airbyte-internal-ops 0.3.0__tar.gz → 0.3.1__tar.gz

{airbyte_internal_ops-0.3.0 → airbyte_internal_ops-0.3.1}/.github/workflows/connector-regression-test.yml

@@ -86,6 +86,8 @@ on:
         required: false
       GCP_GSM_CREDENTIALS:
         required: false
+      GCP_GSM_CREDENTIALS_FOR_TESTING_TOOL:
+        required: false
 
 jobs:
   # Determine which commands to run based on inputs

{airbyte_internal_ops-0.3.0 → airbyte_internal_ops-0.3.1}/CONTRIBUTING.md

@@ -87,6 +87,39 @@ gcloud projects add-iam-policy-binding prod-ab-cloud-proj \
 
 Note: `roles/cloudsql.client` is required for the Cloud SQL Python Connector and Cloud SQL Auth Proxy to establish connections. `roles/cloudsql.instanceUser` is typically needed for IAM database authentication; it may be redundant when using username/password authentication (as this codebase does), but some environments may still require it.
 
+#### Cloud Logging Permissions
+
+For tools that query GCP Cloud Logging (e.g., `lookup_cloud_backend_error`), grant the Logs Viewer role at the project level:
+
+```bash
+# Grant Logs Viewer role (for reading log entries)
+# Note: --condition=None is required to avoid interactive prompts when the project has conditional bindings
+gcloud projects add-iam-policy-binding prod-ab-cloud-proj \
+  --member="serviceAccount:YOUR_SERVICE_ACCOUNT@prod-ab-cloud-proj.iam.gserviceaccount.com" \
+  --role="roles/logging.viewer" \
+  --condition=None
+```
+
+For tools that retrieve connection secrets with audit logging (e.g., `fetch-connection-config --with-secrets`), also grant the Logs Writer role:
+
+```bash
+# Grant Logs Writer role (for writing audit log entries when retrieving secrets)
+gcloud projects add-iam-policy-binding prod-ab-cloud-proj \
+  --member="serviceAccount:YOUR_SERVICE_ACCOUNT@prod-ab-cloud-proj.iam.gserviceaccount.com" \
+  --role="roles/logging.logWriter" \
+  --condition=None
+```
+
+To check if the permission is already granted:
+
+```bash
+# List all IAM bindings for the project and filter for the service account
+gcloud projects get-iam-policy prod-ab-cloud-proj \
+  --flatten="bindings[].members" \
+  --filter="bindings.members:YOUR_SERVICE_ACCOUNT@prod-ab-cloud-proj.iam.gserviceaccount.com" \
+  --format="table(bindings.role)"
+```
+
 ### Verifying Permissions
 
 To check existing permissions on the secret:

{airbyte_internal_ops-0.3.0 → airbyte_internal_ops-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: airbyte-internal-ops
-Version: 0.3.0
+Version: 0.3.1
 Summary: MCP and API interfaces that let the agents do the admin work
 Author-email: Aaron Steers <aj@airbyte.io>
 Keywords: admin,airbyte,api,mcp

{airbyte_internal_ops-0.3.0 → airbyte_internal_ops-0.3.1}/src/airbyte_ops_mcp/connection_config_retriever/audit_logging.py

@@ -11,9 +11,8 @@ import logging
 import subprocess
 from typing import TYPE_CHECKING, Any, Callable
 
-from google.cloud import logging as gcloud_logging
-
 from airbyte_ops_mcp.constants import GCP_PROJECT_NAME
+from airbyte_ops_mcp.gcp_auth import get_logging_client
 
 if TYPE_CHECKING:
     from airbyte_ops_mcp.connection_config_retriever.retrieval import (
@@ -23,21 +22,18 @@ if TYPE_CHECKING:
 LOGGER = logging.getLogger(__name__)
 
