chore: import upstream snapshot with attribution

apps/sim/lib/webhooks/polling/utils.test.ts

@@ -0,0 +1,185 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockUpdate, mockSet, mockWhere, mockSelect, mockSelectRows, sqlCalls } = vi.hoisted(() => {
+  const mockSelectRows = vi.fn()
+  return {
+    mockUpdate: vi.fn(),
+    mockSet: vi.fn(),
+    mockWhere: vi.fn(),
+    mockSelectRows,
+    mockSelect: vi.fn(() => ({
+      from: vi.fn(() => ({
+        where: vi.fn(() => ({
+          limit: mockSelectRows,
+        })),
+      })),
+    })),
+    sqlCalls: [] as Array<{ strings: readonly string[]; values: unknown[] }>,
+  }
+})
+
+vi.mock('@sim/db', () => ({ db: { update: mockUpdate, select: mockSelect } }))
+vi.mock('@sim/db/schema', () => ({
+  webhook: {
+    id: 'webhook.id',
+    providerConfig: 'webhook.providerConfig',
+    updatedAt: 'webhook.updatedAt',
+  },
+  account: {},
+  workflow: {},
+  workflowDeploymentVersion: {},
+}))
+vi.mock('drizzle-orm', () => ({
+  sql: (strings: readonly string[], ...values: unknown[]) => {
+    const node = { strings, values }
+    sqlCalls.push(node)
+    return node
+  },
+  and: vi.fn(),
+  eq: vi.fn((field: unknown, value: unknown) => ({ field, value })),
+  isNull: vi.fn(),
+  ne: vi.fn(),
+  or: vi.fn(),
+}))
+vi.mock('@/app/api/auth/oauth/utils', () => ({
+  getOAuthToken: vi.fn(),
+  refreshAccessTokenIfNeeded: vi.fn(),
+  resolveOAuthAccountId: vi.fn(),
+}))
+vi.mock('@/triggers/constants', () => ({ MAX_CONSECUTIVE_FAILURES: 5 }))
+
+import type { WebhookRecord } from '@/lib/webhooks/polling/types'
+import { resolveOAuthCredential, updateWebhookProviderConfig } from '@/lib/webhooks/polling/utils'
+import {
+  getOAuthToken,
+  refreshAccessTokenIfNeeded,
+  resolveOAuthAccountId,
+} from '@/app/api/auth/oauth/utils'
+
+const logger = { error: vi.fn() } as never
+
+function allInterpolatedValues(): unknown[] {
+  return sqlCalls.flatMap((c) => c.values)
+}
+
+function allSqlText(): string {
+  return sqlCalls.map((c) => c.strings.join('')).join(' ')
+}
+
+describe('updateWebhookProviderConfig (atomic jsonb merge)', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    sqlCalls.length = 0
+    mockWhere.mockResolvedValue(undefined)
+    mockSet.mockReturnValue({ where: mockWhere })
+    mockUpdate.mockReturnValue({ set: mockSet })
+  })
+
+  it('merges defined keys (null preserved) and removes undefined keys', async () => {
+    await updateWebhookProviderConfig(
+      'wh-1',
+      { historyId: 'h1', cleared: undefined, nulled: null },
+      logger
+    )
+
+    expect(mockUpdate).toHaveBeenCalledTimes(1)
+    expect(allInterpolatedValues()).toContain(JSON.stringify({ historyId: 'h1', nulled: null }))
+    expect(allInterpolatedValues()).toContainEqual(['cleared'])
+  })
+
+  it('uses merge only (no key-removal expression) when nothing is undefined', async () => {
+    await updateWebhookProviderConfig('wh-1', { historyId: 'h1' }, logger)
+
+    expect(allInterpolatedValues()).toContain(JSON.stringify({ historyId: 'h1' }))
+    expect(allInterpolatedValues().some((v) => Array.isArray(v))).toBe(false)
+  })
+
+  it('casts the json column to jsonb for the merge and back to json for storage', async () => {
+    await updateWebhookProviderConfig('wh-1', { historyId: 'h1', cleared: undefined }, logger)
