feat: add data access for per-subproject Octolens integrations

[themarolt]

Summary

Adds the data access for running Octolens as one integration per mapped subproject, plus one integration with no segment that owns the shared mention poll. The discovery and poll code switch over in follow-up PRs. Also keeps these automatically managed integrations out of the global integrations views, and makes it impossible to create, change or delete them through the generic integration API.

Changes

• findOrCreateOctolensSubprojectIntegration(qx, segmentId) and findOrCreateOctolensAnchorIntegration(qx) (the one with segmentId IS NULL) share one path returning { id, created, restored }: return the live row, throw if more than one is live, otherwise restore the most recently updated soft-deleted row, otherwise insert. They serialize on pg_advisory_xact_lock(hashtextextended('octolensIntegration', 0)), since integrations has no unique key on (platform, segmentId).
• listActiveOctolensKeywordMappings, deactivateOctolensKeywordMappingsNotSeenAcross (parameterized unnest of the seen pairs; an empty set is a no-op) and softDeleteOctolensSubprojectIntegrationsWithoutActiveMappings. All of them, and the subproject find-or-create, only consider integrations with a segment that don't own an active sync unit, so the poll's integration is never listed, reconciled, soft-deleted or reused for a subproject. The soft-delete must run after the same discovery run's mapping writes and never concurrently with another run; this is noted on the function.
• upsertSyncUnits accepts optional emitEnabled and initialDelaySeconds, applied on insert only. Existing callers (GitHub seed, Nango mirror) keep their current defaults, and the conflict update is unchanged (a supplied watermark still replaces the stored one).
• AUTO_MANAGED_INTEGRATION_PLATFORMS (Octolens): the global not-connected list and count no longer offer Octolens for every subproject that doesn't have it. fetchGlobalIntegrationsStatusCount keeps its query and only excludes the segment-less Octolens integration. Both filters are NULL-safe, so integrations with a NULL platform behave as before.
• The generic POST, PUT and DELETE /integration endpoints return 400 for Octolens integrations, including switching an existing integration's platform to Octolens. IDs are normalized (braces, missing hyphens, case) before the check. Other platforms are unaffected.
• DB and handler tests for all of the above. Protected paths: the data-access layer and services/libs/common (one i18n key).

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Performance improvement
• Chore / dependency update
• Documentation

Related issue

Refs linuxfoundation/lfx-cdp-insights-ops#748

[cursor]

PR Summary

Medium Risk
Touches integration CRUD APIs, global integration listing SQL, and new Octolens row lifecycle (including soft-delete); discovery wiring is deferred but data model assumptions affect future sync behavior.

Overview
Introduces auto-managed Octolens integrations: one row per subproject for keyword mappings, plus a segment-less anchor for the shared mention poll. New DAL helpers find-or-create (with advisory locking and soft-delete restore), list active mappings, reconcile mappings across integrations, and soft-delete subproject integrations with no active mappings. Integrations that own active sync units are excluded from subproject lifecycle so the anchor/legacy poll integration is never reused or cleaned up incorrectly.

upsertSyncUnits now accepts optional emitEnabled and initialDelaySeconds on insert only; re-upserts still only update channel name and optional watermark.

AUTO_MANAGED_INTEGRATION_PLATFORMS (Octolens today) hides Octolens from global “not connected” UI queries and drops the segment-less anchor from status counts. Generic integration create/update/delete handlers use autoManagedGuard (UUID normalization, nested ids parsing, platform lookup) to return 400 for manual Octolens connect/change/disconnect, with a new i18n error string.

Tests cover guards, global integration queries, sync unit upserts, and Octolens DAL behavior.

^{Reviewed by Cursor Bugbot for commit 692c8d9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

🟡 Changes recommended

Subproject reconciliation can deactivate anchor mappings, and the claimed watermark-preservation guarantee needs clarification or implementation.

2 open findings

• Exclude segment-less anchors from subproject reconciliation · New
• Preserve existing watermarks when reruns provide replacements · New

What changed in this PR

Adds data-access support for per-subproject Octolens integrations and a shared polling anchor, ahead of the discovery and poll migration.

Changes:

• Adds integration lifecycle and keyword reconciliation helpers.
• Adds insert-only sync-unit emission and scheduling options.
• Adjusts global integration views and adds database tests.

File	Description
services/​libs/​types/​src/​enums/​platforms.ts	Defines auto-managed platforms.
services/​libs/​data-access-layer/​src/​octolens/​index.ts	Adds lifecycle and reconciliation helpers.
services/​libs/​data-access-layer/​src/​octolens/​index.test.ts	Tests integration and mapping behavior.
services/​libs/​data-access-layer/​src/​integrations/​index.ts	Adjusts global lists and counts.
services/​libs/​data-access-layer/​src/​integrations/​globalIntegrations.test.ts	Tests global-view exclusions.
services/​libs/​data-access-layer/​src/​connectors/​types.ts	Adds insert-only configuration fields.
services/​libs/​data-access-layer/​src/​connectors/​syncUnits.ts	Applies emission and scheduling options.
services/​libs/​data-access-layer/​src/​connectors/​syncUnits.test.ts	Tests defaults and rerun behavior.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Equivalent UUID spellings bypass mutation protection, and subproject lookup can reuse legacy polling integrations whose mappings are excluded from listing.

4 open findings

• UUID format validation allows mutation restriction bypass · New
• Exclude segment-less anchors from subproject reconciliation
• Exclude legacy-owned integrations from segment lookup · New
• Preserve existing watermarks when reruns provide replacements

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

Nested DELETE query arrays bypass the guard and can allow manual deletion of managed Octolens subproject integrations.

1 open finding

• Nested deletion IDs bypass guard and delete managed integrations · New

4 resolved since last review

• UUID format validation allows mutation restriction bypass
• Exclude segment-less anchors from subproject reconciliation
• Exclude legacy-owned integrations from segment lookup
• Preserve existing watermarks when reruns provide replacements

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Shared database lifecycle and mutation-guard changes warrant code-owner review and database-backed validation; tests were not executed here.

0 open findings

1 resolved since last review

• Nested deletion IDs bypass guard and delete managed integrations

🧠 Review effort: Balanced