 # Lazy-initialized to avoid import-time GCP calls
-_logging_client: gcloud_logging.Client | None = None
 _airbyte_gcloud_logger: Any = None
 
 
 def _get_logger() -> Any:
     """Get the GCP Cloud Logger, initializing lazily on first use."""
-    global _logging_client, _airbyte_gcloud_logger
+    global _airbyte_gcloud_logger
 
     if _airbyte_gcloud_logger is not None:
         return _airbyte_gcloud_logger
 
-    _logging_client = gcloud_logging.Client(project=GCP_PROJECT_NAME)
-    _airbyte_gcloud_logger = _logging_client.logger(
-        "airbyte-cloud-connection-retriever"
-    )
+    logging_client = get_logging_client(GCP_PROJECT_NAME)
+    _airbyte_gcloud_logger = logging_client.logger("airbyte-cloud-connection-retriever")
     return _airbyte_gcloud_logger
 
 

airbyte_internal_ops-0.3.1/src/airbyte_ops_mcp/gcp_auth.py

@@ -0,0 +1,192 @@
+# Copyright (c) 2025 Airbyte, Inc., all rights reserved.
+"""Centralized GCP authentication utilities.
+
+This module provides a single code path for GCP credential handling across
+the airbyte-ops-mcp codebase. It supports both standard Application Default
+Credentials (ADC) and the GCP_PROD_DB_ACCESS_CREDENTIALS environment variable
+used internally at Airbyte.
+
+The preferred approach is to pass credentials directly to GCP client constructors
+rather than relying on file-based ADC discovery. This module provides helpers
+that construct credentials from JSON content in environment variables.
+
+Usage:
+    from airbyte_ops_mcp.gcp_auth import get_gcp_credentials, get_secret_manager_client
+
+    # Get credentials object to pass to any GCP client
+    credentials = get_gcp_credentials()
+    client = logging.Client(project="my-project", credentials=credentials)
+
+    # Or use the convenience helper for Secret Manager
+    client = get_secret_manager_client()
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+import sys
+import threading
+
+import google.auth
+from google.cloud import logging as gcp_logging
+from google.cloud import secretmanager
+from google.oauth2 import service_account
+
+from airbyte_ops_mcp.constants import ENV_GCP_PROD_DB_ACCESS_CREDENTIALS
+
+logger = logging.getLogger(__name__)
+
+
+def _get_identity_from_service_account_info(info: dict) -> str | None:
+    """Extract service account identity from parsed JSON info.
+
+    Only accesses the 'client_email' key to avoid any risk of leaking
+    other credential material.
+
+    Args:
+        info: Parsed service account JSON as a dict.
+
+    Returns:
+        The client_email if present and a string, otherwise None.
+    """
+    client_email = info.get("client_email")
+    if isinstance(client_email, str):
+        return client_email
+    return None
+
+
+def _get_identity_from_credentials(
+    credentials: google.auth.credentials.Credentials,
+) -> str | None:
+    """Extract identity from a credentials object using safe attribute access.
+
+    Only accesses known-safe attributes that don't trigger network calls
+    or token refresh.
+
+    Args:
+        credentials: A GCP credentials object.
+
+    Returns:
+        The service account email if available, otherwise None.
+    """
+    # Try service_account_email first (most common for service accounts)
+    identity = getattr(credentials, "service_account_email", None)
+    if isinstance(identity, str):
+        return identity
+
+    # Try signer_email as fallback (sometimes present on impersonated creds)
+    identity = getattr(credentials, "signer_email", None)
+    if isinstance(identity, str):
+        return identity
+
+    return None
+
+
+# Default scopes for GCP services used by this module
+DEFAULT_GCP_SCOPES = ["https://www.googleapis.com/auth/cloud-platform"]
+
+# Module-level cache for credentials (thread-safe)
+_cached_credentials: google.auth.credentials.Credentials | None = None
+_credentials_lock = threading.Lock()
+
+
+def get_gcp_credentials() -> google.auth.credentials.Credentials:
+    """Get GCP credentials, preferring direct JSON parsing over file-based ADC.
+
+    This function resolves credentials in the following order:
+    1. GCP_PROD_DB_ACCESS_CREDENTIALS env var (JSON content) - parsed directly
+    2. Standard ADC discovery (workload identity, gcloud auth, GOOGLE_APPLICATION_CREDENTIALS)
+
+    The credentials are cached after first resolution for efficiency.
+    Uses the cloud-platform scope which provides access to all GCP services.
+
+    Returns:
+        A Credentials object that can be passed to any GCP client constructor.
+
+    Raises:
+        google.auth.exceptions.DefaultCredentialsError: If no credentials can be found.
+    """
+    global _cached_credentials
+
+    # Return cached credentials if available (fast path without lock)
+    if _cached_credentials is not None:
+        return _cached_credentials
+
+    # Acquire lock for thread-safe credential initialization
+    with _credentials_lock:
+        # Double-check after acquiring lock (another thread may have initialized)
+        if _cached_credentials is not None:
+            return _cached_credentials
+
+        # Try GCP_PROD_DB_ACCESS_CREDENTIALS first (JSON content in env var)
+        creds_json = os.getenv(ENV_GCP_PROD_DB_ACCESS_CREDENTIALS)
+        if creds_json:
+            try:
+                creds_dict = json.loads(creds_json)
+                credentials = service_account.Credentials.from_service_account_info(
+                    creds_dict,
+                    scopes=DEFAULT_GCP_SCOPES,
+                )
+                # Extract identity safely (only after successful credential creation)
+                identity = _get_identity_from_service_account_info(creds_dict)
+                identity_str = f" (identity: {identity})" if identity else ""
+                print(
+                    f"GCP credentials loaded from {ENV_GCP_PROD_DB_ACCESS_CREDENTIALS}{identity_str}",
+                    file=sys.stderr,
+                )
+                logger.debug(
+                    f"Loaded GCP credentials from {ENV_GCP_PROD_DB_ACCESS_CREDENTIALS} env var"
+                )
+                _cached_credentials = credentials
+                return credentials
+            except (json.JSONDecodeError, ValueError) as e:
+                # Log only exception type to avoid any risk of leaking credential content
+                logger.warning(
+                    f"Failed to parse {ENV_GCP_PROD_DB_ACCESS_CREDENTIALS}: "
+                    f"{type(e).__name__}. Falling back to ADC discovery."
+                )
+
+        # Fall back to standard ADC discovery
+        credentials, project = google.auth.default(scopes=DEFAULT_GCP_SCOPES)
+        # Extract identity safely from ADC credentials
+        identity = _get_identity_from_credentials(credentials)
+        identity_str = f" (identity: {identity})" if identity else ""
+        project_str = f" (project: {project})" if project else ""
+        print(
+            f"GCP credentials loaded via ADC{project_str}{identity_str}",
+            file=sys.stderr,
+        )
+        logger.debug(f"Loaded GCP credentials via ADC discovery (project: {project})")
+        _cached_credentials = credentials
+        return credentials
+
+
+def get_secret_manager_client() -> secretmanager.SecretManagerServiceClient:
+    """Get a Secret Manager client with proper credential handling.
+
+    This function uses get_gcp_credentials() to resolve credentials and passes
+    them directly to the client constructor.
+
+    Returns:
+        A configured SecretManagerServiceClient instance.
+    """
+    credentials = get_gcp_credentials()
+    return secretmanager.SecretManagerServiceClient(credentials=credentials)
+
+
+def get_logging_client(project: str) -> gcp_logging.Client:
+    """Get a Cloud Logging client with proper credential handling.
+
+    This function uses get_gcp_credentials() to resolve credentials and passes
+    them directly to the client constructor.
+
+    Args:
+        project: The GCP project ID to use for logging operations.
+
+    Returns:
+        A configured Cloud Logging Client instance.
+    """
+    credentials = get_gcp_credentials()
+    return gcp_logging.Client(project=project, credentials=credentials)

