fix(relay): prevent unlink state desync

Co-authored-by: codex <codex@users.noreply.github.com>

Author: juliusmarminge

infra/relay/src/environments/ManagedTunnelLimits.test.ts

@@ -4,6 +4,7 @@ import * as Layer from "effect/Layer";
 
 import*asRelayDbfrom"../db.ts";
 import{
+relayEnvironmentLinks,
 relayManagedEndpointAllocations,
 relayManagedTunnelLimits,
 }from"../persistence/schema.ts";
@@ -28,7 +29,16 @@ function makeFakeDb(input: {
 }
 expect(table).toBe(relayManagedEndpointAllocations);
 return{
-where: ()=>input.countRows??Effect.succeed([{activeTunnels: 0}]),
+innerJoin: (table: unknown,condition: unknown)=>{
+expect(table).toBe(relayEnvironmentLinks);
+expect(condition).toBeDefined();
+return{
+where: (where: unknown)=>{
+expect(where).toBeDefined();
+returninput.countRows??Effect.succeed([{activeTunnels: 0}]);
+},
+};
+},
 };
 },
 }),

infra/relay/src/environments/ManagedTunnelLimits.ts

@@ -1,11 +1,12 @@
-import{and,count,eq,ne}from"drizzle-orm";
+import{and,count,eq,isNull,ne}from"drizzle-orm";
 import*asContextfrom"effect/Context";
 import*asEffectfrom"effect/Effect";
 import*asLayerfrom"effect/Layer";
 import*asSchemafrom"effect/Schema";
 
 import*asRelayDbfrom"../db.ts";
 import{
+relayEnvironmentLinks,
 relayManagedEndpointAllocations,
 relayManagedTunnelLimits,
 }from"../persistence/schema.ts";
@@ -81,10 +82,19 @@ export const make = Effect.gen(function* () {
 constcounted=yield*db
 .select({activeTunnels: count()})
 .from(relayManagedEndpointAllocations)
+.innerJoin(
+relayEnvironmentLinks,
+and(
+eq(relayEnvironmentLinks.userId,relayManagedEndpointAllocations.userId),
+eq(relayEnvironmentLinks.environmentId,relayManagedEndpointAllocations.environmentId),
+),
+)
 .where(
 and(
 eq(relayManagedEndpointAllocations.userId,input.userId),
 ne(relayManagedEndpointAllocations.environmentId,input.environmentId),
+isNull(relayEnvironmentLinks.revokedAt),
+eq(relayEnvironmentLinks.managedTunnelsEnabled,true),
 ),
 )
 .pipe(

infra/relay/src/http/Api.test.ts

@@ -22,12 +22,15 @@ import {
 relayDocsRedirectRoute,
 relayEnvironmentAuthLayer,
 relayNotFoundRoute,
+revokeEnvironmentLinkRecord,
 traceRelayHttpRequestWith,
 verifyRelayClientBearerToken,
 withoutCapturedParentSpan,
 }from"./Api.ts";
 import*asRelayConfigurationfrom"../Config.ts";
+import*asRelayDbfrom"../db.ts";
 import*asEnvironmentCredentialsfrom"../environments/EnvironmentCredentials.ts";
+import*asEnvironmentLinksfrom"../environments/EnvironmentLinks.ts";
 
 vi.mock("@clerk/backend",()=>({
 createClerkClient: vi.fn(),
@@ -155,6 +158,48 @@ describe("relay environment authentication", () => {
 });
 });
 
+describe("relay environment unlink",()=>{
+it.effect("revokes the link and its credentials in one database transaction",()=>{
+constcalls: Array<string>=[];
+constdb={
+$client: {
+withTransaction: <A,E,R>(effect: Effect.Effect<A,E,R>)=>{
+calls.push("transaction");
+returneffect;
+},
+},
+}asunknownasRelayDb.RelayDb["Service"];
+constlinks={
+revokeForUser: ()=>
+Effect.sync(()=>{
+calls.push("link");
+returntrue;
+}),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constcredentials={
+revokeForEnvironmentPublicKey: ()=>
+Effect.sync(()=>{
+calls.push("credential");
+returntrue;
+}),
+}asunknownasEnvironmentCredentials.EnvironmentCredentials["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*revokeEnvironmentLinkRecord({
+ db,
+ links,
+ credentials,
+userId: "user-1",
+environmentId: "environment-1",
+environmentPublicKey: "public-key",
+}),
+).toBe(true);
+expect(calls).toEqual(["transaction","link","credential"]);
+});
+});
+});
+
 describe("relay request tracing",()=>{
 it.effect(
 "does not parent endpoint spans to an ambient parent captured while building handlers",

infra/relay/src/http/Api.ts

@@ -403,6 +403,33 @@ export const healthApi = HttpApiBuilder.group(
 }),
 );
 
+exportconstrevokeEnvironmentLinkRecord=Effect.fn(
+"relay.api.client.revokeEnvironmentLinkRecord",
+)(function*(input: {
+readonlydb: RelayDb.RelayDb["Service"];
+readonlylinks: EnvironmentLinks.EnvironmentLinks["Service"];
+readonlycredentials: EnvironmentCredentials.EnvironmentCredentials["Service"];
+readonlyuserId: string;
+readonlyenvironmentId: string;
+readonlyenvironmentPublicKey: string;
+}){
+returnyield*input.db.$client.withTransaction(
+Effect.gen(function*(){
+constrevoked=yield*input.links.revokeForUser({
+userId: input.userId,
+environmentId: input.environmentId,
+});
+if(revoked){
+yield*input.credentials.revokeForEnvironmentPublicKey({
+environmentId: input.environmentId,
+environmentPublicKey: input.environmentPublicKey,
+});
+}
+returnrevoked;
+}),
+);
+});
+
 exportconstmobileApi=HttpApiBuilder.group(
 RelayApi,
 "mobile",
@@ -472,6 +499,7 @@ export const clientApi = HttpApiBuilder.group(
 constmanagedEndpointProvider=yield*ManagedEndpointProvider.ManagedEndpointProvider;
 constcredentials=yield*EnvironmentCredentials.EnvironmentCredentials;
 constdevices=yield*Devices.Devices;
+constdb=yield*RelayDb.RelayDb;
 returnhandlers
 .handle(
 "listEnvironments",
@@ -605,16 +633,14 @@ export const clientApi = HttpApiBuilder.group(
 if(link===null){
 return{ok: false};
 }
-constunlinked=yield*links.revokeForUser({
+constunlinked=yield*revokeEnvironmentLinkRecord({
+ db,
+ links,
+ credentials,
  userId,
-environmentId: params.environmentId,
-});
-if(unlinked){
-yield*credentials.revokeForEnvironmentPublicKey({
-environmentId: link.environmentId,
-environmentPublicKey: link.environmentPublicKey,
-});
-}
+environmentId: link.environmentId,
+environmentPublicKey: link.environmentPublicKey,
+}).pipe(Effect.catchTag("SqlError",()=>relayInternalErrorResponse("internal_error")));
 return{ok: unlinked};
 },mapRelayCommonApiErrors("not_authorized")),
 )

