        return connection.workspaceId;
+        return connection;
+    }
+    async function resolveWorkspaceId(connectionId) {
+        return (await resolveConnection(connectionId)).workspaceId;
+    }
+    function clearTokenRefresh(connectionId, refresh) {
+        if (tokenRefreshes.get(connectionId) === refresh) tokenRefreshes.delete(connectionId);
     }
     const readSecretToken = (workspaceId, connectionId, key)=>params.secrets.getSecret({
             workspaceId,
@@ -27,20 +57,39 @@ export function createJiraTokenStore(params) {
     }
     return {
         async storeTokens (input) {
-            const workspaceId = await resolveWorkspaceId(input.connectionId);
-            const values = {
-                [ACCESS_TOKEN_KEY]: input.accessToken
-            };
-            if (input.refreshToken) values[REFRESH_TOKEN_KEY] = input.refreshToken;
-            await params.secrets.setSecrets({
-                workspaceId,
-                namespace: jiraSecretsNamespace(input.connectionId),
-                values,
-                editedBy: input.editedBy
-            });
+            const credentialGeneration = advanceCredentialGeneration(input.connectionId);
+            tokenRefreshes.delete(input.connectionId);
+            await withJiraRefreshLockAndWait(input.connectionId, ()=>withCredentialWrite(input.connectionId, async ()=>{
+                    if (currentCredentialGeneration(input.connectionId) !== credentialGeneration) return;
+                    const workspaceId = await resolveWorkspaceId(input.connectionId);
+                    if (currentCredentialGeneration(input.connectionId) !== credentialGeneration) return;
+                    const values = {
+                        [ACCESS_TOKEN_KEY]: input.accessToken
+                    };
+                    if (input.refreshToken) values[REFRESH_TOKEN_KEY] = input.refreshToken;
+                    await params.secrets.setSecrets({
+                        workspaceId,
+                        namespace: jiraSecretsNamespace(input.connectionId),
+                        values,
+                        editedBy: input.editedBy
+                    });
+                    if (currentCredentialGeneration(input.connectionId) === credentialGeneration) {
+                        refreshStateUnknownConnections.delete(input.connectionId);
+                    }
+                }));
         },
         async getAccessToken (input) {
-            const workspaceId = await resolveWorkspaceId(input.connectionId);
+            await waitForCredentialWrites(input.connectionId);
+            const connection = await resolveConnection(input.connectionId);
+            if (connection.lifecycleStatus !== 'active') {
+                throw new JiraTokenUnrefreshableError(input.connectionId);
+            }
+            await waitForCredentialWrites(input.connectionId);
+            if (refreshStateUnknownConnections.has(input.connectionId)) {
+                throw new JiraTokenUnrefreshableError(input.connectionId);
+            }
+            const credentialGeneration = currentCredentialGeneration(input.connectionId);
+            const workspaceId = connection.workspaceId;
             const accessToken = await readAccessToken(workspaceId, input.connectionId);
             if (!input.forceRefresh && !shouldRefresh((await getJiraInstallationByConnectionId(input.connectionId))?.tokenExpiresAt ?? null)) return accessToken;
             const inFlight = tokenRefreshes.get(input.connectionId);
@@ -54,10 +103,18 @@ export function createJiraTokenStore(params) {
                 secrets: params.secrets,
                 readAccessToken,
                 readSecretToken,
-                markConnectionError: params.markConnectionError
+                markConnectionError: params.markConnectionError,
+                withCredentialWrite,
+                waitForCredentialWrites,
+                isCurrentCredentialGeneration: ()=>currentCredentialGeneration(input.connectionId) === credentialGeneration
             });
             tokenRefreshes.set(input.connectionId, refresh);
-            void refresh.then(()=>clearTokenRefresh(input.connectionId, refresh), ()=>clearTokenRefresh(input.connectionId, refresh));
+            void refresh.then(()=>clearTokenRefresh(input.connectionId, refresh), (error)=>{
+                if (isTerminalRefreshFailure(error) && currentCredentialGeneration(input.connectionId) === credentialGeneration) {
+                    refreshStateUnknownConnections.add(input.connectionId);
+                }
+                clearTokenRefresh(input.connectionId, refresh);
+            });
             return refresh;
         }
     };
@@ -65,17 +122,20 @@ export function createJiraTokenStore(params) {
 function shouldRefresh(expiresAt) {
     return expiresAt !== null && expiresAt.getTime() <= Date.now() + TOKEN_REFRESH_MARGIN_MS;
 }
-function clearTokenRefresh(connectionId, refresh) {
-    if (tokenRefreshes.get(connectionId) === refresh) tokenRefreshes.delete(connectionId);
-}
 async function refreshAccessTokenWithLock(params) {
     const lock = await withJiraRefreshLock(params.connectionId, ()=>refreshAccessTokenForConnection(params));
     if (lock.acquired) return lock.value;
+    if (!params.isCurrentCredentialGeneration()) {
+        return params.readAccessToken(params.workspaceId, params.connectionId);
+    }
     const reread = await params.readAccessToken(params.workspaceId, params.connectionId);
     if (reread !== params.originalAccessToken) return reread;
     throw new JiraIntegrationProviderError('provider-unavailable', 'Jira token refresh is already in progress');
 }
 async function refreshAccessTokenForConnection(params) {
+    if (!params.isCurrentCredentialGeneration()) {
+        return params.readAccessToken(params.workspaceId, params.connectionId);
+    }
     const current = await params.readAccessToken(params.workspaceId, params.connectionId);
     const installation = await getJiraInstallationByConnectionId(params.connectionId);
     if (current !== params.originalAccessToken || !params.forceRefresh && !shouldRefresh(installation?.tokenExpiresAt ?? null)) return current;
@@ -88,29 +148,61 @@ async function refreshAccessTokenForConnection(params) {
         const refreshed = await params.client.refreshAccessToken({
             refreshToken
         });
-        if (!refreshed.refreshToken) throw new JiraTokenUnrefreshableError(params.connectionId);
-        await params.secrets.setSecrets({
-            workspaceId: params.workspaceId,
-            namespace: jiraSecretsNamespace(params.connectionId),
-            values: {
-                [ACCESS_TOKEN_KEY]: refreshed.accessToken,
-                [REFRESH_TOKEN_KEY]: refreshed.refreshToken
-            }
-        });
-        await updateJiraInstallationTokenExpiry({
-            connectionId: params.connectionId,
-            tokenExpiresAt: refreshed.expiresAt ?? null,
-            scopes: refreshed.scopes.length > 0 ? refreshed.scopes : undefined
+        const refreshedRefreshToken = refreshed.refreshToken;
+        if (!refreshedRefreshToken) throw new JiraTokenUnrefreshableError(params.connectionId);
+        const persisted = await params.withCredentialWrite(params.connectionId, async ()=>{
+            if (!params.isCurrentCredentialGeneration()) return false;
+            await params.secrets.setSecrets({
+                workspaceId: params.workspaceId,
+                namespace: jiraSecretsNamespace(params.connectionId),
