@shipfox/api-integration-sentry 4.0.0 → 6.0.0

package/src/core/webhook-processor.ts

@@ -0,0 +1,224 @@
+import {Buffer} from 'node:buffer';
+import {
+  decodeWebhookBody,
+  type GetIntegrationConnectionByIdFn,
+  type PublishIntegrationEventReceivedFn,
+  type RecordDeliveryOnlyFn,
+  type StoredWebhookRequest,
+  type UpdateIntegrationConnectionLifecycleStatusFn,
+  type WebhookProcessingResult,
+} from '@shipfox/api-integration-core-dto';
+import {
+  sentryInstallationWebhookSchema,
+  sentryIssueWebhookSchema,
+} from '@shipfox/api-integration-sentry-dto';
+import {logger} from '@shipfox/node-opentelemetry';
+import type {NodePgDatabase} from 'drizzle-orm/node-postgres';
+import type {SentryApiClient} from '#api/client.js';
+import {config} from '#config.js';
+import {SentryIssueDroppedError} from '#core/errors.js';
+import {
+  handleSentryInstallationCreated,
+  handleSentryInstallationDeleted,
+  handleSentryIssueEvent,
+  normalizeSentryIssueAction,
+} from '#core/webhook.js';
+import {
+  completeSentryInstallationVerification,
+  getSentryInstallationByInstallationUuid,
+} from '#db/installations.js';
+import {verifySentrySignature} from './signature.js';
+
+const DELIVERY_ID_HEADER = 'request-id';
+const RESOURCE_HEADER = 'sentry-hook-resource';
+const SIGNATURE_HEADER = 'sentry-hook-signature';
+const LEGACY_SIGNATURE_HEADER = 'sentry-app-signature';
+const ISSUE_RESOURCE = 'issue';
+const INSTALLATION_RESOURCE = 'installation';
+const SENTRY_PROVIDER = 'sentry';
+
+export interface SentryWebhookProcessor {
+  process(request: StoredWebhookRequest): Promise<WebhookProcessingResult>;
+}
+
+export interface CreateSentryWebhookProcessorOptions {
+  sentry: SentryApiClient;
+  coreDb: () => NodePgDatabase<Record<string, unknown>>;
+  publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;
+  recordDeliveryOnly: RecordDeliveryOnlyFn;
+  getIntegrationConnectionById: GetIntegrationConnectionByIdFn;
+  updateConnectionLifecycleStatus: UpdateIntegrationConnectionLifecycleStatusFn;
+}
+
+export function createSentryWebhookProcessor(
+  context: CreateSentryWebhookProcessorOptions,
+): SentryWebhookProcessor {
+  return {process: (request) => processSentryWebhookRequest(context, request)};
+}
+
+async function processSentryWebhookRequest(
+  context: CreateSentryWebhookProcessorOptions,
+  request: StoredWebhookRequest,
+): Promise<WebhookProcessingResult> {
+  if (request.route_id !== 'sentry') {
+    throw new Error(`Sentry processor cannot process ${request.route_id} requests`);
+  }
+
+  const deliveryId = request.headers[DELIVERY_ID_HEADER];
+  const resource = request.headers[RESOURCE_HEADER];
+  const signature = request.headers[SIGNATURE_HEADER] ?? request.headers[LEGACY_SIGNATURE_HEADER];
+  if (!deliveryId || !resource || !signature) {
+    return {outcome: 'discarded', reason: 'missing_required_input'};
+  }
+
+  const rawBody = Buffer.from(decodeWebhookBody(request.body));
+  if (!verifySentrySignature({rawBody, signature, secret: config.SENTRY_APP_CLIENT_SECRET})) {
+    return {outcome: 'discarded', reason: 'invalid_signature', deliveryId};
+  }
+
+  logger().debug(
+    {
+      deliveryId,
+      signatureHeader: request.headers[SIGNATURE_HEADER]
+        ? SIGNATURE_HEADER
+        : LEGACY_SIGNATURE_HEADER,
+    },
+    'sentry webhook: signature verified',
+  );
+
+  if (resource === ISSUE_RESOURCE) return processIssueResource(context, deliveryId, rawBody);
+  if (resource === INSTALLATION_RESOURCE)
+    return processInstallationResource(context, deliveryId, rawBody);
+
+  await recordDeliveryOnly(context, deliveryId);
+  return {outcome: 'discarded', reason: 'unsupported_event', deliveryId};
+}
+
+async function processIssueResource(
+  context: CreateSentryWebhookProcessorOptions,
+  deliveryId: string,
+  rawBody: Uint8Array,
+): Promise<WebhookProcessingResult> {
+  const parsed = parsePayload(
+    sentryIssueWebhookSchema,
+    rawBody,
+    deliveryId,
+    normalizeSentryIssueAction,
+  );
+  if (!parsed.success) {
+    await recordDeliveryOnly(context, deliveryId);
+    return {outcome: 'discarded', reason: parsed.reason, deliveryId};
