fix(search): retain sync failures and resume reconnected accounts

Author: Sg312

apps/sim/app/credential-groups/complete/completion-handoff.test.tsx

@@ -10,8 +10,8 @@ afterEach(() => {
 })
 
 describe('credential group OAuth completion', () => {
-  it.each([undefined, 'denied', 'configuration_changed'] as const)(
-    'publishes %s to only its initiating tab and closes',
+  it.each([undefined, 'failed', 'denied', 'configuration_changed'] as const)(
+    'publishes %s to only its initiating tab and keeps failures visible',
     (failure) => {
       const postMessage = vi.fn()
       const closeChannel = vi.fn()
@@ -40,7 +40,8 @@ describe('credential group OAuth completion', () => {
         expect(names).toEqual([`sim:credential-group-oauth:${completionId}`])
         expect(postMessage).toHaveBeenCalledExactlyOnceWith(failure ?? 'connected')
         expect(closeChannel).toHaveBeenCalledOnce()
-        expect(closeWindow).toHaveBeenCalledOnce()
+        if (failure) expect(closeWindow).not.toHaveBeenCalled()
+        else expect(closeWindow).toHaveBeenCalledOnce()
       } finally {
         act(() => root.unmount())
       }

apps/sim/app/credential-groups/complete/completion-handoff.tsx

@@ -20,7 +20,8 @@ export function CredentialGroupCompletionHandoff({
     const channel = new BroadcastChannel(credentialGroupOAuthCompletionChannel(completionId))
     channel.postMessage(failure ?? 'connected')
     channel.close()
-    window.close()
+    /** Keep the authorization failure visible while the initiating chat shows its retry action. */
+    if (!failure) window.close()
   }, [completionId, failure])
   return null
 }

apps/sim/hooks/use-search-integration-connection.test.tsx

@@ -211,6 +211,37 @@ describe('Search connection card lifecycle', () => {
     expect(m.mutate).toHaveBeenCalledTimes(2)
     expect(connection().pending).toBe(true)
   })
+  it('surfaces callback failures and retries with a fresh completion receipt', async () => {
+    render()
+    await act(async () => {
+      await connection().connect()
+    })
+    const firstId = m.mutate.mock.calls[0][0].oauthCompletionId
+    const failureChannel = m.channels.find(
+      (channel) => channel.name === `sim:credential-group-oauth:${firstId}`
+    )
+    act(() => failureChannel?.onmessage?.(new MessageEvent('message', { data: 'failed' })))
+    expect(connection().pending).toBe(false)
+    expect(connection().connected).toBe(false)
+    expect(connection().error).toContain('Account authorization did not complete')
+    expect(windows[0].close).not.toHaveBeenCalled()
+
+    await act(async () => {
+      await connection().connect()
+    })
+    const secondId = m.mutate.mock.calls[1][0].oauthCompletionId
+    expect(secondId).not.toBe(firstId)
+    expect(connection().pending).toBe(true)
+    expect(connection().error).toBeNull()
+    m.accounts = [{ credentialId: 'mine', status: 'connected' }]
+    m.receipts.set(firstId, 'mine')
+    render()
+    expect(connection().connected).toBe(false)
+    m.receipts.set(secondId, 'mine')
+    render()
+    expect(connection().connected).toBe(true)
+    expect(windows[1].close).toHaveBeenCalled()
+  })
   it('retries the exact source created by the first attempt after cancellation or reload', async () => {
     m.requestedTarget = { type: 'link', provider: 'gmail', connectorType: 'gmail' }
     render()

apps/sim/lib/credential-groups/oauth.test.ts

@@ -278,6 +278,7 @@ describe('credential group OAuth persistence', () => {
       expect(dispatchMemberSyncsForCredentialOption).toHaveBeenCalledWith({
         organizationId: 'org-1',
         credentialGroupOptionId: 'option-1',
+        connectedCredentialId: 'credential-1',
       })
       expect(eq).toHaveBeenCalledWith(
         schemaMock.credentialGroupEnrollment.invitationTokenHash,

