fix(search): retain permission sync failures and clarify progress (#7897)

* fix(search): retain permission sync failures and clarify progress

* docs(search): explain permission warnings and sync continuation

* fix(search): report rejected permission grants as incomplete

* fix(search): distinguish member failures from continuation

* fix(testing): include member sync failure columns in schema mocks

* fix(search): retain central indexing dispatch warnings

Author: waleedlatif1

apps/docs/content/docs/search/confluence.mdx

@@ -132,6 +132,8 @@ Open **Settings → Sources → Confluence**, then a source's **Documents**, **S
 
 Syncing runs automatically. Admins can use **Sync now** for an immediate update, **Pause syncing** to stop scheduled syncs, or **Resume syncing** to restart them. Successful manual syncs have a one-minute cooldown; failed syncs can be retried immediately.
 
+In **Sync history**, **Continuing** means a healthy listing needs another batch. **Partial** means the sync did not fully succeed; read the accompanying notice. If permissions could not be verified, the last successful sync time stays unchanged and documents without verified access remain hidden from Search.
+
 ## Troubleshooting
 
 | Problem | What to check |
@@ -140,6 +142,7 @@ Syncing runs automatically. Admins can use **Sync now** for an immediate update,
 | Space picker is empty or fails | Check the domain, account's space access, and `read:space:confluence` scope. Manual space keys are also supported. |
 | Service-account validation fails | Check token expiry, site, Confluence app access, and the full scope list above, including `read:confluence-user`. |
 | Content syncs but Search is empty | Connect your personal Confluence identity. Check permission/directory sync errors and group-read scopes. |
+| **Some permissions could not be verified** | Open the source's **Sync history**. Check the service account's space, page, and directory access. If access is correct and the warning persists, ask your operator to inspect the connector run's permission errors. Do not broaden sharing to clear the warning. |
 | A new page, blog post, or label is missing | Confluence search can take time to update. Once the content appears in Confluence search with the selected label, sync again. |
 | A restricted page is missing | Both your account and the crawling account need access to the page and its ancestors. |
 | Embedded content is missing | Index the referenced page separately; remote macro output is excluded. |

apps/docs/content/docs/search/jira.mdx

@@ -90,6 +90,8 @@ After an admin approves Jira, a teammate can select **Connect** on the Jira row
 
 Admins open **Settings → Sources → Jira**, then a connection’s **Documents**, **Settings**, or **Sync history**. Metadata tags include issue type, status, priority, labels, assignee, and last updated.
 
+In **Sync history**, **Continuing** means a healthy listing needs another batch. **Partial** means some work did not succeed; the account counts and notice identify what needs attention.
+
 Teammates use the configured site and projects without entering them again. **Additional connection required** means another configured selection needs authorization; select **Connect**. **Reconnect** is for an account whose authorization needs renewing.
 
 Invite teammates through **Settings → Members → Invite** or SSO, then have them connect Jira through **Integrations**. **Settings → Sources → People**, filter by **Jira**, then select **Request connections** only requests a provider connection; it does not invite people to the organization.

apps/sim/app/o/[organizationId]/settings/components/integrations/organization-search-status.test.ts

@@ -29,6 +29,7 @@ describe('organization source status labels', () => {
     ['sync_failed', 'Sync failed'],
     ['account_sync_incomplete', 'Some accounts are not up to date'],
     ['document_indexing_failed', 'Some documents failed to index'],
+    ['permission_sync_incomplete', 'Some permissions could not be verified'],
   ] as const)('describes %s and keeps concurrent recovery visible', (issue, label) => {
     expect(organizationSearchStatusLabel({ ...provider, status: 'needs_attention', issue })).toBe(
       label

apps/sim/app/o/[organizationId]/settings/components/integrations/organization-search-status.ts

@@ -16,9 +16,11 @@ export function organizationSearchStatusLabel(provider: OrganizationSearchProvid
     const error =
       provider.issue === 'account_sync_incomplete'
         ? 'Some accounts are not up to date'
-        : provider.issue === 'document_indexing_failed'
-          ? 'Some documents failed to index'
-          : 'Sync failed'
+        : provider.issue === 'permission_sync_incomplete'
+          ? 'Some permissions could not be verified'
+          : provider.issue === 'document_indexing_failed'
+            ? 'Some documents failed to index'
+            : 'Sync failed'
     return provider.isSyncing ? `Indexing · ${error}` : error
   }
   return STATUS_LABELS[provider.status]

apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connector-sync-history.tsx

@@ -62,14 +62,15 @@ export function ConnectorSyncHistory({
   )
 }
 
-type SyncLogState = 'running' | 'interrupted' | 'failed' | 'completed' | 'partial'
+type SyncLogState = 'running' | 'interrupted' | 'failed' | 'completed' | 'partial' | 'continuing'
 
 const SYNC_LOG_LABELS: Record<SyncLogState, string> = {
   running: 'In progress…',
   interrupted: 'Interrupted',
   failed: 'Failed',
   completed: 'Completed',
   partial: 'Partial',
+  continuing: 'Continuing',
 }
 
