@shipfox/api-integration-jira 4.0.0 → 6.0.0

package/drizzle/0000_whole_master_chief.sql

@@ -15,4 +15,11 @@ CREATE TABLE "integrations_jira_installations" (
 );
 --> statement-breakpoint
 CREATE UNIQUE INDEX "integrations_jira_installations_connection_unique" ON "integrations_jira_installations" USING btree ("connection_id");--> statement-breakpoint
-CREATE INDEX "integrations_jira_installations_cloud_id_idx" ON "integrations_jira_installations" USING btree ("cloud_id");
+CREATE UNIQUE INDEX "integrations_jira_installations_cloud_id_unique" ON "integrations_jira_installations" USING btree ("cloud_id");--> statement-breakpoint
+CREATE TABLE "integrations_jira_pending_selections" (
+	"state_hash" text PRIMARY KEY NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL,
+	"sites" jsonb NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);

package/drizzle/meta/0000_snapshot.json

@@ -107,8 +107,8 @@
           "method": "btree",
           "with": {}
         },
-        "integrations_jira_installations_cloud_id_idx": {
-          "name": "integrations_jira_installations_cloud_id_idx",
+        "integrations_jira_installations_cloud_id_unique": {
+          "name": "integrations_jira_installations_cloud_id_unique",
           "columns": [
             {
               "expression": "cloud_id",
@@ -117,7 +117,7 @@
               "nulls": "last"
             }
           ],
-          "isUnique": false,
+          "isUnique": true,
           "concurrently": false,
           "method": "btree",
           "with": {}
@@ -129,6 +129,50 @@
       "policies": {},
       "checkConstraints": {},
       "isRLSEnabled": false
+    },
+    "public.integrations_jira_pending_selections": {
+      "name": "integrations_jira_pending_selections",
+      "schema": "",
+      "columns": {
+        "state_hash": {
+          "name": "state_hash",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "workspace_id": {
+          "name": "workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sites": {
+          "name": "sites",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
     }
   },
   "enums": {},

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-integration-jira",
   "license": "MIT",
-  "version": "4.0.0",
+  "version": "6.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -13,48 +13,44 @@
   "types": "dist/index.d.ts",
   "imports": {
     "#test/*": "./test/*",
-    "#*": {
-      "workspace-source": "./src/*",
-      "development": "./src/*",
-      "default": "./dist/*"
-    }
+    "#*": "./dist/*"
   },
   "exports": {
     ".": {
-      "development": {
-        "types": "./src/index.ts",
-        "default": "./src/index.ts"
-      },
-      "default": {
-        "types": "./dist/index.d.ts",
-        "default": "./dist/index.js"
-      }
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
     }
   },
   "dependencies": {
     "drizzle-orm": "^0.45.2",
-    "@shipfox/api-integration-jira-dto": "4.0.0",
-    "@shipfox/node-drizzle": "0.3.0",
-    "@shipfox/config": "1.2.1",
-    "@shipfox/node-postgres": "0.4.1"
-  },
-  "peerDependencies": {
-    "@shipfox/api-secrets": "4.0.0"
+    "ky": "^2.0.0",
+    "@shipfox/api-integration-core-dto": "6.0.0",
+    "@shipfox/api-integration-jira-dto": "6.0.0",
+    "@shipfox/api-workspaces": "6.0.0",
+    "@shipfox/config": "1.2.2",
+    "@shipfox/node-drizzle": "0.3.2",
+    "@shipfox/node-fastify": "0.2.4",
+    "@shipfox/node-opentelemetry": "0.5.2",
+    "@shipfox/node-postgres": "0.4.2",
+    "@shipfox/api-auth-context": "6.0.0"
   },
   "devDependencies": {
     "@types/pg": "^8.15.5",
     "drizzle-kit": "^0.31.10",
+    "fastify": "^5.3.3",
     "fishery": "^2.4.0",
-    "@shipfox/swc": "1.2.5",
-    "@shipfox/biome": "1.8.1",
-    "@shipfox/typescript": "1.1.6",
-    "@shipfox/vitest": "1.2.2",
-    "@shipfox/ts-config": "1.3.8"
+    "@shipfox/biome": "1.8.2",
+    "@shipfox/depcruise": "1.0.2",
+    "@shipfox/swc": "1.2.6",
+    "@shipfox/ts-config": "1.3.8",
+    "@shipfox/typescript": "1.1.7",
+    "@shipfox/vitest": "1.2.3"
   },
   "scripts": {
     "build": "shipfox-swc",
     "check": "shipfox-biome-check",
     "check:fix": "shipfox-biome-check --write",
+    "depcruise": "shipfox-depcruise",
     "test": "shipfox-vitest-run",
     "test:watch": "shipfox-vitest-watch",
     "type": "shipfox-tsc-check",