apps/sim/lib/credential-groups/oauth.ts

@@ -359,6 +359,7 @@ async function persistGrant(
     await dispatchMemberSyncsForCredentialOption({
       ...resourceScopeFields(resourceScopeFromOwner(context)),
       credentialGroupOptionId: context.option.id,
+      connectedCredentialId: completion.credentialId,
     })
   } catch (error) {
     logger.warn('Failed to queue member syncs after an account connected', {

apps/sim/lib/credentials/managed-oauth.test.ts

@@ -132,6 +132,38 @@ describe('managed OAuth token resolution', () => {
     expect(mocks.decryptSecret).toHaveBeenCalledWith('encrypted-token-set')
   })
 
+  it('keeps an active GitHub grant connected when the worker lacks its OAuth app configuration', async () => {
+    setEnv({ GITHUB_APP_CLIENT_ID: 'fixture-client', GITHUB_APP_CLIENT_SECRET: 'fixture-secret' })
+    const adapter = createStandardOAuthCredentialGroupProviderAdapter('github-repositories')
+    const policy = await adapter.getPolicy(undefined, { workspaceId: 'workspace-1' })
+    mocks.getAdapter.mockReturnValue(adapter)
+    const row = {
+      ...mondayCredentialRow(),
+      providerId: policy.providerId,
+      authorizationAppId: policy.authorizationAppId,
+      managedOauthScopeVersion: policy.scopeVersion,
+      grantedScopes: [],
+      accessTokenExpiresAt: new Date('2026-09-01T13:00:00Z'),
+    }
+    dbChainMockFns.limit.mockResolvedValue([row])
+    const params = {
+      ...mondayTokenResolutionParams(),
+      expectedProviderId: policy.providerId,
+      requiredScopes: [],
+    }
+    setEnv({ GITHUB_APP_CLIENT_ID: undefined, GITHUB_APP_CLIENT_SECRET: undefined })
+    await expect(resolveManagedOAuthToken(params)).rejects.toMatchObject({
+      code: 'MANAGED_CREDENTIAL_CONFIGURATION_UNAVAILABLE',
+      statusCode: 503,
+    })
+    expect(dbChainMockFns.set).not.toHaveBeenCalled()
+    expect(mocks.decryptSecret).not.toHaveBeenCalled()
+
+    setEnv({ GITHUB_APP_CLIENT_ID: 'fixture-client', GITHUB_APP_CLIENT_SECRET: 'fixture-secret' })
+    await expect(resolveManagedOAuthToken(params)).resolves.toMatchObject({ refreshed: false })
+    expect(dbChainMockFns.set).not.toHaveBeenCalled()
+  })
+
   it.each([
     { grant: 'drive', request: 'drive.readonly', allowed: true },
     { grant: 'drive.readonly', request: 'drive.readonly', allowed: true },
@@ -279,7 +311,10 @@ describe('managed OAuth token resolution', () => {
         expectedProviderId: 'slack',
         requiredScopes: [...SLACK_SEARCH_USER_SCOPES],
       })
-    ).rejects.toMatchObject({ code: 'MANAGED_CREDENTIAL_NEEDS_REAUTH' })
+    ).rejects.toMatchObject({
+      code: 'MANAGED_CREDENTIAL_CONFIGURATION_UNAVAILABLE',
+      statusCode: 503,
+    })
     expect(mocks.decryptSecret).not.toHaveBeenCalled()
   })
 

apps/sim/lib/credentials/managed-oauth.ts

@@ -38,6 +38,7 @@ export type ManagedOAuthCredentialErrorCode =
   | 'MANAGED_CREDENTIAL_NEEDS_REAUTH'
   | 'MANAGED_CREDENTIAL_INSUFFICIENT_SCOPE'
   | 'MANAGED_CREDENTIAL_INVALID_TOKEN_SET'
+  | 'MANAGED_CREDENTIAL_CONFIGURATION_UNAVAILABLE'
   | 'MANAGED_CREDENTIAL_REFRESH_FAILED'
 