{airbyte_internal_ops-0.3.0 → airbyte_internal_ops-0.3.1}/src/airbyte_ops_mcp/gcp_logs/error_lookup.py

@@ -24,10 +24,12 @@ from datetime import UTC, datetime, timedelta
 from enum import StrEnum
 from typing import Any
 
-from google.cloud import logging
+from google.cloud import logging as gcp_logging
 from google.cloud.logging_v2 import entries
 from pydantic import BaseModel, Field
 
+from airbyte_ops_mcp.gcp_auth import get_logging_client
+
 # Default GCP project for Airbyte Cloud
 DEFAULT_GCP_PROJECT = "prod-ab-cloud-proj"
 
@@ -291,14 +293,13 @@ def fetch_error_logs(
     specified error ID, then fetches related log entries (multi-line stack traces)
     from the same timestamp and resource.
     """
-    client_options = {"quota_project_id": project}
-    client = logging.Client(project=project, client_options=client_options)
+    client = get_logging_client(project)
 
     filter_str = _build_filter(error_id, lookback_days, min_severity_filter)
 
     entries_iterator = client.list_entries(
         filter_=filter_str,
-        order_by=logging.DESCENDING,
+        order_by=gcp_logging.DESCENDING,
     )
 
     initial_matches = list(entries_iterator)
@@ -356,7 +357,7 @@ def fetch_error_logs(
 
         related_entries = client.list_entries(
             filter_=related_filter,
-            order_by=logging.ASCENDING,
+            order_by=gcp_logging.ASCENDING,
         )
 
         for entry in related_entries:

{airbyte_internal_ops-0.3.0 → airbyte_internal_ops-0.3.1}/src/airbyte_ops_mcp/mcp/prod_db_queries.py

@@ -8,6 +8,7 @@ airbyte_ops_mcp.prod_db_access.queries for use by AI agents.
 from __future__ import annotations
 
 from datetime import datetime
+from enum import StrEnum
 from typing import Annotated, Any
 
 import requests
@@ -25,11 +26,21 @@ from airbyte_ops_mcp.prod_db_access.queries import (
     query_dataplanes_list,
     query_failed_sync_attempts_for_connector,
     query_new_connector_releases,
-    query_sync_results_for_version,
+    query_recent_syncs_for_connector,
+    query_syncs_for_version_pinned_connector,
     query_workspace_info,
     query_workspaces_by_email_domain,
 )
 
+
+class StatusFilter(StrEnum):
+    """Filter for job status in sync queries."""
+
+    ALL = "all"
+    SUCCEEDED = "succeeded"
+    FAILED = "failed"
+
+
 # Cloud UI base URL for building connection URLs
 CLOUD_UI_BASE_URL = "https://cloud.airbyte.com"
 
@@ -293,7 +304,7 @@ def query_prod_actors_by_connector_version(
     read_only=True,
     idempotent=True,
 )
-def query_prod_connector_version_sync_results(
+def query_prod_recent_syncs_for_version_pinned_connector(
     connector_version_id: Annotated[
         str,
         Field(description="Connector version UUID to find sync results for"),
@@ -314,11 +325,16 @@ def query_prod_connector_version_sync_results(
         ),
     ] = False,
 ) -> list[dict[str, Any]]:
-    """List sync job results for actors pinned to a specific connector version.
+    """List sync job results for actors PINNED to a specific connector version.
 
-    Returns sync job results for connections using actors that are pinned
-    to the specified version. Useful for monitoring rollout health and
-    identifying issues with specific connector versions.
+    IMPORTANT: This tool ONLY returns results for actors that have been explicitly
+    pinned to the specified version via scoped_configuration. Most connections run
+    unpinned and will NOT appear in these results.
+
+    Use this tool when you want to monitor rollout health for actors that have been
+    explicitly pinned to a pre-release or specific version. For finding healthy
+    connections across ALL actors using a connector type (regardless of pinning),
+    use query_prod_recent_syncs_for_connector instead.
 