 /** Reclaimed stale locks leave started log rows behind; both views use the engine's own TTL. */
@@ -92,9 +93,10 @@ interface SyncHistoryRowProps {
   startedAt: string
   state: SyncLogState
   description?: string
+  notice?: string | null
 }
 
-function SyncHistoryRow({ startedAt, state, description }: SyncHistoryRowProps) {
+function SyncHistoryRow({ startedAt, state, description, notice }: SyncHistoryRowProps) {
   return (
     <SettingsResourceRow
       title={
@@ -103,7 +105,7 @@ function SyncHistoryRow({ startedAt, state, description }: SyncHistoryRowProps)
           {state === 'completed' && <span className='sr-only'> · {SYNC_LOG_LABELS[state]}</span>}
         </time>
       }
-      description={description}
+      description={[description, notice].filter(Boolean).join(' · ') || undefined}
       badge={
         state === 'completed' ? undefined : (
           <span
@@ -135,7 +137,14 @@ export function SyncHistory({ logs, isLoading }: SyncHistoryProps) {
   return (
     <div className={RESOURCE_LIST_STACK}>
       {logs.map((log) => {
-        const state = getSyncLogState(log, CONNECTOR_SYNC_STALE_LOCK_TTL_MS, now)
+        const continuing =
+          log.status === 'partial' &&
+          log.listedCount === null &&
+          log.docsFailed === 0 &&
+          !log.errorMessage
+        const state = continuing
+          ? 'continuing'
+          : getSyncLogState(log, CONNECTOR_SYNC_STALE_LOCK_TTL_MS, now)
         const changes = [
           log.docsAdded > 0 && `${log.docsAdded} added`,
           log.docsUpdated > 0 && `${log.docsUpdated} updated`,
@@ -150,11 +159,13 @@ export function SyncHistory({ logs, isLoading }: SyncHistoryProps) {
             key={log.id}
             startedAt={log.startedAt}
             state={state}
+            notice={state === 'failed' ? undefined : log.errorMessage}
             description={
               state === 'failed'
                 ? (log.errorMessage ?? undefined)
-                : state === 'completed' || state === 'partial'
-                  ? changes || 'No changes'
+                : state === 'completed' || state === 'partial' || state === 'continuing'
+                  ? changes ||
+                    (state === 'continuing' || log.errorMessage ? undefined : 'No changes')
                   : undefined
             }
           />
@@ -193,17 +204,29 @@ function MemberSyncHistory({ logs, members, isLoading }: MemberSyncHistoryProps)
         <SettingsEmptyState variant='inline'>No member sync history yet.</SettingsEmptyState>
       ) : (
         logs.map((log) => {
-          const state = getSyncLogState(log, MEMBER_SYNC_STALE_LOCK_TTL_MS, now)
+          const continuing =
+            log.status === 'partial' &&
+            log.membersIncomplete > 0 &&
+            log.membersFailed === 0 &&
+            log.docsFailed === 0 &&
+            log.processingDispatchFailed === 0 &&
+            !log.errorMessage
+          const state = continuing
+            ? 'continuing'
+            : getSyncLogState(log, MEMBER_SYNC_STALE_LOCK_TTL_MS, now)
           const changes = [
             log.docsAdded > 0 && `${log.docsAdded} added`,
             log.docsUpdated > 0 && `${log.docsUpdated} updated`,
             log.docsTombstoned + log.docsPurged > 0 &&
               `${log.docsTombstoned + log.docsPurged} deleted`,
+            (log.docsFailed ?? 0) > 0 && `${log.docsFailed} failed`,
+            (log.processingDispatchFailed ?? 0) > 0 &&
+              `${log.processingDispatchFailed} failed to queue`,
           ]
             .filter(Boolean)
             .join(' · ')
           const description = [
-            changes || 'No changes',
+            changes || (continuing || log.errorMessage ? undefined : 'No changes'),
             log.membersFailed > 0 &&
               `${log.membersFailed} ${log.membersFailed === 1 ? 'account' : 'accounts'} failed`,
             log.membersIncomplete > 0 &&
@@ -216,10 +239,11 @@ function MemberSyncHistory({ logs, members, isLoading }: MemberSyncHistoryProps)
               key={log.id}
               startedAt={log.startedAt}
               state={state}
+              notice={state === 'failed' ? undefined : log.errorMessage}
               description={
                 state === 'failed'
                   ? (log.errorMessage ?? undefined)
-                  : state === 'completed' || state === 'partial'
+                  : state === 'completed' || state === 'partial' || state === 'continuing'
                     ? description
                     : undefined
               }

apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connectors-section.test.tsx