infra/relay/src/environments/ManagedTunnelLimits.test.ts

@@ -4,6 +4,7 @@ import * as Layer from "effect/Layer";
 
 import*asRelayDbfrom"../db.ts";
 import{
+relayEnvironmentLinks,
 relayManagedEndpointAllocations,
 relayManagedTunnelLimits,
 }from"../persistence/schema.ts";
@@ -28,7 +29,16 @@ function makeFakeDb(input: {
 }
 expect(table).toBe(relayManagedEndpointAllocations);
 return{
-where: ()=>input.countRows??Effect.succeed([{activeTunnels: 0}]),
+innerJoin: (table: unknown,condition: unknown)=>{
+expect(table).toBe(relayEnvironmentLinks);
+expect(condition).toBeDefined();
+return{
+where: (where: unknown)=>{
+expect(where).toBeDefined();
+returninput.countRows??Effect.succeed([{activeTunnels: 0}]);
+},
+};
+},
 };
 },
 }),

infra/relay/src/environments/ManagedTunnelLimits.ts

@@ -1,11 +1,12 @@
-import{and,count,eq,ne}from"drizzle-orm";
+import{and,count,eq,isNull,ne}from"drizzle-orm";
 import*asContextfrom"effect/Context";
 import*asEffectfrom"effect/Effect";
 import*asLayerfrom"effect/Layer";
 import*asSchemafrom"effect/Schema";
 
 import*asRelayDbfrom"../db.ts";
 import{
+relayEnvironmentLinks,
 relayManagedEndpointAllocations,
 relayManagedTunnelLimits,
 }from"../persistence/schema.ts";
@@ -81,10 +82,19 @@ export const make = Effect.gen(function* () {
 constcounted=yield*db
 .select({activeTunnels: count()})
 .from(relayManagedEndpointAllocations)
+.innerJoin(
+relayEnvironmentLinks,
+and(
+eq(relayEnvironmentLinks.userId,relayManagedEndpointAllocations.userId),
+eq(relayEnvironmentLinks.environmentId,relayManagedEndpointAllocations.environmentId),
+),
+)
 .where(
 and(
 eq(relayManagedEndpointAllocations.userId,input.userId),
 ne(relayManagedEndpointAllocations.environmentId,input.environmentId),
+isNull(relayEnvironmentLinks.revokedAt),
+eq(relayEnvironmentLinks.managedTunnelsEnabled,true),
 ),
 )
 .pipe(

infra/relay/src/http/Api.test.ts

@@ -22,12 +22,15 @@ import {
 relayDocsRedirectRoute,
 relayEnvironmentAuthLayer,
 relayNotFoundRoute,
+revokeEnvironmentLinkRecord,
 traceRelayHttpRequestWith,
 verifyRelayClientBearerToken,
 withoutCapturedParentSpan,
 }from"./Api.ts";
 import*asRelayConfigurationfrom"../Config.ts";
+import*asRelayDbfrom"../db.ts";
 import*asEnvironmentCredentialsfrom"../environments/EnvironmentCredentials.ts";
+import*asEnvironmentLinksfrom"../environments/EnvironmentLinks.ts";
 
 vi.mock("@clerk/backend",()=>({
 createClerkClient: vi.fn(),
@@ -155,6 +158,48 @@ describe("relay environment authentication", () => {
 });
 });
 
+describe("relay environment unlink",()=>{
+it.effect("revokes the link and its credentials in one database transaction",()=>{
+constcalls: Array<string>=[];
+constdb={
+$client: {
+withTransaction: <A,E,R>(effect: Effect.Effect<A,E,R>)=>{
+calls.push("transaction");
+returneffect;
+},
+},
+}asunknownasRelayDb.RelayDb["Service"];
+constlinks={
+revokeForUser: ()=>
+Effect.sync(()=>{
+calls.push("link");
+returntrue;
+}),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constcredentials={
+revokeForEnvironmentPublicKey: ()=>
+Effect.sync(()=>{
+calls.push("credential");
+returntrue;
+}),
+}asunknownasEnvironmentCredentials.EnvironmentCredentials["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*revokeEnvironmentLinkRecord({
+ db,
+ links,
+ credentials,
+userId: "user-1",
+environmentId: "environment-1",
+environmentPublicKey: "public-key",
+}),
+).toBe(true);
+expect(calls).toEqual(["transaction","link","credential"]);
+});
+});
+});
+
 describe("relay request tracing",()=>{
 it.effect(
 "does not parent endpoint spans to an ambient parent captured while building handlers",

infra/relay/src/http/Api.ts

@@ -403,6 +403,33 @@ export const healthApi = HttpApiBuilder.group(
 }),
 );
 
+exportconstrevokeEnvironmentLinkRecord=Effect.fn(
+"relay.api.client.revokeEnvironmentLinkRecord",
+)(function*(input: {
+readonlydb: RelayDb.RelayDb["Service"];
+readonlylinks: EnvironmentLinks.EnvironmentLinks["Service"];
+readonlycredentials: EnvironmentCredentials.EnvironmentCredentials["Service"];
+readonlyuserId: string;
+readonlyenvironmentId: string;
+readonlyenvironmentPublicKey: string;
+}){
+returnyield*input.db.$client.withTransaction(
+Effect.gen(function*(){
+constrevoked=yield*input.links.revokeForUser({
+userId: input.userId,
+environmentId: input.environmentId,
+});
+if(revoked){
+yield*input.credentials.revokeForEnvironmentPublicKey({
+environmentId: input.environmentId,
+environmentPublicKey: input.environmentPublicKey,
+});
+}
+returnrevoked;
+}),
+);
+});
+
 exportconstmobileApi=HttpApiBuilder.group(
 RelayApi,
 "mobile",
@@ -472,6 +499,7 @@ export const clientApi = HttpApiBuilder.group(
 constmanagedEndpointProvider=yield*ManagedEndpointProvider.ManagedEndpointProvider;
 constcredentials=yield*EnvironmentCredentials.EnvironmentCredentials;
 constdevices=yield*Devices.Devices;
+constdb=yield*RelayDb.RelayDb;
 returnhandlers
 .handle(
 "listEnvironments",
@@ -605,16 +633,14 @@ export const clientApi = HttpApiBuilder.group(
 if(link===null){
 return{ok: false};
 }
-constunlinked=yield*links.revokeForUser({
+constunlinked=yield*revokeEnvironmentLinkRecord({
+ db,
+ links,
+ credentials,
  userId,
-environmentId: params.environmentId,
-});
-if(unlinked){
-yield*credentials.revokeForEnvironmentPublicKey({
-environmentId: link.environmentId,
-environmentPublicKey: link.environmentPublicKey,
-});
-}
+environmentId: link.environmentId,
+environmentPublicKey: link.environmentPublicKey,
+}).pipe(Effect.catchTag("SqlError",()=>relayInternalErrorResponse("internal_error")));
 return{ok: unlinked};
 },mapRelayCommonApiErrors("not_authorized")),
 )

