fix(relay): revoke before tunnel teardown

Co-authored-by: codex <codex@users.noreply.github.com>

Author: juliusmarminge

infra/relay/src/http/Api.test.ts

@@ -24,13 +24,15 @@ import {
 relayNotFoundRoute,
 revokeEnvironmentLinkRecord,
 traceRelayHttpRequestWith,
+unlinkEnvironmentRecord,
 verifyRelayClientBearerToken,
 withoutCapturedParentSpan,
 }from"./Api.ts";
 import*asRelayConfigurationfrom"../Config.ts";
 import*asRelayDbfrom"../db.ts";
 import*asEnvironmentCredentialsfrom"../environments/EnvironmentCredentials.ts";
 import*asEnvironmentLinksfrom"../environments/EnvironmentLinks.ts";
+import*asManagedEndpointProviderfrom"../environments/ManagedEndpointProvider.ts";
 
 vi.mock("@clerk/backend",()=>({
 createClerkClient: vi.fn(),
@@ -198,6 +200,143 @@ describe("relay environment unlink", () => {
 expect(calls).toEqual(["transaction","link","credential"]);
 });
 });
+
+it.effect("commits database revocation before deprovisioning the managed endpoint",()=>{
+constcalls: Array<string>=[];
+constdb={
+$client: {
+withTransaction: <A,E,R>(effect: Effect.Effect<A,E,R>)=>{
+calls.push("transaction");
+returneffect;
+},
+},
+}asunknownasRelayDb.RelayDb["Service"];
+constlinks={
+getForUser: ()=>
+Effect.sync(()=>{
+calls.push("lookup");
+return{
+environmentId: "environment-1",
+environmentPublicKey: "public-key",
+};
+}),
+revokeForUser: ()=>
+Effect.sync(()=>{
+calls.push("link");
+returntrue;
+}),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constcredentials={
+revokeForEnvironmentPublicKey: ()=>
+Effect.sync(()=>{
+calls.push("credential");
+returntrue;
+}),
+}asunknownasEnvironmentCredentials.EnvironmentCredentials["Service"];
+constmanagedEndpointProvider={
+deprovision: ()=>
+Effect.sync(()=>{
+calls.push("deprovision");
+}),
+}asunknownasManagedEndpointProvider.ManagedEndpointProvider["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*unlinkEnvironmentRecord({
+ db,
+ links,
+ credentials,
+ managedEndpointProvider,
+userId: "user-1",
+environmentId: "environment-1",
+}),
+).toBe(true);
+expect(calls).toEqual(["lookup","transaction","link","credential","deprovision"]);
+});
+});
+
+it.effect("does not deprovision when database revocation fails",()=>{
+constcalls: Array<string>=[];
+constfailure=newEnvironmentCredentials.EnvironmentCredentialRevokePersistenceError({
+environmentId: "environment-1",
+cause: "database unavailable",
+});
+constdb={
+$client: {
+withTransaction: <A,E,R>(effect: Effect.Effect<A,E,R>)=>{
+calls.push("transaction");
+returneffect;
+},
+},
+}asunknownasRelayDb.RelayDb["Service"];
+constlinks={
+getForUser: ()=>
+Effect.succeed({
+environmentId: "environment-1",
+environmentPublicKey: "public-key",
+}),
+revokeForUser: ()=>
+Effect.sync(()=>{
+calls.push("link");
+returntrue;
+}),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constcredentials={
+revokeForEnvironmentPublicKey: ()=>
+Effect.sync(()=>{
+calls.push("credential");
+}).pipe(Effect.andThen(Effect.fail(failure))),
+}asunknownasEnvironmentCredentials.EnvironmentCredentials["Service"];
+constmanagedEndpointProvider={
+deprovision: ()=>
+Effect.sync(()=>{
+calls.push("deprovision");
+}),
+}asunknownasManagedEndpointProvider.ManagedEndpointProvider["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*Effect.flip(
+unlinkEnvironmentRecord({
+ db,
+ links,
+ credentials,
+ managedEndpointProvider,
+userId: "user-1",
+environmentId: "environment-1",
+}),
+),
+).toBe(failure);
+expect(calls).toEqual(["transaction","link","credential"]);
+});
+});
+
+it.effect("retries deprovisioning after the link is already revoked",()=>{
+constcalls: Array<string>=[];
+constlinks={
+getForUser: ()=>Effect.succeed(null),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constmanagedEndpointProvider={
+deprovision: ()=>
+Effect.sync(()=>{
+calls.push("deprovision");
+}),
+}asunknownasManagedEndpointProvider.ManagedEndpointProvider["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*unlinkEnvironmentRecord({
+db: {}asRelayDb.RelayDb["Service"],
+ links,
+credentials: {}asEnvironmentCredentials.EnvironmentCredentials["Service"],
+ managedEndpointProvider,
+userId: "user-1",
+environmentId: "environment-1",
+}),
+).toBe(false);
+expect(calls).toEqual(["deprovision"]);
+});
+});
 });
 
 describe("relay request tracing",()=>{

infra/relay/src/http/Api.ts

@@ -430,6 +430,43 @@ export const revokeEnvironmentLinkRecord = Effect.fn(
 );
 });
 
+exportconstunlinkEnvironmentRecord=Effect.fn("relay.api.client.unlinkEnvironmentRecord")(
+function*(input: {
+readonlydb: RelayDb.RelayDb["Service"];
+readonlylinks: EnvironmentLinks.EnvironmentLinks["Service"];
+readonlycredentials: EnvironmentCredentials.EnvironmentCredentials["Service"];
+readonlymanagedEndpointProvider: ManagedEndpointProvider.ManagedEndpointProvider["Service"];
+readonlyuserId: string;
+readonlyenvironmentId: string;
+}){
+constlink=yield*input.links.getForUser({
+userId: input.userId,
+environmentId: input.environmentId,
+});
+constunlinked=
+link===null
+ ? false
+ : yield*revokeEnvironmentLinkRecord({
+db: input.db,
+links: input.links,
+credentials: input.credentials,
+userId: input.userId,
+environmentId: link.environmentId,
+environmentPublicKey: link.environmentPublicKey,
+});
+
+// External teardown cannot share the SQL transaction. Run it only after
+// revocation commits so a database failure leaves a fully usable active
+// link. Still run teardown when the link is already revoked, allowing a
+// retry to finish cleanup after an earlier Cloudflare failure.
+yield*input.managedEndpointProvider.deprovision({
+userId: input.userId,
+environmentId: input.environmentId,
+});
+returnunlinked;
+},
+);
+
 exportconstmobileApi=HttpApiBuilder.group(
 RelayApi,
 "mobile",
@@ -620,27 +657,20 @@ export const clientApi = HttpApiBuilder.group(
 Effect.fn("relay.api.client.unlinkEnvironment")(function*(args){
 const{ params }=args;
 const{ userId }=yield*RelayClientPrincipal;
-yield*managedEndpointProvider
-.deprovision({
- userId,
-environmentId: params.environmentId,
-})
-.pipe(Effect.catch(()=>relayInternalErrorResponse("upstream_unavailable")));
-constlink=yield*links.getForUser({
- userId,
-environmentId: params.environmentId,
-});
-if(link===null){
-return{ok: false};
-}
-constunlinked=yield*revokeEnvironmentLinkRecord({
+constunlinked=yield*unlinkEnvironmentRecord({
  db,
  links,
  credentials,
+ managedEndpointProvider,
  userId,
-environmentId: link.environmentId,
-environmentPublicKey: link.environmentPublicKey,
-}).pipe(Effect.catchTag("SqlError",()=>relayInternalErrorResponse("internal_error")));
+environmentId: params.environmentId,
+}).pipe(
+Effect.catchTags({
+SqlError: ()=>relayInternalErrorResponse("internal_error"),
+ManagedEndpointDeprovisioningFailed: ()=>
+relayInternalErrorResponse("upstream_unavailable"),
+}),
+);
 return{ok: unlinked};
 },mapRelayCommonApiErrors("not_authorized")),
 )

