fix(knowledge): skip a required-key connector without a key and write the unscheduled state only over the row the run observed

Author: waleedlatif1

apps/sim/connectors/auth.test.ts

@@ -2,11 +2,31 @@
  * @vitest-environment node
  */
 import { describe, expect, it } from 'vitest'
-import { isConnectorCredentialTypeAllowed } from '@/connectors/auth'
+import { connectorHasAuthSource, isConnectorCredentialTypeAllowed } from '@/connectors/auth'
 import { confluenceConnectorMeta } from '@/connectors/confluence/meta'
 import { googleDriveConnectorMeta } from '@/connectors/google-drive/meta'
 import { slackConnectorMeta } from '@/connectors/slack/meta'
 
+describe('connectorHasAuthSource', () => {
+  const none = { credentialId: null, encryptedApiKey: null }
+  const keyed = { credentialId: null, encryptedApiKey: 'enc' }
+  const linked = { credentialId: 'cred', encryptedApiKey: null }
+
+  it('mirrors the token resolver for every auth shape', () => {
+    expect(connectorHasAuthSource({ mode: 'apiKey', label: 'Key' }, none)).toBe(false)
+    expect(connectorHasAuthSource({ mode: 'apiKey', label: 'Key' }, keyed)).toBe(true)
+    expect(connectorHasAuthSource({ mode: 'apiKey', label: 'Key', optional: true }, none)).toBe(
+      true
+    )
+    expect(connectorHasAuthSource({ mode: 'oauth', provider: 'slack' }, none)).toBe(false)
+    expect(connectorHasAuthSource({ mode: 'oauth', provider: 'slack' }, linked)).toBe(true)
+    expect(connectorHasAuthSource({ mode: 'oauth', provider: 'slack' }, keyed)).toBe(false)
+    expect(
+      connectorHasAuthSource({ mode: 'oauth', provider: 'github', apiKey: { label: 'PAT' } }, keyed)
+    ).toBe(true)
+  })
+})
+
 describe('connector credential eligibility', () => {
   it.each([confluenceConnectorMeta, googleDriveConnectorMeta])(
     'requires a service account for $name central indexing and preserves member and workspace OAuth',

apps/sim/connectors/auth.ts

@@ -34,11 +34,9 @@ export function connectorHasAuthSource(
   auth: ConnectorAuthConfig,
   connector: { credentialId: string | null; encryptedApiKey: string | null }
 ): boolean {
-  return (
-    auth.mode === 'apiKey' ||
-    Boolean(connector.credentialId) ||
-    Boolean(getConnectorApiKeyConfig(auth) && connector.encryptedApiKey)
-  )
+  const apiKeyConfig = getConnectorApiKeyConfig(auth)
+  if (apiKeyConfig && connector.encryptedApiKey) return true
+  return auth.mode === 'apiKey' ? apiKeyConfig?.optional === true : Boolean(connector.credentialId)
 }
 
 /** Workspace token input supported by a connector, independent of its member OAuth method. */

apps/sim/lib/knowledge/connectors/sync-engine.test.ts

@@ -109,6 +109,12 @@ vi.mock('@/connectors/registry.server', () => ({
       getDocument: mockGetDocument,
       listDocuments: mockListDocuments,
     },
+    keyed: {
+      name: 'Keyed',
+      auth: { mode: 'apiKey' },
+      getDocument: mockGetDocument,
+      listDocuments: mockListDocuments,
+    },
     oauth: {
       name: 'OAuth',
       auth: { mode: 'oauth', provider: 'example' },
@@ -3367,6 +3373,23 @@ describe('executeSync hard-delete reconciliation', () => {
     )
   })
 
+  it('leaves an API-key connector whose required key is missing unscheduled', async () => {
+    const { executeSync } = await import('@/lib/knowledge/connectors/sync-engine')
+
+    queueTableRows(schemaMock.knowledgeConnector, [
+      { ...CONNECTOR, connectorType: 'keyed', credentialId: null, encryptedApiKey: null },
+    ])
+
+    const result = await executeSync('c-1', {
+      billingAttribution: { workspaceId: 'ws-1' } as never,
+    })
+
+    expect(result.skipReason).toBe('credential_missing')
+    expect(dbChainMockFns.set).not.toHaveBeenCalledWith(
+      expect.objectContaining({ consecutiveFailures: expect.any(Number) })
+    )
+  })
+
   it('releases the lock when it errors a connector whose knowledge base is gone', async () => {
     const { executeSync } = await import('@/lib/knowledge/connectors/sync-engine')
 

apps/sim/lib/knowledge/connectors/sync-engine.ts

@@ -856,10 +856,26 @@ export async function executeSync(
    */
   if (!connectorHasAuthSource(connectorConfig.auth, connectorBeforeLock)) {
     logger.warn('Skipping sync: connector has no credential to authenticate with', { connectorId })
+    /**
+     * Written only while the row is still the credential-less runnable row this run read: a
+     * reconnect that landed in between keeps its schedule, and a paused or disabled connector
+     * a stale task reached keeps its status.
+     */
+    const observed = (
+      column: typeof knowledgeConnector.credentialId | typeof knowledgeConnector.encryptedApiKey,
+      value: string | null
+    ) => (value === null ? isNull(column) : eq(column, value))
     await db
       .update(knowledgeConnector)
       .set(buildSyncUnscheduledUpdate(new Date(), CREDENTIAL_REMOVED_SYNC_ERROR))
-      .where(eq(knowledgeConnector.id, connectorId))
+      .where(
+        and(
+          eq(knowledgeConnector.id, connectorId),
+          observed(knowledgeConnector.credentialId, connectorBeforeLock.credentialId),
+          observed(knowledgeConnector.encryptedApiKey, connectorBeforeLock.encryptedApiKey),
+          inArray(knowledgeConnector.status, [...RUNNABLE_CONNECTOR_STATUSES])
+        )
+      )
     return { ...result, skipReason: 'credential_missing' }
   }