infra/relay/src/environments/ManagedTunnelLimits.test.ts

@@ -4,6 +4,7 @@ import * as Layer from "effect/Layer";
 
 import*asRelayDbfrom"../db.ts";
 import{
+relayEnvironmentLinks,
 relayManagedEndpointAllocations,
 relayManagedTunnelLimits,
 }from"../persistence/schema.ts";
@@ -28,7 +29,16 @@ function makeFakeDb(input: {
 }
 expect(table).toBe(relayManagedEndpointAllocations);
 return{
-where: ()=>input.countRows??Effect.succeed([{activeTunnels: 0}]),
+innerJoin: (table: unknown,condition: unknown)=>{
+expect(table).toBe(relayEnvironmentLinks);
+expect(condition).toBeDefined();
+return{
+where: (where: unknown)=>{
+expect(where).toBeDefined();
+returninput.countRows??Effect.succeed([{activeTunnels: 0}]);
+},
+};
+},
 };
 },
 }),

infra/relay/src/environments/ManagedTunnelLimits.ts

@@ -1,11 +1,12 @@
-import{and,count,eq,ne}from"drizzle-orm";
+import{and,count,eq,isNull,ne}from"drizzle-orm";
 import*asContextfrom"effect/Context";
 import*asEffectfrom"effect/Effect";
 import*asLayerfrom"effect/Layer";
 import*asSchemafrom"effect/Schema";
 
 import*asRelayDbfrom"../db.ts";
 import{
+relayEnvironmentLinks,
 relayManagedEndpointAllocations,
 relayManagedTunnelLimits,
 }from"../persistence/schema.ts";
@@ -81,10 +82,19 @@ export const make = Effect.gen(function* () {
 constcounted=yield*db
 .select({activeTunnels: count()})
 .from(relayManagedEndpointAllocations)
+.innerJoin(
+relayEnvironmentLinks,
+and(
+eq(relayEnvironmentLinks.userId,relayManagedEndpointAllocations.userId),
+eq(relayEnvironmentLinks.environmentId,relayManagedEndpointAllocations.environmentId),
+),
+)
 .where(
 and(
 eq(relayManagedEndpointAllocations.userId,input.userId),
 ne(relayManagedEndpointAllocations.environmentId,input.environmentId),
+isNull(relayEnvironmentLinks.revokedAt),
+eq(relayEnvironmentLinks.managedTunnelsEnabled,true),
 ),
 )
 .pipe(

infra/relay/src/http/Api.test.ts

@@ -22,12 +22,15 @@ import {
 relayDocsRedirectRoute,
 relayEnvironmentAuthLayer,
 relayNotFoundRoute,
+revokeEnvironmentLinkRecord,
 traceRelayHttpRequestWith,
 verifyRelayClientBearerToken,
 withoutCapturedParentSpan,
 }from"./Api.ts";
 import*asRelayConfigurationfrom"../Config.ts";
+import*asRelayDbfrom"../db.ts";
 import*asEnvironmentCredentialsfrom"../environments/EnvironmentCredentials.ts";
+import*asEnvironmentLinksfrom"../environments/EnvironmentLinks.ts";
 
 vi.mock("@clerk/backend",()=>({
 createClerkClient: vi.fn(),
@@ -155,6 +158,48 @@ describe("relay environment authentication", () => {
 });
 });
 
+describe("relay environment unlink",()=>{
+it.effect("revokes the link and its credentials in one database transaction",()=>{
+constcalls: Array<string>=[];
+constdb={
+$client: {
+withTransaction: <A,E,R>(effect: Effect.Effect<A,E,R>)=>{
+calls.push("transaction");
+returneffect;
+},
+},
+}asunknownasRelayDb.RelayDb["Service"];
+constlinks={
+revokeForUser: ()=>
+Effect.sync(()=>{
+calls.push("link");
+returntrue;
+}),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constcredentials={
+revokeForEnvironmentPublicKey: ()=>
+Effect.sync(()=>{
+calls.push("credential");
+returntrue;
+}),
+}asunknownasEnvironmentCredentials.EnvironmentCredentials["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*revokeEnvironmentLinkRecord({
+ db,
+ links,
+ credentials,
+userId: "user-1",
+environmentId: "environment-1",
+environmentPublicKey: "public-key",
+}),
+).toBe(true);
+expect(calls).toEqual(["transaction","link","credential"]);
+});
+});
+});
+
 describe("relay request tracing",()=>{
 it.effect(
 "does not parent endpoint spans to an ambient parent captured while building handlers",

infra/relay/src/http/Api.ts

@@ -403,6 +403,33 @@ export const healthApi = HttpApiBuilder.group(
 }),
 );
 
+exportconstrevokeEnvironmentLinkRecord=Effect.fn(
+"relay.api.client.revokeEnvironmentLinkRecord",
+)(function*(input: {
+readonlydb: RelayDb.RelayDb["Service"];
+readonlylinks: EnvironmentLinks.EnvironmentLinks["Service"];
+readonlycredentials: EnvironmentCredentials.EnvironmentCredentials["Service"];
+readonlyuserId: string;
+readonlyenvironmentId: string;
+readonlyenvironmentPublicKey: string;
+}){
+returnyield*input.db.$client.withTransaction(
+Effect.gen(function*(){
+constrevoked=yield*input.links.revokeForUser({
+userId: input.userId,
+environmentId: input.environmentId,
+});
+if(revoked){
+yield*input.credentials.revokeForEnvironmentPublicKey({
+environmentId: input.environmentId,
+environmentPublicKey: input.environmentPublicKey,
+});
+}
+returnrevoked;
+}),
+);
+});
+
 exportconstmobileApi=HttpApiBuilder.group(
 RelayApi,
 "mobile",
@@ -472,6 +499,7 @@ export const clientApi = HttpApiBuilder.group(
 constmanagedEndpointProvider=yield*ManagedEndpointProvider.ManagedEndpointProvider;
 constcredentials=yield*EnvironmentCredentials.EnvironmentCredentials;
 constdevices=yield*Devices.Devices;
+constdb=yield*RelayDb.RelayDb;
 returnhandlers
 .handle(
 "listEnvironments",
@@ -605,16 +633,14 @@ export const clientApi = HttpApiBuilder.group(
 if(link===null){
 return{ok: false};
 }
-constunlinked=yield*links.revokeForUser({
+constunlinked=yield*revokeEnvironmentLinkRecord({
+ db,
+ links,
+ credentials,
  userId,
-environmentId: params.environmentId,
-});
-if(unlinked){
-yield*credentials.revokeForEnvironmentPublicKey({
-environmentId: link.environmentId,
-environmentPublicKey: link.environmentPublicKey,
-});
-}
+environmentId: link.environmentId,
+environmentPublicKey: link.environmentPublicKey,
+}).pipe(Effect.catchTag("SqlError",()=>relayInternalErrorResponse("internal_error")));
 return{ok: unlinked};
 },mapRelayCommonApiErrors("not_authorized")),
 )

