feat: deliver secret-carrying lifecycle events synchronously, drop the retry engine

Only two events still carry a secret — an app being registered and an operator
rotating its secret — and both happen with a human at a dialog. So the delivery
is now synchronous and its outcome comes back in the response the dialog
renders: "the app received these automatically" or "couldn't reach the app,
copy the secret now". A failure is a value, never thrown, because the
credentials were returned in the response too.

The installed and uninstalled deliveries are gone (they carried no secret; an
app sees its installs change in its own discovery call), and with them the
whole fire-and-forget machinery: the dispatcher, the retry scheduler, the
pending-delivery holder, the AppDelivery entity, its repository, model,
assembler, the owner deliveries endpoint and dialog, the app_delivery table and
the retry-tuning properties. Self-registration and app-initiated rotation
deliver nothing — the caller is the app and reads the credentials from its own
response.

Author: JanCizmar

backend/api/src/main/kotlin/io/tolgee/api/v2/controllers/organization/OrganizationOwnedAppsController.kt

@@ -2,8 +2,6 @@ package io.tolgee.api.v2.controllers.organization
 
 import io.swagger.v3.oas.annotations.Operation
 import io.swagger.v3.oas.annotations.tags.Tag
-import io.tolgee.hateoas.apps.AppDeliveryModel
-import io.tolgee.hateoas.apps.AppDeliveryModelAssembler
 import io.tolgee.hateoas.apps.AppSecretModel
 import io.tolgee.hateoas.apps.AppSecretModelAssembler
 import io.tolgee.hateoas.organization.apps.OwnedAppModel
@@ -14,7 +12,6 @@ import io.tolgee.service.apps.AppOwnerRemovalService
 import io.tolgee.service.apps.AppSecretRotationService
 import io.tolgee.service.apps.AppSecretService
 import io.tolgee.service.apps.AppService
-import io.tolgee.service.apps.lifecycle.AppLifecycleDeliveryService
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty
 import org.springframework.hateoas.CollectionModel
 import org.springframework.web.bind.annotation.CrossOrigin
@@ -27,8 +24,7 @@ import org.springframework.web.bind.annotation.RestController
 
 /**
  * What an organization may do with an app it **registered**, as opposed to one it merely installed:
- * rotate the app-level credentials, see why a lifecycle delivery failed, and take the app off every
- * organization on the server.
+ * rotate the app-level credentials and take the app off every organization on the server.
  *
  * Every endpoint resolves the app within the organization, so an organization that installed
  * somebody else's app reaches none of this — app-level credentials are the owner's alone.
@@ -43,10 +39,8 @@ class OrganizationOwnedAppsController(
   private val appSecretService: AppSecretService,
   private val appSecretRotationService: AppSecretRotationService,
   private val appOwnerRemovalService: AppOwnerRemovalService,
-  private val appLifecycleDeliveryService: AppLifecycleDeliveryService,
   private val ownedAppModelAssembler: OwnedAppModelAssembler,
   private val appSecretModelAssembler: AppSecretModelAssembler,
-  private val appDeliveryModelAssembler: AppDeliveryModelAssembler,
 ) {
   @GetMapping
   @RequiresOrganizationRole(OrganizationRoleType.OWNER)
@@ -96,17 +90,22 @@ class OrganizationOwnedAppsController(
     summary = "Issue an additional app-level client secret",
     description =
       "Phase one of an app-level rotation: mints a second secret while every existing one keeps " +
-        "working. The app's installs, their own secrets, their organization availability and their " +
-        "per-project enablements are all untouched. The new secret is both returned here — the " +
-        "only place it is ever disclosed — and pushed to the app over the lifecycle channel.",
+        "working. The app's installs, their organization availability and their per-project " +
+        "enablements are all untouched. The new secret is both returned here — the only place it " +
+        "is ever disclosed — and pushed to the app over the lifecycle channel; the `delivery` " +
+        "field says whether the app took it.",
   )
   fun issueSecret(
     @PathVariable organizationId: Long,
     @PathVariable appId: Long,
   ): AppSecretModel {
     val app = appService.getOwned(organizationId, appId)
-    val issued = appSecretRotationService.issue(app)
-    return appSecretModelAssembler.toModelWithSecret(issued.secret, issued.plaintextSecret)
+    val rotation = appSecretRotationService.issueAndDeliver(app)
+    return appSecretModelAssembler.toModelWithSecret(
+      rotation.issued.secret,
+      rotation.issued.plaintextSecret,
+      rotation.delivery,
+    )
   }
 