infra/relay/src/http/Api.test.ts

@@ -24,13 +24,15 @@ import {
 relayNotFoundRoute,
 revokeEnvironmentLinkRecord,
 traceRelayHttpRequestWith,
+unlinkEnvironmentRecord,
 verifyRelayClientBearerToken,
 withoutCapturedParentSpan,
 }from"./Api.ts";
 import*asRelayConfigurationfrom"../Config.ts";
 import*asRelayDbfrom"../db.ts";
 import*asEnvironmentCredentialsfrom"../environments/EnvironmentCredentials.ts";
 import*asEnvironmentLinksfrom"../environments/EnvironmentLinks.ts";
+import*asManagedEndpointProviderfrom"../environments/ManagedEndpointProvider.ts";
 
 vi.mock("@clerk/backend",()=>({
 createClerkClient: vi.fn(),
@@ -198,6 +200,143 @@ describe("relay environment unlink", () => {
 expect(calls).toEqual(["transaction","link","credential"]);
 });
 });
+
+it.effect("commits database revocation before deprovisioning the managed endpoint",()=>{
+constcalls: Array<string>=[];
+constdb={
+$client: {
+withTransaction: <A,E,R>(effect: Effect.Effect<A,E,R>)=>{
+calls.push("transaction");
+returneffect;
+},
+},
+}asunknownasRelayDb.RelayDb["Service"];
+constlinks={
+getForUser: ()=>
+Effect.sync(()=>{
+calls.push("lookup");
+return{
+environmentId: "environment-1",
+environmentPublicKey: "public-key",
+};
+}),
+revokeForUser: ()=>
+Effect.sync(()=>{
+calls.push("link");
+returntrue;
+}),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constcredentials={
+revokeForEnvironmentPublicKey: ()=>
+Effect.sync(()=>{
+calls.push("credential");
+returntrue;
+}),
+}asunknownasEnvironmentCredentials.EnvironmentCredentials["Service"];
+constmanagedEndpointProvider={
+deprovision: ()=>
+Effect.sync(()=>{
+calls.push("deprovision");
+}),
+}asunknownasManagedEndpointProvider.ManagedEndpointProvider["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*unlinkEnvironmentRecord({
+ db,
+ links,
+ credentials,
+ managedEndpointProvider,
+userId: "user-1",
+environmentId: "environment-1",
+}),
+).toBe(true);
+expect(calls).toEqual(["lookup","transaction","link","credential","deprovision"]);
+});
+});
+
+it.effect("does not deprovision when database revocation fails",()=>{
+constcalls: Array<string>=[];
+constfailure=newEnvironmentCredentials.EnvironmentCredentialRevokePersistenceError({
+environmentId: "environment-1",
+cause: "database unavailable",
+});
+constdb={
+$client: {
+withTransaction: <A,E,R>(effect: Effect.Effect<A,E,R>)=>{
+calls.push("transaction");
+returneffect;
+},
+},
+}asunknownasRelayDb.RelayDb["Service"];
+constlinks={
+getForUser: ()=>
+Effect.succeed({
+environmentId: "environment-1",
+environmentPublicKey: "public-key",
+}),
+revokeForUser: ()=>
+Effect.sync(()=>{
+calls.push("link");
+returntrue;
+}),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constcredentials={
+revokeForEnvironmentPublicKey: ()=>
+Effect.sync(()=>{
+calls.push("credential");
+}).pipe(Effect.andThen(Effect.fail(failure))),
+}asunknownasEnvironmentCredentials.EnvironmentCredentials["Service"];
+constmanagedEndpointProvider={
+deprovision: ()=>
+Effect.sync(()=>{
+calls.push("deprovision");
+}),
+}asunknownasManagedEndpointProvider.ManagedEndpointProvider["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*Effect.flip(
+unlinkEnvironmentRecord({
+ db,
+ links,
+ credentials,
+ managedEndpointProvider,
+userId: "user-1",
+environmentId: "environment-1",
+}),
+),
+).toBe(failure);
+expect(calls).toEqual(["transaction","link","credential"]);
+});
+});
+
+it.effect("retries deprovisioning after the link is already revoked",()=>{
+constcalls: Array<string>=[];
+constlinks={
+getForUser: ()=>Effect.succeed(null),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constmanagedEndpointProvider={
+deprovision: ()=>
+Effect.sync(()=>{
+calls.push("deprovision");
+}),
+}asunknownasManagedEndpointProvider.ManagedEndpointProvider["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*unlinkEnvironmentRecord({
+db: {}asRelayDb.RelayDb["Service"],
+ links,
+credentials: {}asEnvironmentCredentials.EnvironmentCredentials["Service"],
+ managedEndpointProvider,
+userId: "user-1",
+environmentId: "environment-1",
+}),
+).toBe(false);
+expect(calls).toEqual(["deprovision"]);
+});
+});
 });
 
 describe("relay request tracing",()=>{

infra/relay/src/http/Api.ts

@@ -430,6 +430,43 @@ export const revokeEnvironmentLinkRecord = Effect.fn(
 );
 });
 
+exportconstunlinkEnvironmentRecord=Effect.fn("relay.api.client.unlinkEnvironmentRecord")(
+function*(input: {
+readonlydb: RelayDb.RelayDb["Service"];
+readonlylinks: EnvironmentLinks.EnvironmentLinks["Service"];
+readonlycredentials: EnvironmentCredentials.EnvironmentCredentials["Service"];
+readonlymanagedEndpointProvider: ManagedEndpointProvider.ManagedEndpointProvider["Service"];
+readonlyuserId: string;
+readonlyenvironmentId: string;
+}){
+constlink=yield*input.links.getForUser({
+userId: input.userId,
+environmentId: input.environmentId,
+});
+constunlinked=
+link===null
+ ? false
+ : yield*revokeEnvironmentLinkRecord({
+db: input.db,
+links: input.links,
+credentials: input.credentials,
+userId: input.userId,
+environmentId: link.environmentId,
+environmentPublicKey: link.environmentPublicKey,
+});
+
+// External teardown cannot share the SQL transaction. Run it only after
+// revocation commits so a database failure leaves a fully usable active
+// link. Still run teardown when the link is already revoked, allowing a
+// retry to finish cleanup after an earlier Cloudflare failure.
+yield*input.managedEndpointProvider.deprovision({
+userId: input.userId,
+environmentId: input.environmentId,
+});
+returnunlinked;
+},
+);
+
 exportconstmobileApi=HttpApiBuilder.group(
 RelayApi,
 "mobile",
@@ -620,27 +657,20 @@ export const clientApi = HttpApiBuilder.group(
 Effect.fn("relay.api.client.unlinkEnvironment")(function*(args){
 const{ params }=args;
 const{ userId }=yield*RelayClientPrincipal;
-yield*managedEndpointProvider
-.deprovision({
- userId,
-environmentId: params.environmentId,
-})
-.pipe(Effect.catch(()=>relayInternalErrorResponse("upstream_unavailable")));
-constlink=yield*links.getForUser({
- userId,
-environmentId: params.environmentId,
-});
-if(link===null){
-return{ok: false};
-}
-constunlinked=yield*revokeEnvironmentLinkRecord({
+constunlinked=yield*unlinkEnvironmentRecord({
  db,
  links,
  credentials,
+ managedEndpointProvider,
  userId,
-environmentId: link.environmentId,
-environmentPublicKey: link.environmentPublicKey,
-}).pipe(Effect.catchTag("SqlError",()=>relayInternalErrorResponse("internal_error")));
+environmentId: params.environmentId,
+}).pipe(
+Effect.catchTags({
+SqlError: ()=>relayInternalErrorResponse("internal_error"),
+ManagedEndpointDeprovisioningFailed: ()=>
+relayInternalErrorResponse("upstream_unavailable"),
+}),
+);
 return{ok: unlinked};
 },mapRelayCommonApiErrors("not_authorized")),
 )

