OUT-3574: daily cron to auto-refresh QBO refresh tokens

[SandipBajracharya]

Summary

• Idle portals previously needed manual re-auth once their ~100-day refresh token lapsed. New daily Vercel cron at GET /api/quickbooks/refresh-tokens (06:00 UTC) sweeps any portal with qb_settings.sync_flag = true whose refresh token expires within 14 days and rotates it via the existing race-aware getRefreshedQbTokenInfo helper.
• 14-day lead × daily run = comfortable headroom for extended outages (broken deploy across a long weekend, Intuit incident) before any portal actually expires. Refreshing earlier than strictly needed is the same shape of API call, so the conservative window costs nothing.
• Per-run cap of 150 portals fits the non–Fluid-Compute 300 s function budget. Soonest-to-expire ordering means urgency is preserved if a backlog ever exceeds the cap.

Code sites

• Selector: src/db/service/token.service.ts → getPortalsWithExpiringRefreshTokens (INNER JOIN on qb_settings.sync_flag = true)
• Endpoint: src/app/api/quickbooks/refresh-tokens/{route.ts, refresh-tokens.controller.ts, refresh-tokens.service.ts}
• Cron: vercel.json → 0 6 * * *

Out of scope (intentional)

• Auto-suspending revoked portals — isSuspended is dead code today; revocation is logged + Sentry-captured + counted but doesn't mutate state.
• IU notification on revocation — separate ticket.

Test plan

• Unit tests for the loop driver, error isolation, and revocation counter
• Integration test for the SQL interval predicate, soonest-first ordering, and end-to-end persistence
• yarn tsc --noEmit clean; yarn lint:check shows only pre-existing warnings
• Verify the cron run on Vercel after deploy (check Sentry + logs for scanned/refreshed summary)

🤖 Generated with Claude Code

[linear-code]

OUT-3574 Explore: Ways to fix refresh token expiry limitation

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
quickbooks-sync	Building		Apr 30, 2026 9:29am
quickbooks-sync (dev)	Ready	Preview, Comment	Apr 30, 2026 9:29am

[greptile-apps]

Greptile Summary

This PR introduces a daily Vercel cron (GET /api/quickbooks/refresh-tokens, 06:00 UTC) that proactively rotates QBO refresh tokens expiring within 14 days for portals with sync_flag = true, capped at 150 portals per run ordered by urgency. The implementation reuses the existing race-aware getRefreshedQbTokenInfo helper and isolates per-portal errors so a single revocation or network blip doesn't abort the batch. Overall the code is well-structured and well-tested.

Confidence Score: 4/5

Safe to merge; two P2 findings worth addressing but neither blocks correctness under current Intuit TTL behaviour.

Only P2 findings present: ORDER BY uses tokenSetTime as a proxy for expiry order (works because Intuit uses a uniform TTL today, but would break if TTLs ever diverge), and sequential processing of 150 portals at ~2 s each sits right at the 300 s Vercel timeout with no safety margin. No P0/P1 issues found.

src/db/service/token.service.ts (ORDER BY semantics) and src/app/api/quickbooks/refresh-tokens/refresh-tokens.service.ts (batch timeout headroom)

Important Files Changed

Filename	Overview
src/db/service/token.service.ts	Adds getPortalsWithExpiringRefreshTokens with a correct SQL interval predicate and INNER JOIN on qb_settings; ORDER BY tokenSetTime is a proxy for expiry order that only holds when all portals share the same XRefreshTokenExpiresIn TTL.
src/app/api/quickbooks/refresh-tokens/refresh-tokens.service.ts	Well-structured batch loop with per-portal error isolation; sequential processing leaves almost no headroom against the 300 s Vercel function timeout at the 150-portal cap.
src/app/api/quickbooks/refresh-tokens/refresh-tokens.controller.ts	Correctly guards against missing CRON_SECRET env var using an explicit !cronSecret check before the Bearer comparison to prevent the "Bearer undefined" bypass.
src/app/api/quickbooks/refresh-tokens/route.ts	Minimal route file; sets maxDuration = 300, uses withErrorHandler, delegates to the controller. No issues.
test/integration/quickbooks/refreshTokens/expiringSweep.test.ts	Good end-to-end integration coverage: auth rejection, SQL interval predicate, soonest-first ordering, DB persistence, and all three exclusion paths (soft-deleted, no-settings, syncFlag=false).
test/unit/api/quickbooks/refresh-tokens/refresh-tokens.service.test.ts	Comprehensive unit tests cover the loop driver, error isolation, revocation counting, and empty-batch case; hoisted mock for QBReconnectRequiredError avoids DB-import issues cleanly.
vercel.json	Adds daily 06:00 UTC cron entry; missing trailing newline at end of file.

Sequence Diagram

sequenceDiagram
    participant Vercel as Vercel Scheduler (06:00 UTC)
    participant Route as GET /api/quickbooks/refresh-tokens
    participant Controller as refreshExpiringTokensCron
    participant Service as refreshExpiringTokens
    participant DB as PostgreSQL
    participant Intuit as Intuit OAuth API

    Vercel->>Route: GET (Authorization: Bearer CRON_SECRET)
    Route->>Controller: withErrorHandler(refreshExpiringTokensCron)
    Controller->>Controller: Validate Bearer token
    Controller->>Service: refreshExpiringTokens()
    Service->>DB: getPortalsWithExpiringRefreshTokens(14 days, 150)
    DB-->>Service: portals[] (expiring soonest-first, up to 150)
    loop for each portal
        Service->>Intuit: getRefreshedQbTokenInfo(portalId, row)
        Intuit-->>Service: new access_token + refresh_token
        Service->>DB: UPDATE qb_portal_connections SET tokens, tokenSetTime
        alt QBReconnectRequiredError
            Service->>Service: reconnectRequired++, Sentry.captureException
        else other error
            Service->>Service: errored++, Sentry.captureException
        end
    end
    Service-->>Controller: scanned/refreshed/reconnectRequired/errored
    Controller-->>Route: NextResponse.json success + summary
    Route-->>Vercel: 200 OK

Loading

_{Reviews (1): Last reviewed commit: "feat(OUT-3574): daily cron to auto-refre..." | Re-trigger Greptile}

[priosshrsth]

lgtm