fix(deploy): write sync.postConnectRedirectUrl into generated compass.yaml

.github/scripts/deploy-health-check.sh

@@ -553,6 +553,42 @@ done
 REMOTE
 }
 
+remote_check_sync_post_connect_redirect() {
+  require_env FRONTEND_URL || return 1
+
+  ssh_remote "FRONTEND_URL=$(printf '%q' "$FRONTEND_URL") bash -se" <<'REMOTE'
+set -euo pipefail
+config="$HOME/compass/compass.yaml"
+if [ ! -f "$config" ]; then
+  printf 'missing %s\n' "$config" >&2
+  exit 1
+fi
+redirect=$(
+  awk '
+    /^sync:[[:space:]]*$/ { in_sync=1; next }
+    in_sync && /^[^[:space:]]/ { in_sync=0 }
+    in_sync && /^[[:space:]]+postConnectRedirectUrl:[[:space:]]*/ {
+      line=$0
+      sub(/^[[:space:]]+postConnectRedirectUrl:[[:space:]]*/, "", line)
+      gsub(/^"/, "", line)
+      gsub(/"$/, "", line)
+      print line
+      exit
+    }
+  ' "$config"
+)
+if [ -z "$redirect" ]; then
+  printf 'compass.yaml sync.postConnectRedirectUrl is not set\n' >&2
+  exit 1
+fi
+if [ "$redirect" != "$FRONTEND_URL" ]; then
+  printf 'compass.yaml sync.postConnectRedirectUrl (%s) must match FRONTEND_URL (%s)\n' \
+    "$redirect" "$FRONTEND_URL" >&2
+  exit 1
+fi
+REMOTE
+}
+
 remote_check_production_email_config() {
   ssh_remote "bash -se" <<'REMOTE'
 set -euo pipefail
@@ -681,6 +717,7 @@ run_all_checks() {
 
   case "$PROFILE" in
     cloud)
+      run_check "sync-post-connect-redirect" remote_check_sync_post_connect_redirect
       if [ "$ENVIRONMENT" = "production" ]; then
         run_check "production-email-config" remote_check_production_email_config
       fi

.github/workflows/_deploy-environment.yml

@@ -317,6 +317,7 @@ jobs:
               "  mongoUri: \"${SYNC_MONGO_URI}\"" \
               "  internalAuthToken: \"${SYNC_INTERNAL_AUTH_TOKEN}\"" \
               "  callbackBaseUrl: \"${FRONTEND_URL}\"" \
+              "  postConnectRedirectUrl: \"${FRONTEND_URL}\"" \
               '  serviceUrl: "http://sync:3010"' \
               "  enforceLeastPrivilege: ${SYNC_ENFORCE_LEAST_PRIVILEGE}" \
               '  maxConcurrency: 12'

packages/scripts/src/testing/deploy-sync-config.test.ts

@@ -0,0 +1,25 @@
+import { describe, expect, it } from "bun:test";
+import { readFileSync } from "node:fs";
+
+const DEPLOY_WORKFLOW = ".github/workflows/_deploy-environment.yml";
+const HEALTH_CHECK_SCRIPT = ".github/scripts/deploy-health-check.sh";
+
+describe("deploy sync config", () => {
+  it("writes sync.postConnectRedirectUrl from FRONTEND_URL in full calendar deploy", () => {
+    const workflow = readFileSync(DEPLOY_WORKFLOW, "utf8");
+    expect(workflow).toContain("FRONTEND_URL: ${{ vars.FRONTEND_URL }}");
+    expect(workflow).toContain('postConnectRedirectUrl: \\"${FRONTEND_URL}\\"');
+    expect(workflow).toContain('callbackBaseUrl: \\"${FRONTEND_URL}\\"');
+  });
+
+  it("health check verifies sync.postConnectRedirectUrl on cloud deploys", () => {
+    const script = readFileSync(HEALTH_CHECK_SCRIPT, "utf8");
+    expect(script).toContain("remote_check_sync_post_connect_redirect");
+    expect(script).toContain(
+      'run_check "sync-post-connect-redirect" remote_check_sync_post_connect_redirect',
+    );
+    expect(script).toContain(
+      "compass.yaml sync.postConnectRedirectUrl is not set",
+    );
+  });
+});