feat: Confluence checks follow the design's rows and copy

Merged
EV
4d ago
+949-185

Description

Fifth backend PR for the connector checks redesign, stacked on #16167. Confluence's checks now follow the design's rows and copy (design-rows.json of the "Connector Check Copy" doc).

Framework

  • row_id on a check. Checks that share one are one row on the form: the variants of a probe (token types, deployments) and a probe's discovery step. It is carried on results and draft states. Older stored results and in-flight draft runs have none and read it as the check_id.
  • CheckOutput.summary: a passing check's line, i.e. the value it found.

Confluence

  • Names follow the design: "Sign in to Confluence", "List spaces", "Find selected spaces", "Sample page content", "Read space permissions" and so on. The variants and the space listing share rows, so the 25 checks make the design's 17 rows. A test pins the 17 rows and the 24-character names.
  • Failures give the design's line and description. The second line names what the account type needs: the OAuth or scoped-token scope ("Required scope: read:space:confluence"), or the permission the token's user needs. message keeps today's full text, for Error Details.
  • Passing checks give the value they found:
    • "Signed in as {email}" (Cloud API token);
    • "{n} spaces visible";
    • "Found space {name}";
    • "Found page {title}";
    • "First {n} matches are all pages";
    • "Read a page in {space}";
    • "Downloaded a {size} attachment";
    • "Read who can view {space}";
    • "{k} of {n} users show an email", with a caveat for the users without one;
    • "{n} users listed".
  • Rejected API token. Confluence Cloud answers basic auth it does not accept with HTTP 403 "caller cannot access Confluence", as an anonymous caller. For an API token, the sign-in check now reports that as "Sign-in rejected" (error_kind: rejected), not as a missing permission. OAuth keeps "No Confluence access on this site". Found on a local stack with a revoked token.
  • CONFCLOUD-77618. When it blocks the batch read, "Read page restrictions" passes with a caveat that it proved the slower per-page path.
  • Email counts. The Data Center email checks now count all (at most 5) sampled users instead of stopping at the first email, so the line can say "k of n".

Outcome-state changes are the next PR: an empty sample that becomes Incomplete, empty scopes that become Skipped, and the partial Find. The frontend owner merges rows by row_id. Until then, the old card shows "List spaces" twice.

How Has This Been Tested?

  • New unit tests (test_confluence_check_row_text.py):
    • the sign-in and spaces lines;
    • the anonymous-403 mapping for an API token versus OAuth;
    • the per-account-type line of what is needed;
    • the 17 merged rows.
  • Connector and EE unit tests: 4282 passed. The 93 capability-check external dependency tests pass on a scratch DB. ty is clean.
  • Local ods stack with a revoked token: "Sign in to Confluence · Sign-in rejected", and every other row "Not run: Sign in to Confluence failed".

Additional Options

  • [Optional] Please cherry-pick this PR to the latest release version.
  • [Optional] Override Linear Check

🤖 Generated with Claude Code

Summary by cubic

Makes Confluence connector checks follow the design's row names and copy: checks that share a row_id render as one row, and passing checks report what they found in a new CheckOutput.summary.

  • Renames checks to the design's copy ("Sign in to Confluence", "List spaces", "Find selected spaces", and so on), so 25 checks render as 17 rows.
  • Failures carry a short line plus a description naming what the account type needs (an OAuth or scoped-token scope, or a token-user permission).
  • Passing checks name the value found, e.g. "Signed in as {email}", "{n} spaces visible", "Found space {name}", "Read who can view {space}", "{k} of {n} users show an email".
  • The anonymous-access check now shares permission sync's read of a space's anonymous operations and reports anonymous access on/off.
  • A Cloud API token that Confluence rejects (HTTP 403 "caller cannot access Confluence") now reports "Sign-in rejected" instead of a missing-permission error.
  • When CONFCLOUD-77618 blocks the batch restrictions read, "Read page restrictions" passes with a caveat that it proved the slower per-page path.

Outcome-state changes (empty samples, empty scopes, partial finds) are a follow-up PR.

Summary by CodeRabbit

  • New Features
    • Connection checks display concise summaries, findings, and advisories, with related checks grouped into shared form rows.
    • Confluence checks provide clearer results for site access, content, permissions, user and group sync, and credential issues, including sampled results where available.
    • Anonymous space-access checks support multiple permission-response formats.