+                values: {
+                    [ACCESS_TOKEN_KEY]: refreshed.accessToken,
+                    [REFRESH_TOKEN_KEY]: refreshedRefreshToken
+                }
+            });
+            if (!params.isCurrentCredentialGeneration()) return false;
+            await updateJiraInstallationTokenExpiry({
+                connectionId: params.connectionId,
+                tokenExpiresAt: refreshed.expiresAt ?? null,
+                scopes: refreshed.scopes.length > 0 ? refreshed.scopes : undefined
+            });
+            return true;
         });
+        if (!persisted || !params.isCurrentCredentialGeneration()) {
+            await params.waitForCredentialWrites(params.connectionId);
+            return params.readAccessToken(params.workspaceId, params.connectionId);
+        }
         return refreshed.accessToken;
     } catch (error) {
-        if (error instanceof JiraIntegrationProviderError && error.reason === 'access-denied') {
-            await params.markConnectionError?.({
-                connectionId: params.connectionId
+        if (isTerminalRefreshFailure(error)) {
+            await markConnectionError({
+                callback: params.markConnectionError,
+                connectionId: params.connectionId,
+                isCurrentCredentialGeneration: params.isCurrentCredentialGeneration,
+                withCredentialWrite: params.withCredentialWrite
             });
         }
         throw error;
     }
 }
+function isTerminalRefreshFailure(error) {
+    return error instanceof JiraIntegrationProviderError && (error.reason === 'access-denied' || error.reason === 'timeout');
+}
+async function markConnectionError(params) {
+    if (!params.isCurrentCredentialGeneration()) return;
+    try {
+        await params.withCredentialWrite(params.connectionId, async ()=>{
+            if (!params.isCurrentCredentialGeneration()) return;
+            await params.callback?.({
+                connectionId: params.connectionId
+            });
+        });
+    } catch (error) {
+        logger().warn({
+            err: error,
+            connectionId: params.connectionId
+        }, 'Jira connection error-state update failed after token refresh failure');
+    }
+}
 
 //# sourceMappingURL=tokens.js.map

package/dist/core/tokens.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/tokens.ts"],"sourcesContent":["import {createJiraApiClient, type JiraApiClient} from '#api/client.js';\nimport {\n  JiraAccessTokenMissingError,\n  JiraConnectionNotFoundError,\n  JiraIntegrationProviderError,\n  JiraTokenUnrefreshableError,\n} from '#core/errors.js';\nimport {\n  getJiraInstallationByConnectionId,\n  updateJiraInstallationTokenExpiry,\n  withJiraRefreshLock,\n} from '#db/installations.js';\n\nconst ACCESS_TOKEN_KEY = 'ACCESS_TOKEN';\nconst REFRESH_TOKEN_KEY = 'REFRESH_TOKEN';\nconst TOKEN_REFRESH_MARGIN_MS = 5 * 60 * 1000;\nconst tokenRefreshes = new Map<string, Promise<string>>();\n\nexport interface JiraConnectionResolverResult {\n  workspaceId: string;\n}\n\nexport interface JiraSecretsStore {\n  getSecret(params: {workspaceId: string; namespace: string; key: string}): Promise<string | null>;\n  setSecrets(params: {\n    workspaceId: string;\n    namespace: string;\n    values: Record<string, string>;\n    editedBy?: string | null | undefined;\n  }): Promise<void>;\n}\n\nexport interface CreateJiraTokenStoreParams {\n  resolveConnection(connectionId: string): Promise<JiraConnectionResolverResult | undefined>;\n  secrets: JiraSecretsStore;\n  client?: JiraApiClient | undefined;\n  markConnectionError?: (params: {connectionId: string}) => Promise<void>;\n}\n\nexport interface StoreJiraTokensParams {\n  connectionId: string;\n  accessToken: string;\n  refreshToken?: string | undefined;\n  editedBy?: string | null | undefined;\n}\n\nexport interface GetJiraAccessTokenParams {\n  connectionId: string;\n  forceRefresh?: boolean | undefined;\n}\n\nexport interface JiraTokenStore {\n  storeTokens(params: StoreJiraTokensParams): Promise<void>;\n  getAccessToken(params: GetJiraAccessTokenParams): Promise<string>;\n}\n\nexport function jiraSecretsNamespace(connectionId: string): string {\n  return `system/integrations/jira/${connectionId}`;\n}\n\nexport function createJiraTokenStore(params: CreateJiraTokenStoreParams): JiraTokenStore {\n  const client = params.client ?? createJiraApiClient();\n  async function resolveWorkspaceId(connectionId: string): Promise<string> {\n    const connection = await params.resolveConnection(connectionId);\n    if (!connection) throw new JiraConnectionNotFoundError(connectionId);\n    return connection.workspaceId;\n  }\n  const readSecretToken = (\n    workspaceId: string,\n    connectionId: string,\n    key: typeof ACCESS_TOKEN_KEY | typeof REFRESH_TOKEN_KEY,\n  ) => params.secrets.getSecret({workspaceId, namespace: jiraSecretsNamespace(connectionId), key});\n  async function readAccessToken(workspaceId: string, connectionId: string): Promise<string> {\n    const token = await readSecretToken(workspaceId, connectionId, ACCESS_TOKEN_KEY);\n    if (!token) throw new JiraAccessTokenMissingError(connectionId);\n    return token;\n  }\n\n  return {\n    async storeTokens(input) {\n      const workspaceId = await resolveWorkspaceId(input.connectionId);\n      const values: Record<string, string> = {[ACCESS_TOKEN_KEY]: input.accessToken};\n      if (input.refreshToken) values[REFRESH_TOKEN_KEY] = input.refreshToken;\n      await params.secrets.setSecrets({\n        workspaceId,\n        namespace: jiraSecretsNamespace(input.connectionId),\n        values,\n        editedBy: input.editedBy,\n      });\n    },\n    async getAccessToken(input) {\n      const workspaceId = await resolveWorkspaceId(input.connectionId);\n      const accessToken = await readAccessToken(workspaceId, input.connectionId);\n      if (\n        !input.forceRefresh &&\n        !shouldRefresh(\n          (await getJiraInstallationByConnectionId(input.connectionId))?.tokenExpiresAt ?? null,\n        )\n      )\n        return accessToken;\n      const inFlight = tokenRefreshes.get(input.connectionId);\n      if (inFlight) return inFlight;\n      const refresh = refreshAccessTokenWithLock({\n        connectionId: input.connectionId,\n        workspaceId,\n        originalAccessToken: accessToken,\n        forceRefresh: input.forceRefresh === true,\n        client,\n        secrets: params.secrets,\n        readAccessToken,\n        readSecretToken,\n        markConnectionError: params.markConnectionError,\n      });\n      tokenRefreshes.set(input.connectionId, refresh);\n      void refresh.then(\n        () => clearTokenRefresh(input.connectionId, refresh),\n        () => clearTokenRefresh(input.connectionId, refresh),\n      );\n      return refresh;\n    },\n  };\n}\n\nfunction shouldRefresh(expiresAt: Date | null): boolean {\n  return expiresAt !== null && expiresAt.getTime() <= Date.now() + TOKEN_REFRESH_MARGIN_MS;\n}\n\nfunction clearTokenRefresh(connectionId: string, refresh: Promise<string>): void {\n  if (tokenRefreshes.get(connectionId) === refresh) tokenRefreshes.delete(connectionId);\n}\n\nasync function refreshAccessTokenWithLock(params: {\n  connectionId: string;\n  workspaceId: string;\n  originalAccessToken: string;\n  forceRefresh: boolean;\n  client: JiraApiClient;\n  secrets: JiraSecretsStore;\n  readAccessToken(workspaceId: string, connectionId: string): Promise<string>;\n  readSecretToken(\n    workspaceId: string,\n    connectionId: string,\n    key: typeof ACCESS_TOKEN_KEY | typeof REFRESH_TOKEN_KEY,\n  ): Promise<string | null>;\n  markConnectionError?: ((params: {connectionId: string}) => Promise<void>) | undefined;\n}): Promise<string> {\n  const lock = await withJiraRefreshLock(params.connectionId, () =>\n    refreshAccessTokenForConnection(params),\n  );\n  if (lock.acquired) return lock.value;\n  const reread = await params.readAccessToken(params.workspaceId, params.connectionId);\n  if (reread !