infra/relay/src/http/Api.test.ts

@@ -24,13 +24,15 @@ import {
 relayNotFoundRoute,
 revokeEnvironmentLinkRecord,
 traceRelayHttpRequestWith,
+unlinkEnvironmentRecord,
 verifyRelayClientBearerToken,
 withoutCapturedParentSpan,
 }from"./Api.ts";
 import*asRelayConfigurationfrom"../Config.ts";
 import*asRelayDbfrom"../db.ts";
 import*asEnvironmentCredentialsfrom"../environments/EnvironmentCredentials.ts";
 import*asEnvironmentLinksfrom"../environments/EnvironmentLinks.ts";
+import*asManagedEndpointProviderfrom"../environments/ManagedEndpointProvider.ts";
 
 vi.mock("@clerk/backend",()=>({
 createClerkClient: vi.fn(),
@@ -198,6 +200,143 @@ describe("relay environment unlink", () => {
 expect(calls).toEqual(["transaction","link","credential"]);
 });
 });
+
+it.effect("commits database revocation before deprovisioning the managed endpoint",()=>{
+constcalls: Array<string>=[];
+constdb={
+$client: {
+withTransaction: <A,E,R>(effect: Effect.Effect<A,E,R>)=>{
+calls.push("transaction");
+returneffect;
+},
+},
+}asunknownasRelayDb.RelayDb["Service"];
+constlinks={
+getForUser: ()=>
+Effect.sync(()=>{
+calls.push("lookup");
+return{
+environmentId: "environment-1",
+environmentPublicKey: "public-key",
+};
+}),
+revokeForUser: ()=>
+Effect.sync(()=>{
+calls.push("link");
+returntrue;
+}),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constcredentials={
+revokeForEnvironmentPublicKey: ()=>
+Effect.sync(()=>{
+calls.push("credential");
+returntrue;
+}),
+}asunknownasEnvironmentCredentials.EnvironmentCredentials["Service"];
+constmanagedEndpointProvider={
+deprovision: ()=>
+Effect.sync(()=>{
+calls.push("deprovision");
+}),
+}asunknownasManagedEndpointProvider.ManagedEndpointProvider["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*unlinkEnvironmentRecord({
+ db,
+ links,
+ credentials,
+ managedEndpointProvider,
+userId: "user-1",
+environmentId: "environment-1",
+}),
+).toBe(true);
+expect(calls).toEqual(["lookup","transaction","link","credential","deprovision"]);
+});
+});
+
+it.effect("does not deprovision when database revocation fails",()=>{
+constcalls: Array<string>=[];
+constfailure=newEnvironmentCredentials.EnvironmentCredentialRevokePersistenceError({
+environmentId: "environment-1",
+cause: "database unavailable",
+});
+constdb={
+$client: {
+withTransaction: <A,E,R>(effect: Effect.Effect<A,E,R>)=>{
+calls.push("transaction");
+returneffect;
+},
+},
+}asunknownasRelayDb.RelayDb["Service"];
+constlinks={
+getForUser: ()=>
+Effect.succeed({
+environmentId: "environment-1",
+environmentPublicKey: "public-key",
+}),
+revokeForUser: ()=>
+Effect.sync(()=>{
+calls.push("link");
+returntrue;
+}),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constcredentials={
+revokeForEnvironmentPublicKey: ()=>
+Effect.sync(()=>{
+calls.push("credential");
+}).pipe(Effect.andThen(Effect.fail(failure))),
+}asunknownasEnvironmentCredentials.EnvironmentCredentials["Service"];
+constmanagedEndpointProvider={
+deprovision: ()=>
+Effect.sync(()=>{
+calls.push("deprovision");
+}),
+}asunknownasManagedEndpointProvider.ManagedEndpointProvider["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*Effect.flip(
+unlinkEnvironmentRecord({
+ db,
+ links,
+ credentials,
+ managedEndpointProvider,
+userId: "user-1",
+environmentId: "environment-1",
+}),
+),
+).toBe(failure);
+expect(calls).toEqual(["transaction","link","credential"]);
+});
+});
+
+it.effect("retries deprovisioning after the link is already revoked",()=>{
+constcalls: Array<string>=[];
+constlinks={
+getForUser: ()=>Effect.succeed(null),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constmanagedEndpointProvider={
+deprovision: ()=>
+Effect.sync(()=>{
+calls.push("deprovision");
+}),
+}asunknownasManagedEndpointProvider.ManagedEndpointProvider["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*unlinkEnvironmentRecord({
+db: {}asRelayDb.RelayDb["Service"],
+ links,
+credentials: {}asEnvironmentCredentials.EnvironmentCredentials["Service"],
+ managedEndpointProvider,
+userId: "user-1",
+environmentId: "environment-1",
+}),
+).toBe(false);
+expect(calls).toEqual(["deprovision"]);
+});
+});
 });
 
 describe("relay request tracing",()=>{

infra/relay/src/http/Api.ts

@@ -430,6 +430,43 @@ export const revokeEnvironmentLinkRecord = Effect.fn(
 );
 });
 
+exportconstunlinkEnvironmentRecord=Effect.fn("relay.api.client.unlinkEnvironmentRecord")(
+function*(input: {
+readonlydb: RelayDb.RelayDb["Service"];
+readonlylinks: EnvironmentLinks.EnvironmentLinks["Service"];
+readonlycredentials: EnvironmentCredentials.EnvironmentCredentials["Service"];
+readonlymanagedEndpointProvider: ManagedEndpointProvider.ManagedEndpointProvider["Service"];
+readonlyuserId: string;
+readonlyenvironmentId: string;
+}){
+constlink=yield*input.links.getForUser({
+userId: input.userId,
+environmentId: input.environmentId,
+});
+constunlinked=
+link===null
+ ? false
+ : yield*revokeEnvironmentLinkRecord({
+db: input.db,
+links: input.links,
+credentials: input.credentials,
+userId: input.userId,
+environmentId: link.environmentId,
+environmentPublicKey: link.environmentPublicKey,
+});
+
+// External teardown cannot share the SQL transaction. Run it only after
+// revocation commits so a database failure leaves a fully usable active
+// link. Still run teardown when the link is already revoked, allowing a
+// retry to finish cleanup after an earlier Cloudflare failure.
+yield*input.managedEndpointProvider.deprovision({
+userId: input.userId,
+environmentId: input.environmentId,
+});
+returnunlinked;
+},
+);
+
 exportconstmobileApi=HttpApiBuilder.group(
 RelayApi,
 "mobile",
@@ -620,27 +657,20 @@ export const clientApi = HttpApiBuilder.group(
 Effect.fn("relay.api.client.unlinkEnvironment")(function*(args){
 const{ params }=args;
 const{ userId }=yield*RelayClientPrincipal;
-yield*managedEndpointProvider
-.deprovision({
- userId,
-environmentId: params.environmentId,
-})
-.pipe(Effect.catch(()=>relayInternalErrorResponse("upstream_unavailable")));
-constlink=yield*links.getForUser({
- userId,
-environmentId: params.environmentId,
-});
-if(link===null){
-return{ok: false};
-}
-constunlinked=yield*revokeEnvironmentLinkRecord({
+constunlinked=yield*unlinkEnvironmentRecord({
  db,
  links,
  credentials,
+ managedEndpointProvider,
  userId,
-environmentId: link.environmentId,
-environmentPublicKey: link.environmentPublicKey,
-}).pipe(Effect.catchTag("SqlError",()=>relayInternalErrorResponse("internal_error")));
+environmentId: params.environmentId,
+}).pipe(
+Effect.catchTags({
+SqlError: ()=>relayInternalErrorResponse("internal_error"),
+ManagedEndpointDeprovisioningFailed: ()=>
+relayInternalErrorResponse("upstream_unavailable"),
+}),
+);
 return{ok: unlinked};
 },mapRelayCommonApiErrors("not_authorized")),
 )

