refactor: more services (#2119) * refactor: more services * fix(services): address cubic review + drop logtape imports - integration/delete: revoke Slack token after delete commits, not before - service-adapter: map unknown errors to generic message, keep cause - page-subscriber/update: re-verify workspace ownership in audit tx - private-location: dedupe monitorIds before length comparison - monitor-tag/sync: skip update when row missing instead of crashing - integration/list: guard non-object JSON in data column - member tests: capture and restore seeded owner role - drop @logtape/logtape imports (package no longer depends on it) Co-Authored-By: Claude Opus 4.7 (1M context) * fix(services): fail-closed on out-of-workspace monitor_tag id Skipping the row would let earlier deletions in the same sync tx commit, producing a partial sync. Throw ForbiddenError so the whole tx rolls back. Co-Authored-By: Claude Opus 4.7 (1M context) * fix(services): clear workspace 2 rows before addLimitWarnings tests Other suites leave page_component / monitor rows in workspace 2 and the real count(*) drifts. Add a beforeEach that deletes those rows so the DB-touching warning logic runs against a known-empty workspace — real queries, just owned state. Co-Authored-By: Claude Opus 4.7 (1M context) * ci: apply automated fixes * feat(services): audit slack-agent install via service verb Move the Slack OAuth callback's inline `integration` upsert behind a new `installSlackAgent` service verb so installs, reinstalls, and token rotations land in the audit log. Bot tokens are never stored — a SHA-256 fingerprint is recorded instead so rotations register in `changed_fields`. Service consolidates duplicate `slack-agent` rows on the fly since the table has no `(workspace_id, name)` unique index. Propagates the openstatus `userId` from the install token through state to the slack actor so audit rows are attributable. Co-Authored-By: Claude Opus 4.7 (1M context) * fix: * fix(services): make integration snapshot Edge-safe `snapshot.ts` used `node:crypto`'s `createHash`, which broke the dashboard's Edge build because `deleteIntegration` reaches it via tRPC. Switch to Web Crypto's `crypto.subtle.digest` and propagate the resulting `await` through `installSlackAgent` and `deleteIntegration` call sites. Also drop the runtime drizzle import in favor of `import type` for the same reason. Co-Authored-By: Claude Opus 4.7 (1M context) * fix(services): drop logtape from install-slack-agent Replaces the `getLogger` import with `console.warn` to match the pattern in `integration/list.ts` and `page-subscriber/list.ts`. Logtape isn't bundled by the dashboard's Edge tRPC build, so importing it from a transitively-reachable service breaks the status-page Edge build (`module-not-found` at install-slack-agent.ts). Co-Authored-By: Claude Opus 4.7 (1M context) * fix(services): emit status_report_update.create on initial report creation createStatusReport inserts an initial statusReportUpdate row alongside the report but only emitted status_report.create. The first update of every report was missing from the audit log, while subsequent updates via addStatusReportUpdate were tracked correctly. Co-Authored-By: Claude Opus 4.7 (1M context) * fix(services): tighten list input parsing and audit action union - Reject empty teamName in InstallSlackAgentInputSchema - Parse list input at top of listMonitorTags/listPrivateLocations/listIntegrations - Consolidate page_subscriber audit actions into a single array Co-Authored-By: Claude Opus 4.7 (1M context) * fix: data-table columns actor * wip: example * fix(rpc): route monitor/status-page deletes through services The ConnectRPC handlers for `deleteMonitor` and `removeComponent` were hitting the DB directly, bypassing the audit log and (in monitor's case) leaving `private_location_to_monitor` join rows pointing at tombstoned monitors. Routes them through `@openstatus/services` and replaces the local cross-workspace `getPageBySlug` helper with a service-level export. Co-Authored-By: Claude Opus 4.7 (1M context) * fix(services): guard updatePrivateLocation row + link audit-inversion to #2120 `tx.update(...).returning().get()` is `T | undefined`. The pre-update `findFirst` makes the row reachable today, but a future WHERE-clause change would surface as `Cannot read property 'id' of undefined`. Re-throw NotFoundError instead. Also point the createPageSubscriber atomicity-inversion comment at the tracking issue. Co-Authored-By: Claude Opus 4.7 (1M context) * refactor(page-subscriber): inline vendor-add path into service, drop createSubscription The vendor-added page-subscriber path now lives entirely in `@openstatus/services/page-subscriber/createPageSubscriber`. Plan-gate, component validation, dedup, INSERT, join inserts, and the audit emit all run in one `withTransaction`, so a failed audit row rolls the subscriber back — fail-closed audit guarantee from CLAUDE.md restored (closes #2120). `createSubscription` and `CreateSubscriptionInput` are removed from `@openstatus/subscriptions`; the only remaining caller — the `createPageSubscription` ConnectRPC handler — now goes through the service. Drops the redundant `db.select().from(pageSubscriber).where( eq(...id))` re-query at the call site since the service returns the inserted row directly. The service is documented as vendor-only; self-serve subscriptions keep their separate path through `upsertEmailSubscription` and intentionally emit no audit row. Co-Authored-By: Claude Opus 4.7 (1M context) * fix: build * fix(page-subscriber): allow empty headers + add @openstatus/utils dep Two follow-ups to the inlined vendor-add service: 1. `@openstatus/utils` was missing from `packages/services/package.json`; the `assertSafeUrl` import broke the status-page Edge build. 2. `input.headers` arrives as `[]` from the RPC handler when no headers are supplied — empty arrays are truthy in JS, so the previous `input.headers ? ... : null` branch persisted `'{"headers":[]}'` instead of leaving `channelConfig` NULL. Switch to `length > 0`. Co-Authored-By: Claude Opus 4.7 (1M context) * fix(monitor-tag): use existing-row map for workspace check in sync libSQL's HTTP transport can omit RETURNING rows from an UPDATE that doesn't change any column values, which made the no-op update path incorrectly throw ForbiddenError. Check ownership against the pre-fetched existing-tags map up front, and fall back to `before` when the RETURNING row is absent. Co-Authored-By: Claude Opus 4.7 (1M context) * refactor(page-subscriber): inline updateChannel into service for single-tx atomicity The legacy updateChannel helper in @openstatus/subscriptions opened its own DB handle, so the auth check + vendor write + audit emit ran across two transactions in the service. A page delete in the gap between txs left the vendor change without an audit row. Move the logic into packages/services/src/page-subscriber/update.ts so all three steps share one withTransaction block. Drop the now-unused updateChannel + UpdateChannelInput exports from @openstatus/subscriptions. Also: - add getReadDb(ctx) helper in services/context.ts and migrate the list/get verbs touched by this PR (audit, integration, member, monitor-tag, page, page-subscriber, private-location) - add a cross-workspace no-op test for deleteMember to verify the workspace-scoped DELETE silently misses targets in other workspaces Co-Authored-By: Claude Opus 4.7 (1M context) * ci: apply automated fixes * refactor(page-subscriber): move self-signup verbs into services with subscriber actor Visitor-driven subscription mutations (upsert, verify, updateScope, unsubscribe, getByToken, hasPending) now live in @openstatus/services/page-subscriber and emit audit rows with a new "subscriber" actor type, so every page_subscriber state change is attributable. @openstatus/subscriptions retains only channel + dispatcher primitives. Co-Authored-By: Claude Opus 4.7 (1M context) * chore: audit-log data-table-toolbar * fix(services): dedupe pivot inserts, optional NotFound id, wrap getByToken - private-location create/update: dedupe input.monitors before pivot insert and audit snapshot; the join table has no UNIQUE constraint, so duplicate ids would silently produce duplicate FK rows. - NotFoundError: make `id` optional. Token-addressed lookups (page-subscriber unsubscribe, update-scope) no longer surface the confusing "page_subscriber 0 not found" placeholder. - pageSubscriber.getByToken: wrap in try/catch -> throwFromException, matching the rest of the router so unexpected errors hit the SAFE_SUBSCRIPTION_MESSAGES allow-list and console.error telemetry. Co-Authored-By: Claude Opus 4.7 (1M context) * fix: assert * refactor(services): wrap test bodies in withTestTransaction for per-test isolation Adds a `withTestTransaction(fn)` helper in `packages/services/test/helpers.ts` that runs the callback inside a drizzle transaction and always rolls back via a sentinel error. Per-test rows (and their audit emits) never reach the committed db, so cross-test bleed and prior-run leftovers stop flaking quota-gated and audit assertions. `expectAuditRow`, `readAuditLog`, `clearAuditLog` gain an optional in-object `db?: DB` (default `defaultDb`) so tests inside the wrapper read through the test tx. `getPageBySlug` widened with `opts.db` for the same reason — its tests now seed pages inside the tx and look them up via tx. 15 service test suites migrated: each `test()` body wrapped in `withTestTransaction(async (tx) => { ... })`, ctx spread with `db: tx`, in-test `db.*` reads switched to `tx.*`, per-test cleanup arrays and `clearAuditLog` calls dropped. `beforeAll` setup of committed fixtures (monitors, pages, users) and `afterAll` cleanup preserved unchanged. The `audit.test.ts` "fail-closed" test stays outside the wrapper — its whole point is to verify that a real outer tx rolls back when an emit-bearing block throws, which a wrapping tx would mask. `listMonitorTags` casts `getReadDb(ctx) as DrizzleClient` so drizzle's relational `.query` API preserves its inferred return type under the `DB = DrizzleClient | DrizzleTx` union; runtime is identical. Co-Authored-By: Claude Opus 4.7 (1M context) * ci: apply automated fixes * fix(audit): metadata-only updates land even with empty row diff Off-row mutations (e.g. component-scope edits on `page_subscriber` mutate a join table, not the row itself) produce `before === after` on every column. The metadata field is the signal in those cases — dropping the row left changes invisible. Drop only when there is neither a row diff nor metadata. Fixes the failing CI cases on `upsertSelfSignupSubscriber` (component merge) and `updateSubscriberScope`. Co-Authored-By: Claude Opus 4.7 (1M context) * ci: apply automated fixes * fix: tests * fix: missing toolbar --------- Co-authored-by: Claude Opus 4.7 (1M context) Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>