== params.originalAccessToken) return reread;\n  throw new JiraIntegrationProviderError(\n    'provider-unavailable',\n    'Jira token refresh is already in progress',\n  );\n}\n\nasync function refreshAccessTokenForConnection(params: {\n  connectionId: string;\n  workspaceId: string;\n  originalAccessToken: string;\n  forceRefresh: boolean;\n  client: JiraApiClient;\n  secrets: JiraSecretsStore;\n  readAccessToken(workspaceId: string, connectionId: string): Promise<string>;\n  readSecretToken(\n    workspaceId: string,\n    connectionId: string,\n    key: typeof ACCESS_TOKEN_KEY | typeof REFRESH_TOKEN_KEY,\n  ): Promise<string | null>;\n  markConnectionError?: ((params: {connectionId: string}) => Promise<void>) | undefined;\n}): Promise<string> {\n  const current = await params.readAccessToken(params.workspaceId, params.connectionId);\n  const installation = await getJiraInstallationByConnectionId(params.connectionId);\n  if (\n    current !== params.originalAccessToken ||\n    (!params.forceRefresh && !shouldRefresh(installation?.tokenExpiresAt ?? null))\n  )\n    return current;\n  const refreshToken = await params.readSecretToken(\n    params.workspaceId,\n    params.connectionId,\n    REFRESH_TOKEN_KEY,\n  );\n  if (!refreshToken) {\n    if (params.forceRefresh || shouldRefresh(installation?.tokenExpiresAt ?? null))\n      throw new JiraTokenUnrefreshableError(params.connectionId);\n    return current;\n  }\n  try {\n    const refreshed = await params.client.refreshAccessToken({refreshToken});\n    if (!refreshed.refreshToken) throw new JiraTokenUnrefreshableError(params.connectionId);\n    await params.secrets.setSecrets({\n      workspaceId: params.workspaceId,\n      namespace: jiraSecretsNamespace(params.connectionId),\n      values: {\n        [ACCESS_TOKEN_KEY]: refreshed.accessToken,\n        [REFRESH_TOKEN_KEY]: refreshed.refreshToken,\n      },\n    });\n    await updateJiraInstallationTokenExpiry({\n      connectionId: params.connectionId,\n      tokenExpiresAt: refreshed.expiresAt ?? null,\n      scopes: refreshed.scopes.length > 0 ? refreshed.scopes : undefined,\n    });\n    return refreshed.accessToken;\n  } catch (error) {\n    if (error instanceof JiraIntegrationProviderError && error.reason === 'access-denied') {\n      await params.markConnectionError?.({connectionId: params.connectionId});\n    }\n    throw error;\n  }\n}\n"],"names":["createJiraApiClient","JiraAccessTokenMissingError","JiraConnectionNotFoundError","JiraIntegrationProviderError","JiraTokenUnrefreshableError","getJiraInstallationByConnectionId","updateJiraInstallationTokenExpiry","withJiraRefreshLock","ACCESS_TOKEN_KEY","REFRESH_TOKEN_KEY","TOKEN_REFRESH_MARGIN_MS","tokenRefreshes","Map","jiraSecretsNamespace","connectionId","createJiraTokenStore","params","client","resolveWorkspaceId","connection","resolveConnection","workspaceId","readSecretToken","key","secrets","getSecret","namespace","readAccessToken","token","storeTokens","input","values","accessToken","refreshToken","setSecrets","editedBy","getAccessToken","forceRefresh","shouldRefresh","tokenExpiresAt","inFlight","get","refresh","refreshAccessTokenWithLock","originalAccessToken","markConnectionError","set","then","clearTokenRefresh","expiresAt","getTime","Date","now","delete","lock","refreshAccessTokenForConnection","acquired","value","reread","current","installation","refreshed","refreshAccessToken","scopes","length","undefined","error","reason"],"mappings":"AAAA,SAAQA,mBAAmB,QAA2B,iBAAiB;AACvE,SACEC,2BAA2B,EAC3BC,2BAA2B,EAC3BC,4BAA4B,EAC5BC,2BAA2B,QACtB,kBAAkB;AACzB,SACEC,iCAAiC,EACjCC,iCAAiC,EACjCC,mBAAmB,QACd,uBAAuB;AAE9B,MAAMC,mBAAmB;AACzB,MAAMC,oBAAoB;AAC1B,MAAMC,0BAA0B,IAAI,KAAK;AACzC,MAAMC,iBAAiB,IAAIC;AAwC3B,OAAO,SAASC,qBAAqBC,YAAoB;IACvD,OAAO,CAAC,yBAAyB,EAAEA,cAAc;AACnD;AAEA,OAAO,SAASC,qBAAqBC,MAAkC;IACrE,MAAMC,SAASD,OAAOC,MAAM,IAAIjB;IAChC,eAAekB,mBAAmBJ,YAAoB;QACpD,MAAMK,aAAa,MAAMH,OAAOI,iBAAiB,CAACN;QAClD,IAAI,CAACK,YAAY,MAAM,IAAIjB,4BAA4BY;QACvD,OAAOK,WAAWE,WAAW;IAC/B;IACA,MAAMC,kBAAkB,CACtBD,aACAP,cACAS,MACGP,OAAOQ,OAAO,CAACC,SAAS,CAAC;YAACJ;YAAaK,WAAWb,qBAAqBC;YAAeS;QAAG;IAC9F,eAAeI,gBAAgBN,WAAmB,EAAEP,YAAoB;QACtE,MAAMc,QAAQ,MAAMN,gBAAgBD,aAAaP,cAAcN;QAC/D,IAAI,CAACoB,OAAO,MAAM,IAAI3B,4BAA4Ba;QAClD,OAAOc;IACT;IAEA,OAAO;QACL,MAAMC,aAAYC,KAAK;YACrB,MAAMT,cAAc,MAAMH,mBAAmBY,MAAMhB,YAAY;YAC/D,MAAMiB,SAAiC;gBAAC,CAACvB,iBAAiB,EAAEsB,MAAME,WAAW;YAAA;YAC7E,IAAIF,MAAMG,YAAY,EAAEF,MAAM,CAACtB,kBAAkB,GAAGqB,MAAMG,YAAY;YACtE,MAAMjB,OAAOQ,OAAO,CAACU,UAAU,CAAC;gBAC9Bb;gBACAK,WAAWb,qBAAqBiB,MAAMhB,YAAY;gBAClDiB;gBACAI,UAAUL,MAAMK,QAAQ;YAC1B;QACF;QACA,MAAMC,gBAAeN,KAAK;YACxB,MAAMT,cAAc,MAAMH,mBAAmBY,MAAMhB,YAAY;YAC/D,MAAMkB,cAAc,MAAML,gBAAgBN,aAAaS,MAAMhB,YAAY;YACzE,IACE,CAACgB,MAAMO,YAAY,IACnB,CAACC,cACC,AAAC,CAAA,MAAMjC,kCAAkCyB,MAAMhB,YAAY,CAAA,GAAIyB,kBAAkB,OAGnF,OAAOP;YACT,MAAMQ,WAAW7B,eAAe8B,GAAG,CAACX,MAAMhB,YAAY;YACtD,IAAI0B,UAAU,OAAOA;YACrB,MAAME,UAAUC,2BAA2B;gBACzC7B,cAAcgB,MAAMhB,YAAY;gBAChCO;gBACAuB,qBAAqBZ;gBACrBK,cAAcP,MAAMO,YAAY,KAAK;gBACrCpB;gBACAO,SAASR,OAAOQ,OAAO;gBACvBG;gBACAL;gBACAuB,qBAAqB7B,OAAO6B,mBAAmB;YACjD;YACAlC,eAAemC,GAAG,CAAChB,MAAMhB,YAAY,EAAE4B;YACvC,KAAKA,QAAQK,IAAI,CACf,IAAMC,kBAAkBlB,MAAMhB,YAAY,EAAE4B,UAC5C,IAAMM,kBAAkBlB,MAAMhB,YAAY,EAAE4B;YAE9C,OAAOA;QACT;IACF;AACF;AAEA,SAASJ,cAAcW,SAAsB;IAC3C,OAAOA,cAAc,QAAQA,UAAUC,OAAO,MAAMC,KAAKC,GAAG,KAAK1C;AACnE;AAEA,SAASsC,kBAAkBlC,YAAoB,EAAE4B,OAAwB;IACvE,IAAI/B,eAAe8B,GAAG,CAAC3B,kBAAkB4B,SAAS/B,eAAe0C,MAAM,CAACvC;AAC1E;AAEA,eAAe6B,2BAA2B3B,MAczC;IACC,MAAMsC,OAAO,MAAM/C,oBAAoBS,OAAOF,YAAY,EAAE,IAC1DyC,gCAAgCvC;IAElC,IAAIsC,KAAKE,QAAQ,EAAE,OAAOF,KAAKG,KAAK;IACpC,MAAMC,SAAS,MAAM1C,OAAOW,eAAe,CAACX,OAAOK,WAAW,EAAEL,OAAOF,YAAY;IACnF,IAAI4C,WAAW1C,OAAO4B,mBAAmB,EAAE,OAAOc;IAClD,MAAM,IAAIvD,6BACR,wBACA;AAEJ;AAEA,eAAeoD,gCAAgCvC,MAc9C;IACC,MAAM2C,UAAU,MAAM3C,OAAOW,eAAe,CAACX,OAAOK,WAAW,EAAEL,OAAOF,YAAY;IACpF,MAAM8C,eAAe,MAAMvD,kCAAkCW,OAAOF,YAAY;IAChF,IACE6C,YAAY3C,OAAO4B,mBAAmB,IACrC,CAAC5B,OAAOqB,YAAY,IAAI,CAACC,cAAcsB,cAAcrB,kBAAkB,OAExE,OAAOoB;IACT,MAAM1B,eAAe,MAAMjB,OAAOM,eAAe,CAC/CN,OAAOK,WAAW,EAClBL,OAAOF,YAAY,EACnBL;IAEF,IAAI,CAACwB,cAAc;QACjB,IAAIjB,OAAOqB,YAAY,IAAIC,cAAcsB,cAAcrB,kBAAkB,OACvE,MAAM,IAAInC,4BAA4BY,OAAOF,YAAY;QAC3D,OAAO6C;IACT;IACA,IAAI;QACF,MAAME,YAAY,MAAM7C,OAAOC,MAAM,CAAC6C,kBAAkB,CAAC;YAAC7B;QAAY;QACtE,IAAI,CAAC4B,UAAU5B,YAAY,EAAE,MAAM,IAAI7B,4BAA4BY,OAAOF,YAAY;QACtF,MAAME,OAAOQ,OAAO,CAACU,UAAU,CAAC;YAC9Bb,aAAaL,OAAOK,WAAW;YAC/BK,WAAWb,qBAAqBG,OAAOF,YAAY;YACnDiB,QAAQ;gBACN,CAACvB,iBAAiB,EAAEqD,UAAU7B,WAAW;gBACzC,CAACvB,kBAAkB,EAAEoD,UAAU5B,YAAY;YAC7C;QACF;QACA,MAAM3B,kCAAkC;YACtCQ,cAAcE,OAAOF,YAAY;YACjCyB,gBAAgBsB,UAAUZ,SAAS,IAAI;YACvCc,QAAQF,UAAUE,MAAM,CAACC,MAAM,GAAG,IAAIH,UAAUE,MAAM,GAAGE;QAC3D;QACA,OAAOJ,UAAU7B,WAAW;IAC9B,EAAE,OAAOkC,OAAO;QACd,IAAIA,iBAAiB/D,gCAAgC+D,MAAMC,MAAM,KAAK,iBAAiB;YACrF,MAAMnD,OAAO6B,mBAAmB,GAAG;gBAAC/B,cAAcE,OAAOF,YAAY;YAAA;QACvE;QACA,MAAMoD;IACR;AACF"}
