fix(cli): refuse event triggers whose integration the owner has not connected

Merged
KI
2d ago
+198-0

Links

Summary

  • superset automations create and update now refuse to save an event trigger whose integration the caller has not connected. The error says what to do.

Why / Context

Linear, Slack, Sentry, Notion, Microsoft Teams and Google connections are per user. A trigger only fires for an owner who connected that integration, by design (#7317). The desktop editor shows "Requires connection" for such a trigger. The CLI saved it with no check, so an automation created from the CLI or by an agent could silently never fire. That happened to a Linear automation.

How It Works

  • missingConnectionError.ts maps each trigger kind to its connector through the shared TRIGGER_KIND_CONNECTOR. It reads integration.connectionStatus, the same query the desktop editor uses.
  • If a needed connector is not connected, the command throws before any mutation: 
    Error: These triggers would never fire: you have not connected Microsoft Teams
Hint: Connect Microsoft Teams in Settings → Integrations. Then run this command again.
    An expired connection gets "Reconnect … in Settings → Integrations" instead.
  • In update the check runs before setEnabled, so a refused call changes nothing.
  • Schedule, webhook and GitHub triggers are never refused. If the status query fails, the save goes ahead instead of blocking.

Manual QA Checklist

  • automations create with a Microsoft Teams trigger and no Teams connection, run from the source CLI against prod: refused with the message above, and no automation was created.
  • automations update re-saving an existing Linear trigger with a live Linear connection, against prod: saves as before.
  • Expired connection path. Only unit tests cover it.

Testing

  • bun test src/commands/automations (in packages/cli): 14 pass. The new tests fail when the connection check is removed.
  • bun run typecheck (in packages/cli): clean
  • biome check on the changed files: clean

Design Decisions

  • Error instead of warning: a trigger that can never fire is not worth saving, and an error makes an agent pass the fix on to the user. The desktop editor still allows the save, because it offers an inline Connect button.
  • Hint points to Settings → Integrations, not superset plugins connect: the plugins command is internal-only, and plugin connections are separate from trigger connections.

Summary by cubic

Fixes superset automations create and update silently saving event triggers that can never fire because the caller hasn't connected the trigger's integration. The CLI now checks integration.connectionStatus before saving and refuses with a message telling the user to connect or reconnect in Settings → Integrations.

  • Refusal happens before any mutation, so a blocked update changes nothing.
  • A trigger pinned to an account the caller doesn't own, or to an expired account, is refused even when another account on the same integration is live.
  • Schedule, webhook, and GitHub triggers are never refused; a failed status check does not block the save.

Summary by CodeRabbit

  • Bug Fixes
    • Automation creation and updates now check that required integrations are connected before proceeding.
    • When a required integration is disconnected or needs reauthentication, the CLI reports which connection needs attention and how to resolve it.
    • The CLI also identifies when a pinned connection belongs to another account or needs reauthorization. Triggers that do not require an integration connection are unaffected.