package/src/api/client.test.ts

@@ -0,0 +1,29 @@
+import {HTTPError} from 'ky';
+import type {JiraIntegrationProviderError} from '#core/errors.js';
+import {mapJiraError} from './client.js';
+
+function rejectedRequest(status: number): () => Promise<never> {
+  return () =>
+    Promise.reject(
+      new HTTPError(
+        new Response(null, {status}),
+        new Request('https://jira.example.test'),
+        {} as never,
+      ),
+    );
+}
+
+describe('mapJiraError', () => {
+  it.each([
+    [401, 'access-denied'],
+    [403, 'access-denied'],
+    [400, 'malformed-provider-response'],
+    [404, 'malformed-provider-response'],
+  ] as const)('maps HTTP %i to %s', async (status, reason) => {
+    const result = mapJiraError('test', rejectedRequest(status));
+
+    await expect(result).rejects.toMatchObject({
+      reason,
+    } satisfies Partial<JiraIntegrationProviderError>);
+  });
+});

package/src/api/client.ts

@@ -0,0 +1,213 @@
+import {logger} from '@shipfox/node-opentelemetry';
+import ky, {HTTPError, TimeoutError} from 'ky';
+import {config} from '#config.js';
+import {JiraIntegrationProviderError} from '#core/errors.js';
+
+const JIRA_API_TIMEOUT_MS = 10_000;
+const SCOPE_SEPARATOR_RE = /[,\s]+/;
+
+export interface JiraAuthorization {
+  accessToken: string;
+  refreshToken?: string | undefined;
+  expiresAt?: Date | undefined;
+  scopes: string[];
+}
+
+export interface JiraAccessibleResource {
+  cloudId: string;
+  name: string;
+  url: string;
+  scopes: string[];
+}
+
+export interface JiraIdentity {
+  accountId: string;
+}
+
+export interface JiraApiClient {
+  exchangeAuthorizationCode(input: {code: string}): Promise<JiraAuthorization>;
+  refreshAccessToken(input: {refreshToken: string}): Promise<JiraAuthorization>;
+  getAccessibleResources(input: {accessToken: string}): Promise<JiraAccessibleResource[]>;
+  getMyself(input: {accessToken: string; cloudId: string}): Promise<JiraIdentity>;
+}
+
+interface JiraTokenResponse {
+  access_token?: unknown;
+  refresh_token?: unknown;
+  expires_in?: unknown;
+  scope?: unknown;
+}
+
+interface JiraResourceResponse {
+  id?: unknown;
+  name?: unknown;
+  url?: unknown;
+  scopes?: unknown;
+}
+
+interface JiraMyselfResponse {
+  accountId?: unknown;
+}
+
+export function createJiraApiClient(): JiraApiClient {
+  return {
+    async exchangeAuthorizationCode(input) {
+      const body = await mapJiraError('exchange-authorization-code', () =>
+        ky
+          .post(`${config.JIRA_AUTH_BASE_URL}/oauth/token`, {
+            body: new URLSearchParams({
+              grant_type: 'authorization_code',
+              client_id: config.JIRA_OAUTH_CLIENT_ID,
+              client_secret: config.JIRA_OAUTH_CLIENT_SECRET,
+              code: input.code,
+              redirect_uri: config.JIRA_OAUTH_REDIRECT_URL,
+            }),
+            timeout: JIRA_API_TIMEOUT_MS,
+          })
+          .json<JiraTokenResponse>(),
+      );
+      return parseAuthorization(body);
+    },
+
+    async refreshAccessToken(input) {
+      const body = await mapJiraError('refresh-access-token', () =>
+        ky
+          .post(`${config.JIRA_AUTH_BASE_URL}/oauth/token`, {
+            body: new URLSearchParams({
+              grant_type: 'refresh_token',
+              client_id: config.JIRA_OAUTH_CLIENT_ID,
+              client_secret: config.JIRA_OAUTH_CLIENT_SECRET,
+              refresh_token: input.refreshToken,
+            }),
+            timeout: JIRA_API_TIMEOUT_MS,
+          })
+          .json<JiraTokenResponse>(),
+      );
+      return parseAuthorization(body);
+    },
+
+    async getAccessibleResources(input) {
+      const body = await mapJiraError('get-accessible-resources', () =>
+        ky
+          .get(`${config.JIRA_API_BASE_URL}/oauth/token/accessible-resources`, {
+            headers: {authorization: `Bearer ${input.accessToken}`},
+            timeout: JIRA_API_TIMEOUT_MS,
+          })
+          .json<unknown>(),
+      );
+      if (!Array.isArray(body)) {
+        throw malformed('Jira accessible-resources response was not an array');
+      }
+      return body.map(parseAccessibleResource);
+    },
+
+    async getMyself(input) {
+      const body = await mapJiraError('get-myself', () =>