+  }
+  const payload = parsed.data;
+
+  try {
+    await context.coreDb().transaction(async (tx) => {
+      await handleSentryIssueEvent({
+        tx,
+        deliveryId,
+        payload,
+        publishIntegrationEventReceived: context.publishIntegrationEventReceived,
+        getIntegrationConnectionById: context.getIntegrationConnectionById,
+      });
+    });
+  } catch (error) {
+    if (!(error instanceof SentryIssueDroppedError)) throw error;
+
+    logger().warn({deliveryId, err: error}, `sentry webhook: ${error.message}, dropping`);
+    await recordDeliveryOnly(context, deliveryId);
+    return {outcome: 'discarded', reason: 'connection_unavailable', deliveryId};
+  }
+
+  return {outcome: 'processed', deliveryId};
+}
+
+async function processInstallationResource(
+  context: CreateSentryWebhookProcessorOptions,
+  deliveryId: string,
+  rawBody: Uint8Array,
+): Promise<WebhookProcessingResult> {
+  const parsed = parsePayload(sentryInstallationWebhookSchema, rawBody, deliveryId);
+  if (!parsed.success) {
+    await recordDeliveryOnly(context, deliveryId);
+    return {outcome: 'discarded', reason: parsed.reason, deliveryId};
+  }
+  const payload = parsed.data;
+
+  const installation = payload.data.installation;
+  if (payload.action === 'deleted') {
+    await context.coreDb().transaction(async (tx) => {
+      await handleSentryInstallationDeleted({
+        tx,
+        deliveryId,
+        installationUuid: installation.uuid,
+        recordDeliveryOnly: context.recordDeliveryOnly,
+        updateConnectionLifecycleStatus: context.updateConnectionLifecycleStatus,
+      });
+    });
+    return {outcome: 'processed', deliveryId};
+  }
+
+  await handleSentryInstallationCreated({
+    deliveryId,
+    installationUuid: installation.uuid,
+    orgSlug: installation.organization?.slug,
+    code: installation.code,
+    sentry: context.sentry,
+    verifyInstall: config.SENTRY_APP_VERIFY_INSTALL,
+    getSentryInstallation: ({installationUuid}) =>
+      getSentryInstallationByInstallationUuid(installationUuid),
+    persistUnclaimedAndRecordDelivery: ({installationUuid, codeHash, deliveryId: id}) =>
+      context.coreDb().transaction(async (tx) => {
+        const completed = await completeSentryInstallationVerification(
+          {installationUuid, codeHash},
+          {tx},
+        );
+        await context.recordDeliveryOnly({tx, provider: SENTRY_PROVIDER, deliveryId: id});
+        if (completed) return completed;
+
+        const current = await getSentryInstallationByInstallationUuid(installationUuid, {tx});
+        if (!current) throw new Error('Sentry installation verification lost its claim');
+        return current;
+      }),
+    recordDelivery: (id) => recordDeliveryOnly(context, id),
+  });
+
+  return {outcome: 'processed', deliveryId};
+}
+
+type ParsePayloadResult<T> =
+  | {success: true; data: T}
+  | {success: false; reason: 'malformed_payload' | 'unsupported_event'};
+
+function parsePayload<T>(
+  schema: {safeParse(value: unknown): {success: true; data: T} | {success: false; error: unknown}},
+  rawBody: Uint8Array,
+  deliveryId: string,
+  normalize: (payload: unknown) => unknown = (payload) => payload,
+): ParsePayloadResult<T> {
+  let parsedJson: unknown;
+  try {
+    parsedJson = JSON.parse(Buffer.from(rawBody).toString('utf8'));
+  } catch (error) {
+    logger().warn({deliveryId, err: error}, 'sentry webhook: payload JSON parse failed, dropping');
+    return {success: false, reason: 'malformed_payload'};
+  }
+
+  const payload = schema.safeParse(normalize(parsedJson));
+  if (payload.success) return {success: true, data: payload.data};
+
+  logger().warn(
+    {deliveryId, issues: payload.error},
+    'sentry webhook: payload failed validation, dropping',
+  );
+  return {success: false, reason: 'unsupported_event'};
+}
+
+async function recordDeliveryOnly(
+  context: CreateSentryWebhookProcessorOptions,
+  deliveryId: string,
+): Promise<void> {
+  await context.coreDb().transaction(async (tx) => {
+    await context.recordDeliveryOnly({tx, provider: SENTRY_PROVIDER, deliveryId});
+  });
+}