   @DeleteMapping("/{appId}/secrets/{secretId}")
@@ -127,31 +126,14 @@ class OrganizationOwnedAppsController(
     return appSecretModelAssembler.toModel(appSecretService.revoke(app.id, secretId, allowRevokingLast = true))
   }
 
-  @GetMapping("/{appId}/deliveries")
-  @RequiresOrganizationRole(OrganizationRoleType.OWNER)
-  @Operation(
-    summary = "List the app's lifecycle deliveries",
-    description =
-      "Every signed POST Tolgee has made to the app's base URL, with the outcome of each. This is " +
-        "where an owner finds out that an install's credentials never reached the app.",
-  )
-  fun listDeliveries(
-    @PathVariable organizationId: Long,
-    @PathVariable appId: Long,
-  ): CollectionModel<AppDeliveryModel> {
-    val app = appService.getOwned(organizationId, appId)
-    return appDeliveryModelAssembler.toCollectionModel(appLifecycleDeliveryService.listForApp(app.appId))
-  }
-
   @DeleteMapping("/{appId}")
   @RequiresOrganizationRole(OrganizationRoleType.OWNER)
   @Operation(
     summary = "Remove the app from every organization",
     description =
       "Deregisters the app and uninstalls it from every organization that installed it, revoking " +
-        "both the app-level and every per-install credential, and announcing an uninstall to the " +
-        "app for each of those organizations. Only the owner may do this; an organization that " +
-        "installed the app removes only its own install through `DELETE /apps/{installId}`.",
+        "its credentials. Only the owner may do this; an organization that installed the app " +
+        "removes only its own install through `DELETE /apps/{installId}`.",
   )
   fun removeEverywhere(
     @PathVariable organizationId: Long,

backend/api/src/main/kotlin/io/tolgee/hateoas/apps/AppDeliveryModel.kt

@@ -0,0 +1,17 @@
+package io.tolgee.hateoas.apps
+
+import io.swagger.v3.oas.annotations.media.Schema
+
+/**
+ * Whether Tolgee managed to hand the just-disclosed credentials to the app. Present only in the
+ * registration and rotation responses, so the dialog can tell the operator whether the app got them
+ * or whether they still have to copy the secret by hand.
+ */
+@Schema(description = "Outcome of pushing the disclosed credentials to the app's base URL")
+data class AppDeliveryOutcomeModel(
+  @Schema(description = "False when there was nothing to deliver to")
+  val attempted: Boolean,
+  val delivered: Boolean,
+  @Schema(description = "Short reason when the delivery was attempted and failed; null otherwise")
+  val error: String?,
+)

backend/api/src/main/kotlin/io/tolgee/hateoas/apps/AppDeliveryModelAssembler.kt

@@ -29,4 +29,11 @@ open class AppModel(
         "to registering the app.",
   )
   val webhookSecret: String? = null,
+  @Schema(
+    description =
+      "Whether Tolgee managed to push these just-issued credentials to the app's base URL. Present " +
+        "only in the response to registering the app, so the dialog can tell the operator whether " +
+        "the app got them or they still have to copy the secret by hand.",
+  )
+  val delivery: AppDeliveryOutcomeModel? = null,
 ) : RepresentationModel<AppModel>()

