OUT-4039: L1.2 — Dropbox webhook delta flow tests

[SandipBajracharya]

What & why

L1.2 — integration tests for the ongoing Dropbox→Assembly webhook delta flow (vs L1.1's initial sync). Drives the real task graph in-process (via the L1.0 Trigger double) against Testcontainers Postgres, with Dropbox + Copilot faked via MSW.

Stacked on OUT-4034 (PR #125) — it consumes that PR's MSW write handlers + Trigger double. Base is OUT-4034; retarget to main once #125 merges.

Changes (all test/**, zero production change)

• test/msw/write.ts (+mockDropboxLatestCursor, mockCopilotDeleteFile) + harness tests
• test/flows/dropbox-webhook-delta.integration.test.ts — new / delete / rename / content-change / unchanged-no-op
• test/flows/dropbox-webhook-debounce.integration.test.ts — 5-min debounce: defer vs trigger
• test/flows/dropbox-webhook-route.integration.test.ts — route HMAC 200/403/400 + GET challenge

What it proves

• Delta classification end-to-end: new → mapped row; delete → soft-delete; rename → old soft-deleted + new live (delete-before-create); content-change → old soft-deleted + new row w/ new hash; unchanged hash → no-op (no create/delete fires — enforced by onUnhandledRequest:'error').
• Debounce: within the window → pendingWebhook=true, no sync; older → sync runs.
• Route: valid HMAC → 200, tampered → 403, missing → 400, GET challenge echoed.

The DB-row assertions are the real verification (a thrown leaf resolves to {ok:false} in the inline double without failing the call). Reviewed by the fullstack reviewer.

Testing

• pnpm typecheck ✅ · pnpm lint ✅
• pnpm test:integration — 62/62 ✅ (10 files)

🤖 Generated with Claude Code

[linear-code]

OUT-4039

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dropbox-integration	Ready	Preview	Aug 13, 2026 5:07am

[greptile-apps]

Greptile Summary

This PR adds integration coverage for the ongoing Dropbox webhook delta flow.

• Exercises new-file, deletion, rename, content-change, and unchanged-content behavior against Postgres and MSW-backed external services.
• Covers webhook debounce behavior and route challenge/signature handling.
• Adds Dropbox latest-cursor and Copilot deletion test helpers, including captured deletion identifiers.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
test/flows/dropbox-webhook-delta.integration.test.ts	Adds end-to-end database and outbound-delete assertions for the principal Dropbox delta classifications.
test/flows/dropbox-webhook-debounce.integration.test.ts	Adds integration coverage for deferred and immediately triggered webhook synchronization.
test/flows/dropbox-webhook-route.integration.test.ts	Tests challenge handling and POST signature outcomes using the controller’s configured secret.
test/msw/write.ts	Adds reusable latest-cursor and deletion handlers, with captured Copilot deletion identifiers.
test/msw/write.integration.test.ts	Verifies the newly added MSW cursor and Copilot deletion helpers.

Sequence Diagram

sequenceDiagram
    participant Dropbox
    participant Webhook
    participant Sync
    participant Copilot
    participant DB
    Dropbox->>Webhook: Delta notification
    Webhook->>Sync: Fetch cursor changes
    Sync->>Copilot: Delete stale file when required
    Sync->>Copilot: Create or upload changed file
    Sync->>DB: Persist live and soft-deleted mappings
    Sync->>DB: Advance cursor and timestamps

Loading

_{Reviews (2): Last reviewed commit: "test(OUT-4039): sign webhook route test ..." | Re-trigger Greptile}

[priosshrsth]

lgtm

[SandipBajracharya]

@greptileai review again

[SandipBajracharya]

@greptile-apps both P2 suggestions were applied and are merged into main:

1. Outbound request semantics — mockCopilotDeleteFile now captures the deleted ids; the delete / rename / content-change scenarios assert exactly the mapped file's assemblyFileId was sent (once). Create paths stay verified via the resulting DB rows, and delete-before-create ordering is enforced by the partial-unique index.
2. Placeholder secret — the route test now signs with env.DROPBOX_APP_SECRET (the same value the controller verifies against), so it can't drift from placeholder-env.

Both were good catches — thanks.

[greptile-apps]

Both improvements are solid — capturing the actual assemblyFileId in mockCopilotDeleteFile and tying the route test to env.DROPBOX_APP_SECRET directly are the right calls. The test suite is in good shape. Thanks for the thorough follow-through!