fix: guard last-active fold against deleted apps (in-memory)

The rollup fold re-inserted user_last_active rows from retained activity_log
events for since-deleted apps, which violates the user_last_active -> apps FK.
Add an EXISTS(apps) guard so the fold only projects still-existing apps, plus
a test that a user_last_active event for an app absent from apps is skipped
while a concurrent event for an existing app still folds.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: supertokens-agent-runner

CHANGELOG.md

@@ -10,6 +10,7 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - `ActiveUsers.updateLastActive` no longer writes `user_last_active` directly; it only appends the throttled `user_last_active` activity-log event, and the `RollupUserLastActive` cron is now the sole writer of the projection (so counts reflect activity within a rollup interval).
 - Added Phase-1 parity tests proving the last-active rollup derives the same `countUsersActiveSince` answer (and per-user projection) as the direct write, including link/unlink cases (`ActivityLogRollupParityTest`).
 - Adds an observability-only shadow audit to the approximate-user-count background refresh; discrepancies are logged and emitted as telemetry, never served.
+- The last-active rollup fold now skips activity for apps no longer present in `apps`, so a deleted app's retained `activity_log` rows can never resurrect a `user_last_active` projection row (which would violate its `apps` foreign key).
 
 ## [12.2.0]
 

src/main/java/io/supertokens/inmemorydb/queries/ActiveUsersQueries.java

@@ -166,11 +166,17 @@ public static void rollupLastActiveFromActivityLog_Transaction(Start start, Conn
             throws StorageQueryException, SQLException {
         String userLastActiveTable = Config.getConfig(start).getUserLastActiveTable();
         String activityLogTable = Config.getConfig(start).getActivityLogTable();
+        String appsTable = Config.getConfig(start).getAppsTable();
 
         // SQLite's two-argument max() is the scalar GREATEST, so the upsert stays monotonic.
+        // The apps guard skips activity for apps deleted within the window: activity_log rows are
+        // intentionally retained after an app is deleted (no app_id cascade), but user_last_active
+        // cascades on app delete, so folding a since-deleted app's rows would violate the
+        // user_last_active -> apps foreign key. EXISTS keeps the fold set to still-existing apps only.
         String FOLD_QUERY = "INSERT INTO " + userLastActiveTable + " (app_id, user_id, last_active_time)"
-                + " SELECT app_id, primary_or_recipe_user_id, MAX(created_at) FROM " + activityLogTable
+                + " SELECT app_id, primary_or_recipe_user_id, MAX(created_at) FROM " + activityLogTable + " al"
                 + " WHERE event_type = 'user_last_active' AND created_at >= ?"
+                + " AND EXISTS (SELECT 1 FROM " + appsTable + " a WHERE a.app_id = al.app_id)"
                 + " GROUP BY app_id, primary_or_recipe_user_id"
                 + " ON CONFLICT (app_id, user_id) DO UPDATE"
                 + " SET last_active_time = MAX(" + userLastActiveTable + ".last_active_time,"

src/test/java/io/supertokens/test/ActivityLogRollupTest.java

@@ -149,6 +149,39 @@ public void reconcileRemovesRecipeUserLinkedAwayInWindow() throws Exception {
         stopProcess(process);
     }
 