backend/api/src/main/kotlin/io/tolgee/hateoas/apps/AppDeliveryOutcomeModel.kt

@@ -21,4 +21,10 @@ open class AppSecretModel(
         "endpoint exchanges it for the short-lived tokens that reach translation data.",
   )
   val secret: String? = null,
+  @Schema(
+    description =
+      "Whether the new secret reached the app over the lifecycle channel. Present only in the " +
+        "response to an owner issuing it; null on the app-initiated path and when listing.",
+  )
+  val delivery: AppDeliveryOutcomeModel? = null,
 ) : RepresentationModel<AppSecretModel>()

backend/api/src/main/kotlin/io/tolgee/hateoas/apps/AppModel.kt

@@ -1,26 +1,29 @@
 package io.tolgee.hateoas.apps
 
+import io.tolgee.dtos.apps.AppLifecycleDeliveryOutcome
 import io.tolgee.model.apps.AppSecret
 import org.springframework.hateoas.server.RepresentationModelAssembler
 import org.springframework.stereotype.Component
 
 @Component
 class AppSecretModelAssembler : RepresentationModelAssembler<AppSecret, AppSecretModel> {
   override fun toModel(entity: AppSecret): AppSecretModel {
-    return build(entity, plaintextSecret = null)
+    return build(entity, plaintextSecret = null, delivery = null)
   }
 
   /** Builds the model including the plaintext — used once, in the response to issuing the secret. */
   fun toModelWithSecret(
     entity: AppSecret,
     plaintextSecret: String,
+    delivery: AppLifecycleDeliveryOutcome? = null,
   ): AppSecretModel {
-    return build(entity, plaintextSecret)
+    return build(entity, plaintextSecret, delivery)
   }
 
   private fun build(
     entity: AppSecret,
     plaintextSecret: String?,
+    delivery: AppLifecycleDeliveryOutcome?,
   ): AppSecretModel {
     return AppSecretModel(
       id = entity.id,
@@ -29,6 +32,10 @@ class AppSecretModelAssembler : RepresentationModelAssembler<AppSecret, AppSecre
       lastUsedAt = entity.lastUsedAt?.time,
       revokedAt = entity.revokedAt?.time,
       secret = plaintextSecret,
+      delivery = delivery?.toModel(),
     )
   }
 }
+
+fun AppLifecycleDeliveryOutcome.toModel(): AppDeliveryOutcomeModel =
+  AppDeliveryOutcomeModel(attempted = attempted, delivered = delivered, error = error)

backend/api/src/main/kotlin/io/tolgee/hateoas/apps/AppSecretModel.kt

@@ -1,7 +1,9 @@
 package io.tolgee.hateoas.organization.apps
 
+import io.tolgee.dtos.apps.AppLifecycleDeliveryOutcome
 import io.tolgee.dtos.apps.AppManifest
 import io.tolgee.hateoas.apps.AppModel
+import io.tolgee.hateoas.apps.toModel
 import io.tolgee.model.apps.AppInstall
 import io.tolgee.service.apps.AppInstallService
 import io.tolgee.service.apps.AppService
@@ -25,16 +27,17 @@ class AppInstallModelAssembler(
    * installed somebody else's app from ever seeing its app-level credentials.
    */
   fun toModel(result: AppInstallService.RegisterResult): AppInstallModel {
-    return build(result.install, appModel(result.app, result.appCredentials))
+    return build(result.install, appModel(result.app, result.appCredentials, result.delivery))
   }
 
   fun toModel(result: AppInstallService.SelfRegisterResult): AppInstallModel {
-    return build(result.install, appModel(result.app, result.appCredentials), created = result.created)
+    return build(result.install, appModel(result.app, result.appCredentials, delivery = null), created = result.created)
   }
 
   private fun appModel(
     app: AppService.AppSummary,
     credentials: AppService.AppCredentials?,
+    delivery: AppLifecycleDeliveryOutcome?,
   ): AppModel {
     return AppModel(
       id = app.id,
@@ -43,6 +46,7 @@ class AppInstallModelAssembler(
       clientId = credentials?.clientId,
       clientSecret = credentials?.clientSecret,
       webhookSecret = credentials?.webhookSecret,
+      delivery = delivery?.toModel(),
     )
   }