15 KiB
15 KiB
| phase | plan | type | wave | depends_on | files_modified | autonomous | requirements | must_haves | |||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 13-scheduler-admin-toggle | 01 | execute | 1 |
|
true |
|
|
Purpose: Delivers PAX8-07 (daily scheduled sync) and the scheduler-side half of PAX8-09
(disable enforcement). PAX8 becomes the first Pulse integration where the DB toggle gates
an action (a scheduled run), not just health-check display.
Output: A seeded pax8-daily schedule row, a dual-guarded dispatch branch in
executeScheduledSync, and a CLAUDE.md note recording the new gating precedent.
<execution_context> @$HOME/.claude/get-shit-done/workflows/execute-plan.md @$HOME/.claude/get-shit-done/templates/summary.md </execution_context>
@.planning/PROJECT.md @.planning/ROADMAP.md @.planning/STATE.md @.planning/phases/13-scheduler-admin-toggle/13-CONTEXT.md @.planning/phases/13-scheduler-admin-toggle/13-PATTERNS.mdFrom lib/services/pax8-sync-service.ts: isSyncInProgress(): boolean async fullSync(triggeredBy = 'manual'): Promise // call with 'scheduled' getPax8SyncService(): Pax8SyncService // factory export
From lib/services/pax8-factory.ts: isPax8Configured(): boolean // true only when PAX8_CLIENT_ID && PAX8_CLIENT_SECRET set
From lib/services/sync-scheduler.ts:
- line 8:
import { postgresClient } from './postgres-client';(already imported — reuse, no new import) - line 25: the sync_type union that must be extended with 'pax8-daily'
- lines 445-457: the appgate-sessions/appgate-daily branch = direct template for guard style
- createDefaultSchedules() / defaultSchedules array (~line 168-310): DO NOT add pax8 here — virgin-table only
DB toggle query shape (from integration-health.ts getDbDisabledKeys, lines 295-308):
SELECT disabled FROM integration_settings WHERE key = 'pax8' (single-key form)
Read result as: rows[0]?.disabled === true (no row => not disabled => runs — correct default)
Write a single `INSERT INTO sync_schedules (id, name, description, cron_expression, sync_type, is_enabled) SELECT ... WHERE NOT EXISTS (SELECT 1 FROM sync_schedules WHERE name = 'PAX8 Daily Sync')` with these exact literal values:
- id: 'pax8-daily'
- name: 'PAX8 Daily Sync'
- description: 'Full PAX8 sync — companies, subscriptions, products, orders, and company matching, daily at 4 AM.'
- cron_expression: '0 4 * * *' (per D-04 — 4:00 AM, grouping with the backend-reconciliation cluster)
- sync_type: 'pax8-daily'
- is_enabled: false (per D-discretion — every new integration schedule ships disabled; an admin opts in via the schedule editor)
Use the 089 `WHERE NOT EXISTS` style, NOT 090's `ON CONFLICT (id) DO NOTHING`. All values are static literals — no parameters, no string interpolation of any input (this keeps the seed non-injectable, see threat T-13-02).
Then apply the migration to the running dev DB: `docker exec -i pulse-postgres psql -U pulse_user -d pulse_autotask < migrations/096_pax8_daily_schedule.sql` (POSTGRES_USER defaults to pulse_user and POSTGRES_DB to pulse_autotask per docker-compose.yml; if either differs in .env, read the real value from .env first). Re-running the file must be a no-op (idempotent) — verify by running it twice.
(1) Extend the `sync_type` union at line 25 by adding the literal `'pax8-daily'` (append to the existing union — it currently ends with `... | 'appgate-sessions' | 'appgate-daily' | 'tickets-reconcile'`). This is the only place the type needs extending.
(2) Add a new `else if (config.sync_type === 'pax8-daily')` branch inside `executeScheduledSync`, placed immediately after the appgate branch (after line 457) to keep integration-toggle blocks together. The branch performs TWO independent guards before running, matching the lazy-dynamic-import style of the appgate branch:
- Lazy `await import('@/lib/services/pax8-factory')` for `isPax8Configured`. If NOT configured: `console.log('[SCHEDULER] Skipping pax8-daily — PAX8 not configured')` and do nothing else.
- Otherwise query `postgresClient.query<{ disabled: boolean }>("SELECT disabled FROM integration_settings WHERE key = 'pax8'")` (postgresClient is already imported at line 8 — do NOT add an import; use a constant literal SQL string, no interpolation). If `rows[0]?.disabled === true`: `console.log('[SCHEDULER] Skipping pax8-daily — PAX8 disabled via /admin/integrations')` and do nothing else.
- Otherwise lazy `await import('@/lib/services/pax8-sync-service')` for `getPax8SyncService`, then `await getPax8SyncService().fullSync('scheduled')`.
Constraints (do NOT violate):
- Do NOT add a pax8-daily entry to the `defaultSchedules` array / createDefaultSchedules() — the seed lives only in migration 096 (Task 1).
- Do NOT add mid-flight cancellation to fullSync's per-entity loop (D-03 — a sync already running is allowed to finish; the guard only prevents the NEXT tick from starting).
- Do NOT add a failure alert / Teams webhook (D-05 — a failed run just sets sync_schedules.last_status='failed'/last_error via the existing shared success/failure path; leave that path untouched).
- Do NOT modify getDbDisabledKeys()/applyDisableOverlay() in integration-health.ts, and do NOT extract a shared helper (D-01 — this is a PAX8-only inline check).
- Do NOT touch any other branch in the switch.
<threat_model>
Trust Boundaries
| Boundary | Description |
|---|---|
| cron scheduler → Pax8SyncService | Scheduled dispatch must respect the operator's disable toggle before triggering a sync |
| migration seed → Postgres | Static DDL/DML applied to the sync_schedules table on an existing volume |
STRIDE Threat Register
| Threat ID | Category | Component | Disposition | Mitigation Plan |
|---|---|---|---|---|
| T-13-01 | Elevation of Privilege | pax8-daily scheduler branch | mitigate | Branch checks integration_settings.key='pax8' disabled flag AND isPax8Configured() before calling fullSync; a disabled toggle stops the next tick (Task 2) |
| T-13-02 | Tampering (SQL injection) | migration 096 seed | mitigate | Seed is static literals only — no parameters, no interpolation of any input; nothing user-controlled reaches the INSERT (Task 1) |
| T-13-03 | Denial of Service | repeated scheduled/manual runs | accept | Existing isSyncInProgress() 409 guard makes a running sync atomic (D-03); no new surface added this plan |
| T-13-SC | Tampering | npm/pip/cargo installs | accept | No package installs in this plan — all four edits use existing dependencies; no Package Legitimacy Gate needed |
| </threat_model> |
<success_criteria>
- Migration 096 seeds the pax8-daily row idempotently (is_enabled false, cron 0 4 * * *).
- executeScheduledSync has a dual-guarded pax8-daily branch calling fullSync('scheduled').
- Disabling PAX8 in integration_settings makes the branch skip with a distinct log.
- No changes to defaultSchedules, no cancellation logic, no failure alerts, no shared helper. </success_criteria>