 export class ManagedOAuthCredentialError extends Error {
@@ -258,9 +259,9 @@ async function assertManagedCredentialUsable(
   } catch (error) {
     if (!(error instanceof CredentialGroupProviderConfigurationError)) throw error
     throw new ManagedOAuthCredentialError(
-      'MANAGED_CREDENTIAL_NEEDS_REAUTH',
+      'MANAGED_CREDENTIAL_CONFIGURATION_UNAVAILABLE',
       'Managed credential authorization app is unavailable',
-      401
+      503
     )
   }
   if (

apps/sim/lib/knowledge/application/search-source-progress.ts

@@ -1,3 +1,4 @@
+import { requirePrincipalSubjectUserId } from '@sim/auth/principal'
 import { db } from '@sim/db'
 import { document, knowledgeBase, knowledgeConnector } from '@sim/db/schema'
 import { and, eq, exists, inArray, isNull, type SQL, sql } from 'drizzle-orm'
@@ -9,6 +10,7 @@ import { createKnowledgeAccessProvider } from '@/lib/knowledge/access/scope'
 import { defineAuthorizedKnowledgeUseCase } from '@/lib/knowledge/application/authorized-knowledge-use-case'
 import { resolveKnowledgeOwnerContext } from '@/lib/knowledge/application/contexts'
 import { knowledgeOperations } from '@/lib/knowledge/application/operations'
+import { hasViewerMemberSyncError } from '@/lib/knowledge/connectors/viewer-member-sync-error'
 import { MAX_SEARCH_SOURCE_PROGRESS_ITEMS } from '@/lib/knowledge/constants'
 import { failedDocumentCondition } from '@/lib/knowledge/documents/processing-status'
 import { searchIntegrationAccessCondition } from '@/lib/knowledge/search/integration-policy'
@@ -60,6 +62,9 @@ export const readSearchSourceProgress = defineAuthorizedKnowledgeUseCase({
         accessMode: knowledgeConnector.accessMode,
         memberSyncStatus: knowledgeConnector.memberSyncStatus,
         hasRetainedSyncError: sql<boolean>`${knowledgeConnector.lastSyncError} IS NOT NULL`,
+        hasViewerMemberSyncError: hasViewerMemberSyncError(
+          requirePrincipalSubjectUserId(principal)
+        ),
         approved: sql<boolean>`${searchIntegrationAccessCondition()}`,
         isIndexing: hasDocumentsInState(
           inArray(document.processingStatus, ['pending', 'processing'])
@@ -96,6 +101,7 @@ export const readSearchSourceProgress = defineAuthorizedKnowledgeUseCase({
         hasSyncError:
           row.status === 'error' ||
           row.hasRetainedSyncError === true ||
+          row.hasViewerMemberSyncError === true ||
           (row.accessMode === 'members' && row.memberSyncStatus === 'error'),
         hasIndexingError: row.hasIndexingError,
       })),

apps/sim/lib/knowledge/application/search-sources.test.ts

@@ -1,9 +1,11 @@
 /** @vitest-environment node */
 import {
+  credentialGroupEnrollment,
   document,
   embedding,
   knowledgeBase,
   knowledgeConnector,
+  knowledgeConnectorMember,
   member,
   organizationSearchIntegration,
   user,
@@ -96,6 +98,7 @@ function source(id: string, connectorType = 'google_drive', accessMode = 'admin'
     memberSyncStatus: 'idle',
     lastSyncAt: LAST_SYNC as Date | null,
     hasRetainedSyncError: false,
+    hasViewerMemberSyncError: false,
     lastMemberSyncAt: null as Date | null,
     credentialGroupId: 'group-secret',
     credentialGroupOptionId: 'option-secret',
@@ -129,6 +132,26 @@ beforeEach(() => {
 })
 
