fix(telegram): match the active bot with the env the caller resolved its token with

Subscription creation resolves the incoming bot token with the deployer's env,
while cleanup resolves with the background env; the active-row matcher now
uses the same env as its caller, so a bot referenced through a personal
variable still reuses the active secret and is not deleted from under the
active deployment.

Tests: the idempotency service gets one central mock in @sim/testing, used by
every test that mocked it locally, and the new tests import single factory and
mock files instead of the @sim/testing barrel.

Author: waleedlatif1

apps/sim/lib/billing/checkout-admission.test.ts

@@ -1,33 +1,19 @@
+import {
+  idempotencyServiceMock,
+  idempotencyServiceMockFns,
+} from '@sim/testing/mocks/idempotency-service.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockAtomicallyClaim, mockRelease, mockIdempotencyService } = vi.hoisted(() => ({
-  mockAtomicallyClaim: vi.fn(),
-  mockRelease: vi.fn(),
-  mockIdempotencyService: vi.fn(),
-}))
-
-vi.mock('@/lib/core/idempotency/service', () => ({
-  IdempotencyService: class MockIdempotencyService {
-    constructor(options: unknown) {
-      mockIdempotencyService(options)
-    }
-
-    atomicallyClaim(...args: unknown[]) {
-      return mockAtomicallyClaim(...args)
-    }
-
-    release(...args: unknown[]) {
-      return mockRelease(...args)
-    }
-  },
-}))
+vi.mock('@/lib/core/idempotency/service', () => idempotencyServiceMock)
 
 import {
   claimCheckoutAdmission,
   releaseCheckoutAdmission,
   resolveCheckoutReferenceId,
 } from '@/lib/billing/checkout-admission'
 
+const { mockAtomicallyClaim, mockRelease } = idempotencyServiceMockFns
+
 describe('checkout admission', () => {
   beforeEach(() => {
     mockAtomicallyClaim.mockReset()

apps/sim/lib/execution/preprocessing.test.ts

@@ -1,4 +1,4 @@
-import { loggingSessionMock, loggingSessionMockFns, workflowAuthzMockFns } from '@sim/testing'
+import { loggingSessionMock, workflowAuthzMockFns } from '@sim/testing'
 import { authBanMock, authBanMockFns } from '@sim/testing/mocks/auth-ban.mock'
 import {
   billingAttributionMock,
@@ -15,6 +15,7 @@ import {
   billingUsageReservationMockFns,
 } from '@sim/testing/mocks/billing-usage-reservation.mock'
 import { executionLimitsMock } from '@sim/testing/mocks/execution-limits.mock'
+import { loggingSessionMockFns } from '@sim/testing/mocks/logging-session.mock'
 import { createMockRedis } from '@sim/testing/mocks/redis.mock'
 import { redisConfigMockFns, resetRedisConfigMock } from '@sim/testing/mocks/redis-config.mock'
 import { utilsHelpersMock } from '@sim/testing/mocks/utils-helpers.mock'

apps/sim/lib/webhooks/polling/google-calendar.test.ts

@@ -1,6 +1,7 @@
 import { createLogger } from '@sim/logger'
-import { createWorkflowRecord } from '@sim/testing'
+import { createWorkflowRecord } from '@sim/testing/factories/permission.factory'
 import { jsonResponse } from '@sim/testing/helpers/http'
+import { idempotencyServiceMock } from '@sim/testing/mocks/idempotency-service.mock'
 import {
   webhooksPollingUtilsMock,
   webhooksPollingUtilsMockFns,
@@ -11,13 +12,7 @@ import {
 } from '@sim/testing/mocks/webhooks-processor.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-vi.mock('@/lib/core/idempotency/service', () => ({
-  pollingIdempotency: {
-    executeWithIdempotency: vi.fn(
-      async (_provider: string, _key: string, execute: () => Promise<unknown>) => execute()
-    ),
-  },
-}))
+vi.mock('@/lib/core/idempotency/service', () => idempotencyServiceMock)
 
 vi.mock('@/lib/webhooks/processor', () => webhooksProcessorMock)
 

apps/sim/lib/webhooks/polling/imap.test.ts

@@ -1,4 +1,5 @@
 import { dbChainMockFns } from '@sim/testing'
+import { idempotencyServiceMock } from '@sim/testing/mocks/idempotency-service.mock'
 import {
   webhooksPollingUtilsMock,
   webhooksPollingUtilsMockFns,
@@ -18,9 +19,7 @@ const {
   mockResolveImapConnectionForActor: vi.fn(),
 }))
 