infra/relay/src/environments/ManagedTunnelLimits.test.ts

@@ -4,6 +4,7 @@ import * as Layer from "effect/Layer";
 
 import*asRelayDbfrom"../db.ts";
 import{
+relayEnvironmentLinks,
 relayManagedEndpointAllocations,
 relayManagedTunnelLimits,
 }from"../persistence/schema.ts";
@@ -28,7 +29,16 @@ function makeFakeDb(input: {
 }
 expect(table).toBe(relayManagedEndpointAllocations);
 return{
-where: ()=>input.countRows??Effect.succeed([{activeTunnels: 0}]),
+innerJoin: (table: unknown,condition: unknown)=>{
+expect(table).toBe(relayEnvironmentLinks);
+expect(condition).toBeDefined();
+return{
+where: (where: unknown)=>{
+expect(where).toBeDefined();
+returninput.countRows??Effect.succeed([{activeTunnels: 0}]);
+},
+};
+},
 };
 },
 }),

infra/relay/src/environments/ManagedTunnelLimits.ts

@@ -1,11 +1,12 @@
-import{and,count,eq,ne}from"drizzle-orm";
+import{and,count,eq,isNull,ne}from"drizzle-orm";
 import*asContextfrom"effect/Context";
 import*asEffectfrom"effect/Effect";
 import*asLayerfrom"effect/Layer";
 import*asSchemafrom"effect/Schema";
 
 import*asRelayDbfrom"../db.ts";
 import{
+relayEnvironmentLinks,
 relayManagedEndpointAllocations,
 relayManagedTunnelLimits,
 }from"../persistence/schema.ts";
@@ -81,10 +82,19 @@ export const make = Effect.gen(function* () {
 constcounted=yield*db
 .select({activeTunnels: count()})
 .from(relayManagedEndpointAllocations)
+.innerJoin(
+relayEnvironmentLinks,
+and(
+eq(relayEnvironmentLinks.userId,relayManagedEndpointAllocations.userId),
+eq(relayEnvironmentLinks.environmentId,relayManagedEndpointAllocations.environmentId),
+),
+)
 .where(
 and(
 eq(relayManagedEndpointAllocations.userId,input.userId),
 ne(relayManagedEndpointAllocations.environmentId,input.environmentId),
+isNull(relayEnvironmentLinks.revokedAt),
+eq(relayEnvironmentLinks.managedTunnelsEnabled,true),
 ),
 )
 .pipe(

infra/relay/src/http/Api.test.ts

@@ -22,12 +22,15 @@ import {
 relayDocsRedirectRoute,
 relayEnvironmentAuthLayer,
 relayNotFoundRoute,
+revokeEnvironmentLinkRecord,
 traceRelayHttpRequestWith,
 verifyRelayClientBearerToken,
 withoutCapturedParentSpan,
 }from"./Api.ts";
 import*asRelayConfigurationfrom"../Config.ts";
+import*asRelayDbfrom"../db.ts";
 import*asEnvironmentCredentialsfrom"../environments/EnvironmentCredentials.ts";
+import*asEnvironmentLinksfrom"../environments/EnvironmentLinks.ts";
 
 vi.mock("@clerk/backend",()=>({
 createClerkClient: vi.fn(),
@@ -155,6 +158,48 @@ describe("relay environment authentication", () => {
 });
 });
 
+describe("relay environment unlink",()=>{
+it.effect("revokes the link and its credentials in one database transaction",()=>{
+constcalls: Array<string>=[];
+constdb={
+$client: {
+withTransaction: <A,E,R>(effect: Effect.Effect<A,E,R>)=>{
+calls.push("transaction");
+returneffect;
+},
+},
+}asunknownasRelayDb.RelayDb["Service"];
+constlinks={
+revokeForUser: ()=>
+Effect.sync(()=>{
+calls.push("link");
+returntrue;
+}),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constcredentials={
+revokeForEnvironmentPublicKey: ()=>
+Effect.sync(()=>{
+calls.push("credential");
+returntrue;
+}),
+}asunknownasEnvironmentCredentials.EnvironmentCredentials["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*revokeEnvironmentLinkRecord({
+ db,
+ links,
+ credentials,
+userId: "user-1",
+environmentId: "environment-1",
+environmentPublicKey: "public-key",
+}),
+).toBe(true);
+expect(calls).toEqual(["transaction","link","credential"]);
+});
+});
+});
+
 describe("relay request tracing",()=>{
 it.effect(
 "does not parent endpoint spans to an ambient parent captured while building handlers",

infra/relay/src/http/Api.ts

@@ -403,6 +403,33 @@ export const healthApi = HttpApiBuilder.group(
 }),
 );
 
+exportconstrevokeEnvironmentLinkRecord=Effect.fn(
+"relay.api.client.revokeEnvironmentLinkRecord",
+)(function*(input: {
+readonlydb: RelayDb.RelayDb["Service"];
+readonlylinks: EnvironmentLinks.EnvironmentLinks["Service"];
+readonlycredentials: EnvironmentCredentials.EnvironmentCredentials["Service"];
+readonlyuserId: string;
+readonlyenvironmentId: string;
+readonlyenvironmentPublicKey: string;
+}){
+returnyield*input.db.$client.withTransaction(
+Effect.gen(function*(){
+constrevoked=yield*input.links.revokeForUser({
+userId: input.userId,
+environmentId: input.environmentId,
+});
+if(revoked){
+yield*input.credentials.revokeForEnvironmentPublicKey({
+environmentId: input.environmentId,
+environmentPublicKey: input.environmentPublicKey,
+});
+}
+returnrevoked;
+}),
+);
+});
+
 exportconstmobileApi=HttpApiBuilder.group(
 RelayApi,
 "mobile",
@@ -472,6 +499,7 @@ export const clientApi = HttpApiBuilder.group(
 constmanagedEndpointProvider=yield*ManagedEndpointProvider.ManagedEndpointProvider;
 constcredentials=yield*EnvironmentCredentials.EnvironmentCredentials;
 constdevices=yield*Devices.Devices;
+constdb=yield*RelayDb.RelayDb;
 returnhandlers
 .handle(
 "listEnvironments",
@@ -605,16 +633,14 @@ export const clientApi = HttpApiBuilder.group(
 if(link===null){
 return{ok: false};
 }
-constunlinked=yield*links.revokeForUser({
+constunlinked=yield*revokeEnvironmentLinkRecord({
+ db,
+ links,
+ credentials,
  userId,
-environmentId: params.environmentId,
-});
-if(unlinked){
-yield*credentials.revokeForEnvironmentPublicKey({
-environmentId: link.environmentId,
-environmentPublicKey: link.environmentPublicKey,
-});
-}
+environmentId: link.environmentId,
+environmentPublicKey: link.environmentPublicKey,
+}).pipe(Effect.catchTag("SqlError",()=>relayInternalErrorResponse("internal_error")));
 return{ok: unlinked};
 },mapRelayCommonApiErrors("not_authorized")),
 )