package/src/core/webhook.ts

@@ -16,10 +16,12 @@ import {
   SentryInstallationUnclaimedError,
   SentryIntegrationProviderError,
 } from '#core/errors.js';
-import {verifyAndPersistUnclaimedInstallation} from '#core/install.js';
+import {hashAuthorizationCode, verifySentryInstallationBestEffort} from '#core/install.js';
 import {
+  claimSentryInstallationVerification,
   getSentryInstallationByInstallationUuid,
   markSentryInstallationDeleted,
+  markSentryInstallationExchangeSucceeded,
   type SentryInstallation,
 } from '#db/installations.js';
 
@@ -101,24 +103,24 @@ export interface HandleSentryInstallationCreatedParams {
     codeHash: string;
     deliveryId: string;
   }) => Promise<SentryInstallation>;
-  // Records the delivery for dedup without persisting an install (reconcile/no-op,
-  // missing code, or exchange failure → record-and-drop).
+  // Records the delivery for dedup without persisting an install (reconcile/no-op
+  // or missing claim input).
   recordDelivery: (deliveryId: string) => Promise<void>;
 }
 
 /**
  * The authoritative `installation.created` path. Whichever of webhook or browser
  * arrives first exchanges the single-use code and persists a verified-unclaimed
- * row; the other reconciles. Idempotent on the installation uuid. The exchange
- * runs outside any DB transaction; a short transaction wraps only persist +
- * delivery record. On an exchange failure the delivery is record-and-dropped
- * (204) — the browser may still win, or the code expired. Never logs the raw code.
+ * row; the other reconciles. The webhook writes a pending claim before the
+ * exchange and a durable checkpoint after it succeeds. Only that checkpoint can
+ * bypass the single-use exchange on retry. The installed transition and delivery
+ * record commit in one transaction. Never logs the raw code.
  */
 export async function handleSentryInstallationCreated(
   params: HandleSentryInstallationCreatedParams,
 ): Promise<void> {
   const existing = await params.getSentryInstallation({installationUuid: params.installationUuid});
-  if (existing) {
+  if (existing && (existing.status === 'installed' || existing.status === 'deleted')) {
     logger().debug(
       {deliveryId: params.deliveryId, installationUuid: params.installationUuid},
       'sentry webhook: installation.created for an existing row, reconciling',
@@ -127,58 +129,78 @@ export async function handleSentryInstallationCreated(
     return;
   }
 
-  if (!params.code) {
+  if (!params.code || !params.orgSlug) {
     logger().warn(
       {deliveryId: params.deliveryId, installationUuid: params.installationUuid},
-      'sentry webhook: installation.created without an authorization code, dropping',
+      'sentry webhook: installation.created without claim input, dropping',
     );
     await params.recordDelivery(params.deliveryId);
     return;
   }
 
