Skip to content

Ian/misc - #74

Open
ianmacartney wants to merge 7 commits into
mainfrom
ian/misc
Open

Ian/misc#74
ianmacartney wants to merge 7 commits into
mainfrom
ian/misc

Conversation

@ianmacartney

@ianmacartney ianmacartney commented Aug 24, 2026

Copy link
Copy Markdown
Member

Follow-up to #73

You can review as separate commits, main changes are:

  1. Drop the event listing now that we're all-in on webhooks
  2. Move the user validator out to a shared file
  3. Capture the userId in events so we can (in the future) offer an API to delete events by associated user
  4. Add user tombstones in a new "deletedUsers" table, so we can avoid handling create/update events for deleted users. In the future we can have an API / async worker to clean up deleted users after some period of time (>3 days would be safest, since WorkOS will try that long to deliver an old webhook event)

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

@ianmacartney
ianmacartney requested a review from erquhart August 24, 2026 23:04
@pkg-pr-new

pkg-pr-new Bot commented Aug 24, 2026

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/@convex-dev/workos-authkit@74

commit: 96c2197

@erquhart erquhart left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One blocking issue and we should drop the remaining workpool references and dependency.

Comment thread src/component/lib.ts Outdated
Comment on lines +31 to +36
const userId =
"id" in args.event.data
? args.event.data.id
: "userId" in args.event.data
? args.event.data.userId
: undefined;

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Because we support handling all events and not just user events, this might be an id from a non-user data object. It could also be null.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Understood. I'm fine with false negatives here. If an org id happens to match a userId that'd be surprising. The index here would just be used to delete things for a given user. But maybe it should be named more generically to delete by dataId or something.
My guess is that users with data retention policies will want ways to delete all data related to a user within a time frame. One way to satisfy it is to delete all events within that time frame. Another is to track which events come from which users.
Why don't we decouple this change from the rest and follow up on the simpler time-bound vacuuming first?

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we need to decouple, the fixes here are simple - check for userId first and filter out nulls. I'll push a commit

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sounds good, updated

Address PR feedback on #74:

- Derive an event's userId from `data.userId` first, falling back to
  `data.id`, and only record it when it's a string. Events for non-user
  objects can carry a null id, which the schema rejected outright, and a
  session-style event's own id was previously preferred over the userId
  it references. Add tests for all three cases.
- Import `vResultValidator` from `@convex-dev/workflow` (which re-exports
  it) and drop the unused `@convex-dev/workpool/test` imports left over
  from the removed event workpool, so `@convex-dev/workpool` is no longer
  a direct dependency.

Copy link
Copy Markdown
Member Author

This stack of pull requests is managed by Graphite. Learn more about stacking.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants