Dropbox Stale File Retention Sentinel

id: dropbox-stale-file-retention-sentinel
namespace: company.team

description: |
  List files under a Dropbox path, flag the ones whose last client-modified date is older than
  a retention threshold you set, alert Slack with the count and file paths when any are found,
  and log a governance audit trail either way. Read-only: this flow never deletes or modifies a
  file.

inputs:
  - id: dropbox_path
    type: STRING
    displayName: Dropbox path to scan
    description: Dropbox path to audit. Empty or / scans the root.
    defaults: ""

  - id: recursive_scan
    type: BOOL
    displayName: Scan sub-folders
    description: When true, traverses every sub-folder under dropbox_path instead of
      just the top level.
    defaults: true

  - id: retention_days
    type: INT
    displayName: Retention age in days
    description: A file whose clientModified date is older than this many days is
      reported stale.
    defaults: 180

  - id: max_stale_count
    type: INT
    displayName: Max stale count
    description: Alert when this many or more matching files are found.
    defaults: 1

tasks:
  - id: list_files
    type: io.kestra.plugin.dropbox.files.List
    description: Read-only. Lists every entry under dropbox_path; evaluate below
      filters to stale files since the Dropbox List API itself has no age-based
      filter.
    allowFailure: true
    accessToken: "{{ secret('DROPBOX_ACCESS_TOKEN') }}"
    from: "{{ inputs.dropbox_path }}"
    recursive: "{{ inputs.recursive_scan }}"
    fetchType: FETCH

  - id: evaluate
    type: io.kestra.plugin.core.output.OutputValues
    description: Compares each file's clientModified date against the retention_days
      cutoff, by date only, computed here so the comparison never depends on
      wall-clock time inside jq.
    values:
      stale_count: >-
        {{ outputs.list_files is not defined ? -1 : (({'rows':
        outputs.list_files.rows, 'cutoff': (now() |
        dateAdd(-inputs.retention_days, 'DAYS') | date('yyyy-MM-dd'))} |
        jq('.cutoff as $c | [(.rows // [])[] | select(.type == "file" and
        ((.clientModified // "")[0:10]) as $d | $d != "" and $d <= $c)] |
        length')) | first | number) }}
      stale_paths: >-
        {{ outputs.list_files is not defined ? '' : (({'rows':
        outputs.list_files.rows, 'cutoff': (now() |
        dateAdd(-inputs.retention_days, 'DAYS') | date('yyyy-MM-dd'))} |
        jq('.cutoff as $c | [(.rows // [])[] | select(.type == "file" and
        ((.clientModified // "")[0:10]) as $d | $d != "" and $d <= $c) | .path]
        | join("; ")')) | first) }}
      severity: >-
        {{ outputs.list_files is not defined ? 'CRITICAL' : (((({'rows':
        outputs.list_files.rows, 'cutoff': (now() |
        dateAdd(-inputs.retention_days, 'DAYS') | date('yyyy-MM-dd'))} |
        jq('.cutoff as $c | [(.rows // [])[] | select(.type == "file" and
        ((.clientModified // "")[0:10]) as $d | $d != "" and $d <= $c)] |
        length')) | first | number) >= inputs.max_stale_count) ?
        'STALE_FILES_FOUND' : 'OK') }}

  - id: route
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.evaluate.values.severity != 'OK' }}"
    then:
      - id: alert
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK_URL') }}"
        payload: |
          {{ {'text': outputs.evaluate.values.severity ~ ': ' ~ outputs.evaluate.values.stale_count ~ ' file(s) under Dropbox path ' ~ (inputs.dropbox_path == '' ? '/' : inputs.dropbox_path) ~ ' are older than ' ~ inputs.retention_days ~ ' day(s): ' ~ outputs.evaluate.values.stale_paths ~ '.'} | toJson }}
    else:
      - id: compliant
        type: io.kestra.plugin.core.log.Log
        message: "No file under Dropbox path {{ inputs.dropbox_path == '' ? '/' :
          inputs.dropbox_path }} is older than {{ inputs.retention_days }}
          day(s)."

  - id: summary
    type: io.kestra.plugin.core.log.Log
    message: "Dropbox stale file retention sentinel complete: {{
      outputs.evaluate.values.stale_count }} stale file(s), severity {{
      outputs.evaluate.values.severity }}."

errors:
  - id: alert_flow_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {{ {'text': 'Dropbox stale file retention sentinel failed (execution ' ~ execution.id ~ '). Check the logs.'} | toJson }}

triggers:
  - id: weekly
    type: io.kestra.plugin.core.trigger.Schedule
    description: Shipped disabled. Enable once DROPBOX_ACCESS_TOKEN and
      SLACK_WEBHOOK_URL are set and dropbox_path points at a real folder.
    cron: "0 7 * * 1"
    disabled: true
    inputs:
      dropbox_path: ""
      recursive_scan: true
      retention_days: 180
      max_stale_count: 1