infra/relay/src/http/Api.test.ts

@@ -24,13 +24,15 @@ import {
 relayNotFoundRoute,
 revokeEnvironmentLinkRecord,
 traceRelayHttpRequestWith,
+unlinkEnvironmentRecord,
 verifyRelayClientBearerToken,
 withoutCapturedParentSpan,
 }from"./Api.ts";
 import*asRelayConfigurationfrom"../Config.ts";
 import*asRelayDbfrom"../db.ts";
 import*asEnvironmentCredentialsfrom"../environments/EnvironmentCredentials.ts";
 import*asEnvironmentLinksfrom"../environments/EnvironmentLinks.ts";
+import*asManagedEndpointProviderfrom"../environments/ManagedEndpointProvider.ts";
 
 vi.mock("@clerk/backend",()=>({
 createClerkClient: vi.fn(),
@@ -198,6 +200,143 @@ describe("relay environment unlink", () => {
 expect(calls).toEqual(["transaction","link","credential"]);
 });
 });
+
+it.effect("commits database revocation before deprovisioning the managed endpoint",()=>{
+constcalls: Array<string>=[];
+constdb={
+$client: {
+withTransaction: <A,E,R>(effect: Effect.Effect<A,E,R>)=>{
+calls.push("transaction");
+returneffect;
+},
+},
+}asunknownasRelayDb.RelayDb["Service"];
+constlinks={
+getForUser: ()=>
+Effect.sync(()=>{
+calls.push("lookup");
+return{
+environmentId: "environment-1",
+environmentPublicKey: "public-key",
+};
+}),
+revokeForUser: ()=>
+Effect.sync(()=>{
+calls.push("link");
+returntrue;
+}),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constcredentials={
+revokeForEnvironmentPublicKey: ()=>
+Effect.sync(()=>{
+calls.push("credential");
+returntrue;
+}),
+}asunknownasEnvironmentCredentials.EnvironmentCredentials["Service"];
+constmanagedEndpointProvider={
+deprovision: ()=>
+Effect.sync(()=>{
+calls.push("deprovision");
+}),
+}asunknownasManagedEndpointProvider.ManagedEndpointProvider["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*unlinkEnvironmentRecord({
+ db,
+ links,
+ credentials,
+ managedEndpointProvider,
+userId: "user-1",
+environmentId: "environment-1",
+}),
+).toBe(true);
+expect(calls).toEqual(["lookup","transaction","link","credential","deprovision"]);
+});
+});
+
+it.effect("does not deprovision when database revocation fails",()=>{
+constcalls: Array<string>=[];
+constfailure=newEnvironmentCredentials.EnvironmentCredentialRevokePersistenceError({
+environmentId: "environment-1",
+cause: "database unavailable",
+});
+constdb={
+$client: {
+withTransaction: <A,E,R>(effect: Effect.Effect<A,E,R>)=>{
+calls.push("transaction");
+returneffect;
+},
+},
+}asunknownasRelayDb.RelayDb["Service"];
+constlinks={
+getForUser: ()=>
+Effect.succeed({
+environmentId: "environment-1",
+environmentPublicKey: "public-key",
+}),
+revokeForUser: ()=>
+Effect.sync(()=>{
+calls.push("link");
+returntrue;
+}),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constcredentials={
+revokeForEnvironmentPublicKey: ()=>
+Effect.sync(()=>{
+calls.push("credential");
+}).pipe(Effect.andThen(Effect.fail(failure))),
+}asunknownasEnvironmentCredentials.EnvironmentCredentials["Service"];
+constmanagedEndpointProvider={
+deprovision: ()=>
+Effect.sync(()=>{
+calls.push("deprovision");
+}),
+}asunknownasManagedEndpointProvider.ManagedEndpointProvider["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*Effect.flip(
+unlinkEnvironmentRecord({
+ db,
+ links,
+ credentials,
+ managedEndpointProvider,
+userId: "user-1",
+environmentId: "environment-1",
+}),
+),
+).toBe(failure);
+expect(calls).toEqual(["transaction","link","credential"]);
+});
+});
+
+it.effect("retries deprovisioning after the link is already revoked",()=>{
+constcalls: Array<string>=[];
+constlinks={
+getForUser: ()=>Effect.succeed(null),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constmanagedEndpointProvider={
+deprovision: ()=>
+Effect.sync(()=>{
+calls.push("deprovision");
+}),
+}asunknownasManagedEndpointProvider.ManagedEndpointProvider["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*unlinkEnvironmentRecord({
+db: {}asRelayDb.RelayDb["Service"],
+ links,
+credentials: {}asEnvironmentCredentials.EnvironmentCredentials["Service"],
+ managedEndpointProvider,
+userId: "user-1",
+environmentId: "environment-1",
+}),
+).toBe(false);
+expect(calls).toEqual(["deprovision"]);
+});
+});
 });
 
 describe("relay request tracing",()=>{

infra/relay/src/http/Api.ts

@@ -430,6 +430,43 @@ export const revokeEnvironmentLinkRecord = Effect.fn(
 );
 });
 
+exportconstunlinkEnvironmentRecord=Effect.fn("relay.api.client.unlinkEnvironmentRecord")(
+function*(input: {
+readonlydb: RelayDb.RelayDb["Service"];
+readonlylinks: EnvironmentLinks.EnvironmentLinks["Service"];
+readonlycredentials: EnvironmentCredentials.EnvironmentCredentials["Service"];
+readonlymanagedEndpointProvider: ManagedEndpointProvider.ManagedEndpointProvider["Service"];
+readonlyuserId: string;
+readonlyenvironmentId: string;
+}){
+constlink=yield*input.links.getForUser({
+userId: input.userId,
+environmentId: input.environmentId,
+});
+constunlinked=
+link===null
+ ? false
+ : yield*revokeEnvironmentLinkRecord({
+db: input.db,
+links: input.links,
+credentials: input.credentials,
+userId: input.userId,
+environmentId: link.environmentId,
+environmentPublicKey: link.environmentPublicKey,
+});
+
+// External teardown cannot share the SQL transaction. Run it only after
+// revocation commits so a database failure leaves a fully usable active
+// link. Still run teardown when the link is already revoked, allowing a
+// retry to finish cleanup after an earlier Cloudflare failure.
+yield*input.managedEndpointProvider.deprovision({
+userId: input.userId,
+environmentId: input.environmentId,
+});
+returnunlinked;
+},
+);
+
 exportconstmobileApi=HttpApiBuilder.group(
 RelayApi,
 "mobile",
@@ -620,27 +657,20 @@ export const clientApi = HttpApiBuilder.group(
 Effect.fn("relay.api.client.unlinkEnvironment")(function*(args){
 const{ params }=args;
 const{ userId }=yield*RelayClientPrincipal;
-yield*managedEndpointProvider
-.deprovision({
- userId,
-environmentId: params.environmentId,
-})
-.pipe(Effect.catch(()=>relayInternalErrorResponse("upstream_unavailable")));
-constlink=yield*links.getForUser({
- userId,
-environmentId: params.environmentId,
-});
-if(link===null){
-return{ok: false};
-}
-constunlinked=yield*revokeEnvironmentLinkRecord({
+constunlinked=yield*unlinkEnvironmentRecord({
  db,
  links,
  credentials,
+ managedEndpointProvider,
  userId,
-environmentId: link.environmentId,
-environmentPublicKey: link.environmentPublicKey,
-}).pipe(Effect.catchTag("SqlError",()=>relayInternalErrorResponse("internal_error")));
+environmentId: params.environmentId,
+}).pipe(
+Effect.catchTags({
+SqlError: ()=>relayInternalErrorResponse("internal_error"),
+ManagedEndpointDeprovisioningFailed: ()=>
+relayInternalErrorResponse("upstream_unavailable"),
+}),
+);
 return{ok: unlinked};
 },mapRelayCommonApiErrors("not_authorized")),
 )