infra/relay/src/environments/ManagedTunnelLimits.test.ts

@@ -4,6 +4,7 @@ import * as Layer from "effect/Layer";
 
 import*asRelayDbfrom"../db.ts";
 import{
+relayEnvironmentLinks,
 relayManagedEndpointAllocations,
 relayManagedTunnelLimits,
 }from"../persistence/schema.ts";
@@ -28,7 +29,16 @@ function makeFakeDb(input: {
 }
 expect(table).toBe(relayManagedEndpointAllocations);
 return{
-where: ()=>input.countRows??Effect.succeed([{activeTunnels: 0}]),
+innerJoin: (table: unknown,condition: unknown)=>{
+expect(table).toBe(relayEnvironmentLinks);
+expect(condition).toBeDefined();
+return{
+where: (where: unknown)=>{
+expect(where).toBeDefined();
+returninput.countRows??Effect.succeed([{activeTunnels: 0}]);
+},
+};
+},
 };
 },
 }),

infra/relay/src/environments/ManagedTunnelLimits.ts

@@ -1,11 +1,12 @@
-import{and,count,eq,ne}from"drizzle-orm";
+import{and,count,eq,isNull,ne}from"drizzle-orm";
 import*asContextfrom"effect/Context";
 import*asEffectfrom"effect/Effect";
 import*asLayerfrom"effect/Layer";
 import*asSchemafrom"effect/Schema";
 
 import*asRelayDbfrom"../db.ts";
 import{
+relayEnvironmentLinks,
 relayManagedEndpointAllocations,
 relayManagedTunnelLimits,
 }from"../persistence/schema.ts";
@@ -81,10 +82,19 @@ export const make = Effect.gen(function* () {
 constcounted=yield*db
 .select({activeTunnels: count()})
 .from(relayManagedEndpointAllocations)
+.innerJoin(
+relayEnvironmentLinks,
+and(
+eq(relayEnvironmentLinks.userId,relayManagedEndpointAllocations.userId),
+eq(relayEnvironmentLinks.environmentId,relayManagedEndpointAllocations.environmentId),
+),
+)
 .where(
 and(
 eq(relayManagedEndpointAllocations.userId,input.userId),
 ne(relayManagedEndpointAllocations.environmentId,input.environmentId),
+isNull(relayEnvironmentLinks.revokedAt),
+eq(relayEnvironmentLinks.managedTunnelsEnabled,true),
 ),
 )
 .pipe(

infra/relay/src/http/Api.test.ts

@@ -22,12 +22,15 @@ import {
 relayDocsRedirectRoute,
 relayEnvironmentAuthLayer,
 relayNotFoundRoute,
+revokeEnvironmentLinkRecord,
 traceRelayHttpRequestWith,
 verifyRelayClientBearerToken,
 withoutCapturedParentSpan,
 }from"./Api.ts";
 import*asRelayConfigurationfrom"../Config.ts";
+import*asRelayDbfrom"../db.ts";
 import*asEnvironmentCredentialsfrom"../environments/EnvironmentCredentials.ts";
+import*asEnvironmentLinksfrom"../environments/EnvironmentLinks.ts";
 
 vi.mock("@clerk/backend",()=>({
 createClerkClient: vi.fn(),
@@ -155,6 +158,48 @@ describe("relay environment authentication", () => {
 });
 });
 
+describe("relay environment unlink",()=>{
+it.effect("revokes the link and its credentials in one database transaction",()=>{
+constcalls: Array<string>=[];
+constdb={
+$client: {
+withTransaction: <A,E,R>(effect: Effect.Effect<A,E,R>)=>{
+calls.push("transaction");
+returneffect;
+},
+},
+}asunknownasRelayDb.RelayDb["Service"];
+constlinks={
+revokeForUser: ()=>
+Effect.sync(()=>{
+calls.push("link");
+returntrue;
+}),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constcredentials={
+revokeForEnvironmentPublicKey: ()=>
+Effect.sync(()=>{
+calls.push("credential");
+returntrue;
+}),
+}asunknownasEnvironmentCredentials.EnvironmentCredentials["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*revokeEnvironmentLinkRecord({
+ db,
+ links,
+ credentials,
+userId: "user-1",
+environmentId: "environment-1",
+environmentPublicKey: "public-key",
+}),
+).toBe(true);
+expect(calls).toEqual(["transaction","link","credential"]);
+});
+});
+});
+
 describe("relay request tracing",()=>{
 it.effect(
 "does not parent endpoint spans to an ambient parent captured while building handlers",

infra/relay/src/http/Api.ts

@@ -403,6 +403,33 @@ export const healthApi = HttpApiBuilder.group(
 }),
 );
 
+exportconstrevokeEnvironmentLinkRecord=Effect.fn(
+"relay.api.client.revokeEnvironmentLinkRecord",
+)(function*(input: {
+readonlydb: RelayDb.RelayDb["Service"];
+readonlylinks: EnvironmentLinks.EnvironmentLinks["Service"];
+readonlycredentials: EnvironmentCredentials.EnvironmentCredentials["Service"];
+readonlyuserId: string;
+readonlyenvironmentId: string;
+readonlyenvironmentPublicKey: string;
+}){
+returnyield*input.db.$client.withTransaction(
+Effect.gen(function*(){
+constrevoked=yield*input.links.revokeForUser({
+userId: input.userId,
+environmentId: input.environmentId,
+});
+if(revoked){
+yield*input.credentials.revokeForEnvironmentPublicKey({
+environmentId: input.environmentId,
+environmentPublicKey: input.environmentPublicKey,
+});
+}
+returnrevoked;
+}),
+);
+});
+
 exportconstmobileApi=HttpApiBuilder.group(
 RelayApi,
 "mobile",
@@ -472,6 +499,7 @@ export const clientApi = HttpApiBuilder.group(
 constmanagedEndpointProvider=yield*ManagedEndpointProvider.ManagedEndpointProvider;
 constcredentials=yield*EnvironmentCredentials.EnvironmentCredentials;
 constdevices=yield*Devices.Devices;
+constdb=yield*RelayDb.RelayDb;
 returnhandlers
 .handle(
 "listEnvironments",
@@ -605,16 +633,14 @@ export const clientApi = HttpApiBuilder.group(
 if(link===null){
 return{ok: false};
 }
-constunlinked=yield*links.revokeForUser({
+constunlinked=yield*revokeEnvironmentLinkRecord({
+ db,
+ links,
+ credentials,
  userId,
-environmentId: params.environmentId,
-});
-if(unlinked){
-yield*credentials.revokeForEnvironmentPublicKey({
-environmentId: link.environmentId,
-environmentPublicKey: link.environmentPublicKey,
-});
-}
+environmentId: link.environmentId,
+environmentPublicKey: link.environmentPublicKey,
+}).pipe(Effect.catchTag("SqlError",()=>relayInternalErrorResponse("internal_error")));
 return{ok: unlinked};
 },mapRelayCommonApiErrors("not_authorized")),
 )

