fix(core): dedupe integration on re-authorize

[d-klotz]

Summary

• CreateIntegration now looks up an existing integration by (userId, config.type, entityIds) before creating a new one. If found, the existing record is reused and testAuth() runs so stale credentials surface via the usual status/messages pipeline — no ON_CREATE re-send, no config overwrite.
• Entity identity already encodes the external account because ProcessAuthorizationCallback.findOrCreateEntity dedupes entities by (userId, moduleName, externalId). Re-auth returns the same entity.id, so the integration record was the only place duplicates still leaked in.
• Entity comparison is order-insensitive (it's a set).

Files changed

• integrations/use-cases/create-integration.js — dedup logic + _buildInstance extraction.
• integrations/repositories/integration-repository-interface.js — new abstract findIntegrationByUserIdTypeAndEntities.
• integrations/repositories/integration-repository-{mongo,postgres,documentdb}.js — implementations. Filter by userId + config.type at the DB layer, then order-insensitive set equality on entity IDs in JS.
• integrations/tests/doubles/test-integration-repository.js — in-memory version.
• integrations/tests/doubles/dummy-integration-class.js — adds a testAuth() spy (no other tests reference it).
• integrations/tests/use-cases/create-integration.test.js — 6 new cases.

Test plan

• npm test -- --testPathPattern="create-integration" — 13/13 pass (6 new).
• npm test -- --testPathPattern="integrations/tests" — 129/129 pass.
• Lint: no new errors. Pre-existing abstract-method arg warnings only.

Notes

• Behaviour change only on the "re-auth" path — fresh creations unchanged.
• The testAuth() on reuse writes to messages.errors and flips status to ERROR on failure via UpdateIntegrationStatus / UpdateIntegrationMessages, so the API response naturally reflects credential validity.

[sonarqubecloud]

Quality Gate failed

Failed conditions
D Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dd85498e4a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Return refreshed state after re-auth testAuth

When an existing integration is reused, instance.testAuth() persists status/message changes through repository use-cases, but those writes do not mutate the in-memory instance object; immediately mapping instance to DTO can therefore return stale status/messages even when auth just failed. This affects re-authorize requests that depend on the response payload to reflect credential validity, so the flow should reload the integration (or update the instance fields) before returning.

Useful? React with 👍 / 👎.

[d-klotz]

Code review

Found 1 issue:

1. On the reuse path, await instance.testAuth() persists status/messages to the DB via updateIntegrationStatus.execute(...) / updateIntegrationMessages.execute(...) but does not mutate this.status / this.messages on the in-memory instance. The next line returns mapIntegrationClassToIntegrationDTO(instance), which reads directly from the instance — so when auth has just failed, the DB row is ERROR but the HTTP response still shows the pre-testAuth status (typically ENABLED) with no errors. This contradicts this PR's own JSDoc promising stale credentials "surface as an ERROR status / message".

frigg/packages/core/integrations/use-cases/create-integration.js

Lines 49 to 57 in dd85498

	);
	if (existing) {
	const instance = await this._buildInstance(existing);
	await instance.testAuth();
	return mapIntegrationClassToIntegrationDTO(instance);
	}
	const integrationRecord =

Fix options: re-read the record from the repository after testAuth() and map that, or have testAuth() also mutate the instance's status / messages when it updates the DB.

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}