infra/relay/src/http/Api.test.ts

@@ -24,13 +24,15 @@ import {
 relayNotFoundRoute,
 revokeEnvironmentLinkRecord,
 traceRelayHttpRequestWith,
+unlinkEnvironmentRecord,
 verifyRelayClientBearerToken,
 withoutCapturedParentSpan,
 }from"./Api.ts";
 import*asRelayConfigurationfrom"../Config.ts";
 import*asRelayDbfrom"../db.ts";
 import*asEnvironmentCredentialsfrom"../environments/EnvironmentCredentials.ts";
 import*asEnvironmentLinksfrom"../environments/EnvironmentLinks.ts";
+import*asManagedEndpointProviderfrom"../environments/ManagedEndpointProvider.ts";
 
 vi.mock("@clerk/backend",()=>({
 createClerkClient: vi.fn(),
@@ -198,6 +200,143 @@ describe("relay environment unlink", () => {
 expect(calls).toEqual(["transaction","link","credential"]);
 });
 });
+
+it.effect("commits database revocation before deprovisioning the managed endpoint",()=>{
+constcalls: Array<string>=[];
+constdb={
+$client: {
+withTransaction: <A,E,R>(effect: Effect.Effect<A,E,R>)=>{
+calls.push("transaction");
+returneffect;
+},
+},
+}asunknownasRelayDb.RelayDb["Service"];
+constlinks={
+getForUser: ()=>
+Effect.sync(()=>{
+calls.push("lookup");
+return{
+environmentId: "environment-1",
+environmentPublicKey: "public-key",
+};
+}),
+revokeForUser: ()=>
+Effect.sync(()=>{
+calls.push("link");
+returntrue;
+}),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constcredentials={
+revokeForEnvironmentPublicKey: ()=>
+Effect.sync(()=>{
+calls.push("credential");
+returntrue;
+}),
+}asunknownasEnvironmentCredentials.EnvironmentCredentials["Service"];
+constmanagedEndpointProvider={
+deprovision: ()=>
+Effect.sync(()=>{
+calls.push("deprovision");
+}),
+}asunknownasManagedEndpointProvider.ManagedEndpointProvider["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*unlinkEnvironmentRecord({
+ db,
+ links,
+ credentials,
+ managedEndpointProvider,
+userId: "user-1",
+environmentId: "environment-1",
+}),
+).toBe(true);
+expect(calls).toEqual(["lookup","transaction","link","credential","deprovision"]);
+});
+});
+
+it.effect("does not deprovision when database revocation fails",()=>{
+constcalls: Array<string>=[];
+constfailure=newEnvironmentCredentials.EnvironmentCredentialRevokePersistenceError({
+environmentId: "environment-1",
+cause: "database unavailable",
+});
+constdb={
+$client: {
+withTransaction: <A,E,R>(effect: Effect.Effect<A,E,R>)=>{
+calls.push("transaction");
+returneffect;
+},
+},
+}asunknownasRelayDb.RelayDb["Service"];
+constlinks={
+getForUser: ()=>
+Effect.succeed({
+environmentId: "environment-1",
+environmentPublicKey: "public-key",
+}),
+revokeForUser: ()=>
+Effect.sync(()=>{
+calls.push("link");
+returntrue;
+}),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constcredentials={
+revokeForEnvironmentPublicKey: ()=>
+Effect.sync(()=>{
+calls.push("credential");
+}).pipe(Effect.andThen(Effect.fail(failure))),
+}asunknownasEnvironmentCredentials.EnvironmentCredentials["Service"];
+constmanagedEndpointProvider={
+deprovision: ()=>
+Effect.sync(()=>{
+calls.push("deprovision");
+}),
+}asunknownasManagedEndpointProvider.ManagedEndpointProvider["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*Effect.flip(
+unlinkEnvironmentRecord({
+ db,
+ links,
+ credentials,
+ managedEndpointProvider,
+userId: "user-1",
+environmentId: "environment-1",
+}),
+),
+).toBe(failure);
+expect(calls).toEqual(["transaction","link","credential"]);
+});
+});
+
+it.effect("retries deprovisioning after the link is already revoked",()=>{
+constcalls: Array<string>=[];
+constlinks={
+getForUser: ()=>Effect.succeed(null),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constmanagedEndpointProvider={
+deprovision: ()=>
+Effect.sync(()=>{
+calls.push("deprovision");
+}),
+}asunknownasManagedEndpointProvider.ManagedEndpointProvider["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*unlinkEnvironmentRecord({
+db: {}asRelayDb.RelayDb["Service"],
+ links,
+credentials: {}asEnvironmentCredentials.EnvironmentCredentials["Service"],
+ managedEndpointProvider,
+userId: "user-1",
+environmentId: "environment-1",
+}),
+).toBe(false);
+expect(calls).toEqual(["deprovision"]);
+});
+});
 });
 
 describe("relay request tracing",()=>{

infra/relay/src/http/Api.ts

@@ -430,6 +430,43 @@ export const revokeEnvironmentLinkRecord = Effect.fn(
 );
 });
 
+exportconstunlinkEnvironmentRecord=Effect.fn("relay.api.client.unlinkEnvironmentRecord")(
+function*(input: {
+readonlydb: RelayDb.RelayDb["Service"];
+readonlylinks: EnvironmentLinks.EnvironmentLinks["Service"];
+readonlycredentials: EnvironmentCredentials.EnvironmentCredentials["Service"];
+readonlymanagedEndpointProvider: ManagedEndpointProvider.ManagedEndpointProvider["Service"];
+readonlyuserId: string;
+readonlyenvironmentId: string;
+}){
+constlink=yield*input.links.getForUser({
+userId: input.userId,
+environmentId: input.environmentId,
+});
+constunlinked=
+link===null
+ ? false
+ : yield*revokeEnvironmentLinkRecord({
+db: input.db,
+links: input.links,
+credentials: input.credentials,
+userId: input.userId,
+environmentId: link.environmentId,
+environmentPublicKey: link.environmentPublicKey,
+});
+
+// External teardown cannot share the SQL transaction. Run it only after
+// revocation commits so a database failure leaves a fully usable active
+// link. Still run teardown when the link is already revoked, allowing a
+// retry to finish cleanup after an earlier Cloudflare failure.
+yield*input.managedEndpointProvider.deprovision({
+userId: input.userId,
+environmentId: input.environmentId,
+});
+returnunlinked;
+},
+);
+
 exportconstmobileApi=HttpApiBuilder.group(
 RelayApi,
 "mobile",
@@ -620,27 +657,20 @@ export const clientApi = HttpApiBuilder.group(
 Effect.fn("relay.api.client.unlinkEnvironment")(function*(args){
 const{ params }=args;
 const{ userId }=yield*RelayClientPrincipal;
-yield*managedEndpointProvider
-.deprovision({
- userId,
-environmentId: params.environmentId,
-})
-.pipe(Effect.catch(()=>relayInternalErrorResponse("upstream_unavailable")));
-constlink=yield*links.getForUser({
- userId,
-environmentId: params.environmentId,
-});
-if(link===null){
-return{ok: false};
-}
-constunlinked=yield*revokeEnvironmentLinkRecord({
+constunlinked=yield*unlinkEnvironmentRecord({
  db,
  links,
  credentials,
+ managedEndpointProvider,
  userId,
-environmentId: link.environmentId,
-environmentPublicKey: link.environmentPublicKey,
-}).pipe(Effect.catchTag("SqlError",()=>relayInternalErrorResponse("internal_error")));
+environmentId: params.environmentId,
+}).pipe(
+Effect.catchTags({
+SqlError: ()=>relayInternalErrorResponse("internal_error"),
+ManagedEndpointDeprovisioningFailed: ()=>
+relayInternalErrorResponse("upstream_unavailable"),
+}),
+);
 return{ok: unlinked};
 },mapRelayCommonApiErrors("not_authorized")),
 )

