Order workflows alphabetically in credential revoke dialog (#4955)

* Order workflows alphabetically in credential revoke dialog

The query behind the "this credential is in use by the following
workflows" confirmation had no explicit ordering, so with a distinct
select the workflow names came back in an arbitrary, unstable order.
Add an order-by so the dialog lists them alphabetically and predictably.

* Add contract tests and honest framing for workflow ordering

Add unit tests for project_workflows_using_credentials/1, which had no
coverage, exercising grouping, credential filtering, and the sorted
result. Keep the credential dialog test order-insensitive, since the
ordering guarantee belongs to the query, not the rendered view. Move the
changelog note to Changed: the previous order was left to the database
rather than being broken, so this makes the alphabetical sort explicit.

---------

Co-authored-by: Frank Midigo <midigofrank@gmail.com>

Author: elias-ba

CHANGELOG.md

@@ -39,6 +39,9 @@ and this project adheres to
   advisories from the `mix deps.audit` ignore list.
   [#4846](https://github.com/OpenFn/lightning/issues/4846)
 - Bump worker to 1.27.0
+- The credential revoke-access dialog now sorts the affected workflows
+  alphabetically. The order was previously left to the database and not
+  guaranteed. [#4954](https://github.com/OpenFn/lightning/issues/4954)
 - Updated Phoenix to 1.7.24 to address vulnerabilities in 1.7.23. This
   implicitly introduces a limit of 100 concurrent channels per Websocket
   connection (transport). If worker instances are set with a concurrency higher

lib/lightning/workflows.ex

@@ -74,7 +74,8 @@ defmodule Lightning.Workflows do
         join: j in assoc(w, :jobs),
         where: j.project_credential_id in ^project_credential_ids,
         select: %{name: w.name, project_id: w.project_id},
-        distinct: true
+        distinct: true,
+        order_by: w.name
 
     query
     |> Repo.all()

test/lightning/workflows_test.exs

@@ -1773,6 +1773,66 @@ defmodule Lightning.WorkflowsTest do
     end
   end
 
+  describe "project_workflows_using_credentials/1" do
+    test "returns each project's workflow names sorted alphabetically" do
+      project = insert(:project)
+
+      project_credential =
+        insert(:project_credential,
+          project: project,
+          credential: insert(:credential)
+        )
+
+      # inserted in reverse-alphabetical order so a query that dropped its
+      # ordering would return them out of order
+      for name <- ["ccc-workflow", "bbb-workflow", "aaa-workflow"] do
+        insert(:simple_workflow, project: project, name: name)
+        |> then(fn %{jobs: [job | _]} ->
+          job
+          |> Ecto.Changeset.change(%{
+            project_credential_id: project_credential.id
+          })
+          |> Repo.update!()
+        end)
+      end
+
+      assert Workflows.project_workflows_using_credentials([
+               project_credential.id
+             ]) ==
+               %{project.id => ["aaa-workflow", "bbb-workflow", "ccc-workflow"]}
+    end
+
+    test "only returns workflows whose jobs use the given credentials" do
+      project = insert(:project)
+
+      used =
+        insert(:project_credential,
+          project: project,
+          credential: insert(:credential)
+        )
+
+      unused =
+        insert(:project_credential,
+          project: project,
+          credential: insert(:credential)
+        )
+
+      insert(:simple_workflow, project: project, name: "uses-credential")
+      |> then(fn %{jobs: [job | _]} ->
+        job
+        |> Ecto.Changeset.change(%{project_credential_id: used.id})
+        |> Repo.update!()
+      end)
+
+      insert(:simple_workflow, project: project, name: "no-credential")
+
+      result = Workflows.project_workflows_using_credentials([used.id])
+
+      assert result == %{project.id => ["uses-credential"]}
+      assert Workflows.project_workflows_using_credentials([unused.id]) == %{}
+    end
+  end
+
   defp assert_trigger_state_audit(
          workflow_id,
          user_id,