From 7be0f37a5d12cc39551026371158448ac8adf6a2 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Fri, 16 Oct 2026 15:07:07 +0000
Subject: [PATCH] fix(deploy): persist sync.postConnectRedirectUrl in generated
 compass.yaml

Co-authored-by: Tyler Dane <tyler-dane@users.noreply.github.com>
---
 .github/scripts/deploy-health-check.sh        | 37 +++++++++++++++++++
 .github/workflows/_deploy-environment.yml     |  1 +
 .../src/testing/deploy-sync-config.test.ts    | 25 +++++++++++++
 3 files changed, 63 insertions(+)
 create mode 100644 packages/scripts/src/testing/deploy-sync-config.test.ts

diff --git a/.github/scripts/deploy-health-check.sh b/.github/scripts/deploy-health-check.sh
index 886f889f9d..a106512b07 100755
--- a/.github/scripts/deploy-health-check.sh
+++ b/.github/scripts/deploy-health-check.sh
@@ -553,6 +553,42 @@ done
 REMOTE
 }
 
+remote_check_sync_post_connect_redirect() {
+  require_env FRONTEND_URL || return 1
+
+  ssh_remote "FRONTEND_URL=$(printf '%q' "$FRONTEND_URL") bash -se" <<'REMOTE'
+set -euo pipefail
+config="$HOME/compass/compass.yaml"
+if [ ! -f "$config" ]; then
+  printf 'missing %s\n' "$config" >&2
+  exit 1
+fi
+redirect=$(
+  awk '
+    /^sync:[[:space:]]*$/ { in_sync=1; next }
+    in_sync && /^[^[:space:]]/ { in_sync=0 }
+    in_sync && /^[[:space:]]+postConnectRedirectUrl:[[:space:]]*/ {
+      line=$0
+      sub(/^[[:space:]]+postConnectRedirectUrl:[[:space:]]*/, "", line)
+      gsub(/^"/, "", line)
+      gsub(/"$/, "", line)
+      print line
+      exit
+    }
+  ' "$config"
+)
+if [ -z "$redirect" ]; then
+  printf 'compass.yaml sync.postConnectRedirectUrl is not set\n' >&2
+  exit 1
+fi
+if [ "$redirect" != "$FRONTEND_URL" ]; then
+  printf 'compass.yaml sync.postConnectRedirectUrl (%s) must match FRONTEND_URL (%s)\n' \
+    "$redirect" "$FRONTEND_URL" >&2
+  exit 1
+fi
+REMOTE
+}
+
 remote_check_production_email_config() {
   ssh_remote "bash -se" <<'REMOTE'
 set -euo pipefail
@@ -681,6 +717,7 @@ run_all_checks() {
 
   case "$PROFILE" in
     cloud)
+      run_check "sync-post-connect-redirect" remote_check_sync_post_connect_redirect
       if [ "$ENVIRONMENT" = "production" ]; then
         run_check "production-email-config" remote_check_production_email_config
       fi
diff --git a/.github/workflows/_deploy-environment.yml b/.github/workflows/_deploy-environment.yml
index 3e2af7ad9b..81a4829519 100644
--- a/.github/workflows/_deploy-environment.yml
+++ b/.github/workflows/_deploy-environment.yml
@@ -317,6 +317,7 @@ jobs:
               "  mongoUri: \"${SYNC_MONGO_URI}\"" \
               "  internalAuthToken: \"${SYNC_INTERNAL_AUTH_TOKEN}\"" \
               "  callbackBaseUrl: \"${FRONTEND_URL}\"" \
+              "  postConnectRedirectUrl: \"${FRONTEND_URL}\"" \
               '  serviceUrl: "http://sync:3010"' \
               "  enforceLeastPrivilege: ${SYNC_ENFORCE_LEAST_PRIVILEGE}" \
               '  maxConcurrency: 12'
diff --git a/packages/scripts/src/testing/deploy-sync-config.test.ts b/packages/scripts/src/testing/deploy-sync-config.test.ts
new file mode 100644
index 0000000000..b9ac6cf208
--- /dev/null
+++ b/packages/scripts/src/testing/deploy-sync-config.test.ts
@@ -0,0 +1,25 @@
+import { describe, expect, it } from "bun:test";
+import { readFileSync } from "node:fs";
+
+const DEPLOY_WORKFLOW = ".github/workflows/_deploy-environment.yml";
+const HEALTH_CHECK_SCRIPT = ".github/scripts/deploy-health-check.sh";
+
+describe("deploy sync config", () => {
+  it("writes sync.postConnectRedirectUrl from FRONTEND_URL in full calendar deploy", () => {
+    const workflow = readFileSync(DEPLOY_WORKFLOW, "utf8");
+    expect(workflow).toContain("FRONTEND_URL: ${{ vars.FRONTEND_URL }}");
+    expect(workflow).toContain('postConnectRedirectUrl: \\"${FRONTEND_URL}\\"');
+    expect(workflow).toContain('callbackBaseUrl: \\"${FRONTEND_URL}\\"');
+  });
+
+  it("health check verifies sync.postConnectRedirectUrl on cloud deploys", () => {
+    const script = readFileSync(HEALTH_CHECK_SCRIPT, "utf8");
+    expect(script).toContain("remote_check_sync_post_connect_redirect");
+    expect(script).toContain(
+      'run_check "sync-post-connect-redirect" remote_check_sync_post_connect_redirect',
+    );
+    expect(script).toContain(
+      "compass.yaml sync.postConnectRedirectUrl is not set",
+    );
+  });
+});