infra/relay/src/environments/ManagedTunnelLimits.test.ts

@@ -4,6 +4,7 @@ import * as Layer from "effect/Layer";
 
 import*asRelayDbfrom"../db.ts";
 import{
+relayEnvironmentLinks,
 relayManagedEndpointAllocations,
 relayManagedTunnelLimits,
 }from"../persistence/schema.ts";
@@ -28,7 +29,16 @@ function makeFakeDb(input: {
 }
 expect(table).toBe(relayManagedEndpointAllocations);
 return{
-where: ()=>input.countRows??Effect.succeed([{activeTunnels: 0}]),
+innerJoin: (table: unknown,condition: unknown)=>{
+expect(table).toBe(relayEnvironmentLinks);
+expect(condition).toBeDefined();
+return{
+where: (where: unknown)=>{
+expect(where).toBeDefined();
+returninput.countRows??Effect.succeed([{activeTunnels: 0}]);
+},
+};
+},
 };
 },
 }),

infra/relay/src/environments/ManagedTunnelLimits.ts

@@ -1,11 +1,12 @@
-import{and,count,eq,ne}from"drizzle-orm";
+import{and,count,eq,isNull,ne}from"drizzle-orm";
 import*asContextfrom"effect/Context";
 import*asEffectfrom"effect/Effect";
 import*asLayerfrom"effect/Layer";
 import*asSchemafrom"effect/Schema";
 
 import*asRelayDbfrom"../db.ts";
 import{
+relayEnvironmentLinks,
 relayManagedEndpointAllocations,
 relayManagedTunnelLimits,
 }from"../persistence/schema.ts";
@@ -81,10 +82,19 @@ export const make = Effect.gen(function* () {
 constcounted=yield*db
 .select({activeTunnels: count()})
 .from(relayManagedEndpointAllocations)
+.innerJoin(
+relayEnvironmentLinks,
+and(
+eq(relayEnvironmentLinks.userId,relayManagedEndpointAllocations.userId),
+eq(relayEnvironmentLinks.environmentId,relayManagedEndpointAllocations.environmentId),
+),
+)
 .where(
 and(
 eq(relayManagedEndpointAllocations.userId,input.userId),
 ne(relayManagedEndpointAllocations.environmentId,input.environmentId),
+isNull(relayEnvironmentLinks.revokedAt),
+eq(relayEnvironmentLinks.managedTunnelsEnabled,true),
 ),
 )
 .pipe(

infra/relay/src/http/Api.test.ts

@@ -22,12 +22,15 @@ import {
 relayDocsRedirectRoute,
 relayEnvironmentAuthLayer,
 relayNotFoundRoute,
+revokeEnvironmentLinkRecord,
 traceRelayHttpRequestWith,
 verifyRelayClientBearerToken,
 withoutCapturedParentSpan,
 }from"./Api.ts";
 import*asRelayConfigurationfrom"../Config.ts";
+import*asRelayDbfrom"../db.ts";
 import*asEnvironmentCredentialsfrom"../environments/EnvironmentCredentials.ts";
+import*asEnvironmentLinksfrom"../environments/EnvironmentLinks.ts";
 
 vi.mock("@clerk/backend",()=>({
 createClerkClient: vi.fn(),
@@ -155,6 +158,48 @@ describe("relay environment authentication", () => {
 });
 });
 
+describe("relay environment unlink",()=>{
+it.effect("revokes the link and its credentials in one database transaction",()=>{
+constcalls: Array<string>=[];
+constdb={
+$client: {
+withTransaction: <A,E,R>(effect: Effect.Effect<A,E,R>)=>{
+calls.push("transaction");
+returneffect;
+},
+},
+}asunknownasRelayDb.RelayDb["Service"];
+constlinks={
+revokeForUser: ()=>
+Effect.sync(()=>{
+calls.push("link");
+returntrue;
+}),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constcredentials={
+revokeForEnvironmentPublicKey: ()=>
+Effect.sync(()=>{
+calls.push("credential");
+returntrue;
+}),
+}asunknownasEnvironmentCredentials.EnvironmentCredentials["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*revokeEnvironmentLinkRecord({
+ db,
+ links,
+ credentials,
+userId: "user-1",
+environmentId: "environment-1",
+environmentPublicKey: "public-key",
+}),
+).toBe(true);
+expect(calls).toEqual(["transaction","link","credential"]);
+});
+});
+});
+
 describe("relay request tracing",()=>{
 it.effect(
 "does not parent endpoint spans to an ambient parent captured while building handlers",

infra/relay/src/http/Api.ts

@@ -403,6 +403,33 @@ export const healthApi = HttpApiBuilder.group(
 }),
 );
 
+exportconstrevokeEnvironmentLinkRecord=Effect.fn(
+"relay.api.client.revokeEnvironmentLinkRecord",
+)(function*(input: {
+readonlydb: RelayDb.RelayDb["Service"];
+readonlylinks: EnvironmentLinks.EnvironmentLinks["Service"];
+readonlycredentials: EnvironmentCredentials.EnvironmentCredentials["Service"];
+readonlyuserId: string;
+readonlyenvironmentId: string;
+readonlyenvironmentPublicKey: string;
+}){
+returnyield*input.db.$client.withTransaction(
+Effect.gen(function*(){
+constrevoked=yield*input.links.revokeForUser({
+userId: input.userId,
+environmentId: input.environmentId,
+});
+if(revoked){
+yield*input.credentials.revokeForEnvironmentPublicKey({
+environmentId: input.environmentId,
+environmentPublicKey: input.environmentPublicKey,
+});
+}
+returnrevoked;
+}),
+);
+});
+
 exportconstmobileApi=HttpApiBuilder.group(
 RelayApi,
 "mobile",
@@ -472,6 +499,7 @@ export const clientApi = HttpApiBuilder.group(
 constmanagedEndpointProvider=yield*ManagedEndpointProvider.ManagedEndpointProvider;
 constcredentials=yield*EnvironmentCredentials.EnvironmentCredentials;
 constdevices=yield*Devices.Devices;
+constdb=yield*RelayDb.RelayDb;
 returnhandlers
 .handle(
 "listEnvironments",
@@ -605,16 +633,14 @@ export const clientApi = HttpApiBuilder.group(
 if(link===null){
 return{ok: false};
 }
-constunlinked=yield*links.revokeForUser({
+constunlinked=yield*revokeEnvironmentLinkRecord({
+ db,
+ links,
+ credentials,
  userId,
-environmentId: params.environmentId,
-});
-if(unlinked){
-yield*credentials.revokeForEnvironmentPublicKey({
-environmentId: link.environmentId,
-environmentPublicKey: link.environmentPublicKey,
-});
-}
+environmentId: link.environmentId,
+environmentPublicKey: link.environmentPublicKey,
+}).pipe(Effect.catchTag("SqlError",()=>relayInternalErrorResponse("internal_error")));
 return{ok: unlinked};
 },mapRelayCommonApiErrors("not_authorized")),
 )

infra/relay/src/environments/ManagedTunnelLimits.test.ts

@@ -4,6 +4,7 @@ import * as Layer from "effect/Layer";
 