+
+    const sqlText = allSqlText()
+    // Column (interpolated as a value) is cast to jsonb: `COALESCE(<col>::jsonb, ...)`
+    expect(sqlText).toContain('COALESCE(::jsonb')
+    // Merge runs in jsonb space, result cast back to the json column: `(<expr>)::json`
+    expect(sqlText).toContain(')::json')
+  })
+})
+
+describe('resolveOAuthCredential (single-credential polling)', () => {
+  const makeWebhook = (providerConfig: Record<string, unknown>): WebhookRecord =>
+    ({ id: 'wh-1', providerConfig }) as unknown as WebhookRecord
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockSelectRows.mockResolvedValue([])
+  })
+
+  it('resolves via credentialId: account lookup then token refresh', async () => {
+    vi.mocked(resolveOAuthAccountId).mockResolvedValue({
+      accountId: 'acc-1',
+    } as Awaited<ReturnType<typeof resolveOAuthAccountId>>)
+    mockSelectRows.mockResolvedValue([{ userId: 'owner-1' }])
+    vi.mocked(refreshAccessTokenIfNeeded).mockResolvedValue('tok-abc')
+
+    const token = await resolveOAuthCredential(
+      makeWebhook({ credentialId: 'cred-1' }),
+      'google-email',
+      'req-1'
+    )
+
+    expect(token).toBe('tok-abc')
+    expect(resolveOAuthAccountId).toHaveBeenCalledWith('cred-1')
+    expect(refreshAccessTokenIfNeeded).toHaveBeenCalledWith('acc-1', 'owner-1', 'req-1')
+    expect(getOAuthToken).not.toHaveBeenCalled()
+  })
+
+  it('throws when the credential cannot be resolved to an OAuth account', async () => {
+    vi.mocked(resolveOAuthAccountId).mockResolvedValue(null)
+
+    await expect(
+      resolveOAuthCredential(makeWebhook({ credentialId: 'cred-gone' }), 'google-email', 'req-1')
+    ).rejects.toThrow('Failed to resolve OAuth account for credential cred-gone')
+  })
+
+  it('throws when the resolved account row does not exist', async () => {
+    vi.mocked(resolveOAuthAccountId).mockResolvedValue({
+      accountId: 'acc-missing',
+    } as Awaited<ReturnType<typeof resolveOAuthAccountId>>)
+    mockSelectRows.mockResolvedValue([])
+
+    await expect(
+      resolveOAuthCredential(makeWebhook({ credentialId: 'cred-1' }), 'google-email', 'req-1')
+    ).rejects.toThrow('Credential cred-1 not found for webhook wh-1')
+  })
+
+  it('falls back to the legacy userId path via getOAuthToken', async () => {
+    vi.mocked(getOAuthToken).mockResolvedValue('tok-legacy')
+
+    const token = await resolveOAuthCredential(
+      makeWebhook({ userId: 'user-1' }),
+      'outlook',
+      'req-1'
+    )
+
+    expect(token).toBe('tok-legacy')
+    expect(getOAuthToken).toHaveBeenCalledWith('user-1', 'outlook')
+    expect(resolveOAuthAccountId).not.toHaveBeenCalled()
+  })
+
+  it('throws when neither credentialId nor userId is present', async () => {
+    await expect(resolveOAuthCredential(makeWebhook({}), 'gmail', 'req-1')).rejects.toThrow(
+      'Missing credential info for webhook wh-1'
+    )
+  })
+
+  it('throws when the legacy userId path yields no token', async () => {
+    vi.mocked(getOAuthToken).mockResolvedValue(null)
+
+    await expect(
+      resolveOAuthCredential(makeWebhook({ userId: 'user-1' }), 'outlook', 'req-1')
+    ).rejects.toThrow('Failed to get outlook access token for webhook wh-1')
+  })
+})