Add token circuit breaker notification (issue #18886)

src/api/app/models/event/base.rb

@@ -22,7 +22,7 @@ def notification_events
          Event::CommentForRequest, Event::CommentForReport,
          Event::RelationshipCreate, Event::RelationshipDelete,
          Event::Report, Event::Decision, Event::AppealCreated,
-         Event::WorkflowRunFail,
+         Event::WorkflowRunFail, Event::TokenDisabled,
          Event::AddedUserToGroup, Event::RemovedUserFromGroup,
          Event::Assignment]
       end

src/api/app/models/event/token_disabled.rb

@@ -0,0 +1,56 @@
+module Event
+  class TokenDisabled < Base
+    self.description = 'SCM/CI Token disabled due to authorization failure'
+    payload_keys :id, :token_id, :scm_vendor, :summary, :token_description
+
+    receiver_roles :token_executor, :token_member
+    delegate :members, to: :token, prefix: true
+
+    self.notification_explanation = 'Receive notifications when an SCM/CI integration token is disabled due to authorization problems.'
+
+    # Example of subject:
+    #   GitHub workflow token disabled
+    def subject
+      vendor_map = { 'github' => 'GitHub', 'gitlab' => 'GitLab', 'gitea' => 'Gitea' }
+      vendor = vendor_map[payload['scm_vendor']] || payload['scm_vendor']&.capitalize || 'SCM'
+      "#{vendor} workflow token disabled"
+    end
+
+    def token_executors
+      [token&.executor].compact
+    end
+
+    def parameters_for_notification
+      super.merge(notifiable_type: 'Token::Workflow', notifiable_id: payload['token_id'], type: 'NotificationToken')
+    end
+
+    def event_object
+      Token.find_by(id: payload['token_id'])
+    end
+
+    private
+
+    def token
+      Token.find_by(id: payload['token_id'], type: 'Token::Workflow')
+    end
+  end
+end
+
+# == Schema Information
+#
+# Table name: events
+#
+#  id          :bigint           not null, primary key
+#  eventtype   :string(255)      not null, indexed
+#  mails_sent  :boolean          default(FALSE), indexed
+#  payload     :text(16777215)
+#  undone_jobs :integer          default(0)
+#  created_at  :datetime         indexed
+#  updated_at  :datetime
+#
+# Indexes
+#
+#  index_events_on_created_at  (created_at)
+#  index_events_on_eventtype   (eventtype)
+#  index_events_on_mails_sent  (mails_sent)
+#

src/api/app/models/notification_token.rb

@@ -0,0 +1,58 @@
+class NotificationToken < Notification
+  def description
+    "Token #{notifiable.description.presence || ''} was disabled".strip
+  end
+
+  def excerpt
+    event_payload['summary'] || 'Token was disabled due to authorization failure'
+  end
+
+  def avatar_objects
+    [notifiable&.executor].compact
+  end
+
+  def link_text
+    'Token'
+  end
+
+  def link_path
+    return if notifiable.blank?
+
+    Rails.application.routes.url_helpers.token_path(notifiable)
+  end
+end
+
+# == Schema Information
+#
+# Table name: notifications
+#
+#  id                         :bigint           not null, primary key
+#  bs_request_oldstate        :string(255)
+#  bs_request_state           :string(255)
+#  delivered                  :boolean          default(FALSE), indexed
+#  event_payload              :text(16777215)   not null
+#  event_type                 :string(255)      not null, indexed
+#  last_seen_at               :datetime
+#  notifiable_type            :string(255)      indexed => [notifiable_id]
+#  rss                        :boolean          default(FALSE), indexed
+#  subscriber_type            :string(255)      indexed => [subscriber_id]
+#  subscription_receiver_role :string(255)      not null
+#  title                      :string(255)
+#  type                        :string(255)      indexed
+#  web                        :boolean          default(FALSE), indexed
+#  created_at                 :datetime         not null, indexed
+#  updated_at                 :datetime         not null
+#  notifiable_id              :integer          indexed => [notifiable_type]
+#  subscriber_id              :integer          indexed => [subscriber_type]
+#
+# Indexes
+#
+#  index_notifications_on_created_at                         (created_at)
+#  index_notifications_on_delivered                          (delivered)
+#  index_notifications_on_event_type                         (event_type)
+#  index_notifications_on_notifiable_type_and_notifiable_id  (notifiable_type,notifiable_id)
+#  index_notifications_on_rss                                (rss)
+#  index_notifications_on_subscriber_type_and_subscriber_id  (subscriber_type,subscriber_id)
+#  index_notifications_on_type                               (type)
+#  index_notifications_on_web                                (web)
+#

src/api/app/models/workflow_run.rb

@@ -81,7 +81,16 @@ def update_as_failed(message)
     # "Failed to report back to GitHub: Unauthorized request. Please check your credentials again."
     # "Failed to report back to GitHub: Request is forbidden."
 