infra/relay/src/http/Api.test.ts

@@ -24,13 +24,15 @@ import {
 relayNotFoundRoute,
 revokeEnvironmentLinkRecord,
 traceRelayHttpRequestWith,
+unlinkEnvironmentRecord,
 verifyRelayClientBearerToken,
 withoutCapturedParentSpan,
 }from"./Api.ts";
 import*asRelayConfigurationfrom"../Config.ts";
 import*asRelayDbfrom"../db.ts";
 import*asEnvironmentCredentialsfrom"../environments/EnvironmentCredentials.ts";
 import*asEnvironmentLinksfrom"../environments/EnvironmentLinks.ts";
+import*asManagedEndpointProviderfrom"../environments/ManagedEndpointProvider.ts";
 
 vi.mock("@clerk/backend",()=>({
 createClerkClient: vi.fn(),
@@ -198,6 +200,143 @@ describe("relay environment unlink", () => {
 expect(calls).toEqual(["transaction","link","credential"]);
 });
 });
+
+it.effect("commits database revocation before deprovisioning the managed endpoint",()=>{
+constcalls: Array<string>=[];
+constdb={
+$client: {
+withTransaction: <A,E,R>(effect: Effect.Effect<A,E,R>)=>{
+calls.push("transaction");
+returneffect;
+},
+},
+}asunknownasRelayDb.RelayDb["Service"];
+constlinks={
+getForUser: ()=>
+Effect.sync(()=>{
+calls.push("lookup");
+return{
+environmentId: "environment-1",
+environmentPublicKey: "public-key",
+};
+}),
+revokeForUser: ()=>
+Effect.sync(()=>{
+calls.push("link");
+returntrue;
+}),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constcredentials={
+revokeForEnvironmentPublicKey: ()=>
+Effect.sync(()=>{
+calls.push("credential");
+returntrue;
+}),
+}asunknownasEnvironmentCredentials.EnvironmentCredentials["Service"];
+constmanagedEndpointProvider={
+deprovision: ()=>
+Effect.sync(()=>{
+calls.push("deprovision");
+}),
+}asunknownasManagedEndpointProvider.ManagedEndpointProvider["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*unlinkEnvironmentRecord({
+ db,
+ links,
+ credentials,
+ managedEndpointProvider,
+userId: "user-1",
+environmentId: "environment-1",
+}),
+).toBe(true);
+expect(calls).toEqual(["lookup","transaction","link","credential","deprovision"]);
+});
+});
+
+it.effect("does not deprovision when database revocation fails",()=>{
+constcalls: Array<string>=[];
+constfailure=newEnvironmentCredentials.EnvironmentCredentialRevokePersistenceError({
+environmentId: "environment-1",
+cause: "database unavailable",
+});
+constdb={
+$client: {
+withTransaction: <A,E,R>(effect: Effect.Effect<A,E,R>)=>{
+calls.push("transaction");
+returneffect;
+},
+},
+}asunknownasRelayDb.RelayDb["Service"];
+constlinks={
+getForUser: ()=>
+Effect.succeed({
+environmentId: "environment-1",
+environmentPublicKey: "public-key",
+}),
+revokeForUser: ()=>
+Effect.sync(()=>{
+calls.push("link");
+returntrue;
+}),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constcredentials={
+revokeForEnvironmentPublicKey: ()=>
+Effect.sync(()=>{
+calls.push("credential");
+}).pipe(Effect.andThen(Effect.fail(failure))),
+}asunknownasEnvironmentCredentials.EnvironmentCredentials["Service"];
+constmanagedEndpointProvider={
+deprovision: ()=>
+Effect.sync(()=>{
+calls.push("deprovision");
+}),
+}asunknownasManagedEndpointProvider.ManagedEndpointProvider["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*Effect.flip(
+unlinkEnvironmentRecord({
+ db,
+ links,
+ credentials,
+ managedEndpointProvider,
+userId: "user-1",
+environmentId: "environment-1",
+}),
+),
+).toBe(failure);
+expect(calls).toEqual(["transaction","link","credential"]);
+});
+});
+
+it.effect("retries deprovisioning after the link is already revoked",()=>{
+constcalls: Array<string>=[];
+constlinks={
+getForUser: ()=>Effect.succeed(null),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constmanagedEndpointProvider={
+deprovision: ()=>
+Effect.sync(()=>{
+calls.push("deprovision");
+}),
+}asunknownasManagedEndpointProvider.ManagedEndpointProvider["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*unlinkEnvironmentRecord({
+db: {}asRelayDb.RelayDb["Service"],
+ links,
+credentials: {}asEnvironmentCredentials.EnvironmentCredentials["Service"],
+ managedEndpointProvider,
+userId: "user-1",
+environmentId: "environment-1",
+}),
+).toBe(false);
+expect(calls).toEqual(["deprovision"]);
+});
+});
 });
 
 describe("relay request tracing",()=>{

infra/relay/src/http/Api.ts

@@ -430,6 +430,43 @@ export const revokeEnvironmentLinkRecord = Effect.fn(
 );
 });
 
+exportconstunlinkEnvironmentRecord=Effect.fn("relay.api.client.unlinkEnvironmentRecord")(
+function*(input: {
+readonlydb: RelayDb.RelayDb["Service"];
+readonlylinks: EnvironmentLinks.EnvironmentLinks["Service"];
+readonlycredentials: EnvironmentCredentials.EnvironmentCredentials["Service"];
+readonlymanagedEndpointProvider: ManagedEndpointProvider.ManagedEndpointProvider["Service"];
+readonlyuserId: string;
+readonlyenvironmentId: string;
+}){
+constlink=yield*input.links.getForUser({
+userId: input.userId,
+environmentId: input.environmentId,
+});
+constunlinked=
+link===null
+ ? false
+ : yield*revokeEnvironmentLinkRecord({
+db: input.db,
+links: input.links,
+credentials: input.credentials,
+userId: input.userId,
+environmentId: link.environmentId,
+environmentPublicKey: link.environmentPublicKey,
+});
+
+// External teardown cannot share the SQL transaction. Run it only after
+// revocation commits so a database failure leaves a fully usable active
+// link. Still run teardown when the link is already revoked, allowing a
+// retry to finish cleanup after an earlier Cloudflare failure.
+yield*input.managedEndpointProvider.deprovision({
+userId: input.userId,
+environmentId: input.environmentId,
+});
+returnunlinked;
+},
+);
+
 exportconstmobileApi=HttpApiBuilder.group(
 RelayApi,
 "mobile",
@@ -620,27 +657,20 @@ export const clientApi = HttpApiBuilder.group(
 Effect.fn("relay.api.client.unlinkEnvironment")(function*(args){
 const{ params }=args;
 const{ userId }=yield*RelayClientPrincipal;
-yield*managedEndpointProvider
-.deprovision({
- userId,
-environmentId: params.environmentId,
-})
-.pipe(Effect.catch(()=>relayInternalErrorResponse("upstream_unavailable")));
-constlink=yield*links.getForUser({
- userId,
-environmentId: params.environmentId,
-});
-if(link===null){
-return{ok: false};
-}
-constunlinked=yield*revokeEnvironmentLinkRecord({
+constunlinked=yield*unlinkEnvironmentRecord({
  db,
  links,
  credentials,
+ managedEndpointProvider,
  userId,
-environmentId: link.environmentId,
-environmentPublicKey: link.environmentPublicKey,
-}).pipe(Effect.catchTag("SqlError",()=>relayInternalErrorResponse("internal_error")));
+environmentId: params.environmentId,
+}).pipe(
+Effect.catchTags({
+SqlError: ()=>relayInternalErrorResponse("internal_error"),
+ManagedEndpointDeprovisioningFailed: ()=>
+relayInternalErrorResponse("upstream_unavailable"),
+}),
+);
 return{ok: unlinked};
 },mapRelayCommonApiErrors("not_authorized")),
 )

