Greptile Overview

Greptile Summary

This PR implements Postgres-backed recovery for Redis queues, migrating away from pg-boss to pure BullMQ with a persistence layer. The implementation adds a queue_jobs table to track critical jobs (dynamic secret revocation, PAM session expiration) that need to survive Redis data loss.

Key Changes:

• Added queue_jobs table with status tracking, heartbeat monitoring, and retry logic
• Implemented startup recovery job (runs 2 minutes after boot) to restore pending/failed jobs from Postgres
• Added reconciliation job (runs every 2 minutes) to detect and re-queue stuck jobs
• Migrated dynamic secret revocation and PAM session expiration queues to use persistence
• Added queue job pruning to daily cleanup routine
• Removed all pg-boss dependencies and related code

Architecture:
The system maintains dual state: Redis (active execution) and Postgres (persistence/recovery). Jobs are written to Postgres before Redis, with lifecycle updates tracked via event listeners. Recovery checks for jobs missing from Redis and re-queues them with recalculated delays.

Issues Found:

• Migration not fully idempotent - could fail on retry with duplicate key errors
• 2-minute startup recovery delay could impact security-critical credential revocations
• No alerting when stuck jobs are marked as dead
• Sequential recovery could be slow for large job backlogs

Confidence Score: 4/5

• Safe to merge with minor concerns around migration idempotency and recovery timing for security-critical operations
• The implementation is well-structured with proper persistence mechanisms for critical queues. The main concern is the migration's lack of full idempotency which could cause issues on retry. The 2-minute recovery delay could impact security-critical operations like credential revocation. Otherwise, the queue recovery and reconciliation logic is solid.
• backend/src/db/migrations/20260203141935_durable-queue.ts requires fixing for full idempotency before deployment to production

Important Files Changed

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.