     The actor_id field is the actor ID (superset of source_id/destination_id).
 
@@ -327,7 +343,7 @@ def query_prod_connector_version_sync_results(
     pin_origin_type, pin_origin, workspace_id, workspace_name, organization_id,
     dataplane_group_id, dataplane_name
     """
-    return query_sync_results_for_version(
+    return query_syncs_for_version_pinned_connector(
         connector_version_id,
         days=days,
         limit=limit,
@@ -335,6 +351,163 @@ def query_prod_connector_version_sync_results(
     )
 
 
+@mcp_tool(
+    read_only=True,
+    idempotent=True,
+    open_world=True,
+)
+def query_prod_recent_syncs_for_connector(
+    source_definition_id: Annotated[
+        str | None,
+        Field(
+            description=(
+                "Source connector definition ID (UUID) to search for. "
+                "Provide this OR source_canonical_name OR destination_definition_id "
+                "OR destination_canonical_name (exactly one required). "
+                "Example: 'afa734e4-3571-11ec-991a-1e0031268139' for YouTube Analytics."
+            ),
+            default=None,
+        ),
+    ],
+    source_canonical_name: Annotated[
+        str | None,
+        Field(
+            description=(
+                "Canonical source connector name to search for. "
+                "Provide this OR source_definition_id OR destination_definition_id "
+                "OR destination_canonical_name (exactly one required). "
+                "Examples: 'source-youtube-analytics', 'YouTube Analytics'."
+            ),
+            default=None,
+        ),
+    ],
+    destination_definition_id: Annotated[
+        str | None,
+        Field(
+            description=(
+                "Destination connector definition ID (UUID) to search for. "
+                "Provide this OR destination_canonical_name OR source_definition_id "
+                "OR source_canonical_name (exactly one required). "
+                "Example: '94bd199c-2ff0-4aa2-b98e-17f0acb72610' for DuckDB."
+            ),
+            default=None,
+        ),
+    ],
+    destination_canonical_name: Annotated[
+        str | None,
+        Field(
+            description=(
+                "Canonical destination connector name to search for. "
+                "Provide this OR destination_definition_id OR source_definition_id "
+                "OR source_canonical_name (exactly one required). "
+                "Examples: 'destination-duckdb', 'DuckDB'."
+            ),
+            default=None,
+        ),
+    ],
+    status_filter: Annotated[
+        StatusFilter,
+        Field(
+            description=(
+                "Filter by job status: 'all' (default), 'succeeded', or 'failed'. "
+                "Use 'succeeded' to find healthy connections with recent successful syncs. "
+                "Use 'failed' to find connections with recent failures."
+            ),
+            default=StatusFilter.ALL,
+        ),
+    ],
+    organization_id: Annotated[
+        str | OrganizationAliasEnum | None,
+        Field(
+            description=(
+                "Optional organization ID (UUID) or alias to filter results. "
+                "If provided, only syncs from this organization will be returned. "
+                "Accepts '@airbyte-internal' as an alias for the Airbyte internal org."
+            ),
+            default=None,
+        ),
+    ],
+    lookback_days: Annotated[
+        int,
+        Field(description="Number of days to look back (default: 7)", default=7),
+    ],
+    limit: Annotated[
+        int,
+        Field(description="Maximum number of results (default: 100)", default=100),
+    ],
+) -> list[dict[str, Any]]:
+    """List recent sync jobs for ALL actors using a connector type.
+
+    This tool finds all actors with the given connector definition and returns their
+    recent sync jobs, regardless of whether they have explicit version pins. It filters
+    out deleted actors, deleted workspaces, and deprecated connections.
+
+    Use this tool to:
+    - Find healthy connections with recent successful syncs (status_filter='succeeded')
+    - Investigate connector issues across all users (status_filter='failed')
+    - Get an overview of all recent sync activity (status_filter='all')
+
+    Supports both SOURCE and DESTINATION connectors. Provide exactly one of:
+    source_definition_id, source_canonical_name, destination_definition_id,
+    or destination_canonical_name.
+
+    Key fields in results:
+    - job_status: 'succeeded', 'failed', 'cancelled', etc.
+    - connection_id, connection_name: The connection that ran the sync
+    - actor_id, actor_name: The source or destination actor
+    - pin_origin_type, pin_origin, pinned_version_id: Version pin context (NULL if not pinned)
+    """
+    # Validate that exactly one connector parameter is provided
+    provided_params = [
+        source_definition_id,
+        source_canonical_name,
+        destination_definition_id,
+        destination_canonical_name,
+    ]
+    num_provided = sum(p is not None for p in provided_params)
+    if num_provided != 1:
+        raise PyAirbyteInputError(
+            message=(
+                "Exactly one of source_definition_id, source_canonical_name, "
+                "destination_definition_id, or destination_canonical_name must be provided."
+            ),
+        )
+
+    # Determine if this is a destination connector
+    is_destination = (
+        destination_definition_id is not None or destination_canonical_name is not None
+    )
+
+    # Resolve canonical name to definition ID if needed
+    resolved_definition_id: str
+    if source_canonical_name:
+        resolved_definition_id = _resolve_canonical_name_to_definition_id(
+            canonical_name=source_canonical_name,
+        )
+    elif destination_canonical_name:
+        resolved_definition_id = _resolve_canonical_name_to_definition_id(
+            canonical_name=destination_canonical_name,
+        )
+    elif source_definition_id:
+        resolved_definition_id = source_definition_id
+    else:
+        # We've validated exactly one param is provided, so this must be set
+        assert destination_definition_id is not None
+        resolved_definition_id = destination_definition_id
+
+    # Resolve organization ID alias
+    resolved_organization_id = OrganizationAliasEnum.resolve(organization_id)
+
+    return query_recent_syncs_for_connector(
+        connector_definition_id=resolved_definition_id,
+        is_destination=is_destination,
+        status_filter=status_filter,
+        organization_id=resolved_organization_id,
+        days=lookback_days,
+        limit=limit,
+    )
+
+
 @mcp_tool(
     read_only=True,
     idempotent=True,