infra/relay/src/http/Api.test.ts

@@ -24,13 +24,15 @@ import {
 relayNotFoundRoute,
 revokeEnvironmentLinkRecord,
 traceRelayHttpRequestWith,
+unlinkEnvironmentRecord,
 verifyRelayClientBearerToken,
 withoutCapturedParentSpan,
 }from"./Api.ts";
 import*asRelayConfigurationfrom"../Config.ts";
 import*asRelayDbfrom"../db.ts";
 import*asEnvironmentCredentialsfrom"../environments/EnvironmentCredentials.ts";
 import*asEnvironmentLinksfrom"../environments/EnvironmentLinks.ts";
+import*asManagedEndpointProviderfrom"../environments/ManagedEndpointProvider.ts";
 
 vi.mock("@clerk/backend",()=>({
 createClerkClient: vi.fn(),
@@ -198,6 +200,143 @@ describe("relay environment unlink", () => {
 expect(calls).toEqual(["transaction","link","credential"]);
 });
 });
+
+it.effect("commits database revocation before deprovisioning the managed endpoint",()=>{
+constcalls: Array<string>=[];
+constdb={
+$client: {
+withTransaction: <A,E,R>(effect: Effect.Effect<A,E,R>)=>{
+calls.push("transaction");
+returneffect;
+},
+},
+}asunknownasRelayDb.RelayDb["Service"];
+constlinks={
+getForUser: ()=>
+Effect.sync(()=>{
+calls.push("lookup");
+return{
+environmentId: "environment-1",
+environmentPublicKey: "public-key",
+};
+}),
+revokeForUser: ()=>
+Effect.sync(()=>{
+calls.push("link");
+returntrue;
+}),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constcredentials={
+revokeForEnvironmentPublicKey: ()=>
+Effect.sync(()=>{
+calls.push("credential");
+returntrue;
+}),
+}asunknownasEnvironmentCredentials.EnvironmentCredentials["Service"];
+constmanagedEndpointProvider={
+deprovision: ()=>
+Effect.sync(()=>{
+calls.push("deprovision");
+}),
+}asunknownasManagedEndpointProvider.ManagedEndpointProvider["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*unlinkEnvironmentRecord({
+ db,
+ links,
+ credentials,
+ managedEndpointProvider,
+userId: "user-1",
+environmentId: "environment-1",
+}),
+).toBe(true);
+expect(calls).toEqual(["lookup","transaction","link","credential","deprovision"]);
+});
+});
+
+it.effect("does not deprovision when database revocation fails",()=>{
+constcalls: Array<string>=[];
+constfailure=newEnvironmentCredentials.EnvironmentCredentialRevokePersistenceError({
+environmentId: "environment-1",
+cause: "database unavailable",
+});
+constdb={
+$client: {
+withTransaction: <A,E,R>(effect: Effect.Effect<A,E,R>)=>{
+calls.push("transaction");
+returneffect;
+},
+},
+}asunknownasRelayDb.RelayDb["Service"];
+constlinks={
+getForUser: ()=>
+Effect.succeed({
+environmentId: "environment-1",
+environmentPublicKey: "public-key",
+}),
+revokeForUser: ()=>
+Effect.sync(()=>{
+calls.push("link");
+returntrue;
+}),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constcredentials={
+revokeForEnvironmentPublicKey: ()=>
+Effect.sync(()=>{
+calls.push("credential");
+}).pipe(Effect.andThen(Effect.fail(failure))),
+}asunknownasEnvironmentCredentials.EnvironmentCredentials["Service"];
+constmanagedEndpointProvider={
+deprovision: ()=>
+Effect.sync(()=>{
+calls.push("deprovision");
+}),
+}asunknownasManagedEndpointProvider.ManagedEndpointProvider["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*Effect.flip(
+unlinkEnvironmentRecord({
+ db,
+ links,
+ credentials,
+ managedEndpointProvider,
+userId: "user-1",
+environmentId: "environment-1",
+}),
+),
+).toBe(failure);
+expect(calls).toEqual(["transaction","link","credential"]);
+});
+});
+
+it.effect("retries deprovisioning after the link is already revoked",()=>{
+constcalls: Array<string>=[];
+constlinks={
+getForUser: ()=>Effect.succeed(null),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constmanagedEndpointProvider={
+deprovision: ()=>
+Effect.sync(()=>{
+calls.push("deprovision");
+}),
+}asunknownasManagedEndpointProvider.ManagedEndpointProvider["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*unlinkEnvironmentRecord({
+db: {}asRelayDb.RelayDb["Service"],
+ links,
+credentials: {}asEnvironmentCredentials.EnvironmentCredentials["Service"],
+ managedEndpointProvider,
+userId: "user-1",
+environmentId: "environment-1",
+}),
+).toBe(false);
+expect(calls).toEqual(["deprovision"]);
+});
+});
 });
 
 describe("relay request tracing",()=>{

infra/relay/src/http/Api.ts

@@ -430,6 +430,43 @@ export const revokeEnvironmentLinkRecord = Effect.fn(
 );
 });
 
+exportconstunlinkEnvironmentRecord=Effect.fn("relay.api.client.unlinkEnvironmentRecord")(
+function*(input: {
+readonlydb: RelayDb.RelayDb["Service"];
+readonlylinks: EnvironmentLinks.EnvironmentLinks["Service"];
+readonlycredentials: EnvironmentCredentials.EnvironmentCredentials["Service"];
+readonlymanagedEndpointProvider: ManagedEndpointProvider.ManagedEndpointProvider["Service"];
+readonlyuserId: string;
+readonlyenvironmentId: string;
+}){
+constlink=yield*input.links.getForUser({
+userId: input.userId,
+environmentId: input.environmentId,
+});
+constunlinked=
+link===null
+ ? false
+ : yield*revokeEnvironmentLinkRecord({
+db: input.db,
+links: input.links,
+credentials: input.credentials,
+userId: input.userId,
+environmentId: link.environmentId,
+environmentPublicKey: link.environmentPublicKey,
+});
+
+// External teardown cannot share the SQL transaction. Run it only after
+// revocation commits so a database failure leaves a fully usable active
+// link. Still run teardown when the link is already revoked, allowing a
+// retry to finish cleanup after an earlier Cloudflare failure.
+yield*input.managedEndpointProvider.deprovision({
+userId: input.userId,
+environmentId: input.environmentId,
+});
+returnunlinked;
+},
+);
+
 exportconstmobileApi=HttpApiBuilder.group(
 RelayApi,
 "mobile",
@@ -620,27 +657,20 @@ export const clientApi = HttpApiBuilder.group(
 Effect.fn("relay.api.client.unlinkEnvironment")(function*(args){
 const{ params }=args;
 const{ userId }=yield*RelayClientPrincipal;
-yield*managedEndpointProvider
-.deprovision({
- userId,
-environmentId: params.environmentId,
-})
-.pipe(Effect.catch(()=>relayInternalErrorResponse("upstream_unavailable")));
-constlink=yield*links.getForUser({
- userId,
-environmentId: params.environmentId,
-});
-if(link===null){
-return{ok: false};
-}
-constunlinked=yield*revokeEnvironmentLinkRecord({
+constunlinked=yield*unlinkEnvironmentRecord({
  db,
  links,
  credentials,
+ managedEndpointProvider,
  userId,
-environmentId: link.environmentId,
-environmentPublicKey: link.environmentPublicKey,
-}).pipe(Effect.catchTag("SqlError",()=>relayInternalErrorResponse("internal_error")));
+environmentId: params.environmentId,
+}).pipe(
+Effect.catchTags({
+SqlError: ()=>relayInternalErrorResponse("internal_error"),
+ManagedEndpointDeprovisioningFailed: ()=>
+relayInternalErrorResponse("upstream_unavailable"),
+}),
+);
 return{ok: unlinked};
 },mapRelayCommonApiErrors("not_authorized")),
 )