-vi.mock('@/lib/core/idempotency/service', () => ({
-  pollingIdempotency: { executeWithIdempotency: vi.fn() },
-}))
+vi.mock('@/lib/core/idempotency/service', () => idempotencyServiceMock)
 
 vi.mock('@/lib/imap/connection.server', () => ({
   createSecureImapClient: mockCreateSecureImapClient,

apps/sim/lib/webhooks/polling/orchestrator.test.ts

@@ -1,5 +1,5 @@
 import { webhook } from '@sim/db/schema'
-import { createWorkflowRecord } from '@sim/testing'
+import { createWorkflowRecord } from '@sim/testing/factories/permission.factory'
 import { queueTableRows, resetDbChainMock } from '@sim/testing/mocks/database.mock'
 import { resetEnvFlagsMock, setEnvFlags } from '@sim/testing/mocks/env-flags.mock'
 import { createMockRedis } from '@sim/testing/mocks/redis.mock'

apps/sim/lib/webhooks/polling/rss.test.ts

@@ -1,5 +1,6 @@
 import { createLogger } from '@sim/logger'
-import { createWorkflowRecord } from '@sim/testing'
+import { createWorkflowRecord } from '@sim/testing/factories/permission.factory'
+import { idempotencyServiceMock } from '@sim/testing/mocks/idempotency-service.mock'
 import {
   inputValidationMock,
   inputValidationMockFns,
@@ -18,13 +19,7 @@ vi.mock('@/lib/core/security/input-validation.server', () => inputValidationMock
 const mockFetch = inputValidationMockFns.mockSecureFetchWithPinnedIP
 const mockValidateUrl = inputValidationMockFns.mockValidateUrlWithDNS
 
-vi.mock('@/lib/core/idempotency/service', () => ({
-  pollingIdempotency: {
-    executeWithIdempotency: vi.fn(
-      async (_provider: string, _key: string, execute: () => Promise<unknown>) => execute()
-    ),
-  },
-}))
+vi.mock('@/lib/core/idempotency/service', () => idempotencyServiceMock)
 
 vi.mock('@/lib/webhooks/processor', () => webhooksProcessorMock)
 

apps/sim/lib/webhooks/providers/telegram.test.ts

@@ -115,14 +115,17 @@ describe('Telegram bot tokens stored as environment variable references', () =>
   beforeEach(() => {
     resetDbChainMock()
     billingAttributionMockFns.mockGetWorkspaceBilledAccountUserId.mockResolvedValue('owner-1')
-    environmentUtilsMockFns.mockGetExecutionEnvironment.mockResolvedValue({
-      personalDecrypted: {},
-      workspaceDecrypted: { TELEGRAM_BOT_TOKEN: BOT_TOKEN },
-    })
     queueTableRows(webhook, [{ id: 'active-row', providerConfig: activeConfig }])
   })
 
-  it('reuses the active secret when the active row stores the token as a reference', async () => {
+  it("reuses the active secret when the reference resolves in the deployer's env", async () => {
+    environmentUtilsMockFns.mockGetEffectiveDecryptedEnv.mockResolvedValue({
+      TELEGRAM_BOT_TOKEN: BOT_TOKEN,
+    })
+    environmentUtilsMockFns.mockGetExecutionEnvironment.mockResolvedValue({
+      personalDecrypted: {},
+      workspaceDecrypted: {},
+    })
     const fetchMock = vi.fn().mockResolvedValue(jsonResponse({ ok: true, result: true }, 200))
     vi.stubGlobal('fetch', fetchMock)
 
@@ -139,6 +142,10 @@ describe('Telegram bot tokens stored as environment variable references', () =>
   })
 
   it('leaves the bot webhook in place when the active deployment uses the same referenced bot', async () => {
+    environmentUtilsMockFns.mockGetExecutionEnvironment.mockResolvedValue({
+      personalDecrypted: {},
+      workspaceDecrypted: { TELEGRAM_BOT_TOKEN: BOT_TOKEN },
+    })
     const fetchMock = vi.fn().mockResolvedValue(jsonResponse({ ok: true, result: true }, 200))
     vi.stubGlobal('fetch', fetchMock)
 

apps/sim/lib/webhooks/providers/telegram.ts

@@ -4,6 +4,7 @@ import { getErrorMessage } from '@sim/utils/errors'
 import { generateShortId } from '@sim/utils/id'
 import { and, eq, isNull, ne } from 'drizzle-orm'
 import { NextResponse } from 'next/server'
+import { getEffectiveDecryptedEnv } from '@/lib/environment/utils'
 import { resolveBackgroundWebhookEnv } from '@/lib/webhooks/env-resolver'
 import { getNotificationUrl, getProviderConfig } from '@/lib/webhooks/provider-subscription-utils'
 import type {
@@ -221,7 +222,8 @@ export const telegramHandler: WebhookProviderHandler = {
       const activeConfigs = await findActiveTelegramConfigsForBot(
         ctx.webhook.id,
         ctx.workflow,
-        botToken
+        botToken,
+        () => backgroundEnvFor(ctx.workflow)
       )
       if (activeConfigs.length > 0) {
         logger.info(
@@ -274,10 +276,12 @@ async function resolveSubscriptionSecretToken(
   const ownSecret = readSecretToken(config)
   if (ownSecret) return ownSecret
 