 describe('Search source summaries', () => {
+  it('retains the viewer account failure after an otherwise successful empty run', async () => {
+    seed([{ ...source('github', 'google_drive', 'members'), hasViewerMemberSyncError: true }])
+    const result = await listSearchSources.execute({ principal, input })
+    expect(result.sources[0]).toMatchObject({ hasSyncError: true, isSyncing: false })
+    expect(dbChainMockFns.where).toHaveBeenCalledWith(
+      expect.objectContaining({
+        type: 'and',
+        conditions: expect.arrayContaining([
+          { type: 'eq', left: credentialGroupEnrollment.userId, right: principal.userId },
+          {
+            type: 'eq',
+            left: knowledgeConnectorMember.connectorId,
+            right: knowledgeConnector.id,
+          },
+          { type: 'isNotNull', column: knowledgeConnectorMember.lastError },
+        ]),
+      })
+    )
+  })
+
   it.each(['read', 'write', 'admin'])(
     'allows a current workspace %s without exposing credentials or other members',
     async (role) => {
@@ -297,7 +320,7 @@ describe('Search source summaries', () => {
       sources: [],
       nextCursor: null,
     })
-    expect(dbChainMockFns.where.mock.calls[0][0]).toEqual({
+    expect(dbChainMockFns.where).toHaveBeenCalledWith({
       type: 'and',
       conditions: expect.arrayContaining([
         {
@@ -493,6 +516,26 @@ describe('organization Search source summaries', () => {
 })
 
 describe('bounded Search progress', () => {
+  it('keeps reporting an unresolved viewer account failure between retries', async () => {
+    queueTableRows(knowledgeConnector, [
+      {
+        connectorId: 'github',
+        approved: true,
+        status: 'active',
+        accessMode: 'members',
+        memberSyncStatus: 'idle',
+        hasViewerMemberSyncError: true,
+        isIndexing: false,
+        hasIndexingError: false,
+      },
+    ])
+    const result = await readSearchSourceProgress.execute({
+      principal,
+      input: { ...input, connectorIds: ['github'] },
+    })
+    expect(result.sources[0]).toMatchObject({ hasSyncError: true, isSyncing: false })
+  })
+
   it('reports visible pending and failed work without counting documents or chunks', async () => {
     queueTableRows(knowledgeConnector, [
       {

apps/sim/lib/knowledge/application/search-sources.ts

@@ -17,6 +17,7 @@ import { defineAuthorizedKnowledgeUseCase } from '@/lib/knowledge/application/au
 import { resolveKnowledgeOwnerContext } from '@/lib/knowledge/application/contexts'
 import { knowledgeOperations } from '@/lib/knowledge/application/operations'
 import { resolveViewerConnectorMemberships } from '@/lib/knowledge/connectors/member-provisioning'
+import { hasViewerMemberSyncError } from '@/lib/knowledge/connectors/viewer-member-sync-error'
 import { resolveViewerSourceAccounts } from '@/lib/knowledge/connectors/viewer-source-accounts'
 import {
   SEARCH_SOURCE_CANDIDATE_PAGE_SIZE,
@@ -84,6 +85,7 @@ export const listSearchSources = defineAuthorizedKnowledgeUseCase({
         memberSyncStatus: knowledgeConnector.memberSyncStatus,
         lastSyncAt: knowledgeConnector.lastSyncAt,
         hasRetainedSyncError: sql<boolean>`${knowledgeConnector.lastSyncError} IS NOT NULL`,
+        hasViewerMemberSyncError: hasViewerMemberSyncError(userId),
         lastMemberSyncAt: knowledgeConnector.lastMemberSyncAt,
         credentialGroupId: knowledgeConnector.credentialGroupId,
         credentialGroupOptionId: knowledgeConnector.credentialGroupOptionId,
@@ -274,6 +276,7 @@ export const listSearchSources = defineAuthorizedKnowledgeUseCase({
           hasSyncError:
             row.status === 'error' ||
             row.hasRetainedSyncError === true ||
+            row.hasViewerMemberSyncError === true ||
             (row.accessMode === 'members' && row.memberSyncStatus === 'error'),
           hasViewerDocuments: available && state?.hasDocuments === true,
           viewerFailedDocumentCount: available ? (state?.failedCount ?? 0) : 0,