{airbyte_internal_ops-0.3.0 → airbyte_internal_ops-0.3.1}/src/airbyte_ops_mcp/prod_db_access/queries.py

@@ -29,6 +29,12 @@ from airbyte_ops_mcp.prod_db_access.sql import (
     SELECT_FAILED_SYNC_ATTEMPTS_FOR_CONNECTOR,
     SELECT_NEW_CONNECTOR_RELEASES,
     SELECT_ORG_WORKSPACES,
+    SELECT_RECENT_FAILED_SYNCS_FOR_DESTINATION_CONNECTOR,
+    SELECT_RECENT_FAILED_SYNCS_FOR_SOURCE_CONNECTOR,
+    SELECT_RECENT_SUCCESSFUL_SYNCS_FOR_DESTINATION_CONNECTOR,
+    SELECT_RECENT_SUCCESSFUL_SYNCS_FOR_SOURCE_CONNECTOR,
+    SELECT_RECENT_SYNCS_FOR_DESTINATION_CONNECTOR,
+    SELECT_RECENT_SYNCS_FOR_SOURCE_CONNECTOR,
     SELECT_SUCCESSFUL_SYNCS_FOR_VERSION,
     SELECT_SYNC_RESULTS_FOR_VERSION,
     SELECT_WORKSPACE_INFO,
@@ -227,7 +233,7 @@ def query_actors_pinned_to_version(
     )
 
