fix(search): admin-gated first connect on the surfaces, live indexing state, honest filters and loading

Route errors redact bound values from the outer message too; a source
nobody connected is offered only to an admin and others see why; a first
connect refreshes the base's connector list; member connectors poll
while a source is indexing for the viewer; a filter from a shared link
applies even when the controls would not appear; results kept from the
previous query show as loading.

Author: waleedlatif1

apps/sim/app/workspace/[workspaceId]/home/components/knowledge-search-results/knowledge-search-results.tsx

@@ -190,6 +190,7 @@ export function KnowledgeSearchResults({
     data: results,
     isPending,
     isFetching,
+    isPlaceholderData,
     error,
   } = useWorkspaceKnowledgeSearch(workspaceId, knowledgeBaseIds, query)
   const { features } = useWorkspaceHostContext()
@@ -213,9 +214,12 @@ export function KnowledgeSearchResults({
     [documents]
   )
   const [filters, setFilters] = useQueryStates(searchFilterParsers, resourceUrlKeys)
-  const showFilters = documents.length >= FILTERS_MIN_RESULTS && sourceTypes.length > 1
+  const filtersActive = filters.source !== null || filters.updated !== 'any'
+  /** The controls appear once the list is long and mixed, and stay while a filter from the link is active. */
+  const showFilters =
+    filtersActive || (documents.length >= FILTERS_MIN_RESULTS && sourceTypes.length > 1)
   const visible = useMemo(() => {
-    if (!showFilters) return documents
+    if (!filtersActive) return documents
     const window = UPDATED_WINDOWS.find((entry) => entry.id === filters.updated)
     const cutoff = window?.days ? Date.now() - window.days * DAY_MS : null
     return documents.filter((result) => {
@@ -226,7 +230,7 @@ export function KnowledgeSearchResults({
       }
       return true
     })
-  }, [documents, showFilters, filters.source, filters.updated])
+  }, [documents, filtersActive, filters.source, filters.updated])
 
   const failure = basesError ?? error
   if (failure) {
@@ -239,7 +243,8 @@ export function KnowledgeSearchResults({
       </p>
     )
   }
-  if (isPending || (isFetching && !results)) {
+  /** Kept results belong to the previous query; a new query shows its own state. */
+  if (isPending || isPlaceholderData || (isFetching && !results)) {
     return <p className='px-2 py-2 text-[var(--text-muted)] text-caption'>Searching…</p>
   }
 

apps/sim/app/workspace/[workspaceId]/home/components/search-sources/search-sources.tsx

@@ -18,6 +18,7 @@ import {
   useWorkspaceMemberConnectors,
   type WorkspaceMemberConnector,
 } from '@/hooks/queries/kb/connectors'
+import { useWorkspacePermissionsQuery } from '@/hooks/queries/workspace'
 import { CONNECTABLE_MEMBERSHIPS, useMemberEnrollment } from '@/hooks/use-member-enrollment'
 import { usePermissionConfig } from '@/hooks/use-permission-config'
 
@@ -145,6 +146,9 @@ export function SearchSources({ workspaceId }: SearchSourcesProps) {
    * off, a connect is refused, so the chips say so instead of offering one.
    */
   const memberAccessAvailable = features?.knowledgeMemberAccess === true
+  const { data: workspacePermissions } = useWorkspacePermissionsQuery(workspaceId)
+  /** The first connect of a source turns it on for the workspace, which takes an admin. */
+  const canCreate = workspacePermissions?.viewer?.isAdmin ?? false
   const { data: memberConnectorRows } = useWorkspaceMemberConnectors(workspaceId, {
     enabled: memberAccessAvailable,
   })
@@ -198,7 +202,7 @@ export function SearchSources({ workspaceId }: SearchSourcesProps) {
               unavailableReason={searchConnectorUnavailableReason(
                 connector,
                 integrationAvailability,
-                memberAccessAvailable
+                { memberAccessAvailable, hasConnection: connection !== undefined, canCreate }
               )}
               waiting={
                 connection ? isAwaiting(connection.connectorId) : isAwaitingSource(connector.type)