+        ky
+          .get(`${config.JIRA_API_BASE_URL}/ex/jira/${input.cloudId}/rest/api/3/myself`, {
+            headers: {authorization: `Bearer ${input.accessToken}`},
+            timeout: JIRA_API_TIMEOUT_MS,
+          })
+          .json<JiraMyselfResponse>(),
+      );
+      if (typeof body.accountId !== 'string' || body.accountId.length === 0) {
+        throw malformed('Jira identity response did not include an accountId');
+      }
+      return {accountId: body.accountId};
+    },
+  };
+}
+
+function parseAuthorization(body: JiraTokenResponse): JiraAuthorization {
+  if (typeof body.access_token !== 'string' || body.access_token.length === 0) {
+    throw malformed('Jira authorization response did not include an access token');
+  }
+  return {
+    accessToken: body.access_token,
+    refreshToken: typeof body.refresh_token === 'string' ? body.refresh_token : undefined,
+    expiresAt: parseExpiresAt(body.expires_in),
+    scopes: parseScopes(body.scope),
+  };
+}
+
+function parseAccessibleResource(value: unknown): JiraAccessibleResource {
+  if (!value || typeof value !== 'object') throw malformed('Jira site response was malformed');
+  const {id, name, url, scopes} = value as JiraResourceResponse;
+  if (
+    typeof id !== 'string' ||
+    id.length === 0 ||
+    typeof name !== 'string' ||
+    name.length === 0 ||
+    typeof url !== 'string' ||
+    url.length === 0 ||
+    !Array.isArray(scopes) ||
+    !scopes.every((scope) => typeof scope === 'string')
+  ) {
+    throw malformed('Jira site response did not include a valid cloud id, name, URL, and scopes');
+  }
+  return {cloudId: id, name, url, scopes};
+}
+
+function parseScopes(scope: unknown): string[] {
+  if (typeof scope === 'string')
+    return scope
+      .split(SCOPE_SEPARATOR_RE)
+      .map((value) => value.trim())
+      .filter(Boolean);
+  if (Array.isArray(scope) && scope.every((value) => typeof value === 'string')) return scope;
+  if (scope === undefined) return [];
+  throw malformed('Jira authorization response included malformed scopes');
+}
+
+function parseExpiresAt(expiresIn: unknown): Date | undefined {
+  if (expiresIn === undefined) return undefined;
+  if (typeof expiresIn !== 'number' || !Number.isFinite(expiresIn) || expiresIn <= 0) {
+    throw malformed('Jira authorization response included a malformed expiry');
+  }
+  return new Date(Date.now() + expiresIn * 1000);
+}
+
+export async function mapJiraError<T>(operation: string, request: () => Promise<T>): Promise<T> {
+  try {
+    return await request();
+  } catch (error) {
+    if (error instanceof JiraIntegrationProviderError) throw error;
+    if (error instanceof HTTPError) {
+      const {status, statusText, headers} = error.response;
+      logger().warn({operation, status, statusText}, 'Jira API request rejected');
+      if (status === 429) {
+        throw new JiraIntegrationProviderError(
+          'rate-limited',
+          'Jira request was rate limited',
+          retryAfterSeconds(headers),
+        );
+      }
+      if (status >= 500)
+        throw new JiraIntegrationProviderError('provider-unavailable', 'Jira request failed');
+      if (status === 401 || status === 403) {
+        throw new JiraIntegrationProviderError('access-denied', 'Jira request was rejected');
+      }
+      throw malformed('Jira request was rejected');
+    }
+    if (error instanceof TimeoutError) {
+      logger().warn({operation}, 'Jira API request timed out');
+      throw new JiraIntegrationProviderError('timeout', 'Jira request timed out');
+    }
+    logger().warn(
+      {operation, errName: error instanceof Error ? error.name : typeof error},
+      'Jira API request failed',
+    );
+    throw new JiraIntegrationProviderError('provider-unavailable', 'Jira request failed');
+  }
+}
+
+function malformed(message: string): JiraIntegrationProviderError {
+  return new JiraIntegrationProviderError('malformed-provider-response', message);
+}
+
+function retryAfterSeconds(headers: Headers): number | undefined {
+  const value = headers.get('retry-after');
+  if (!value) return undefined;
+  const parsed = Number.parseInt(value, 10);
+  return Number.isNaN(parsed) ? undefined : parsed;
+}

package/src/core/disconnect.test.ts

@@ -0,0 +1,24 @@
+vi.mock('#db/installations.js', () => ({
+  deleteJiraInstallationByConnectionId: vi.fn().mockResolvedValue(true),
+}));
+
+import {disconnectJiraInstallation} from './disconnect.js';
+
+describe('disconnectJiraInstallation', () => {
+  it('deletes secrets, installation, and connection when the connection exists', async () => {
+    const deleteSecrets = vi.fn().mockResolvedValue(1);
+    const deleteConnection = vi.fn().mockResolvedValue(true);
+    const transaction = vi.fn(async (fn) => await fn({}));
+
+    await disconnectJiraInstallation({
+      connectionId: crypto.randomUUID(),
+      getConnection: vi.fn().mockResolvedValue({workspaceId: crypto.randomUUID()}),
+      deleteSecrets,
+      transaction,
+      deleteConnection,
+    });
+
+    expect(deleteSecrets).toHaveBeenCalledOnce();
+    expect(deleteConnection).toHaveBeenCalledOnce();
+  });
+});

package/src/core/disconnect.ts

@@ -0,0 +1,25 @@
+import {deleteJiraInstallationByConnectionId} from '#db/installations.js';
+import {jiraSecretsNamespace} from './tokens.js';
+
+export interface DisconnectJiraInstallationParams<Tx = unknown> {
+  connectionId: string;
+  getConnection(connectionId: string): Promise<{workspaceId: string} | undefined>;
+  deleteSecrets(params: {workspaceId: string; namespace: string}): Promise<number>;
+  transaction<T>(fn: (tx: Tx) => Promise<T>): Promise<T>;
+  deleteConnection(params: {connectionId: string}, options: {tx: Tx}): Promise<boolean>;
+}
+
+export async function disconnectJiraInstallation<Tx = unknown>(
+  params: DisconnectJiraInstallationParams<Tx>,
+): Promise<void> {
+  const connection = await params.getConnection(params.connectionId);
+  if (connection)
+    await params.deleteSecrets({
+      workspaceId: connection.workspaceId,
+      namespace: jiraSecretsNamespace(params.connectionId),
+    });
+  await params.transaction(async (tx) => {
+    await deleteJiraInstallationByConnectionId(params.connectionId, {tx});
+    await params.deleteConnection({connectionId: params.connectionId}, {tx});
+  });
+}

