CS-544 [BUG] - refresh OAuth token issue

[github-actions]

This is an automated pull request to merge chas/cs-544-refresh-token into dev.
It was created by the [Auto Pull Request] action.

---

Summary by cubic

Adds a daily 05:00 UTC cron to proactively refresh OAuth tokens expiring within 24 hours, preventing “token expired” disconnects during integration checks (CS-544).

• New Features

  • Adds refresh-expiring-tokens-schedule using @trigger.dev/sdk (runs 1 hour before daily checks).
  • Considers only the latest credential version and refreshes if it expires within 24h.
  • Uses API_URL and @db; logs results, returns summary counts, and includes tests for latest-version filtering.

• Bug Fixes

  • Fixed a mismatched field in the connection query to correctly select active connections and refresh targets.

^{Written for commit 9d30b3e. Summary will update on new commits.}

[linear]

CS-544

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
comp-framework-editor	Ready	Preview, Comment	Jun 23, 2026 3:12pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
app	Skipped		Jun 23, 2026 3:12pm
portal	Skipped		Jun 23, 2026 3:12pm

[cubic-dev-ai]

1 issue found across 1 file

Confidence score: 3/5

• In apps/api/src/trigger/integration-platform/refresh-expiring-tokens-schedule.ts, the connection filter uses credentials.some(...), which can match older credential rows even though only the latest credential is returned; this can select the wrong connections for token refresh and lead to missed or incorrect refresh behavior in production. Update the query/filter to explicitly target the latest credential version (or constrain the relation used by some) and add a test that reproduces the version-mismatch case before merging.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/api/src/trigger/integration-platform/refresh-expiring-tokens-schedule.ts">

<violation number="1" location="apps/api/src/trigger/integration-platform/refresh-expiring-tokens-schedule.ts:36">
P2: Connection selection logic uses `credentials.some(...)` which can match non-latest credential versions, while `include.credentials` with `orderBy version desc / take: 1` only affects returned data. This causes unnecessary force-refreshes when an older credential version is within the expiry window but the latest version is fine.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

Linked issue analysis

Linked issue: CS-544: [BUG] - refresh OAuth token issue

Status	Acceptance criteria	Notes
✅	Add a daily scheduled task that runs at 05:00 UTC to proactively refresh tokens	schedules.task is defined with cron '0 5 * * *' and an explanatory comment about running 1 hour before integration checks.
✅	Refresh tokens that will expire within the next 24 hours (24h lookahead)	REFRESH_LOOKAHEAD_HOURS = 24 and expiryThreshold is computed from now + lookahead; filter selects connections whose latest expiresAt is <= threshold and > now.
✅	Consider only the latest credential version when deciding which connections to refresh	DB query includes credentialVersions ordered by version desc with take: 1, and the filter checks connection.credentialVersions[0].expiresAt to decide expiry.
✅	Call requestValidCredentials(...) with forceRefresh: true for each expiring connection	For each selected connection the code calls requestValidCredentials with forceRefresh: true; tests assert the call and parameters for the expiring connection.
✅	Return and log summary counts (refreshed/failed/skipped/total) and handle missing API_URL	Function logs start/complete messages, returns an object with refreshed/failed/skipped/total, and checks API_URL, logging an error and returning zero counts if unset.
⚠️	Log minutes-until-expiry for each connection correctly	The code computes minutesUntilExpiry and logs it, but it reads expiresAt from connection.credentials[0] while earlier logic and the DB select use connection.credentialVersions[0]. This mismatch may make minutesUntilExpiry null/incorrect even when filtering selected the connection based on credentialVersions.

[chasprowebdev]

@cubic-dev-ai please review this .

[cubic-dev-ai]

@cubic-dev-ai please review this .

@chasprowebdev I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

cubic analysis

1 issue found across 2 files

Confidence score: 2/5

• In apps/api/src/trigger/integration-platform/refresh-expiring-tokens-schedule.ts, the scheduler reads connection.credentials[0] even though the Prisma query loads credentialVersions, so this can throw a runtime TypeError and stop the token-refresh schedule from running; align the accessed relation with the queried include (or update the query) and add a quick schedule-path test before merging.

Linked issue analysis

Linked issue: CS-544: [BUG] - refresh OAuth token issue

Status	Acceptance criteria	Notes
✅	Add a daily scheduled task that runs at 05:00 UTC to proactively refresh tokens	schedules.task is defined with cron '0 5 * * *' and an explanatory comment about running 1 hour before integration checks.
✅	Refresh tokens that will expire within the next 24 hours (24h lookahead)	REFRESH_LOOKAHEAD_HOURS = 24 and expiryThreshold is computed from now + lookahead; filter selects connections whose latest expiresAt is <= threshold and > now.
✅	Consider only the latest credential version when deciding which connections to refresh	DB query includes credentialVersions ordered by version desc with take: 1, and the filter checks connection.credentialVersions[0].expiresAt to decide expiry.
✅	Call requestValidCredentials(...) with forceRefresh: true for each expiring connection	For each selected connection the code calls requestValidCredentials with forceRefresh: true; tests assert the call and parameters for the expiring connection.
✅	Return and log summary counts (refreshed/failed/skipped/total) and handle missing API_URL	Function logs start/complete messages, returns an object with refreshed/failed/skipped/total, and checks API_URL, logging an error and returning zero counts if unset.
⚠️	Log minutes-until-expiry for each connection correctly	The code computes minutesUntilExpiry and logs it, but it reads expiresAt from connection.credentials[0] while earlier logic and the DB select use connection.credentialVersions[0]. This mismatch may make minutesUntilExpiry null/incorrect even when filtering selected the connection based on credentialVersions.

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>