apps/sim/app/workspace/[workspaceId]/search/search.test.tsx

@@ -23,6 +23,9 @@ vi.mock('nuqs', () => ({
 vi.mock('@/hooks/use-debounced-search-setter', () => ({
   useDebouncedSearchSetter: (write: (value: string) => void) => write,
 }))
+vi.mock('@/hooks/queries/workspace', () => ({
+  useWorkspacePermissionsQuery: () => ({ data: { viewer: { isAdmin: true } } }),
+}))
 vi.mock('@/hooks/use-permission-config', () => ({
   usePermissionConfig: () => ({
     integrationAvailability: new Map([
@@ -77,13 +80,15 @@ vi.mock('@/lib/sim-search/connectors', () => {
     searchConnectorUnavailableReason: (
       candidate: { blockType: string; meta: { name: string } },
       availability: ReadonlyMap<string, { oauthAvailable: boolean }>,
-      memberAccessAvailable: boolean
+      context: { memberAccessAvailable: boolean; hasConnection: boolean; canCreate: boolean }
     ) =>
       !isSearchConnectorAvailable(candidate, availability)
         ? `${candidate.meta.name} is unavailable in this deployment`
-        : memberAccessAvailable
-          ? null
-          : 'Per-member access is not available in this workspace',
+        : !context.memberAccessAvailable
+          ? 'Per-member access is not available in this workspace'
+          : !context.hasConnection && !context.canCreate
+            ? `Ask a workspace admin to connect ${candidate.meta.name} first`
+            : null,
     SEARCH_CONNECTORS: [
       connector('google_drive', 'Google Drive', 'Sync Drive files', true),
       connector('confluence', 'Confluence', 'Sync Confluence pages', false),

apps/sim/app/workspace/[workspaceId]/search/search.tsx

@@ -31,6 +31,7 @@ import {
   useWorkspaceMemberConnectors,
   type WorkspaceMemberConnector,
 } from '@/hooks/queries/kb/connectors'
+import { useWorkspacePermissionsQuery } from '@/hooks/queries/workspace'
 import { useDebouncedSearchSetter } from '@/hooks/use-debounced-search-setter'
 import {
   CONNECTABLE_MEMBERSHIPS,
@@ -129,6 +130,9 @@ export function Search() {
    * one and the memberships are not fetched.
    */
   const memberAccessAvailable = features?.knowledgeMemberAccess === true
+  const { data: workspacePermissions } = useWorkspacePermissionsQuery(workspaceId)
+  /** The first connect of a source turns it on for the workspace, which takes an admin. */
+  const canCreate = workspacePermissions?.viewer?.isAdmin ?? false
 
   const [searchTerm, setSearchTermParam] = useQueryState(connectorSearchParam.key, {
     ...connectorSearchParam.parser,
@@ -242,7 +246,11 @@ export function Search() {
                       unavailableReason={searchConnectorUnavailableReason(
                         connector,
                         integrationAvailability,
-                        memberAccessAvailable
+                        {
+                          memberAccessAvailable,
+                          hasConnection: connection !== undefined,
+                          canCreate,
+                        }
                       )}
                       waiting={
                         connection

apps/sim/hooks/queries/kb/connectors.ts

@@ -372,6 +372,8 @@ export const memberConnectorKeys = {
 }
 
 export const WORKSPACE_MEMBER_CONNECTORS_STALE_TIME = 30 * 1000
+/** While a connected source is still indexing for the viewer, its state is worth asking for again. */
+const WORKSPACE_MEMBER_CONNECTORS_INDEXING_POLL_MS = 5 * 1000
 