package/src/core/errors.ts

@@ -1,3 +1,5 @@
+import {IntegrationProviderError} from '@shipfox/api-integration-core-dto';
+
 export class JiraConnectionNotFoundError extends Error {
   constructor(connectionId: string) {
     super(`Jira integration connection was not found: ${connectionId}`);
@@ -20,3 +22,80 @@ export class JiraInstallationSiteMismatchError extends Error {
     this.name = 'JiraInstallationSiteMismatchError';
   }
 }
+
+export class JiraIntegrationProviderError extends IntegrationProviderError {}
+
+export class JiraInstallStateError extends Error {
+  constructor(message = 'Invalid Jira install state') {
+    super(message);
+    this.name = 'JiraInstallStateError';
+  }
+}
+
+export class JiraInstallStateActorMismatchError extends Error {
+  constructor() {
+    super('Jira install state was created by a different user');
+    this.name = 'JiraInstallStateActorMismatchError';
+  }
+}
+
+export class JiraOAuthCallbackError extends Error {
+  constructor(
+    public readonly providerError: string,
+    public readonly providerDescription: string | undefined,
+  ) {
+    super(providerDescription ?? `Jira OAuth callback failed: ${providerError}`);
+    this.name = 'JiraOAuthCallbackError';
+  }
+}
+
+export class JiraAuthorizationScopeMismatchError extends Error {
+  constructor(public readonly missingScopes: string[]) {
+    super(`Jira authorization is missing usable site scopes: ${missingScopes.join(', ')}`);
+    this.name = 'JiraAuthorizationScopeMismatchError';
+  }
+}
+
+export class JiraOfflineAccessNotGrantedError extends Error {
+  constructor() {
+    super(
+      'Jira authorization did not grant offline access; reconnect and approve the requested scopes',
+    );
+    this.name = 'JiraOfflineAccessNotGrantedError';
+  }
+}
+
+export class JiraInstallationAlreadyLinkedError extends Error {
+  constructor(cloudId: string) {
+    super(`Jira site is already linked to another Shipfox workspace: ${cloudId}`);
+    this.name = 'JiraInstallationAlreadyLinkedError';
+  }
+}
+
+export class JiraConnectionAlreadyLinkedError extends Error {
+  constructor(connectionId: string) {
+    super(`Integration connection is already linked to another Jira site: ${connectionId}`);
+    this.name = 'JiraConnectionAlreadyLinkedError';
+  }
+}
+
+export class JiraTokenUnrefreshableError extends Error {
+  constructor(public readonly connectionId: string) {
+    super(`Jira token cannot be refreshed; reconnect is required: ${connectionId}`);
+    this.name = 'JiraTokenUnrefreshableError';
+  }
+}
+
+export class JiraSiteSelectionMismatchError extends Error {
+  constructor(cloudId: string) {
+    super(`Jira site was not included in the authorized site selection: ${cloudId}`);
+    this.name = 'JiraSiteSelectionMismatchError';
+  }
+}
+
+export class JiraPendingSelectionNotFoundError extends Error {
+  constructor() {
+    super('The Jira site selection expired or has already been completed; start over');
+    this.name = 'JiraPendingSelectionNotFoundError';
+  }
+}