-  try {
-    await verifyAndPersistUnclaimedInstallation({
-      sentry: params.sentry,
+  const codeHash = hashAuthorizationCode(params.code);
+  let claimed =
+    existing ??
+    (await claimSentryInstallationVerification({
       installationUuid: params.installationUuid,
-      code: params.code,
       orgSlug: params.orgSlug,
-      verifyInstall: params.verifyInstall,
-      persistVerifiedUnclaimedInstallation: ({installationUuid, orgSlug, codeHash}) =>
-        params.persistUnclaimedAndRecordDelivery({
-          installationUuid,
-          orgSlug,
-          codeHash,
-          deliveryId: params.deliveryId,
-        }),
-    });
-  } catch (error) {
-    if (error instanceof SentryIntegrationProviderError) {
-      // The Sentry exchange (or org-slug lookup) failed, so we never durably
-      // spent the code on a row we own. `reason` distinguishes a transient/expected
-      // drop (access-denied: the code was already spent, e.g. the browser won) from
-      // a likely misconfiguration (a bad client id/secret/slug fails every install)
-      // so log-based alerting can fire on the sustained case. Never logs the raw code.
-      logger().warn(
-        {
-          deliveryId: params.deliveryId,
-          installationUuid: params.installationUuid,
-          reason: error.reason,
-          err: error,
-        },
-        'sentry webhook: installation.created exchange failed, dropping',
-      );
-    } else {
-      // The exchange succeeded (the single-use code is now spent) but the persist
-      // transaction failed, so no row exists and Sentry will not usefully
-      // re-deliver — the install is stranded until a reinstall mints a fresh uuid.
-      // Log at error so alerting catches it; still record-and-drop because retrying
-      // a spent code cannot recover the row. Never logs the raw code.
-      logger().error(
-        {deliveryId: params.deliveryId, installationUuid: params.installationUuid, err: error},
-        'sentry webhook: installation.created persisted nothing after a successful exchange, install stranded until reinstall',
-      );
-    }
+      codeHash,
+    }));
+  if (claimed.status === 'installed' || claimed.status === 'deleted') {
+    await params.recordDelivery(params.deliveryId);
+    return;
+  }
+  if (claimed.codeHash !== codeHash) {
+    logger().warn(
+      {deliveryId: params.deliveryId, installationUuid: params.installationUuid},
+      'sentry webhook: installation.created does not match the pending claim, dropping',
+    );
     await params.recordDelivery(params.deliveryId);
+    return;
+  }
+
+  let authorization: Awaited<ReturnType<SentryApiClient['exchangeAuthorizationCode']>> | undefined;
+  if (claimed.status === 'pending') {
+    try {
+      authorization = await params.sentry.exchangeAuthorizationCode({
+        installationUuid: params.installationUuid,
+        code: params.code,
+      });
+    } catch (error) {
+      if (!(error instanceof SentryIntegrationProviderError) || error.reason !== 'access-denied') {
+        throw error;
+      }
+
+      const current = await params.getSentryInstallation({
+        installationUuid: params.installationUuid,
+      });
+      const concurrentAttemptSucceeded =
+        current?.codeHash === codeHash &&
+        (current.status === 'exchange-succeeded' || current.status === 'installed');
+      if (!current || !concurrentAttemptSucceeded) throw error;
+      claimed = current;
+    }
+
+    if (authorization) {
+      await markSentryInstallationExchangeSucceeded({
+        installationUuid: params.installationUuid,
+        codeHash,
+      });
+    }
+  }
+
+  const completed = await params.persistUnclaimedAndRecordDelivery({
+    installationUuid: params.installationUuid,
+    orgSlug: claimed.orgSlug,
+    codeHash,
+    deliveryId: params.deliveryId,
+  });
+  if (authorization && completed.status === 'installed' && params.verifyInstall) {
+    await verifySentryInstallationBestEffort({
+      sentry: params.sentry,
+      installationUuid: params.installationUuid,
+      token: authorization.token,
+    });
   }
 }
 
@@ -191,9 +213,8 @@ export interface HandleSentryInstallationDeletedParams {
 }
 
 // Tombstones the install and disables its connection if one exists. An unknown
-// uuid (never installed, or reinstall mints a fresh uuid) only records the
-// delivery: there is no tombstone row to write. Runs entirely in the caller's
-// transaction — no exchange is needed.
+// uuid also gets a tombstone, so a reordered creation cannot restore it. The
+// state change and delivery record share the caller's transaction.
 export async function handleSentryInstallationDeleted(
   params: HandleSentryInstallationDeletedParams,
 ): Promise<void> {

package/src/db/installations.test.ts

@@ -1,10 +1,14 @@
 import {randomUUID} from 'node:crypto';
+import {eq} from 'drizzle-orm';
 import {SentryInstallationAlreadyLinkedError} from '#core/errors.js';
 import {db} from './db.js';
 import {
+  claimSentryInstallationVerification,
+  completeSentryInstallationVerification,
   getSentryInstallationByInstallationUuid,
   listUnclaimedSentryInstallations,
   markSentryInstallationDeleted,
+  markSentryInstallationExchangeSucceeded,
   persistVerifiedUnclaimedInstallation,
   pruneUnclaimedSentryInstallations,
   upsertSentryInstallation,
@@ -99,10 +103,29 @@ describe('sentry installations persistence', () => {
     expect(deleted?.connectionId).toBe(connectionId);
   });
 
-  test('markSentryInstallationDeleted returns undefined when no row matches', async () => {
+  test('markSentryInstallationDeleted creates a tombstone when no row matches', async () => {
     const result = await markSentryInstallationDeleted({installationUuid: 'never-installed'});
 