 import*asRelayDbfrom"../db.ts";
 import{
+relayEnvironmentLinks,
 relayManagedEndpointAllocations,
 relayManagedTunnelLimits,
 }from"../persistence/schema.ts";
@@ -28,7 +29,16 @@ function makeFakeDb(input: {
 }
 expect(table).toBe(relayManagedEndpointAllocations);
 return{
-where: ()=>input.countRows??Effect.succeed([{activeTunnels: 0}]),
+innerJoin: (table: unknown,condition: unknown)=>{
+expect(table).toBe(relayEnvironmentLinks);
+expect(condition).toBeDefined();
+return{
+where: (where: unknown)=>{
+expect(where).toBeDefined();
+returninput.countRows??Effect.succeed([{activeTunnels: 0}]);
+},
+};
+},
 };
 },
 }),

infra/relay/src/environments/ManagedTunnelLimits.ts

@@ -1,11 +1,12 @@
-import{and,count,eq,ne}from"drizzle-orm";
+import{and,count,eq,isNull,ne}from"drizzle-orm";
 import*asContextfrom"effect/Context";
 import*asEffectfrom"effect/Effect";
 import*asLayerfrom"effect/Layer";
 import*asSchemafrom"effect/Schema";
 
 import*asRelayDbfrom"../db.ts";
 import{
+relayEnvironmentLinks,
 relayManagedEndpointAllocations,
 relayManagedTunnelLimits,
 }from"../persistence/schema.ts";
@@ -81,10 +82,19 @@ export const make = Effect.gen(function* () {
 constcounted=yield*db
 .select({activeTunnels: count()})
 .from(relayManagedEndpointAllocations)
+.innerJoin(
+relayEnvironmentLinks,
+and(
+eq(relayEnvironmentLinks.userId,relayManagedEndpointAllocations.userId),
+eq(relayEnvironmentLinks.environmentId,relayManagedEndpointAllocations.environmentId),
+),
+)
 .where(
 and(
 eq(relayManagedEndpointAllocations.userId,input.userId),
 ne(relayManagedEndpointAllocations.environmentId,input.environmentId),
+isNull(relayEnvironmentLinks.revokedAt),
+eq(relayEnvironmentLinks.managedTunnelsEnabled,true),
 ),
 )
 .pipe(

infra/relay/src/http/Api.test.ts

@@ -22,12 +22,15 @@ import {
 relayDocsRedirectRoute,
 relayEnvironmentAuthLayer,
 relayNotFoundRoute,
+revokeEnvironmentLinkRecord,
 traceRelayHttpRequestWith,
 verifyRelayClientBearerToken,
 withoutCapturedParentSpan,
 }from"./Api.ts";
 import*asRelayConfigurationfrom"../Config.ts";
+import*asRelayDbfrom"../db.ts";
 import*asEnvironmentCredentialsfrom"../environments/EnvironmentCredentials.ts";
+import*asEnvironmentLinksfrom"../environments/EnvironmentLinks.ts";
 
 vi.mock("@clerk/backend",()=>({
 createClerkClient: vi.fn(),
@@ -155,6 +158,48 @@ describe("relay environment authentication", () => {
 });
 });
 
+describe("relay environment unlink",()=>{
+it.effect("revokes the link and its credentials in one database transaction",()=>{
+constcalls: Array<string>=[];
+constdb={
+$client: {
+withTransaction: <A,E,R>(effect: Effect.Effect<A,E,R>)=>{
+calls.push("transaction");
+returneffect;
+},
+},
+}asunknownasRelayDb.RelayDb["Service"];
+constlinks={
+revokeForUser: ()=>
+Effect.sync(()=>{
+calls.push("link");
+returntrue;
+}),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constcredentials={
+revokeForEnvironmentPublicKey: ()=>
+Effect.sync(()=>{
+calls.push("credential");
+returntrue;
+}),
+}asunknownasEnvironmentCredentials.EnvironmentCredentials["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*revokeEnvironmentLinkRecord({
+ db,
+ links,
+ credentials,
+userId: "user-1",
+environmentId: "environment-1",
+environmentPublicKey: "public-key",
+}),
+).toBe(true);
+expect(calls).toEqual(["transaction","link","credential"]);
+});
+});
+});
+
 describe("relay request tracing",()=>{
 it.effect(
 "does not parent endpoint spans to an ambient parent captured while building handlers",

infra/relay/src/http/Api.ts

@@ -403,6 +403,33 @@ export const healthApi = HttpApiBuilder.group(
 }),
 );
 
+exportconstrevokeEnvironmentLinkRecord=Effect.fn(
+"relay.api.client.revokeEnvironmentLinkRecord",
+)(function*(input: {
+readonlydb: RelayDb.RelayDb["Service"];
+readonlylinks: EnvironmentLinks.EnvironmentLinks["Service"];
+readonlycredentials: EnvironmentCredentials.EnvironmentCredentials["Service"];
+readonlyuserId: string;
+readonlyenvironmentId: string;
+readonlyenvironmentPublicKey: string;
+}){
+returnyield*input.db.$client.withTransaction(
+Effect.gen(function*(){
+constrevoked=yield*input.links.revokeForUser({
+userId: input.userId,
+environmentId: input.environmentId,
+});
+if(revoked){
+yield*input.credentials.revokeForEnvironmentPublicKey({
+environmentId: input.environmentId,
+environmentPublicKey: input.environmentPublicKey,
+});
+}
+returnrevoked;
+}),
+);
+});
+
 exportconstmobileApi=HttpApiBuilder.group(
 RelayApi,
 "mobile",
@@ -472,6 +499,7 @@ export const clientApi = HttpApiBuilder.group(
 constmanagedEndpointProvider=yield*ManagedEndpointProvider.ManagedEndpointProvider;
 constcredentials=yield*EnvironmentCredentials.EnvironmentCredentials;
 constdevices=yield*Devices.Devices;
+constdb=yield*RelayDb.RelayDb;
 returnhandlers
 .handle(
 "listEnvironments",
@@ -605,16 +633,14 @@ export const clientApi = HttpApiBuilder.group(
 if(link===null){
 return{ok: false};
 }
-constunlinked=yield*links.revokeForUser({
+constunlinked=yield*revokeEnvironmentLinkRecord({
+ db,
+ links,
+ credentials,
  userId,
-environmentId: params.environmentId,
-});
-if(unlinked){
-yield*credentials.revokeForEnvironmentPublicKey({
-environmentId: link.environmentId,
-environmentPublicKey: link.environmentPublicKey,
-});
-}
+environmentId: link.environmentId,
+environmentPublicKey: link.environmentPublicKey,
+}).pipe(Effect.catchTag("SqlError",()=>relayInternalErrorResponse("internal_error")));
 return{ok: unlinked};
 },mapRelayCommonApiErrors("not_authorized")),
 )

infra/relay/src/environments/ManagedTunnelLimits.test.ts

@@ -4,6 +4,7 @@ import * as Layer from "effect/Layer";
 
