Disable Notion connect button when OAuth credentials are absent #SUPERLOG

[superlog-app]

Summary

Users visiting the Settings page and clicking Connect Notion receive an unhandled promise rejection that generates a browser OTel error span (ApiError: 503: {"error":"notion not configured"}). This happens because POST /api/notion/install-url returns 503 when NOTION_CLIENT_ID, NOTION_CLIENT_SECRET, or STATE_SIGNING_SECRET are not set, but the onClick handler awaits the mutation without a try/catch, so the rejection surfaces as window.unhandledrejection.

The deeper issue is that GET /api/notion/installation previously returned {installed: false} with no indication of whether the OAuth flow is even available on this deployment, leaving the frontend no signal to preemptively disable the Connect button.

Root cause

The GET /api/notion/installation endpoint did not expose whether Notion env vars are configured. The frontend always rendered an enabled Connect button, and when clicked, the resulting 503 from POST /api/notion/install-url became an unhandled rejection because the onClick handler lacked error handling.

Remediation

• apps/api/src/notion.ts: mountNotionAuthed now computes configurable = !!(clientId && clientSecret && stateSecret) once at mount time and includes it in every GET /api/notion/installation response variant ({installed: false, configurable} and the full installed shape).
• apps/web/src/api.ts: NotionInstallation type extended with optional configurable?: boolean on both variants.
• apps/web/src/Settings.tsx: NotionCard reads install.data?.configurable !== false (defaults to true when the field is absent — safe for old cached data or older API versions), disables the Connect button when configurable is false, and renders a short explanatory paragraph so users understand why the button is unavailable.

No changes to the 503 guard on POST /api/notion/install-url — that guard is intentional and stays in place as a server-side safety net.

---

Incident: balmy-newt (415a04f7-e9b3-48b0-8278-f60e6857aa70)

---

Was this PR helpful? Leave feedback — goes straight to the Superlog team.

---

Summary by cubic

Disable the Notion Connect button when OAuth credentials are not configured, and show a clear message to avoid unhandled rejections and 503 noise. The API now exposes a configurable flag via GET /api/notion/installation so the UI can decide availability.

• Bug Fixes
  • API: GET /api/notion/installation includes configurable computed from NOTION_CLIENT_ID, NOTION_CLIENT_SECRET, and STATE_SIGNING_SECRET.
  • Web: Notion card disables Connect when configurable is false and shows a short explanation.
  • Types: NotionInstallation extended with optional configurable on both variants (defaults to true if absent for compatibility).

^{Written for commit 2837cd5. Summary will update on new commits.}

[superlog-app]

Observability review

All clear — no observability concerns found.

This PR understood the assignment.