package/src/core/install.test.ts

@@ -0,0 +1,129 @@
+import {
+  JiraOfflineAccessNotGrantedError,
+  JiraPendingSelectionNotFoundError,
+  JiraSiteSelectionMismatchError,
+} from './errors.js';
+import {handleJiraCallback, handleJiraSiteSelection} from './install.js';
+import {signJiraInstallState} from './state.js';
+
+function createParams() {
+  const workspaceId = crypto.randomUUID();
+  const state = signJiraInstallState({workspaceId, userId: 'user-1'});
+  const jira = {
+    exchangeAuthorizationCode: vi.fn().mockResolvedValue({
+      accessToken: 'access',
+      refreshToken: 'refresh',
+      expiresAt: new Date(),
+      scopes: [],
+    }),
+    getAccessibleResources: vi.fn(),
+    getMyself: vi.fn().mockResolvedValue({accountId: 'account-1'}),
+    refreshAccessToken: vi.fn(),
+  };
+  const tokenStore = {storeTokens: vi.fn().mockResolvedValue(undefined)};
+  const pendingStore = {
+    save: vi.fn().mockResolvedValue(undefined),
+    load: vi.fn(),
+    clear: vi.fn().mockResolvedValue(undefined),
+  };
+  const connectJiraInstallation = vi
+    .fn()
+    .mockResolvedValue({id: 'connection-1', workspaceId, provider: 'jira'});
+  return {
+    workspaceId,
+    state,
+    jira,
+    tokenStore,
+    pendingStore,
+    connectJiraInstallation,
+    code: 'code',
+    sessionUserId: 'user-1',
+    sessionMemberships: [],
+    requireWorkspaceMembership: vi.fn().mockResolvedValue(undefined),
+    getExistingJiraConnection: vi.fn().mockResolvedValue(undefined),
+    disconnectJiraInstallation: vi.fn().mockResolvedValue(undefined),
+  };
+}
+
+describe('Jira OAuth installation', () => {
+  it('connects a single granted site and stores its tokens', async () => {
+    const params = createParams();
+    params.jira.getAccessibleResources.mockResolvedValue([
+      {
+        cloudId: 'cloud-1',
+        name: 'Acme',
+        url: 'https://acme.atlassian.net',
+        scopes: ['read:jira-work'],
+      },
+    ]);
+
+    const result = await handleJiraCallback(params);
+
+    expect(result).toMatchObject({id: 'connection-1'});
+    expect(params.connectJiraInstallation).toHaveBeenCalledWith(
+      expect.objectContaining({cloudId: 'cloud-1'}),
+    );
+    expect(params.tokenStore.storeTokens).toHaveBeenCalledWith(
+      expect.objectContaining({connectionId: 'connection-1', refreshToken: 'refresh'}),
+    );
+  });
+
+  it('stores a multi-site grant until the selected site completes', async () => {
+    const params = createParams();
+    const sites = [
+      {
+        cloudId: 'cloud-1',
+        name: 'Acme',
+        url: 'https://acme.atlassian.net',
+        scopes: ['read:jira-work'],
+      },
+      {
+        cloudId: 'cloud-2',
+        name: 'Beta',
+        url: 'https://beta.atlassian.net',
+        scopes: ['read:issue:jira'],
+      },
+    ];
+    params.jira.getAccessibleResources.mockResolvedValue(sites);
+
+    const callback = await handleJiraCallback(params);
+    params.pendingStore.load.mockResolvedValue({
+      authorization: {accessToken: 'access', refreshToken: 'refresh', scopes: []},
+      sites,
+    });
+    const completed = await handleJiraSiteSelection({...params, cloudId: 'cloud-2'});
+
+    expect(callback).toEqual({sites});
+    expect(params.pendingStore.save).toHaveBeenCalled();
+    expect(completed).toMatchObject({id: 'connection-1'});
+    expect(params.pendingStore.clear).toHaveBeenCalledWith({
+      workspaceId: params.workspaceId,
+      state: params.state,
+    });
+  });
+
+  it('rejects missing refresh tokens and invalid pending selections', async () => {
+    const missingRefresh = createParams();
+    missingRefresh.jira.exchangeAuthorizationCode.mockResolvedValue({
+      accessToken: 'access',
+      scopes: [],
+    });
+    const missingPending = createParams();
+    missingPending.pendingStore.load.mockResolvedValue(undefined);
+    const mismatchedSite = createParams();
+    mismatchedSite.pendingStore.load.mockResolvedValue({
+      authorization: {accessToken: 'access', refreshToken: 'refresh', scopes: []},
+      sites: [],
+    });
+
+    await expect(handleJiraCallback(missingRefresh)).rejects.toBeInstanceOf(
+      JiraOfflineAccessNotGrantedError,
+    );
+    await expect(
+      handleJiraSiteSelection({...missingPending, cloudId: 'cloud-1'}),
+    ).rejects.toBeInstanceOf(JiraPendingSelectionNotFoundError);
+    await expect(
+      handleJiraSiteSelection({...mismatchedSite, cloudId: 'cloud-1'}),
+    ).rejects.toBeInstanceOf(JiraSiteSelectionMismatchError);
+  });
+});