chore: consolidate local integration changes

backend/internal/service/worksmobile_relay_worker.go

@@ -6,6 +6,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"log/slog"
 	"sort"
 	"strings"
@@ -15,10 +16,15 @@ import (
 type WorksmobileRelayWorker struct {
 	repo       repository.WorksmobileOutboxRepository
 	client     WorksmobileDirectoryClient
+	leaderLock WorksmobileRelayLeaderLock
 	interval   time.Duration
 	batchLimit int
 }
 
+type WorksmobileRelayLeaderLock interface {
+	EnsureLeadership(ctx context.Context) (bool, error)
+}
+
 func NewWorksmobileRelayWorker(repo repository.WorksmobileOutboxRepository, client WorksmobileDirectoryClient) *WorksmobileRelayWorker {
 	return &WorksmobileRelayWorker{
 		repo:       repo,
@@ -28,6 +34,17 @@ func NewWorksmobileRelayWorker(repo repository.WorksmobileOutboxRepository, clie
 	}
 }
 
+func (w *WorksmobileRelayWorker) SetLeaderLock(lock WorksmobileRelayLeaderLock) {
+	w.leaderLock = lock
+}
+
+func (w *WorksmobileRelayWorker) SetBatchLimit(limit int) {
+	if limit <= 0 {
+		return
+	}
+	w.batchLimit = limit
+}
+
 func (w *WorksmobileRelayWorker) Start(ctx context.Context) {
 	if w.repo == nil || w.client == nil {
 		slog.Warn("Worksmobile relay worker disabled")
@@ -49,7 +66,23 @@ func (w *WorksmobileRelayWorker) Start(ctx context.Context) {
 	}
 }
 
-func (w *WorksmobileRelayWorker) ProcessOnce(ctx context.Context) error {
+func (w *WorksmobileRelayWorker) ProcessOnce(ctx context.Context) (err error) {
+	defer func() {
+		if recovered := recover(); recovered != nil {
+			err = fmt.Errorf("worksmobile relay panic: %v", recovered)
+		}
+	}()
+
+	if w.leaderLock != nil {
+		isLeader, err := w.leaderLock.EnsureLeadership(ctx)
+		if err != nil {
+			return err
+		}
+		if !isLeader {
+			return nil
+		}
+	}
+
 	jobs, err := w.repo.ListReady(ctx, w.batchLimit)
 	if err != nil {
 		return err
@@ -109,15 +142,20 @@ func (w *WorksmobileRelayWorker) dispatch(ctx context.Context, job domain.Worksm
 			aliasEmails := append([]string(nil), payload.AliasEmails...)
 			payload.AliasEmails = nil
 			if err := w.client.UpsertUser(ctx, payload); err != nil {
-				return err
+				return fmt.Errorf("worksmobile user upsert failed: %w", err)
 			}
 			for _, aliasEmail := range aliasEmails {
 				if err := w.client.AddUserAliasEmail(ctx, payload.Email, aliasEmail); err != nil {
-					return err
+					return fmt.Errorf("worksmobile user alias add failed: %w", err)
 				}
 			}
 			if stringValue(job.Payload["baronStatus"]) == domain.UserStatusActive {
-				return w.client.SetUserActive(ctx, worksmobileOutboxUserIdentifier(job), true)
+				if err := w.client.SetUserActive(ctx, worksmobileOutboxUserIdentifier(job), true); err != nil {
+					if isWorksmobileSCIMTokenNotConfiguredError(err) {
+						return nil
+					}
+					return fmt.Errorf("worksmobile user set active failed: %w", err)
+				}
 			}
 			return nil
 		case domain.WorksmobileActionDelete:
@@ -142,6 +180,10 @@ func (w *WorksmobileRelayWorker) dispatch(ctx context.Context, job domain.Worksm
 	}
 }
 
+func isWorksmobileSCIMTokenNotConfiguredError(err error) bool {
+	return err != nil && strings.Contains(err.Error(), "worksmobile scim token is not configured")
+}
+
 func sortWorksmobileReadyJobs(jobs []domain.WorksmobileOutbox) []domain.WorksmobileOutbox {
 	sorted := append([]domain.WorksmobileOutbox(nil), jobs...)
 	depthByID := worksmobileOrgUnitDepths(sorted)