 import*asRelayDbfrom"../db.ts";
 import{
+relayEnvironmentLinks,
 relayManagedEndpointAllocations,
 relayManagedTunnelLimits,
 }from"../persistence/schema.ts";
@@ -28,7 +29,16 @@ function makeFakeDb(input: {
 }
 expect(table).toBe(relayManagedEndpointAllocations);
 return{
-where: ()=>input.countRows??Effect.succeed([{activeTunnels: 0}]),
+innerJoin: (table: unknown,condition: unknown)=>{
+expect(table).toBe(relayEnvironmentLinks);
+expect(condition).toBeDefined();
+return{
+where: (where: unknown)=>{
+expect(where).toBeDefined();
+returninput.countRows??Effect.succeed([{activeTunnels: 0}]);
+},
+};
+},
 };
 },
 }),

infra/relay/src/environments/ManagedTunnelLimits.ts

@@ -1,11 +1,12 @@
-import{and,count,eq,ne}from"drizzle-orm";
+import{and,count,eq,isNull,ne}from"drizzle-orm";
 import*asContextfrom"effect/Context";
 import*asEffectfrom"effect/Effect";
 import*asLayerfrom"effect/Layer";
 import*asSchemafrom"effect/Schema";
 
 import*asRelayDbfrom"../db.ts";
 import{
+relayEnvironmentLinks,
 relayManagedEndpointAllocations,
 relayManagedTunnelLimits,
 }from"../persistence/schema.ts";
@@ -81,10 +82,19 @@ export const make = Effect.gen(function* () {
 constcounted=yield*db
 .select({activeTunnels: count()})
 .from(relayManagedEndpointAllocations)
+.innerJoin(
+relayEnvironmentLinks,
+and(
+eq(relayEnvironmentLinks.userId,relayManagedEndpointAllocations.userId),
+eq(relayEnvironmentLinks.environmentId,relayManagedEndpointAllocations.environmentId),
+),
+)
 .where(
 and(
 eq(relayManagedEndpointAllocations.userId,input.userId),
 ne(relayManagedEndpointAllocations.environmentId,input.environmentId),
+isNull(relayEnvironmentLinks.revokedAt),
+eq(relayEnvironmentLinks.managedTunnelsEnabled,true),
 ),
 )
 .pipe(

infra/relay/src/http/Api.test.ts

@@ -22,12 +22,15 @@ import {
 relayDocsRedirectRoute,
 relayEnvironmentAuthLayer,
 relayNotFoundRoute,
+revokeEnvironmentLinkRecord,
 traceRelayHttpRequestWith,
 verifyRelayClientBearerToken,
 withoutCapturedParentSpan,
 }from"./Api.ts";
 import*asRelayConfigurationfrom"../Config.ts";
+import*asRelayDbfrom"../db.ts";
 import*asEnvironmentCredentialsfrom"../environments/EnvironmentCredentials.ts";
+import*asEnvironmentLinksfrom"../environments/EnvironmentLinks.ts";
 
 vi.mock("@clerk/backend",()=>({
 createClerkClient: vi.fn(),
@@ -155,6 +158,48 @@ describe("relay environment authentication", () => {
 });
 });
 
+describe("relay environment unlink",()=>{
+it.effect("revokes the link and its credentials in one database transaction",()=>{
+constcalls: Array<string>=[];
+constdb={
+$client: {
+withTransaction: <A,E,R>(effect: Effect.Effect<A,E,R>)=>{
+calls.push("transaction");
+returneffect;
+},
+},
+}asunknownasRelayDb.RelayDb["Service"];
+constlinks={
+revokeForUser: ()=>
+Effect.sync(()=>{
+calls.push("link");
+returntrue;
+}),
+}asunknownasEnvironmentLinks.EnvironmentLinks["Service"];
+constcredentials={
+revokeForEnvironmentPublicKey: ()=>
+Effect.sync(()=>{
+calls.push("credential");
+returntrue;
+}),
+}asunknownasEnvironmentCredentials.EnvironmentCredentials["Service"];
+
+returnEffect.gen(function*(){
+expect(
+yield*revokeEnvironmentLinkRecord({
+ db,
+ links,
+ credentials,
+userId: "user-1",
+environmentId: "environment-1",
+environmentPublicKey: "public-key",
+}),
+).toBe(true);
+expect(calls).toEqual(["transaction","link","credential"]);
+});
+});
+});
+
 describe("relay request tracing",()=>{
 it.effect(
 "does not parent endpoint spans to an ambient parent captured while building handlers",

infra/relay/src/http/Api.ts

@@ -403,6 +403,33 @@ export const healthApi = HttpApiBuilder.group(
 }),
 );
 
+exportconstrevokeEnvironmentLinkRecord=Effect.fn(
+"relay.api.client.revokeEnvironmentLinkRecord",
+)(function*(input: {
+readonlydb: RelayDb.RelayDb["Service"];
+readonlylinks: EnvironmentLinks.EnvironmentLinks["Service"];
+readonlycredentials: EnvironmentCredentials.EnvironmentCredentials["Service"];
+readonlyuserId: string;
+readonlyenvironmentId: string;
+readonlyenvironmentPublicKey: string;
+}){
+returnyield*input.db.$client.withTransaction(
+Effect.gen(function*(){
+constrevoked=yield*input.links.revokeForUser({
+userId: input.userId,
+environmentId: input.environmentId,
+});
+if(revoked){
+yield*input.credentials.revokeForEnvironmentPublicKey({
+environmentId: input.environmentId,
+environmentPublicKey: input.environmentPublicKey,
+});
+}
+returnrevoked;
+}),
+);
+});
+
 exportconstmobileApi=HttpApiBuilder.group(
 RelayApi,
 "mobile",
@@ -472,6 +499,7 @@ export const clientApi = HttpApiBuilder.group(
 constmanagedEndpointProvider=yield*ManagedEndpointProvider.ManagedEndpointProvider;
 constcredentials=yield*EnvironmentCredentials.EnvironmentCredentials;
 constdevices=yield*Devices.Devices;
+constdb=yield*RelayDb.RelayDb;
 returnhandlers
 .handle(
 "listEnvironments",
@@ -605,16 +633,14 @@ export const clientApi = HttpApiBuilder.group(
 if(link===null){
 return{ok: false};
 }
-constunlinked=yield*links.revokeForUser({
+constunlinked=yield*revokeEnvironmentLinkRecord({
+ db,
+ links,
+ credentials,
  userId,
-environmentId: params.environmentId,
-});
-if(unlinked){
-yield*credentials.revokeForEnvironmentPublicKey({
-environmentId: link.environmentId,
-environmentPublicKey: link.environmentPublicKey,
-});
-}
+environmentId: link.environmentId,
+environmentPublicKey: link.environmentPublicKey,
+}).pipe(Effect.catchTag("SqlError",()=>relayInternalErrorResponse("internal_error")));
 return{ok: unlinked};
 },mapRelayCommonApiErrors("not_authorized")),
 )