@@ -1063,6 +1063,41 @@ describe('shared connector sync history', () => {
     }
   )
 
+  it.each([
+    { docsFailed: 0, processingDispatchFailed: 0, continuing: true },
+    { docsFailed: 1, processingDispatchFailed: 0, continuing: false },
+    { docsFailed: 0, processingDispatchFailed: 1, continuing: false },
+    { docsFailed: null, processingDispatchFailed: null, continuing: false },
+    { docsFailed: undefined, processingDispatchFailed: undefined, continuing: false },
+  ])('requires known healthy member counters for continuation: %j', (fields) => {
+    lifecycle.detail.current = {
+      memberSyncLogs: [
+        {
+          ...makeLog({ status: 'partial' }),
+          membersCompleted: 1,
+          membersIncomplete: 1,
+          membersFailed: 0,
+          docsFailed: fields.docsFailed,
+          processingDispatchFailed: fields.processingDispatchFailed,
+          docsTombstoned: 0,
+          docsPurged: 0,
+        },
+      ],
+    }
+    const container = renderComponent(
+      <ConnectorSyncHistory
+        connector={makeConnector({ accessMode: 'members' })}
+        knowledgeBaseId='knowledge-1'
+      />
+    )
+    expect(container.textContent).toContain(fields.continuing ? 'Continuing' : 'Partial')
+    expect(container.textContent).not.toContain(fields.continuing ? 'Partial' : 'Continuing')
+    if (fields.continuing) expect(container.textContent).not.toContain('No changes')
+    if (fields.docsFailed) expect(container.textContent).toContain('1 failed')
+    if (fields.processingDispatchFailed)
+      expect(container.textContent).toContain('1 failed to queue')
+  })
+
   it('loads the member engine history rather than the content history', () => {
     lifecycle.detail.current = {
       syncLogs: [makeLog({ status: 'completed', docsAdded: 999 })],
@@ -1129,13 +1164,37 @@ describe('SyncHistory', () => {
     expect(container.textContent).not.toContain('No changes')
   })
 
-  it('renders a continued listing as partial with the work already completed', () => {
-    const container = render(makeLog({ status: 'partial', docsAdded: 3 }))
-    expect(container.textContent).toContain('Partial')
+  it('distinguishes a continued listing from a partial failure', () => {
+    const container = render(makeLog({ status: 'partial', docsAdded: 3, listedCount: null }))
+    expect(container.textContent).toContain('Continuing')
     expect(container.textContent).toContain('3 added')
     expect(container.textContent).not.toContain('In progress…')
   })
 
+  it('keeps permission failures visible even when document processing succeeded', () => {
+    const container = render(
+      makeLog({
+        status: 'partial',
+        listedCount: 4,
+        errorMessage: 'Some document permissions could not be verified.',
+      })
+    )
+    expect(container.textContent).toContain('Some document permissions could not be verified.')
+    expect(container.textContent).toContain('Partial')
+    expect(container.textContent).not.toContain('No changes')
+    expect(container.textContent).not.toContain('Continuing')
+  })
+
+  it.each([
+    { docsFailed: 1, listedCount: null },
+    { docsFailed: 0, listedCount: 4 },
+    { docsFailed: 0 },
+  ])('does not label failed, finished, or legacy partial logs as continuing: %j', (fields) => {
+    const container = render(makeLog({ status: 'partial', ...fields }))
+    expect(container.textContent).toContain('Partial')
+    expect(container.textContent).not.toContain('Continuing')
+  })
+
   it('keeps completion accessible without repeating decorative status on every row', () => {
     const log = makeLog({ status: 'completed', docsAdded: 3 })
     const container = render(log)