-    expect(result).toBeUndefined();
+    expect(result.status).toBe('deleted');
+    expect(result.connectionId).toBeNull();
+    expect(result.orgSlug).toBe('');
+  });
+
+  test('upsert never restores a deleted tombstone', async () => {
+    const installationUuid = randomUUID();
+    await markSentryInstallationDeleted({installationUuid});
+
+    const reconnect = upsertSentryInstallation({
+      connectionId: randomUUID(),
+      installationUuid,
+      orgSlug: 'acme',
+      status: 'installed',
+    });
+
+    await expect(reconnect).rejects.toBeInstanceOf(SentryInstallationAlreadyLinkedError);
+    expect((await getSentryInstallationByInstallationUuid(installationUuid))?.status).toBe(
+      'deleted',
+    );
   });
 
   test('getSentryInstallationByInstallationUuid returns undefined for a miss', async () => {
@@ -125,6 +148,57 @@ describe('sentry installations persistence', () => {
     expect(persisted.codeHash).toBe('hash-1');
   });
 
+  test('claimSentryInstallationVerification preserves the first pending code', async () => {
+    const installationUuid = randomUUID();
+    const first = await claimSentryInstallationVerification({
+      installationUuid,
+      orgSlug: 'acme',
+      codeHash: 'hash-1',
+    });
+
+    const second = await claimSentryInstallationVerification({
+      installationUuid,
+      orgSlug: 'other',
+      codeHash: 'hash-2',
+    });
+
+    expect(first.status).toBe('pending');
+    expect(second.status).toBe('pending');
+    expect(second.orgSlug).toBe('acme');
+    expect(second.codeHash).toBe('hash-1');
+  });
+
+  test('verification advances only from a matching pending claim through the exchange checkpoint', async () => {
+    const installationUuid = randomUUID();
+    await claimSentryInstallationVerification({
+      installationUuid,
+      orgSlug: 'acme',
+      codeHash: 'hash-1',
+    });
+
+    const prematureCompletion = await completeSentryInstallationVerification({
+      installationUuid,
+      codeHash: 'hash-1',
+    });
+    const mismatch = await markSentryInstallationExchangeSucceeded({
+      installationUuid,
+      codeHash: 'hash-2',
+    });
+    const exchanged = await markSentryInstallationExchangeSucceeded({
+      installationUuid,
+      codeHash: 'hash-1',
+    });
+    const completed = await completeSentryInstallationVerification({
+      installationUuid,
+      codeHash: 'hash-1',
+    });
+
+    expect(prematureCompletion).toBeUndefined();
+    expect(mismatch).toBeUndefined();
+    expect(exchanged?.status).toBe('exchange-succeeded');
+    expect(completed?.status).toBe('installed');
+  });
+
   test('persistVerifiedUnclaimedInstallation never clobbers a claimed connection or downgrades status', async () => {
     const installationUuid = randomUUID();
     const connectionId = randomUUID();
@@ -149,24 +223,42 @@ describe('sentry installations persistence', () => {
     expect(reconciled.codeHash).toBe('webhook-hash');
   });
 
-  test('listUnclaimedSentryInstallations returns only rows with no connection', async () => {
+  test('listUnclaimedSentryInstallations returns every non-deleted row with no connection', async () => {
     const claimedUuid = randomUUID();
-    const unclaimedUuid = randomUUID();
+    const pendingUuid = randomUUID();
+    const exchangedUuid = randomUUID();
+    const installedUuid = randomUUID();
     await upsertSentryInstallation({
       connectionId: randomUUID(),
       installationUuid: claimedUuid,
       orgSlug: 'acme',
       status: 'installed',
     });
+    await claimSentryInstallationVerification({
+      installationUuid: pendingUuid,
+      orgSlug: 'acme',
+      codeHash: 'pending-hash',
+    });
+    await claimSentryInstallationVerification({
+      installationUuid: exchangedUuid,
+      orgSlug: 'acme',
+      codeHash: 'exchanged-hash',
+    });
+    await markSentryInstallationExchangeSucceeded({
+      installationUuid: exchangedUuid,
+      codeHash: 'exchanged-hash',
+    });
     await persistVerifiedUnclaimedInstallation({
-      installationUuid: unclaimedUuid,
+      installationUuid: installedUuid,
       orgSlug: 'acme',
       codeHash: 'hash',
     });
 
     const unclaimed = await listUnclaimedSentryInstallations();
 