+  const workspaceId = workspaceIdOf(ctx.workflow)
   const activeConfigs = await findActiveTelegramConfigsForBot(
     ctx.webhook.id,
     ctx.workflow,
-    botToken
+    botToken,
+    () => getEffectiveDecryptedEnv(ctx.userId, workspaceId)
   )
   for (const activeConfig of activeConfigs) {
     const activeSecret = readSecretToken(activeConfig)
@@ -287,16 +291,30 @@ async function resolveSubscriptionSecretToken(
   return generateShortId(TELEGRAM_SECRET_TOKEN_LENGTH)
 }
 
+function workspaceIdOf(workflowRecord: Record<string, unknown>): string | undefined {
+  return typeof workflowRecord.workspaceId === 'string' ? workflowRecord.workspaceId : undefined
+}
+
+/** The env cleanup resolves a stored config with (`cleanupExternalWebhook`). */
+async function backgroundEnvFor(workflowRecord: Record<string, unknown>) {
+  const ownerUserId = workflowRecord.userId
+  return typeof ownerUserId === 'string'
+    ? resolveBackgroundWebhookEnv(ownerUserId, workspaceIdOf(workflowRecord))
+    : {}
+}
+
 /**
  * Provider configs of other active-deployment Telegram webhooks in the workflow
  * using `botToken`. Rows store the bot token as authored, often a `{{VAR}}`
- * reference, while subscription callers hold it resolved, so each stored token
- * is resolved against the same background env before comparing.
+ * reference, while the caller holds it resolved, so each stored token is
+ * resolved with `loadEnv` — the same env the caller resolved its own token with —
+ * before comparing.
  */
 async function findActiveTelegramConfigsForBot(
   webhookId: unknown,
   workflowRecord: Record<string, unknown>,
-  botToken: string
+  botToken: string,
+  loadEnv: () => Promise<Record<string, string>>
 ): Promise<Record<string, unknown>[]> {
   const workflowId = workflowRecord.id
   if (typeof workflowId !== 'string' || typeof webhookId !== 'string') return []
@@ -325,14 +343,7 @@ async function findActiveTelegramConfigsForBot(
   const referencesEnv = activeConfigs.some((config) =>
     createEnvVarPattern().test(String(config.botToken ?? ''))
   )
-  const ownerUserId = workflowRecord.userId
-  const envVars =
-    referencesEnv && typeof ownerUserId === 'string'
-      ? await resolveBackgroundWebhookEnv(
-          ownerUserId,
-          typeof workflowRecord.workspaceId === 'string' ? workflowRecord.workspaceId : undefined
-        )
-      : {}
+  const envVars = referencesEnv ? await loadEnv() : {}
   return activeConfigs.filter(
     (config) => resolveEnvVarReferences(config.botToken, envVars) === botToken
   )

apps/sim/lib/workspace-files/application/extract-workspace-file.test.ts

@@ -5,6 +5,10 @@ import {
   createSessionPrincipal,
   createWorkspaceApiKeyPrincipal,
 } from '@sim/testing/factories/principal.factory'
+import {
+  idempotencyServiceMock,
+  idempotencyServiceMockFns,
+} from '@sim/testing/mocks/idempotency-service.mock'
 import { realtimeNotifyMock, realtimeNotifyMockFns } from '@sim/testing/mocks/realtime-notify.mock'
 import { workspaceAuthzMock, workspaceAuthzMockFns } from '@sim/testing/mocks/workspace-authz.mock'
 import {
@@ -23,26 +27,14 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 
 const hoisted = vi.hoisted(() => ({
-  atomicallyClaim: vi.fn(),
   decompress: vi.fn(),
-  releaseLease: vi.fn(),
 }))
 
 vi.mock('@sim/platform-authz/workspace', () => workspaceAuthzMock)
 
 vi.mock('@/lib/realtime/notify', () => realtimeNotifyMock)
 