apps/sim/connectors/confluence/permissions.test.ts

@@ -284,6 +284,59 @@ describe('listSpaceReadPrincipals', () => {
 
     await expect(listSpaceReadPrincipals(CLOUD, 'token', 'space-1')).rejects.toThrow('403')
   })
+
+  it.each([
+    '/wiki/api/v2/spaces/1/permissions?cursor=next',
+    '/wiki/api/v2/spaces/1/permissions?limit=250',
+  ])(
+    'rejects a repeated or missing cursor without publishing partial permissions: %s',
+    async (next) => {
+      mockFetch
+        .mockResolvedValueOnce(jsonResponse({ results: [], _links: { next: '?cursor=next' } }))
+        .mockResolvedValueOnce(jsonResponse({ results: [], _links: { next } }))
+
+      await expect(listSpaceReadPrincipals(CLOUD, 'token', 'space-1')).rejects.toThrow(
+        'invalid or repeated space permissions continuation'
+      )
+      expect(mockFetch).toHaveBeenCalledTimes(2)
+    }
+  )
+
+  it('rejects a cursor cycle rather than making a hundred repeated requests', async () => {
+    for (const cursor of ['first', 'second', 'first']) {
+      mockFetch.mockResolvedValueOnce(
+        jsonResponse({ results: [], _links: { next: `?cursor=${cursor}` } })
+      )
+    }
+    await expect(listSpaceReadPrincipals(CLOUD, 'token', 'space-1')).rejects.toThrow('repeated')
+    expect(mockFetch).toHaveBeenCalledTimes(3)
+  })
+
+  it('rejects a malformed collection instead of treating it as a verified empty grant', async () => {
+    mockFetch.mockResolvedValueOnce(jsonResponse({}))
+    await expect(listSpaceReadPrincipals(CLOUD, 'token', 'space-1')).rejects.toThrow(
+      'invalid space permissions'
+    )
+  })
+
+  it('keeps the request bound for a provider that keeps issuing distinct continuations', async () => {
+    let page = 0
+    mockFetch.mockImplementation(async () =>
+      jsonResponse({
+        results: [
+          {
+            principal: { type: 'user', id: 'reader' },
+            operation: { key: 'read', targetType: 'space' },
+          },
+        ],
+        _links: { next: `?cursor=${++page}` },
+      })
+    )
+    await expect(listSpaceReadPrincipals(CLOUD, 'token', 'space-1')).rejects.toThrow(
+      'exceeded 100 pages (100 entries)'
+    )
+    expect(mockFetch).toHaveBeenCalledTimes(100)
+  })
 })
 
 describe('getReadRestriction', () => {

apps/sim/connectors/confluence/permissions.ts

@@ -78,6 +78,7 @@ async function getJson<T>(
  */
 async function drainV2<T>(url: string, accessToken: string, what: string): Promise<T[]> {
   const items: T[] = []
+  const cursors = new Set<string>()
   let cursor: string | undefined
   for (let page = 0; page < MAX_PAGES; page += 1) {
     const query = new URLSearchParams({ limit: String(PAGE_SIZE) })
@@ -86,11 +87,19 @@ async function drainV2<T>(url: string, accessToken: string, what: string): Promi
       `${url}?${query.toString()}`,
       accessToken
     )
-    items.push(...(body.results ?? []))
-    cursor = extractCursor(body._links?.next)
-    if (!cursor) return items
+    if (!Array.isArray(body.results)) {
+      throw new Error(`Confluence returned invalid ${what}`)
+    }
+    items.push(...body.results)
+    const next = body._links?.next
+    if (!next) return items
+    cursor = extractCursor(next)
+    if (!cursor || cursors.has(cursor)) {
+      throw new Error(`Confluence returned an invalid or repeated ${what} continuation`)
+    }
+    cursors.add(cursor)
   }
-  throw new Error(`Confluence ${what} exceeded ${MAX_PAGES} pages`)
+  throw new Error(`Confluence ${what} exceeded ${MAX_PAGES} pages (${items.length} entries)`)
 }
 
 /**

apps/sim/hooks/queries/kb/connectors.test.ts

@@ -45,6 +45,7 @@ import {
 } from '@/lib/api/contracts/knowledge'
 import {
   type ConnectorDetailData,
+  type OrganizationSearchOverview,
   readSearchIndexContract,
 } from '@/lib/api/contracts/knowledge/connectors'
 import { MAX_KNOWLEDGE_CONNECTOR_DOCUMENT_PAGE_SIZE } from '@/lib/knowledge/constants'
@@ -55,6 +56,7 @@ import {
   useConnectorDetail,
   useConnectorDocuments,
   useConnectorList,
+  useOrganizationSearchOverview,
   useSearchIndex,
   useSearchSources,
   useTriggerSync,
@@ -159,6 +161,36 @@ describe('isConnectorSyncingOrPending', () => {
   )
 })
 
+describe('organization overview polling', () => {
+  it.each([
+    { isSyncing: true, hasPendingSync: false, polling: true },
+    { isSyncing: false, hasPendingSync: true, polling: true },
+    { isSyncing: false, hasPendingSync: false, polling: false },
+    { isSyncing: false, hasPendingSync: undefined, polling: false },
+  ])('polls unfinished work across worker handoffs: %j', ({ polling, ...state }) => {
+    useOrganizationSearchOverview('organization-1')
+    const { refetchInterval } = capturedQueryOptions<OrganizationSearchOverview>()
+    const interval = refetchInterval({
+      state: {
+        data: {
+          providers: [
+            {
+              connectorType: 'confluence',
+              approved: true,
+              sourceCount: 1,
+              status: 'active',
+              issue: null,
+              ...state,
+            },
+          ],
+        },
+      },
+    })
+    if (polling) expect(interval).toBeGreaterThan(0)
+    else expect(interval).toBe(false)
+  })
+})
+
 describe('useConnectorList polling', () => {
   beforeEach(() => {
     vi.clearAllMocks()