+{"version":3,"sources":["../../src/core/tokens.ts"],"sourcesContent":["import type {IntegrationConnectionLifecycleStatus} from '@shipfox/api-integration-spi';\nimport {logger} from '@shipfox/node-opentelemetry';\nimport {createJiraApiClient, type JiraApiClient} from '#api/client.js';\nimport {\n  JiraAccessTokenMissingError,\n  JiraConnectionNotFoundError,\n  JiraIntegrationProviderError,\n  JiraTokenUnrefreshableError,\n} from '#core/errors.js';\nimport {\n  getJiraInstallationByConnectionId,\n  updateJiraInstallationTokenExpiry,\n  withJiraRefreshLock,\n  withJiraRefreshLockAndWait,\n} from '#db/installations.js';\n\nconst ACCESS_TOKEN_KEY = 'ACCESS_TOKEN';\nconst REFRESH_TOKEN_KEY = 'REFRESH_TOKEN';\nconst TOKEN_REFRESH_MARGIN_MS = 5 * 60 * 1000;\n\nexport interface JiraConnectionResolverResult {\n  workspaceId: string;\n  lifecycleStatus: IntegrationConnectionLifecycleStatus;\n}\n\nexport interface JiraSecretsStore {\n  getSecret(params: {workspaceId: string; namespace: string; key: string}): Promise<string | null>;\n  setSecrets(params: {\n    workspaceId: string;\n    namespace: string;\n    values: Record<string, string>;\n    editedBy?: string | null | undefined;\n  }): Promise<void>;\n}\n\nexport interface CreateJiraTokenStoreParams {\n  resolveConnection(connectionId: string): Promise<JiraConnectionResolverResult | undefined>;\n  secrets: JiraSecretsStore;\n  client?: JiraApiClient | undefined;\n  markConnectionError?: (params: {connectionId: string}) => Promise<void>;\n}\n\nexport interface StoreJiraTokensParams {\n  connectionId: string;\n  accessToken: string;\n  refreshToken?: string | undefined;\n  editedBy?: string | null | undefined;\n}\n\nexport interface GetJiraAccessTokenParams {\n  connectionId: string;\n  forceRefresh?: boolean | undefined;\n}\n\nexport interface JiraTokenStore {\n  storeTokens(params: StoreJiraTokensParams): Promise<void>;\n  getAccessToken(params: GetJiraAccessTokenParams): Promise<string>;\n}\n\nexport function jiraSecretsNamespace(connectionId: string): string {\n  return `system/integrations/jira/${connectionId}`;\n}\n\nexport function createJiraTokenStore(params: CreateJiraTokenStoreParams): JiraTokenStore {\n  const client = params.client ?? createJiraApiClient();\n  const tokenRefreshes = new Map<string, Promise<string>>();\n  const refreshStateUnknownConnections = new Set<string>();\n  const credentialGenerations = new Map<string, number>();\n  const credentialWriteQueues = new Map<string, Promise<void>>();\n  const currentCredentialGeneration = (connectionId: string): number =>\n    credentialGenerations.get(connectionId) ?? 0;\n  const advanceCredentialGeneration = (connectionId: string): number => {\n    const generation = currentCredentialGeneration(connectionId) + 1;\n    credentialGenerations.set(connectionId, generation);\n    return generation;\n  };\n  function withCredentialWrite<T>(connectionId: string, operation: () => Promise<T>): Promise<T> {\n    const previous = credentialWriteQueues.get(connectionId) ?? Promise.resolve();\n    const operationResult = previous.then(operation);\n    const completion = operationResult.then(\n      () => undefined,\n      () => undefined,\n    );\n    credentialWriteQueues.set(connectionId, completion);\n    return operationResult.finally(() => {\n      if (credentialWriteQueues.get(connectionId) === completion) {\n        credentialWriteQueues.delete(connectionId);\n      }\n    });\n  }\n  async function waitForCredentialWrites(connectionId: string): Promise<void> {\n    await credentialWriteQueues.get(connectionId);\n  }\n  async function resolveConnection(connectionId: string): Promise<JiraConnectionResolverResult> {\n    const connection = await params.resolveConnection(connectionId);\n    if (!connection) throw new JiraConnectionNotFoundError(connectionId);\n    return connection;\n  }\n  async function resolveWorkspaceId(connectionId: string): Promise<string> {\n    return (await resolveConnection(connectionId)).workspaceId;\n  }\n  function clearTokenRefresh(connectionId: string, refresh: Promise<string>): void {\n    if (tokenRefreshes.get(connectionId) === refresh) tokenRefreshes.delete(connectionId);\n  }\n  const readSecretToken = (\n    workspaceId: string,\n    connectionId: string,\n    key: typeof ACCESS_TOKEN_KEY | typeof REFRESH_TOKEN_KEY,\n  ) => params.secrets.getSecret({workspaceId, namespace: jiraSecretsNamespace(connectionId), key});\n  async function readAccessToken(workspaceId: string, connectionId: string): Promise<string> {\n    const token = await readSecretToken(workspaceId, connectionId, ACCESS_TOKEN_KEY);\n    if (!token) throw new JiraAccessTokenMissingError(connectionId);\n    return token;\n  }\n\n  return {\n    async storeTokens(input) {\n      const credentialGeneration = advanceCredentialGeneration(input.connectionId);\n      tokenRefreshes.delete(input.connectionId);\n      await withJiraRefreshLockAndWait(input.connectionId, () =>\n        withCredentialWrite(input.connectionId, async () => {\n          if (currentCredentialGeneration(input.connectionId) !== credentialGeneration) return;\n          const workspaceId = await resolveWorkspaceId(input.connectionId);\n          if (currentCredentialGeneration(input.connectionId) !== credentialGeneration) return;\n          const values: Record<string, string> = {[ACCESS_TOKEN_KEY]: input.accessToken};\n          if (input.refreshToken) values[REFRESH_TOKEN_KEY] = input.refreshToken;\n          await params.secrets.setSecrets({\n            workspaceId,\n            namespace: jiraSecretsNamespace(input.connectionId),\n            values,\n            editedBy: input.editedBy,\n          });\n          if (currentCredentialGeneration(input.connectionId) === credentialGeneration) {\n            refreshStateUnknownConnections.delete(input.connectionId);\n          }\n        }),\n      );\n    },\n    async getAccessToken(input) {\n      await waitForCredentialWrites(input.connectionId);\n      const connection = await resolveConnection(input.connectionId);\n      if (connection.lifecycleStatus !== 'active') {\n        throw new JiraTokenUnrefreshableError(input.connectionId);\n      }\n      await waitForCredentialWrites(input.connectionId);\n      if (refreshStateUnknownConnections.has(input.connectionId)) {\n        throw new JiraTokenUnrefreshableError(input.connectionId);\n      }\n      const credentialGeneration = currentCredentialGeneration(input.connectionId);\n      const workspaceId = connection.workspaceId;\n      const accessToken = await readAccessToken(workspaceId, input.connectionId);\n      if (\n        !input.forceRefresh &&\n        !shouldRefresh(\n          (await getJiraInstallationByConnectionId(input.connectionId))?.tokenExpiresAt ?? null,\n        )\n      )\n        return accessToken;\n      const inFlight = tokenRefreshes.get(input.connectionId);\n      if (inFlight) return inFlight;\n      const refresh = refreshAccessTokenWithLock({\n        connectionId: input.connectionId,\n        workspaceId,\n        originalAccessToken: accessToken,\n        forceRefresh: input.forceRefresh === true,\n        client,\n        secrets: params.secrets,\n        readAccessToken,\n        readSecretToken,\n        markConnectionError: params.markConnectionError,\n        withCredentialWrite,\n        waitForCredentialWrites,\n        isCurrentCredentialGeneration: () =>\n          currentCredentialGeneration(input.connectionId) === credentialGeneration,\n      });\n      tokenRefreshes.set(input.connectionId, refresh);\n      void refresh.then(\n        () => clearTokenRefresh(input.connectionId, refresh),\n        (error) => {\n          if (\n            isTerminalRefreshFailure(error) &&\n            currentCredentialGeneration(input.connectionId) === credentialGeneration\n          ) {\n            refreshStateUnknownConnections.add(input.connectionId);\n          }\n          clearTokenRefresh(input.connectionId, refresh);\n        },\n      );\n      return refresh;\n    },\n  };\n}\n\nfunction shouldRefresh(expiresAt: Date | null): boolean {\n  return expiresAt !