-vi.mock('@/lib/core/idempotency/service', () => ({
-  IdempotencyService: class MockIdempotencyService {
-    atomicallyClaim(...args: unknown[]) {
-      return hoisted.atomicallyClaim(...args)
-    }
-
-    release(...args: unknown[]) {
-      return hoisted.releaseLease(...args)
-    }
-  },
-}))
+vi.mock('@/lib/core/idempotency/service', () => idempotencyServiceMock)
 
 vi.mock('@/lib/uploads/archive', () => ({
   decompressArchiveBufferToWorkspaceFiles: hoisted.decompress,
@@ -71,6 +63,8 @@ const mocks = {
   loadContext: workspaceFileManagerMockFns.mockLoadActiveWorkspaceFileContext,
   notify: realtimeNotifyMockFns.mockNotifyWorkspaceFilesChanged,
   ...hoisted,
+  atomicallyClaim: idempotencyServiceMockFns.mockAtomicallyClaim,
+  releaseLease: idempotencyServiceMockFns.mockRelease,
   createFolder: workspaceFileFoldersMockFns.mockCreateWorkspaceFileFolder,
   archiveFolderIfEmpty: workspaceFileFoldersMockFns.mockArchiveWorkspaceFileFolderIfEmpty,
   resolvePermission: workspaceAuthzMockFns.mockResolveEffectiveWorkspacePermission,

packages/testing/src/mocks/idempotency-service.mock.ts

@@ -0,0 +1,76 @@
+import { vi } from 'vitest'
+
+/**
+ * Controllable mock functions for `@/lib/core/idempotency/service`.
+ *
+ * Every `IdempotencyService` instance and the exported singletons (`webhookIdempotency`,
+ * `pollingIdempotency`, `chatSendIdempotency`) share these functions. `executeWithIdempotency`
+ * runs the operation once, as a first claim would; `executeOrSkipInProgress` resolves with its
+ * result. `atomicallyClaim` is a bare `vi.fn()`; `release` resolves `undefined`.
+ * `mockConstructor` records each `new IdempotencyService(config)`. Defaults are
+ * `vi.fn(impl)`, so `mockReset()` restores them.
+ *
+ * @example
+ * ```ts
+ * import { idempotencyServiceMockFns } from '@sim/testing/mocks/idempotency-service.mock'
+ *
+ * idempotencyServiceMockFns.mockAtomicallyClaim.mockResolvedValue({ claimed: true })
+ * ```
+ */
+export const idempotencyServiceMockFns = {
+  mockConstructor: vi.fn((_config?: unknown): void => {}),
+  mockAtomicallyClaim: vi.fn(),
+  mockRelease: vi.fn(async (..._args: unknown[]): Promise<void> => {}),
+  mockExecuteWithIdempotency: vi.fn(
+    async (_provider: string, _identifier: string, operation: () => Promise<unknown>) => operation()
+  ),
+  mockExecuteOrSkipInProgress: vi.fn(
+    async (_provider: string, _identifier: string, operation: () => Promise<unknown>) => ({
+      outcome: 'resolved' as const,
+      result: await operation(),
+    })
+  ),
+}
+
+const idempotencyMethods = {
+  atomicallyClaim: (...args: unknown[]) => idempotencyServiceMockFns.mockAtomicallyClaim(...args),
+  release: (...args: unknown[]) => idempotencyServiceMockFns.mockRelease(...args),
+  executeWithIdempotency: (
+    provider: string,
+    identifier: string,
+    operation: () => Promise<unknown>
+  ) => idempotencyServiceMockFns.mockExecuteWithIdempotency(provider, identifier, operation),
+  executeOrSkipInProgress: (
+    provider: string,
+    identifier: string,
+    operation: () => Promise<unknown>
+  ) => idempotencyServiceMockFns.mockExecuteOrSkipInProgress(provider, identifier, operation),
+}
+
+class IdempotencyService {
+  constructor(config?: unknown) {
+    idempotencyServiceMockFns.mockConstructor(config)
+  }
+
+  atomicallyClaim = idempotencyMethods.atomicallyClaim
+  release = idempotencyMethods.release
+  executeWithIdempotency = idempotencyMethods.executeWithIdempotency
+  executeOrSkipInProgress = idempotencyMethods.executeOrSkipInProgress
+}
+
+/**
+ * Static mock module for `@/lib/core/idempotency/service`. Covers every runtime export;
+ * `WEBHOOK_IN_PROGRESS_LEASE_SECONDS` carries the real value (2 hours).
+ *
+ * @example
+ * ```ts
+ * vi.mock('@/lib/core/idempotency/service', () => idempotencyServiceMock)
+ * ```
+ */
+export const idempotencyServiceMock = {
+  WEBHOOK_IN_PROGRESS_LEASE_SECONDS: 60 * 60 * 2,
+  IdempotencyService,
+  webhookIdempotency: idempotencyMethods,
+  pollingIdempotency: idempotencyMethods,
+  chatSendIdempotency: idempotencyMethods,
+}