-    token.update(enabled: false) if message.include?('Unauthorized request') || /Request (is )?forbidden/.match?(message)
+    return unless message.include?('Unauthorized request') || /Request (is )?forbidden/.match?(message)
+
+    token.update(enabled: false)
+    # Create event notification for token being disabled
+    Event::TokenDisabled.create(
+      token_id: token.id,
+      scm_vendor: scm_vendor,
+      summary: message,
+      token_description: token.description
+    )
   end
 
   # Stores debug info to help figure out what went wrong when trying to save a Status in the SCM.

src/api/db/data/20251207091632_create_default_token_disabled_subscriptions.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+class CreateDefaultTokenDisabledSubscriptions < ActiveRecord::Migration[7.2]
+  def up
+    # Create default subscriptions for Event::TokenDisabled
+    # This event is triggered when a workflow token is disabled due to authorization failures
+    create_default_subscription('token_executor', :instant_email)
+    create_default_subscription('token_executor', :web)
+    create_default_subscription('token_member', :instant_email)
+    create_default_subscription('token_member', :web)
+  end
+
+  def down
+    raise ActiveRecord::IrreversibleMigration
+  end
+
+  private
+
+  def create_default_subscription(receiver_role, channel)
+    EventSubscription.find_or_create_by!(
+      eventtype: 'Event::TokenDisabled',
+      receiver_role: receiver_role,
+      channel: channel,
+      user_id: nil,
+      group_id: nil
+    ) do |subscription|
+      subscription.enabled = true
+    end
+  end
+end

src/api/spec/models/event/token_disabled_spec.rb

@@ -0,0 +1,159 @@
+RSpec.describe Event::TokenDisabled do
+  describe '#token_executors' do
+    subject { event.token_executors }
+
+    let(:token) { create(:workflow_token) }
+    let(:event) do
+      Event::TokenDisabled.create(
+        token_id: token.id,
+        scm_vendor: 'github',
+        summary: 'Failed to report back to GitHub: Unauthorized request.',
+        token_description: 'My workflow token'
+      )
+    end
+
+    it { expect(subject).to contain_exactly(token.executor) }
+
+    context 'when the token does not exist' do
+      before do
+        event
+        token.destroy
+      end
+
+      it { expect(subject).to be_empty }
+    end
+  end
+
+  describe '#subject' do
+    subject { event.subject }
+
+    let(:token) { create(:workflow_token) }
+
+    context 'with GitHub vendor' do
+      let(:event) do
+        Event::TokenDisabled.create(
+          token_id: token.id,
+          scm_vendor: 'github',
+          summary: 'Failed to report back to GitHub: Unauthorized request.',
+          token_description: 'My workflow token'
+        )
+      end
+
+      it { expect(subject).to eq('GitHub workflow token disabled') }
+    end
+
+    context 'with GitLab vendor' do
+      let(:event) do
+        Event::TokenDisabled.create(
+          token_id: token.id,
+          scm_vendor: 'gitlab',
+          summary: 'Failed to report back to GitLab: Request forbidden.',
+          token_description: 'My workflow token'
+        )
+      end
+
+      it { expect(subject).to eq('GitLab workflow token disabled') }
+    end
+
+    context 'with nil vendor' do
+      let(:event) do
+        Event::TokenDisabled.create(
+          token_id: token.id,
+          scm_vendor: nil,
+          summary: 'Failed to report back.',
+          token_description: 'My workflow token'
+        )
+      end
+
+      it { expect(subject).to eq('SCM workflow token disabled') }
+    end
+
+    context 'with unknown vendor' do
+      let(:event) do
+        Event::TokenDisabled.create(
+          token_id: token.id,
+          scm_vendor: 'bitbucket',
+          summary: 'Failed to report back to Bitbucket.',
+          token_description: 'My workflow token'
+        )
+      end
+
+      it { expect(subject).to eq('Bitbucket workflow token disabled') }
+    end
+  end
+
+  describe '#parameters_for_notification' do
+    subject { event.parameters_for_notification }
+
+    let(:token) { create(:workflow_token) }
+    let(:event) do
+      Event::TokenDisabled.create(
+        token_id: token.id,
+        scm_vendor: 'github',
+        summary: 'Failed to report back to GitHub: Unauthorized request.',
+        token_description: 'My workflow token'
+      )
+    end
+
+    it 'includes the correct notifiable type' do
+      expect(subject[:notifiable_type]).to eq('Token::Workflow')
+    end
+
+    it 'includes the correct notifiable id' do
+      expect(subject[:notifiable_id]).to eq(token.id)
+    end
+
+    it 'includes the correct notification type' do
+      expect(subject[:type]).to eq('NotificationToken')
+    end
+  end
+
+  describe '#event_object' do
+    subject { event.event_object }
+
+    let(:token) { create(:workflow_token) }
+    let(:event) do
+      Event::TokenDisabled.create(
+        token_id: token.id,
+        scm_vendor: 'github',
+        summary: 'Failed to report back to GitHub: Unauthorized request.',
+        token_description: 'My workflow token'
+      )
+    end
+
+    it { expect(subject).to eq(token) }
+
+    context 'when the token does not exist' do
+      before do
+        event
+        token.destroy
+      end
+
+      it { expect(subject).to be_nil }
+    end
+  end
+
+  describe '#token_members' do
+    subject { event.token_members }
+
+    let(:executor) { create(:confirmed_user) }
+    let(:member) { create(:confirmed_user) }
+    let(:token) { create(:workflow_token, executor: executor) }
+    let(:event) do
+      Event::TokenDisabled.create(
+        token_id: token.id,
+        scm_vendor: 'github',
+        summary: 'Failed to report back to GitHub: Unauthorized request.',
+        token_description: 'My workflow token'
+      )
+    end
+
+    before do
+      token.users << member
+    end
+
+    it 'returns all members including shared users' do
+      expect(subject).to include(member)
+    end
+  end
+end