infra/relay/src/http/Api.test.ts

@@ -24,13 +24,15 @@ import {
 relayNotFoundRoute,
 revokeEnvironmentLinkRecord,
 traceRelayHttpRequestWith,
+unlinkEnvironmentRecord,
 verifyRelayClientBearerToken,
 withoutCapturedParentSpan,
 }from"./Api.ts";
 import*asRelayConfigurationfrom"../Config.ts";
 import*asRelayDbfrom"../db.ts";
 import*asEnvironmentCredentialsfrom"../environments/EnvironmentCredentials.ts";
 import*asEnvironmentLinksfrom"../environments/EnvironmentLinks.ts";
+import*asManagedEndpointProviderfrom"../environments/ManagedEndpointProvider.ts";
 
 vi.mock("@clerk/backend",()=>({
 createClerkClient: vi.fn(),
@@ -198,6 +200,143 @@ describe("relay environment unlink", () => {
 expect(calls).toEqual(["transaction","link","credential"]);
 });
 });
+
+it.effect("commits database revocation before deprovisioning the managed endpoint",()=>{
+constcalls: Array<string>=[];
+constdb={
+$client: {
+withTransaction: <A,E,R>(effect: Effect.Effect<A,E,R>)=>{
+calls.push("transaction");
+returneffect;
+},
+},
+}asunknownasRelayDb.RelayDb["Service"];
+constlinks={
+getForUser: ()=>
+Effect.sync(()=>{
+calls.push("lookup");
+return{
+environmentId: "environment-1",
+environmentPublicKey: "public-key",
+};
+}),
+revokeForUser: ()=>
+Effect.sync(()=>{
+calls.push("link");
+returntrue;
+}),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constcredentials={
+revokeForEnvironmentPublicKey: ()=>
+Effect.sync(()=>{
+calls.push("credential");
+returntrue;
+}),
+}asunknownasEnvironmentCredentials.EnvironmentCredentials["Service"];
+constmanagedEndpointProvider={
+deprovision: ()=>
+Effect.sync(()=>{
+calls.push("deprovision");
+}),
+}asunknownasManagedEndpointProvider.ManagedEndpointProvider["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*unlinkEnvironmentRecord({
+ db,
+ links,
+ credentials,
+ managedEndpointProvider,
+userId: "user-1",
+environmentId: "environment-1",
+}),
+).toBe(true);
+expect(calls).toEqual(["lookup","transaction","link","credential","deprovision"]);
+});
+});
+
+it.effect("does not deprovision when database revocation fails",()=>{
+constcalls: Array<string>=[];
+constfailure=newEnvironmentCredentials.EnvironmentCredentialRevokePersistenceError({
+environmentId: "environment-1",
+cause: "database unavailable",
+});
+constdb={
+$client: {
+withTransaction: <A,E,R>(effect: Effect.Effect<A,E,R>)=>{
+calls.push("transaction");
+returneffect;
+},
+},
+}asunknownasRelayDb.RelayDb["Service"];
+constlinks={
+getForUser: ()=>
+Effect.succeed({
+environmentId: "environment-1",
+environmentPublicKey: "public-key",
+}),
+revokeForUser: ()=>
+Effect.sync(()=>{
+calls.push("link");
+returntrue;
+}),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constcredentials={
+revokeForEnvironmentPublicKey: ()=>
+Effect.sync(()=>{
+calls.push("credential");
+}).pipe(Effect.andThen(Effect.fail(failure))),
+}asunknownasEnvironmentCredentials.EnvironmentCredentials["Service"];
+constmanagedEndpointProvider={
+deprovision: ()=>
+Effect.sync(()=>{
+calls.push("deprovision");
+}),
+}asunknownasManagedEndpointProvider.ManagedEndpointProvider["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*Effect.flip(
+unlinkEnvironmentRecord({
+ db,
+ links,
+ credentials,
+ managedEndpointProvider,
+userId: "user-1",
+environmentId: "environment-1",
+}),
+),
+).toBe(failure);
+expect(calls).toEqual(["transaction","link","credential"]);
+});
+});
+
+it.effect("retries deprovisioning after the link is already revoked",()=>{
+constcalls: Array<string>=[];
+constlinks={
+getForUser: ()=>Effect.succeed(null),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constmanagedEndpointProvider={
+deprovision: ()=>
+Effect.sync(()=>{
+calls.push("deprovision");
+}),
+}asunknownasManagedEndpointProvider.ManagedEndpointProvider["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*unlinkEnvironmentRecord({
+db: {}asRelayDb.RelayDb["Service"],
+ links,
+credentials: {}asEnvironmentCredentials.EnvironmentCredentials["Service"],
+ managedEndpointProvider,
+userId: "user-1",
+environmentId: "environment-1",
+}),
+).toBe(false);
+expect(calls).toEqual(["deprovision"]);
+});
+});
 });
 
 describe("relay request tracing",()=>{

infra/relay/src/http/Api.ts

@@ -430,6 +430,43 @@ export const revokeEnvironmentLinkRecord = Effect.fn(
 );
 });
 
+exportconstunlinkEnvironmentRecord=Effect.fn("relay.api.client.unlinkEnvironmentRecord")(
+function*(input: {
+readonlydb: RelayDb.RelayDb["Service"];
+readonlylinks: EnvironmentLinks.EnvironmentLinks["Service"];
+readonlycredentials: EnvironmentCredentials.EnvironmentCredentials["Service"];
+readonlymanagedEndpointProvider: ManagedEndpointProvider.ManagedEndpointProvider["Service"];
+readonlyuserId: string;
+readonlyenvironmentId: string;
+}){
+constlink=yield*input.links.getForUser({
+userId: input.userId,
+environmentId: input.environmentId,
+});
+constunlinked=
+link===null
+ ? false
+ : yield*revokeEnvironmentLinkRecord({
+db: input.db,
+links: input.links,
+credentials: input.credentials,
+userId: input.userId,
+environmentId: link.environmentId,
+environmentPublicKey: link.environmentPublicKey,
+});
+
+// External teardown cannot share the SQL transaction. Run it only after
+// revocation commits so a database failure leaves a fully usable active
+// link. Still run teardown when the link is already revoked, allowing a
+// retry to finish cleanup after an earlier Cloudflare failure.
+yield*input.managedEndpointProvider.deprovision({
+userId: input.userId,
+environmentId: input.environmentId,
+});
+returnunlinked;
+},
+);
+
 exportconstmobileApi=HttpApiBuilder.group(
 RelayApi,
 "mobile",
@@ -620,27 +657,20 @@ export const clientApi = HttpApiBuilder.group(
 Effect.fn("relay.api.client.unlinkEnvironment")(function*(args){
 const{ params }=args;
 const{ userId }=yield*RelayClientPrincipal;
-yield*managedEndpointProvider
-.deprovision({
- userId,
-environmentId: params.environmentId,
-})
-.pipe(Effect.catch(()=>relayInternalErrorResponse("upstream_unavailable")));
-constlink=yield*links.getForUser({
- userId,
-environmentId: params.environmentId,
-});
-if(link===null){
-return{ok: false};
-}
-constunlinked=yield*revokeEnvironmentLinkRecord({
+constunlinked=yield*unlinkEnvironmentRecord({
  db,
  links,
  credentials,
+ managedEndpointProvider,
  userId,
-environmentId: link.environmentId,
-environmentPublicKey: link.environmentPublicKey,
-}).pipe(Effect.catchTag("SqlError",()=>relayInternalErrorResponse("internal_error")));
+environmentId: params.environmentId,
+}).pipe(
+Effect.catchTags({
+SqlError: ()=>relayInternalErrorResponse("internal_error"),
+ManagedEndpointDeprovisioningFailed: ()=>
+relayInternalErrorResponse("upstream_unavailable"),
+}),
+);
 return{ok: unlinked};
 },mapRelayCommonApiErrors("not_authorized")),
 )