 
-def query_sync_results_for_version(
+def query_syncs_for_version_pinned_connector(
     connector_version_id: str,
     days: int = 7,
     limit: int = 100,
@@ -320,6 +326,81 @@ def query_failed_sync_attempts_for_connector(
     return results
 
 
+def query_recent_syncs_for_connector(
+    connector_definition_id: str,
+    is_destination: bool = False,
+    status_filter: str = "all",
+    organization_id: str | None = None,
+    days: int = 7,
+    limit: int = 100,
+    *,
+    gsm_client: secretmanager.SecretManagerServiceClient | None = None,
+) -> list[dict[str, Any]]:
+    """Query recent sync jobs for ALL actors using a connector definition.
+
+    Finds all actors with the given actor_definition_id and returns their sync jobs,
+    regardless of whether they have explicit version pins. Filters out deleted actors,
+    deleted workspaces, and deprecated connections.
+
+    This is useful for finding healthy connections with recent successful syncs,
+    or for investigating connector issues across all users.
+
+    Args:
+        connector_definition_id: Connector definition UUID to filter by
+        is_destination: If True, query destination connectors; if False, query sources
+        status_filter: Filter by job status - "all", "succeeded", or "failed"
+        organization_id: Optional organization UUID to filter results by (post-query filter)
+        days: Number of days to look back (default: 7)
+        limit: Maximum number of results (default: 100)
+        gsm_client: GCP Secret Manager client. If None, a new client will be instantiated.
+
+    Returns:
+        List of sync job records with workspace info and optional pin context
+    """
+    cutoff_date = datetime.now(timezone.utc) - timedelta(days=days)
+
+    # Select the appropriate query based on connector type and status filter
+    if is_destination:
+        if status_filter == "succeeded":
+            query = SELECT_RECENT_SUCCESSFUL_SYNCS_FOR_DESTINATION_CONNECTOR
+            query_name = "SELECT_RECENT_SUCCESSFUL_SYNCS_FOR_DESTINATION_CONNECTOR"
+        elif status_filter == "failed":
+            query = SELECT_RECENT_FAILED_SYNCS_FOR_DESTINATION_CONNECTOR
+            query_name = "SELECT_RECENT_FAILED_SYNCS_FOR_DESTINATION_CONNECTOR"
+        else:
+            query = SELECT_RECENT_SYNCS_FOR_DESTINATION_CONNECTOR
+            query_name = "SELECT_RECENT_SYNCS_FOR_DESTINATION_CONNECTOR"
+    else:
+        if status_filter == "succeeded":
+            query = SELECT_RECENT_SUCCESSFUL_SYNCS_FOR_SOURCE_CONNECTOR
+            query_name = "SELECT_RECENT_SUCCESSFUL_SYNCS_FOR_SOURCE_CONNECTOR"
+        elif status_filter == "failed":
+            query = SELECT_RECENT_FAILED_SYNCS_FOR_SOURCE_CONNECTOR
+            query_name = "SELECT_RECENT_FAILED_SYNCS_FOR_SOURCE_CONNECTOR"
+        else:
+            query = SELECT_RECENT_SYNCS_FOR_SOURCE_CONNECTOR
+            query_name = "SELECT_RECENT_SYNCS_FOR_SOURCE_CONNECTOR"
+
+    results = _run_sql_query(
+        query,
+        parameters={
+            "connector_definition_id": connector_definition_id,
+            "cutoff_date": cutoff_date,
+            "limit": limit,
+        },
+        query_name=query_name,
+        gsm_client=gsm_client,
+    )
+
+    # Post-query filter by organization_id if provided
+    if organization_id is not None:
+        results = [
+            r for r in results if str(r.get("organization_id")) == organization_id
+        ]
+
+    return results
+
+
 def query_dataplanes_list(
     *,
     gsm_client: secretmanager.SecretManagerServiceClient | None = None,