 async function fetchWorkspaceMemberConnectors(
   workspaceId: string,
@@ -394,6 +396,14 @@ export function useWorkspaceMemberConnectors(
     queryFn: ({ signal }) => fetchWorkspaceMemberConnectors(workspaceId as string, signal),
     enabled: Boolean(workspaceId) && (options?.enabled ?? true),
     staleTime: WORKSPACE_MEMBER_CONNECTORS_STALE_TIME,
+    refetchInterval: (query) =>
+      query.state.data?.some(
+        (connector) =>
+          connector.viewerMembership === 'connected' &&
+          (connector.memberSyncStatus === 'pending' || connector.memberSyncStatus === 'running')
+      )
+        ? WORKSPACE_MEMBER_CONNECTORS_INDEXING_POLL_MS
+        : false,
     placeholderData: keepPreviousData,
   })
 }
@@ -703,6 +713,10 @@ export function useConnectSimSearchConnector() {
   const queryClient = useQueryClient()
   return useMutation({
     mutationFn: connectSimSearchConnector,
+    onSuccess: (data) => {
+      /** A first connect added a connector to the base; its own list is open on the settings page. */
+      queryClient.invalidateQueries({ queryKey: connectorKeys.all(data.knowledgeBaseId) })
+    },
     onSettled: () => {
       queryClient.invalidateQueries({ queryKey: memberConnectorKeys.lists() })
       queryClient.invalidateQueries({ queryKey: knowledgeKeys.lists() })

apps/sim/lib/core/utils/with-route-handler.ts

@@ -1,5 +1,5 @@
 import { createLogger, runWithRequestContext } from '@sim/logger'
-import { describeError, getErrorMessage } from '@sim/utils/errors'
+import { describeError, getErrorMessage, redactBoundParameters } from '@sim/utils/errors'
 import type { NextRequest } from 'next/server'
 import { NextResponse } from 'next/server'
 import { getRateLimitHeaders } from '@/lib/api/server/rate-limit-context'
@@ -133,7 +133,8 @@ export function withRouteHandler<T>(
         response = await withPermissionGroupScope(() => handler(request, context))
       } catch (error) {
         const duration = Date.now() - startTime
-        const message = getErrorMessage(error, 'Unknown error')
+        /** A query failure names its bound values in the message; they are user data. */
+        const message = redactBoundParameters(getErrorMessage(error, 'Unknown error'))
         const detail = errorDetail(error)
         if (request.signal.aborted) {
           logger.info('Client closed request', { duration, status: 499 })

apps/sim/lib/sim-search/connectors.ts

@@ -113,16 +113,29 @@ export function connectorDisplayName(connectorType: string): string {
   return CONNECTOR_META_REGISTRY[connectorType]?.name ?? connectorType
 }
 
+export interface SearchConnectorAvailabilityContext {
+  /** Whether per-member access is on for the workspace. */
+  memberAccessAvailable: boolean
+  /** Whether someone already connected this source in the workspace. */
+  hasConnection: boolean
+  /** Whether the viewer may turn a source on for the workspace; the first connect needs an admin. */
+  canCreate: boolean
+}
+
 /** Why a source cannot be connected on this surface right now; null when it can. */
 export function searchConnectorUnavailableReason(
   connector: SearchConnector,
   integrationAvailability: ReadonlyMap<string, { oauthAvailable: boolean }>,
-  memberAccessAvailable: boolean
+  context: SearchConnectorAvailabilityContext
 ): string | null {
   if (!isSearchConnectorAvailable(connector, integrationAvailability)) {
     return `${connector.meta.name} is unavailable in this deployment`
   }
-  return memberAccessAvailable ? null : 'Per-member access is not available in this workspace'
+  if (!context.memberAccessAvailable) return 'Per-member access is not available in this workspace'
+  if (!context.hasConnection && !context.canCreate) {
+    return `Ask a workspace admin to connect ${connector.meta.name} first`
+  }
+  return null
 }
 
 /**

packages/utils/src/errors.ts

@@ -100,7 +100,7 @@ export function describeError(error: unknown): DescribedError {
 }
 
 /** Replaces a driver-appended `params: <values>` tail with a redaction marker. */
-function redactBoundParameters(message: string): string {
+export function redactBoundParameters(message: string): string {
   const index = message.indexOf('\nparams:')
   return index === -1 ? message : `${message.slice(0, index)}\nparams: [redacted]`
 }