-    expect(unclaimed.map((row) => row.installationUuid)).toEqual([unclaimedUuid]);
+    expect(unclaimed.map((row) => row.installationUuid).sort()).toEqual(
+      [pendingUuid, exchangedUuid, installedUuid].sort(),
+    );
   });
 
   test('listUnclaimedSentryInstallations filters by age when olderThan is given', async () => {
@@ -184,27 +276,81 @@ describe('sentry installations persistence', () => {
     expect(await listUnclaimedSentryInstallations({olderThan: past})).toHaveLength(0);
   });
 
-  test('pruneUnclaimedSentryInstallations tombstones stale unclaimed rows and leaves fresh ones', async () => {
-    const staleUuid = randomUUID();
-    await persistVerifiedUnclaimedInstallation({
-      installationUuid: staleUuid,
+  test('pruneUnclaimedSentryInstallations releases stale pending claims', async () => {
+    const installationUuid = randomUUID();
+    await claimSentryInstallationVerification({
+      installationUuid,
       orgSlug: 'acme',
-      codeHash: 'hash',
+      codeHash: 'stale-hash',
     });
 
-    const youngResult = await pruneUnclaimedSentryInstallations({
-      olderThan: new Date(Date.now() - 60_000),
+    const result = await pruneUnclaimedSentryInstallations({
+      olderThan: new Date(Date.now() + 60_000),
+    });
+    const reclaimed = await claimSentryInstallationVerification({
+      installationUuid,
+      orgSlug: 'acme',
+      codeHash: 'fresh-hash',
     });
-    expect(youngResult.tombstoned).toBe(0);
 
-    const staleResult = await pruneUnclaimedSentryInstallations({
+    expect(result).toEqual({releasedPending: 1, tombstoned: 0});
+    expect(reclaimed.status).toBe('pending');
+    expect(reclaimed.codeHash).toBe('fresh-hash');
+  });
+
+  test('pruneUnclaimedSentryInstallations tombstones stale exchanged and installed rows', async () => {
+    const exchangedUuid = randomUUID();
+    const installedUuid = randomUUID();
+    await claimSentryInstallationVerification({
+      installationUuid: exchangedUuid,
+      orgSlug: 'acme',
+      codeHash: 'exchanged-hash',
+    });
+    await markSentryInstallationExchangeSucceeded({
+      installationUuid: exchangedUuid,
+      codeHash: 'exchanged-hash',
+    });
+    await persistVerifiedUnclaimedInstallation({
+      installationUuid: installedUuid,
+      orgSlug: 'acme',
+      codeHash: 'hash',
+    });
+
+    const result = await pruneUnclaimedSentryInstallations({
       olderThan: new Date(Date.now() + 60_000),
     });
-    expect(staleResult.tombstoned).toBe(1);
-    expect((await getSentryInstallationByInstallationUuid(staleUuid))?.status).toBe('deleted');
+
+    expect(result).toEqual({releasedPending: 0, tombstoned: 2});
+    expect((await getSentryInstallationByInstallationUuid(exchangedUuid))?.status).toBe('deleted');
+    expect((await getSentryInstallationByInstallationUuid(installedUuid))?.status).toBe('deleted');
     expect(await listUnclaimedSentryInstallations()).toHaveLength(0);
   });
 
+  test('completing an old claim starts a fresh installed retention window', async () => {
+    const installationUuid = randomUUID();
+    const oldTimestamp = new Date(Date.now() - 120_000);
+    await claimSentryInstallationVerification({
+      installationUuid,
+      orgSlug: 'acme',
+      codeHash: 'hash',
+    });
+    await db()
+      .update(sentryInstallations)
+      .set({createdAt: oldTimestamp, updatedAt: oldTimestamp})
+      .where(eq(sentryInstallations.installationUuid, installationUuid));
+    await markSentryInstallationExchangeSucceeded({installationUuid, codeHash: 'hash'});
+    await completeSentryInstallationVerification({installationUuid, codeHash: 'hash'});
+
+    const result = await pruneUnclaimedSentryInstallations({
+      olderThan: new Date(Date.now() - 60_000),
+    });
+
+    expect(result).toEqual({releasedPending: 0, tombstoned: 0});
+    expect((await getSentryInstallationByInstallationUuid(installationUuid))?.status).toBe(
+      'installed',
+    );
+  });
+
   test('pruneUnclaimedSentryInstallations never tombstones a claimed install', async () => {
     const claimedUuid = randomUUID();
     await upsertSentryInstallation({