== null && expiresAt.getTime() <= Date.now() + TOKEN_REFRESH_MARGIN_MS;\n}\n\nasync function refreshAccessTokenWithLock(params: {\n  connectionId: string;\n  workspaceId: string;\n  originalAccessToken: string;\n  forceRefresh: boolean;\n  client: JiraApiClient;\n  secrets: JiraSecretsStore;\n  readAccessToken(workspaceId: string, connectionId: string): Promise<string>;\n  readSecretToken(\n    workspaceId: string,\n    connectionId: string,\n    key: typeof ACCESS_TOKEN_KEY | typeof REFRESH_TOKEN_KEY,\n  ): Promise<string | null>;\n  markConnectionError?: ((params: {connectionId: string}) => Promise<void>) | undefined;\n  withCredentialWrite<T>(connectionId: string, operation: () => Promise<T>): Promise<T>;\n  waitForCredentialWrites(connectionId: string): Promise<void>;\n  isCurrentCredentialGeneration(): boolean;\n}): Promise<string> {\n  const lock = await withJiraRefreshLock(params.connectionId, () =>\n    refreshAccessTokenForConnection(params),\n  );\n  if (lock.acquired) return lock.value;\n  if (!params.isCurrentCredentialGeneration()) {\n    return params.readAccessToken(params.workspaceId, params.connectionId);\n  }\n  const reread = await params.readAccessToken(params.workspaceId, params.connectionId);\n  if (reread !== params.originalAccessToken) return reread;\n  throw new JiraIntegrationProviderError(\n    'provider-unavailable',\n    'Jira token refresh is already in progress',\n  );\n}\n\nasync function refreshAccessTokenForConnection(params: {\n  connectionId: string;\n  workspaceId: string;\n  originalAccessToken: string;\n  forceRefresh: boolean;\n  client: JiraApiClient;\n  secrets: JiraSecretsStore;\n  readAccessToken(workspaceId: string, connectionId: string): Promise<string>;\n  readSecretToken(\n    workspaceId: string,\n    connectionId: string,\n    key: typeof ACCESS_TOKEN_KEY | typeof REFRESH_TOKEN_KEY,\n  ): Promise<string | null>;\n  markConnectionError?: ((params: {connectionId: string}) => Promise<void>) | undefined;\n  withCredentialWrite<T>(connectionId: string, operation: () => Promise<T>): Promise<T>;\n  waitForCredentialWrites(connectionId: string): Promise<void>;\n  isCurrentCredentialGeneration(): boolean;\n}): Promise<string> {\n  if (!params.isCurrentCredentialGeneration()) {\n    return params.readAccessToken(params.workspaceId, params.connectionId);\n  }\n  const current = await params.readAccessToken(params.workspaceId, params.connectionId);\n  const installation = await getJiraInstallationByConnectionId(params.connectionId);\n  if (\n    current !== params.originalAccessToken ||\n    (!params.forceRefresh && !shouldRefresh(installation?.tokenExpiresAt ?? null))\n  )\n    return current;\n  const refreshToken = await params.readSecretToken(\n    params.workspaceId,\n    params.connectionId,\n    REFRESH_TOKEN_KEY,\n  );\n  if (!refreshToken) {\n    if (params.forceRefresh || shouldRefresh(installation?.tokenExpiresAt ?? null))\n      throw new JiraTokenUnrefreshableError(params.connectionId);\n    return current;\n  }\n  try {\n    const refreshed = await params.client.refreshAccessToken({refreshToken});\n    const refreshedRefreshToken = refreshed.refreshToken;\n    if (!refreshedRefreshToken) throw new JiraTokenUnrefreshableError(params.connectionId);\n    const persisted = await params.withCredentialWrite(params.connectionId, async () => {\n      if (!params.isCurrentCredentialGeneration()) return false;\n      await params.secrets.setSecrets({\n        workspaceId: params.workspaceId,\n        namespace: jiraSecretsNamespace(params.connectionId),\n        values: {\n          [ACCESS_TOKEN_KEY]: refreshed.accessToken,\n          [REFRESH_TOKEN_KEY]: refreshedRefreshToken,\n        },\n      });\n      if (!params.isCurrentCredentialGeneration()) return false;\n      await updateJiraInstallationTokenExpiry({\n        connectionId: params.connectionId,\n        tokenExpiresAt: refreshed.expiresAt ?? null,\n        scopes: refreshed.scopes.length > 0 ? refreshed.scopes : undefined,\n      });\n      return true;\n    });\n    if (!persisted || !params.isCurrentCredentialGeneration()) {\n      await params.waitForCredentialWrites(params.connectionId);\n      return params.readAccessToken(params.workspaceId, params.connectionId);\n    }\n    return refreshed.accessToken;\n  } catch (error) {\n    if (isTerminalRefreshFailure(error)) {\n      await markConnectionError({\n        callback: params.markConnectionError,\n        connectionId: params.connectionId,\n        isCurrentCredentialGeneration: params.isCurrentCredentialGeneration,\n        withCredentialWrite: params.withCredentialWrite,\n      });\n    }\n    throw error;\n  }\n}\n\nfunction isTerminalRefreshFailure(error: unknown): boolean {\n  return (\n    error instanceof JiraIntegrationProviderError &&\n    (error.reason === 'access-denied' || error.reason === 'timeout')\n  );\n}\n\nasync function markConnectionError(params: {\n  callback: CreateJiraTokenStoreParams['markConnectionError'];\n  connectionId: string;\n  isCurrentCredentialGeneration(): boolean;\n  withCredentialWrite<T>(connectionId: string, operation: () => Promise<T>): Promise<T>;\n}): Promise<void> {\n  if (!params.isCurrentCredentialGeneration()) return;\n  try {\n    await params.withCredentialWrite(params.connectionId, async () => {\n      if (!params.isCurrentCredentialGeneration()) return;\n      await params.callback?.({connectionId: params.connectionId});\n    });\n  } catch (error) {\n    logger().warn(\n      {err: error, connectionId: params.connectionId},\n      'Jira connection error-state update failed after token refresh failure',\n    );\n  }\n}\n"],"names":["logger","createJiraApiClient","JiraAccessTokenMissingError","JiraConnectionNotFoundError","JiraIntegrationProviderError","JiraTokenUnrefreshableError","getJiraInstallationByConnectionId","updateJiraInstallationTokenExpiry","withJiraRefreshLock","withJiraRefreshLockAndWait","ACCESS_TOKEN_KEY","REFRESH_TOKEN_KEY","TOKEN_REFRESH_MARGIN_MS","jiraSecretsNamespace","connectionId","createJiraTokenStore","params","client","tokenRefreshes","Map","refreshStateUnknownConnections","Set","credentialGenerations","credentialWriteQueues","currentCredentialGeneration","get","advanceCredentialGeneration","generation","set","withCredentialWrite","operation","previous","Promise","resolve","operationResult","then","completion","undefined","finally","delete","waitForCredentialWrites","resolveConnection","connection","resolveWorkspaceId","workspaceId","clearTokenRefresh","refresh","readSecretToken","key","secrets","getSecret","namespace","readAccessToken","token","storeTokens","input","credentialGeneration","values","accessToken","refreshToken","setSecrets","editedBy","getAccessToken","lifecycleStatus","has","forceRefresh","shouldRefresh","tokenExpiresAt","inFlight","refreshAccessTokenWithLock","originalAccessToken","markConnectionError","isCurrentCredentialGeneration","error","isTerminalRefreshFailure","add","expiresAt","getTime","Date","now","lock","refreshAccessTokenForConnection","acquired","value","reread","current","installation","refreshed","refreshAccessToken","refreshedRefreshToken","persisted","scopes","length","callback","reason","warn","err"],"mappings":"AACA,SAAQA,MAAM,QAAO,8BAA8B;AACnD,SAAQC,mBAAmB,QAA2B,iBAAiB;AACvE,SACEC,2BAA2B,EAC3BC,2BAA2B,EAC3BC,4BAA4B,EAC5BC,2BAA2B,QACtB,kBAAkB;AACzB,SACEC,iCAAiC,EACjCC,iCAAiC,EACjCC,mBAAmB,EACnBC,0BAA0B,QACrB,uBAAuB;AAE9B,MAAMC,mBAAmB;AACzB,MAAMC,oBAAoB;AAC1B,MAAMC,0BAA0B,IAAI,KAAK;AAyCzC,OAAO,SAASC,qBAAqBC,YAAoB;IACvD,OAAO,CAAC,yBAAyB,EAAEA,cAAc;AACnD;AAEA,OAAO,SAASC,qBAAqBC,MAAkC;IACrE,MAAMC,SAASD,OAAOC,MAAM,IAAIhB;IAChC,MAAMiB,iBAAiB,IAAIC;IAC3B,MAAMC,iCAAiC,IAAIC;IAC3C,MAAMC,wBAAwB,IAAIH;IAClC,MAAMI,wBAAwB,IAAIJ;IAClC,MAAMK,8BAA8B,CAACV,eACnCQ,sBAAsBG,GAAG,CAACX,iBAAiB;IAC7C,MAAMY,8BAA8B,CAACZ;QACnC,MAAMa,aAAaH,4BAA4BV,gBAAgB;QAC/DQ,sBAAsBM,GAAG,CAACd,cAAca;QACxC,OAAOA;IACT;IACA,SAASE,oBAAuBf,YAAoB,EAAEgB,SAA2B;QAC/E,MAAMC,WAAWR,sBAAsBE,GAAG,CAACX,iBAAiBkB,QAAQC,OAAO;QAC3E,MAAMC,kBAAkBH,SAASI,IAAI,CAACL;QACtC,MAAMM,aAAaF,gBAAgBC,IAAI,CACrC,IAAME,WACN,IAAMA;QAERd,sBAAsBK,GAAG,CAACd,cAAcsB;QACxC,OAAOF,gBAAgBI,OAAO,CAAC;YAC7B,IAAIf,sBAAsBE,GAAG,CAACX,kBAAkBsB,YAAY;gBAC1Db,sBAAsBgB,MAAM,CAACzB;YAC/B;QACF;IACF;IACA,eAAe0B,wBAAwB1B,YAAoB;QACzD,MAAMS,sBAAsBE,GAAG,CAACX;IAClC;IACA,eAAe2B,kBAAkB3B,YAAoB;QACnD,MAAM4B,aAAa,MAAM1B,OAAOyB,iBAAiB,CAAC3B;QAClD,IAAI,CAAC4B,YAAY,MAAM,IAAIvC,4BAA4BW;QACvD,OAAO4B;IACT;IACA,eAAeC,mBAAmB7B,YAAoB;QACpD,OAAO,AAAC,CAAA,MAAM2B,kBAAkB3B,aAAY,EAAG8B,WAAW;IAC5D;IACA,SAASC,kBAAkB/B,YAAoB,EAAEgC,OAAwB;QACvE,IAAI5B,eAAeO,GAAG,CAACX,kBAAkBgC,SAAS5B,eAAeqB,MAAM,CAACzB;IAC1E;IACA,MAAMiC,kBAAkB,CACtBH,aACA9B,cACAkC,MACGhC,OAAOiC,OAAO,CAACC,SAAS,CAAC;YAACN;YAAaO,WAAWtC,qBAAqBC;YAAekC;QAAG;IAC9F,eAAeI,gBAAgBR,WAAmB,EAAE9B,YAAoB;QACtE,MAAMuC,QAAQ,MAAMN,gBAAgBH,aAAa9B,cAAcJ;QAC/D,IAAI,CAAC2C,OAAO,MAAM,IAAInD,4BAA4BY;QAClD,OAAOuC;IACT;IAEA,OAAO;QACL,MAAMC,aAAYC,KAAK;YACrB,MAAMC,uBAAuB9B,4BAA4B6B,MAAMzC,YAAY;YAC3EI,eAAeqB,MAAM,CAACgB,MAAMzC,YAAY;YACxC,MAAML,2BAA2B8C,MAAMzC,YAAY,EAAE,IACnDe,oBAAoB0B,MAAMzC,YAAY,EAAE;oBACtC,IAAIU,4BAA4B+B,MAAMzC,YAAY,MAAM0C,sBAAsB;oBAC9E,MAAMZ,cAAc,MAAMD,mBAAmBY,MAAMzC,YAAY;oBAC/D,IAAIU,4BAA4B+B,MAAMzC,YAAY,MAAM0C,sBAAsB;oBAC9E,MAAMC,SAAiC;wBAAC,CAAC/C,iBAAiB,EAAE6C,MAAMG,WAAW;oBAAA;oBAC7E,IAAIH,MAAMI,YAAY,EAAEF,MAAM,CAAC9C,kBAAkB,GAAG4C,MAAMI,YAAY;oBACtE,MAAM3C,OAAOiC,OAAO,CAACW,UAAU,CAAC;wBAC9BhB;wBACAO,WAAWtC,qBAAqB0C,MAAMzC,YAAY;wBAClD2C;wBACAI,UAAUN,MAAMM,QAAQ;oBAC1B;oBACA,IAAIrC,4BAA4B+B,MAAMzC,YAAY,MAAM0C,sBAAsB;wBAC5EpC,+BAA+BmB,MAAM,CAACgB,MAAMzC,YAAY;oBAC1D;gBACF;QAEJ;QACA,MAAMgD,gBAAeP,KAAK;YACxB,MAAMf,wBAAwBe,MAAMzC,YAAY;YAChD,MAAM4B,aAAa,MAAMD,kBAAkBc,MAAMzC,YAAY;YAC7D,IAAI4B,WAAWqB,eAAe,KAAK,UAAU;gBAC3C,MAAM,IAAI1D,4BAA4BkD,MAAMzC,YAAY;YAC1D;YACA,MAAM0B,wBAAwBe,MAAMzC,YAAY;YAChD,IAAIM,+BAA+B4C,GAAG,CAACT,MAAMzC,YAAY,GAAG;gBAC1D,MAAM,IAAIT,4BAA4BkD,MAAMzC,YAAY;YAC1D;YACA,MAAM0C,uBAAuBhC,4BAA4B+B,MAAMzC,YAAY;YAC3E,MAAM8B,cAAcF,WAAWE,WAAW;YAC1C,MAAMc,cAAc,MAAMN,gBAAgBR,aAAaW,MAAMzC,YAAY;YACzE,IACE,CAACyC,MAAMU,YAAY,IACnB,CAACC,cACC,AAAC,CAAA,MAAM5D,kCAAkCiD,MAAMzC,YAAY,CAAA,GAAIqD,kBAAkB,OAGnF,OAAOT;YACT,MAAMU,WAAWlD,eAAeO,GAAG,CAAC8B,MAAMzC,YAAY;YACtD,IAAIsD,UAAU,OAAOA;YACrB,MAAMtB,UAAUuB,2BAA2B;gBACzCvD,cAAcyC,MAAMzC,YAAY;gBAChC8B;gBACA0B,qBAAqBZ;gBACrBO,cAAcV,MAAMU,YAAY,KAAK;gBACrChD;gBACAgC,SAASjC,OAAOiC,OAAO;gBACvBG;gBACAL;gBACAwB,qBAAqBvD,OAAOuD,mBAAmB;gBAC/C1C;gBACAW;gBACAgC,+BAA+B,IAC7BhD,4BAA4B+B,MAAMzC,YAAY,MAAM0C;YACxD;YACAtC,eAAeU,GAAG,CAAC2B,MAAMzC,YAAY,EAAEgC;YACvC,KAAKA,QAAQX,IAAI,CACf,IAAMU,kBAAkBU,MAAMzC,YAAY,EAAEgC,UAC5C,CAAC2B;gBACC,IACEC,yBAAyBD,UACzBjD,4BAA4B+B,MAAMzC,YAAY,MAAM0C,sBACpD;oBACApC,+BAA+BuD,GAAG,CAACpB,MAAMzC,YAAY;gBACvD;gBACA+B,kBAAkBU,MAAMzC,YAAY,EAAEgC;YACxC;YAEF,OAAOA;QACT;IACF;AACF;AAEA,SAASoB,cAAcU,SAAsB;IAC3C,OAAOA,cAAc,QAAQA,UAAUC,OAAO,MAAMC,KAAKC,GAAG,KAAKnE;AACnE;AAEA,eAAeyD,2BAA2BrD,MAiBzC;IACC,MAAMgE,OAAO,MAAMxE,oBAAoBQ,OAAOF,YAAY,EAAE,IAC1DmE,gCAAgCjE;IAElC,IAAIgE,KAAKE,QAAQ,EAAE,OAAOF,KAAKG,KAAK;IACpC,IAAI,CAACnE,OAAOwD,6BAA6B,IAAI;QAC3C,OAAOxD,OAAOoC,eAAe,CAACpC,OAAO4B,WAAW,EAAE5B,OAAOF,YAAY;IACvE;IACA,MAAMsE,SAAS,MAAMpE,OAAOoC,eAAe,CAACpC,OAAO4B,WAAW,EAAE5B,OAAOF,YAAY;IACnF,IAAIsE,WAAWpE,OAAOsD,mBAAmB,EAAE,OAAOc;IAClD,MAAM,IAAIhF,6BACR,wBACA;AAEJ;AAEA,eAAe6E,gCAAgCjE,MAiB9C;IACC,IAAI,CAACA,OAAOwD,6BAA6B,IAAI;QAC3C,OAAOxD,OAAOoC,eAAe,CAACpC,OAAO4B,WAAW,EAAE5B,OAAOF,YAAY;IACvE;IACA,MAAMuE,UAAU,MAAMrE,OAAOoC,eAAe,CAACpC,OAAO4B,WAAW,EAAE5B,OAAOF,YAAY;IACpF,MAAMwE,eAAe,MAAMhF,kCAAkCU,OAAOF,YAAY;IAChF,IACEuE,YAAYrE,OAAOsD,mBAAmB,IACrC,CAACtD,OAAOiD,YAAY,IAAI,CAACC,cAAcoB,cAAcnB,kBAAkB,OAExE,OAAOkB;IACT,MAAM1B,eAAe,MAAM3C,OAAO+B,eAAe,CAC/C/B,OAAO4B,WAAW,EAClB5B,OAAOF,YAAY,EACnBH;IAEF,IAAI,CAACgD,cAAc;QACjB,IAAI3C,OAAOiD,YAAY,IAAIC,cAAcoB,cAAcnB,kBAAkB,OACvE,MAAM,IAAI9D,4BAA4BW,OAAOF,YAAY;QAC3D,OAAOuE;IACT;IACA,IAAI;QACF,MAAME,YAAY,MAAMvE,OAAOC,MAAM,CAACuE,kBAAkB,CAAC;YAAC7B;QAAY;QACtE,MAAM8B,wBAAwBF,UAAU5B,YAAY;QACpD,IAAI,CAAC8B,uBAAuB,MAAM,IAAIpF,4BAA4BW,OAAOF,YAAY;QACrF,MAAM4E,YAAY,MAAM1E,OAAOa,mBAAmB,CAACb,OAAOF,YAAY,EAAE;YACtE,IAAI,CAACE,OAAOwD,6BAA6B,IAAI,OAAO;YACpD,MAAMxD,OAAOiC,OAAO,CAACW,UAAU,CAAC;gBAC9BhB,aAAa5B,OAAO4B,WAAW;gBAC/BO,WAAWtC,qBAAqBG,OAAOF,YAAY;gBACnD2C,QAAQ;oBACN,CAAC/C,iBAAiB,EAAE6E,UAAU7B,WAAW;oBACzC,CAAC/C,kBAAkB,EAAE8E;gBACvB;YACF;YACA,IAAI,CAACzE,OAAOwD,6BAA6B,IAAI,OAAO;YACpD,MAAMjE,kCAAkC;gBACtCO,cAAcE,OAAOF,YAAY;gBACjCqD,gBAAgBoB,UAAUX,SAAS,IAAI;gBACvCe,QAAQJ,UAAUI,MAAM,CAACC,MAAM,GAAG,IAAIL,UAAUI,MAAM,GAAGtD;YAC3D;YACA,OAAO;QACT;QACA,IAAI,CAACqD,aAAa,CAAC1E,OAAOwD,6BAA6B,IAAI;YACzD,MAAMxD,OAAOwB,uBAAuB,CAACxB,OAAOF,YAAY;YACxD,OAAOE,OAAOoC,eAAe,CAACpC,OAAO4B,WAAW,EAAE5B,OAAOF,YAAY;QACvE;QACA,OAAOyE,UAAU7B,WAAW;IAC9B,EAAE,OAAOe,OAAO;QACd,IAAIC,yBAAyBD,QAAQ;YACnC,MAAMF,oBAAoB;gBACxBsB,UAAU7E,OAAOuD,mBAAmB;gBACpCzD,cAAcE,OAAOF,YAAY;gBACjC0D,+BAA+BxD,OAAOwD,6BAA6B;gBACnE3C,qBAAqBb,OAAOa,mBAAmB;YACjD;QACF;QACA,MAAM4C;IACR;AACF;AAEA,SAASC,yBAAyBD,KAAc;IAC9C,OACEA,iBAAiBrE,gCAChBqE,CAAAA,MAAMqB,MAAM,KAAK,mBAAmBrB,MAAMqB,MAAM,KAAK,SAAQ;AAElE;AAEA,eAAevB,oBAAoBvD,MAKlC;IACC,IAAI,CAACA,OAAOwD,6BAA6B,IAAI;IAC7C,IAAI;QACF,MAAMxD,OAAOa,mBAAmB,CAACb,OAAOF,YAAY,EAAE;YACpD,IAAI,CAACE,OAAOwD,6BAA6B,IAAI;YAC7C,MAAMxD,OAAO6E,QAAQ,GAAG;gBAAC/E,cAAcE,OAAOF,YAAY;YAAA;QAC5D;IACF,EAAE,OAAO2D,OAAO;QACdzE,SAAS+F,IAAI,CACX;YAACC,KAAKvB;YAAO3D,cAAcE,OAAOF,YAAY;QAAA,GAC9C;IAEJ;AACF"}

package/dist/db/db.d.ts

@@ -197,6 +197,40 @@ export declare const schema: {
                 identity: undefined;
                 generated: undefined;
             }, {}, {}>;
+            refreshTokenLastUsedAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "refresh_token_last_used_at";
+                tableName: "installations";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            refreshTokenLastAttemptedAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "refresh_token_last_attempted_at";
+                tableName: "installations";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
             createdAt: import("drizzle-orm/pg-core").PgColumn<{
                 name: "created_at";
                 tableName: "installations";
@@ -527,6 +561,40 @@ export declare function db(): NodePgDatabase<{
                 identity: undefined;
                 generated: undefined;
             }, {}, {}>;
+            refreshTokenLastUsedAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "refresh_token_last_used_at";
+                tableName: "installations";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            refreshTokenLastAttemptedAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "refresh_token_last_attempted_at";
+                tableName: "installations";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
             createdAt: import("drizzle-orm/pg-core").PgColumn<{
                 name: "created_at";