+    /**
+     * The fold must never resurrect a projection row for an app that no longer exists. {@code activity_log}
+     * rows are intentionally retained after an app is deleted (no app_id cascade), while {@code
+     * user_last_active} cascades on app delete; folding a since-deleted app's activity would re-insert a row
+     * that violates the {@code user_last_active -> apps} foreign key (this is what surfaced on PostgreSQL
+     * once the test DB stopped being reset). The {@code EXISTS (apps)} guard confines the fold to still-
+     * existing apps: a user_last_active event whose app_id is absent from {@code apps} is skipped, while a
+     * concurrent event for an existing app in the same window still folds normally.
+     */
+    @Test
+    public void foldSkipsActivityForAppMissingFromApps() throws Exception {
+        TestingProcessManager.TestingProcess process = startInMemoryProcess();
+        Start storage = (Start) StorageLayer.getStorage(process.getProcess());
+
+        long base = System.currentTimeMillis();
+        String existingAppUser = "rollup-app-guard-existing";
+        String deletedAppUser = "rollup-app-guard-deleted";
+        // "public" is present in the apps table; this id never is, standing in for a deleted app whose
+        // activity_log rows still linger.
+        String missingAppId = "app-that-was-deleted";
+
+        insertUserLastActiveEventForApp(storage, APP_ID, existingAppUser, base + 1000);
+        insertUserLastActiveEventForApp(storage, missingAppId, deletedAppUser, base + 2000);
+
+        runRollup(storage, base - 10000);
+
+        // The existing app's user is folded; the missing app's user is skipped (no resurrected row).
+        assertEquals(Long.valueOf(base + 1000), getLastActiveForApp(storage, APP_ID, existingAppUser));
+        assertNull(getLastActiveForApp(storage, missingAppId, deletedAppUser));
+
+        stopProcess(process);
+    }
+
     /**
      * A transactional audit write plus a mutation on one connection, with a failure injected after the
      * write, must roll back together — neither the audit row nor the mutation survives.
@@ -251,25 +284,46 @@ private void seedUserLastActive(Start storage, String userId, long lastActiveTim
         });
     }
 
+    private Long getLastActiveForApp(Start storage, String appId, String userId) throws Exception {
+        String query = "SELECT last_active_time FROM " + USER_LAST_ACTIVE + " WHERE app_id = ? AND user_id = ?";
+        return storage.startTransaction(con -> {
+            Connection sqlCon = (Connection) con.getConnection();
+            try (PreparedStatement pst = sqlCon.prepareStatement(query)) {
+                pst.setString(1, appId);
+                pst.setString(2, userId);
+                try (ResultSet rs = pst.executeQuery()) {
+                    return rs.next() ? Long.valueOf(rs.getLong(1)) : null;
+                }
+            } catch (Exception e) {
+                throw new RuntimeException(e);
+            }
+        });
+    }
+
     private void insertUserLastActiveEvent(Start storage, String userId, long createdAt) throws Exception {
         // For a user_last_active event the user is its own primary_or_recipe_user_id.
-        insertActivityLogRow(storage, userId, userId, "user_last_active", createdAt);
+        insertActivityLogRow(storage, APP_ID, userId, userId, "user_last_active", createdAt);
+    }
+
+    private void insertUserLastActiveEventForApp(Start storage, String appId, String userId, long createdAt)
+            throws Exception {
+        insertActivityLogRow(storage, appId, userId, userId, "user_last_active", createdAt);
     }
 
     private void insertAccountLinkingEvent(Start storage, String recipeUserId, String primaryUserId, long createdAt)
             throws Exception {
-        insertActivityLogRow(storage, recipeUserId, primaryUserId, "account_linking", createdAt);
+        insertActivityLogRow(storage, APP_ID, recipeUserId, primaryUserId, "account_linking", createdAt);
     }
 
-    private void insertActivityLogRow(Start storage, String recipeUserId, String primaryOrRecipeUserId,
+    private void insertActivityLogRow(Start storage, String appId, String recipeUserId, String primaryOrRecipeUserId,
                                       String eventType, long createdAt) throws Exception {
         String query = "INSERT INTO " + ACTIVITY_LOG
                 + " (app_id, tenant_id, recipe_user_id, primary_or_recipe_user_id, event_type, status, created_at)"
                 + " VALUES (?, 'public', ?, ?, ?, 'success', ?)";
         storage.startTransaction(con -> {
             Connection sqlCon = (Connection) con.getConnection();
             try (PreparedStatement pst = sqlCon.prepareStatement(query)) {
-                pst.setString(1, APP_ID);
+                pst.setString(1, appId);
                 pst.setString(2, recipeUserId);
                 pst.setString(3, primaryOrRecipeUserId);
                 pst.setString(4, eventType);