                 tableName: "installations";

package/dist/db/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/db/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAKnE,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAA6C,CAAC;AAIjE,wBAAgB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAGjB;AAED,wBAAgB,OAAO,IAAI,IAAI,CAE9B"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/db/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAKnE,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAA6C,CAAC;AAIjE,wBAAgB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAGjB;AAED,wBAAgB,OAAO,IAAI,IAAI,CAE9B"}

package/dist/db/installations.d.ts

@@ -1,5 +1,11 @@
 export type JiraInstallationLock = <T>(lockKey: string, fn: () => Promise<T>) => Promise<T>;
-export declare function withJiraInstallationLock<T>(lockKey: string, fn: () => Promise<T>): Promise<T>;
+type JiraAdvisoryLockAttempt<T> = {
+    acquired: true;
+    value: T;
+} | {
+    acquired: false;
+};
+export declare function withJiraInstallationLock<T>(lockKey: string, fn: () => Promise<T>): Promise<Awaited<T>>;
 export type JiraInstallationStatus = 'installed' | 'revoked';
 export interface JiraInstallation {
     id: string;
@@ -13,6 +19,8 @@ export interface JiraInstallation {
     webhookExpiresAt: Date | null;
     status: JiraInstallationStatus;
     tokenExpiresAt: Date | null;
+    refreshTokenLastUsedAt: Date;
+    refreshTokenLastAttemptedAt: Date;
     createdAt: Date;
     updatedAt: Date;
 }
@@ -27,6 +35,8 @@ export interface UpsertJiraInstallationParams {
     webhookExpiresAt?: Date | null | undefined;
     status: JiraInstallationStatus;
     tokenExpiresAt?: Date | null | undefined;
+    refreshTokenLastUsedAt?: Date | undefined;
+    refreshTokenLastAttemptedAt?: Date | undefined;
 }
 export interface UpdateJiraInstallationTokenExpiryParams {
     connectionId: string;
@@ -47,19 +57,24 @@ export declare function getJiraInstallationByCloudId(cloudId: string, options?:
 export declare function updateJiraInstallationTokenExpiry(params: UpdateJiraInstallationTokenExpiryParams, options?: {
     tx?: unknown;
 }): Promise<JiraInstallation | undefined>;
+export declare function markJiraInstallationTokenRefreshAttempt(connectionId: string, options?: {
+    tx?: unknown;
+}): Promise<JiraInstallation | undefined>;
+export declare function listJiraInstallationsDueForTokenRefresh(params: {
+    before: Date;
+    limit?: number | undefined;
+}, options?: {
+    tx?: unknown;
+}): Promise<JiraInstallation[]>;
 export declare function updateJiraInstallationWebhook(params: UpdateJiraInstallationWebhookParams, options?: {
     tx?: unknown;
 }): Promise<JiraInstallation | undefined>;
 export declare function deleteJiraInstallationByConnectionId(connectionId: string, options?: {
     tx?: unknown;
 }): Promise<boolean>;
-export type JiraRefreshLockResult<T> = {
-    acquired: true;
-    value: T;
-} | {
-    acquired: false;
-};
+export type JiraRefreshLockResult<T> = JiraAdvisoryLockAttempt<T>;
 export declare function withJiraRefreshLock<T>(connectionId: string, fn: () => Promise<T>): Promise<JiraRefreshLockResult<T>>;
+export declare function withJiraRefreshLockAndWait<T>(connectionId: string, fn: () => Promise<T>): Promise<T>;
 export declare function withJiraWebhookRegistrationLock<T>(lockKey: string, fn: (tx?: unknown) => Promise<T>): Promise<T>;
 export declare function getJiraInstallationByConnectionId(connectionId: string, options?: {
     tx?: unknown;
@@ -70,4 +85,5 @@ export declare function getJiraInstallationByWebhookId(webhookId: number, option
 export declare function markJiraInstallationRevoked(connectionId: string, options?: {
     tx?: unknown;
 }): Promise<JiraInstallation | undefined>;
+export {};
 //# sourceMappingURL=installations.d.ts.map

package/dist/db/installations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"installations.d.ts","sourceRoot":"","sources":["../../src/db/installations.ts"],"names":[],"mappings":"AAWA,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;AAM5F,wBAAsB,wBAAwB,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,cA2BtF;AAED,MAAM,MAAM,sBAAsB,GAAG,WAAW,GAAG,SAAS,CAAC;AAE7D,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,sBAAsB,CAAC;IAC/B,cAAc,EAAE,IAAI,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAClC,gBAAgB,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,CAAC;IAC3C,MAAM,EAAE,sBAAsB,CAAC;IAC/B,cAAc,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,CAAC;CAC1C;AAED,MAAM,WAAW,uCAAuC;IACtD,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,IAAI,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,mCAAmC;IAClD,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;CAC/B;AAKD,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,4BAA4B,EACpC,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,CAAC,CAkD3B;AAED,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CASvC;AAED,wBAAsB,iCAAiC,CACrD,MAAM,EAAE,uCAAuC,EAC/C,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAYvC;AAED,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,mCAAmC,EAC3C,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAYvC;AAED,wBAAsB,oCAAoC,CACxD,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,OAAO,CAAC,CAMlB;AAED,MAAM,MAAM,qBAAqB,CAAC,CAAC,IAAI;IAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAC,GAAG;IAAC,QAAQ,EAAE,KAAK,CAAA;CAAC,CAAC;AAEtF,wBAAgB,mBAAmB,CAAC,CAAC,EACnC,YAAY,EAAE,MAAM,EACpB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAEnC;AAED,wBAAgB,+BAA+B,CAAC,CAAC,EAC/C,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAC/B,OAAO,CAAC,CAAC,CAAC,CAEZ;AAyBD,wBAAsB,iCAAiC,CACrD,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAUvC;AAED,wBAAsB,8BAA8B,CAClD,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAUvC;AAED,wBAAsB,2BAA2B,CAC/C,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CASvC"}
+{"version":3,"file":"installations.d.ts","sourceRoot":"","sources":["../../src/db/installations.ts"],"names":[],"mappings":"AAWA,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;AAM5F,KAAK,uBAAuB,CAAC,CAAC,IAAI;IAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAC,GAAG;IAAC,QAAQ,EAAE,KAAK,CAAA;CAAC,CAAC;AAEjF,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,uBAiBhF;AAED,MAAM,MAAM,sBAAsB,GAAG,WAAW,GAAG,SAAS,CAAC;AAE7D,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,sBAAsB,CAAC;IAC/B,cAAc,EAAE,IAAI,GAAG,IAAI,CAAC;IAC5B,sBAAsB,EAAE,IAAI,CAAC;IAC7B,2BAA2B,EAAE,IAAI,CAAC;IAClC,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAClC,gBAAgB,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,CAAC;IAC3C,MAAM,EAAE,sBAAsB,CAAC;IAC/B,cAAc,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,CAAC;IACzC,sBAAsB,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAC1C,2BAA2B,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CAChD;AAED,MAAM,WAAW,uCAAuC;IACtD,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,IAAI,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,mCAAmC;IAClD,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAC;CAC/B;AAKD,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,4BAA4B,EACpC,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,CAAC,CAsD3B;AAED,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CASvC;AAED,wBAAsB,iCAAiC,CACrD,MAAM,EAAE,uCAAuC,EAC/C,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAevC;AAED,wBAAsB,uCAAuC,CAC3D,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAQvC;AAED,wBAAsB,uCAAuC,CAC3D,MAAM,EAAE;IAAC,MAAM,EAAE,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAC,EAClD,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAc7B;AAED,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,mCAAmC,EAC3C,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAYvC;AAED,wBAAsB,oCAAoC,CACxD,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,OAAO,CAAC,CAMlB;AAED,MAAM,MAAM,qBAAqB,CAAC,CAAC,IAAI,uBAAuB,CAAC,CAAC,CAAC,CAAC;AAElE,wBAAgB,mBAAmB,CAAC,CAAC,EACnC,YAAY,EAAE,MAAM,EACpB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAEnC;AAED,wBAAgB,0BAA0B,CAAC,CAAC,EAC1C,YAAY,EAAE,MAAM,EACpB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAIZ;AAED,wBAAgB,+BAA+B,CAAC,CAAC,EAC/C,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAC/B,OAAO,CAAC,CAAC,CAAC,CAEZ;AAyCD,wBAAsB,iCAAiC,CACrD,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAUvC;AAED,wBAAsB,8BAA8B,CAClD,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAUvC;AAED,wBAAsB,2BAA2B,CAC/C,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAM,GAC3B,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CASvC"}

package/dist/db/installations.js

@@ -1,18 +1,15 @@
 import { isUniqueViolation } from '@shipfox/node-drizzle';
 import { pgClient, withPostgresSession } from '@shipfox/node-postgres';
-import { eq, sql } from 'drizzle-orm';
+import { and, asc, eq, lte, sql } from 'drizzle-orm';
 import { JiraConnectionAlreadyLinkedError, JiraInstallationAlreadyLinkedError, JiraInstallationSiteMismatchError } from '#core/errors.js';
 import { db } from './db.js';
 import { jiraInstallations, toJiraInstallation } from './schema/installations.js';
-const JIRA_INSTALLATION_LOCK_RETRY_DELAY_MS = 100;
-const JIRA_INSTALLATION_LOCK_MAX_RETRY_DELAY_MS = 1_000;
-const JIRA_INSTALLATION_LOCK_TIMEOUT_MS = 30_000;
-export async function withJiraInstallationLock(lockKey, fn) {
+const JIRA_ADVISORY_LOCK_RETRY_DELAY_MS = 100;
+const JIRA_ADVISORY_LOCK_MAX_RETRY_DELAY_MS = 1_000;
+const JIRA_ADVISORY_LOCK_TIMEOUT_MS = 30_000;
+export function withJiraInstallationLock(lockKey, fn) {
     const advisoryKey = `jira-installation:${lockKey}`;
-    const deadline = Date.now() + JIRA_INSTALLATION_LOCK_TIMEOUT_MS;
-    let retryDelayMs = JIRA_INSTALLATION_LOCK_RETRY_DELAY_MS;
-    while(true){
-        const attempt = await withPostgresSession(async (client)=>{
+    return withJiraAdvisoryLockWait(`Jira installation lock: ${lockKey}`, ()=>withPostgresSession(async (client)=>{
             const lock = await client.query('SELECT pg_try_advisory_lock(hashtext($1)) AS acquired', [
                 advisoryKey
             ]);
@@ -29,14 +26,7 @@ export async function withJiraInstallationLock(lockKey, fn) {
                     advisoryKey
                 ]);
             }
-        });
-        if (attempt.acquired) return attempt.value;
-        if (Date.now() >= deadline) {
-            throw new Error(`Timed out waiting for Jira installation lock: ${lockKey}`);
-        }
-        await new Promise((resolve)=>setTimeout(resolve, retryDelayMs));
-        retryDelayMs = Math.min(retryDelayMs * 2, JIRA_INSTALLATION_LOCK_MAX_RETRY_DELAY_MS);
-    }
+        }));
 }
 export async function upsertJiraInstallation(params, options = {}) {
     const executor = options.tx ?? db();
@@ -53,7 +43,9 @@ export async function upsertJiraInstallation(params, options = {}) {
             webhookIds: params.webhookIds ?? [],
             webhookExpiresAt: params.webhookExpiresAt ?? null,
             status: params.status,
-            tokenExpiresAt: params.tokenExpiresAt ?? null
+            tokenExpiresAt: params.tokenExpiresAt ?? null,
+            refreshTokenLastUsedAt: params.refreshTokenLastUsedAt ?? now,
+            refreshTokenLastAttemptedAt: params.refreshTokenLastAttemptedAt ?? now
         }).onConflictDoUpdate({
             target: jiraInstallations.connectionId,
             setWhere: eq(jiraInstallations.cloudId, params.cloudId),
@@ -71,6 +63,8 @@ export async function upsertJiraInstallation(params, options = {}) {
                 },
                 status: params.status,
                 tokenExpiresAt: params.tokenExpiresAt ?? null,
+                refreshTokenLastUsedAt: params.refreshTokenLastUsedAt ?? now,
+                refreshTokenLastAttemptedAt: params.refreshTokenLastAttemptedAt ?? now,
                 updatedAt: now
             }
         }).returning();
@@ -94,15 +88,30 @@ export async function getJiraInstallationByCloudId(cloudId, options = {}) {
 }
 export async function updateJiraInstallationTokenExpiry(params, options = {}) {
     const executor = options.tx ?? db();
+    const now = new Date();
     const [row] = await executor.update(jiraInstallations).set({
         tokenExpiresAt: params.tokenExpiresAt,
+        refreshTokenLastUsedAt: now,
+        refreshTokenLastAttemptedAt: now,
         ...params.scopes === undefined ? {} : {
             scopes: params.scopes
         },
-        updatedAt: new Date()
+        updatedAt: now
     }).where(eq(jiraInstallations.connectionId, params.connectionId)).returning();
     return row ? toJiraInstallation(row) : undefined;
 }
+export async function markJiraInstallationTokenRefreshAttempt(connectionId, options = {}) {
+    const executor = options.tx ?? db();
+    const [row] = await executor.update(jiraInstallations).set({
+        refreshTokenLastAttemptedAt: new Date()
+    }).where(eq(jiraInstallations.connectionId, connectionId)).returning();
+    return row ? toJiraInstallation(row) : undefined;
+}
+export async function listJiraInstallationsDueForTokenRefresh(params, options = {}) {
+    const executor = options.tx ?? db();
+    const rows = await executor.select().from(jiraInstallations).where(and(eq(jiraInstallations.status, 'installed'), lte(jiraInstallations.refreshTokenLastUsedAt, params.before))).orderBy(asc(jiraInstallations.refreshTokenLastAttemptedAt)).limit(params.limit ?? 100);
+    return rows.map(toJiraInstallation);
+}
 export async function updateJiraInstallationWebhook(params, options = {}) {
     const executor = options.tx ?? db();
     const [row] = await executor.update(jiraInstallations).set({
@@ -120,6 +129,9 @@ export async function deleteJiraInstallationByConnectionId(connectionId, options
 export function withJiraRefreshLock(connectionId, fn) {
     return withJiraRefreshLockClient(connectionId, fn);
 }
+export function withJiraRefreshLockAndWait(connectionId, fn) {
+    return withJiraAdvisoryLockWait(`Jira refresh lock: ${connectionId}`, ()=>withJiraRefreshLock(connectionId, fn));
+}
 export function withJiraWebhookRegistrationLock(lockKey, fn) {
     return withJiraInstallationLock(lockKey, ()=>fn());
 }
@@ -148,6 +160,17 @@ async function withJiraRefreshLockClient(connectionId, fn) {
         }
     }
 }
+async function withJiraAdvisoryLockWait(lockDescription, attemptLock) {
+    const deadline = Date.now() + JIRA_ADVISORY_LOCK_TIMEOUT_MS;
+    let retryDelayMs = JIRA_ADVISORY_LOCK_RETRY_DELAY_MS;
+    while(true){
+        const attempt = await attemptLock();
+        if (attempt.acquired) return attempt.value;
+        if (Date.now() >= deadline) throw new Error(`Timed out waiting for ${lockDescription}`);
+        await new Promise((resolve)=>setTimeout(resolve, retryDelayMs));
+        retryDelayMs = Math.min(retryDelayMs * 2, JIRA_ADVISORY_LOCK_MAX_RETRY_DELAY_MS);
+    }
+}
 export async function getJiraInstallationByConnectionId(connectionId, options = {}) {
     const executor = options.tx ?? db();
     const rows = await executor.select().from(jiraInstallations).where(eq(jiraInstallations.connectionId, connectionId)).limit(1);