fix: GraphQL error on sync views for roles without credentials access

backend/backend/graphene/types.py

@@ -974,6 +974,10 @@ class Meta:
 class ProviderCredentialsType(DjangoObjectType):
     sync_count = graphene.Int()
     provider = graphene.Field(ProviderType)
+    # Nullable: resolve_credentials withholds the value for users without
+    # IntegrationCredentials read — non-null would turn that into a hard
+    # error that nulls the surrounding payload.
+    credentials = graphene.JSONString()
 
     class Meta:
         model = ProviderCredentials

backend/tests/test_graphene_schema.py

@@ -0,0 +1,16 @@
+"""Schema-shape guards for fields with withholding resolvers."""
+
+from graphql import GraphQLNonNull
+
+from backend.schema import schema
+
+
+def test_provider_credentials_field_is_nullable():
+    """resolve_credentials returns None for users without
+    IntegrationCredentials read — the field must stay nullable, or the
+    withholding becomes a hard GraphQL error that nulls the surrounding
+    payload."""
+    field = schema.graphql_schema.type_map["ProviderCredentialsType"].fields[
+        "credentials"
+    ]
+    assert not isinstance(field.type, GraphQLNonNull)

frontend/apollo/schema.graphql

@@ -530,7 +530,7 @@ type ProviderCredentialsType {
   id: String!
   name: String!
   provider: ProviderType
-  credentials: JSONString!
+  credentials: JSONString
   createdAt: DateTime
   updatedAt: DateTime!
   syncCount: Int

frontend/app/[team]/integrations/credentials/page.tsx

@@ -2,7 +2,7 @@
 
 import { organisationContext } from '@/contexts/organisationContext'
 import { useContext, useState, useEffect, useMemo } from 'react'
-import GetOrganisationSyncs from '@/graphql/queries/syncing/GetOrgSyncs.gql'
+import GetSavedCredentials from '@/graphql/queries/syncing/getSavedCredentials.gql'
 import GetProviderList from '@/graphql/queries/syncing/getProviders.gql'
 import { useQuery } from '@apollo/client'
 import { ProviderCredentialsType, ProviderType } from '@/apollo/graphql'
@@ -55,7 +55,10 @@ export default function Integrations({ params }: { params: { team: string } }) {
     }
   }, [providerFromUrl, providers])
 
-  const { data, loading } = useQuery(GetOrganisationSyncs, {
+  // Deliberately not the shared GetOrganisationSyncs query: this page is the
+  // only consumer of savedCredentials, and resolving it decrypts every
+  // stored credential — that must not ride along on the syncs poll.
+  const { data, loading } = useQuery(GetSavedCredentials, {
     variables: { orgId: organisation?.id },
     pollInterval: 10000,
     skip:

frontend/components/syncing/IntegrationsHomeCard.tsx

@@ -1,7 +1,7 @@
 'use client'
 
 import { useQuery } from '@apollo/client'
-import GetSavedCredentials from '@/graphql/queries/syncing/getSavedCredentials.gql'
+import GetSavedCredentialIds from '@/graphql/queries/syncing/getSavedCredentialIds.gql'
 import { OrganisationType, ProviderCredentialsType } from '@/apollo/graphql'
 import Spinner from '../common/Spinner'
 import { FaProjectDiagram } from 'react-icons/fa'
@@ -17,7 +17,9 @@ export default function IntegrationsHomeCard(props: { organisation: Organisation
     'read'
   )
 
-  const { data, loading } = useQuery(GetSavedCredentials, {
+  // Only the count is rendered — an id-only selection avoids decrypting
+  // every stored credential on each dashboard visit.
+  const { data, loading } = useQuery(GetSavedCredentialIds, {
     variables: {
       orgId: organisation.id,
     },

frontend/components/syncing/UpdateProviderCredentials.tsx

@@ -31,8 +31,9 @@ export const UpdateProviderCredentials = (props: { credential: ProviderCredentia
   const [updateCredentials] = useMutation(UpdateProviderCreds)
   const [validateRotationCreds] = useMutation(ValidateRotationCredentials)
   const [name, setName] = useState<string>(credential.name)
+  // credentials is withheld (null) without IntegrationCredentials read
   const [credentials, setCredentials] = useState<CredentialState>(
-    JSON.parse(credential.credentials)
+    JSON.parse(credential.credentials || '{}') ?? {}
   )
 
   const [credentialsUpdated, setCredentialsUpdated] = useState(false)
@@ -42,7 +43,7 @@ export const UpdateProviderCredentials = (props: { credential: ProviderCredentia
   const ROTATION_PROVIDER_IDS = ['litellm', 'openai']
 
   useEffect(() => {
-    const credsAreEqual = isEqual(credentials, JSON.parse(credential.credentials))
+    const credsAreEqual = isEqual(credentials, JSON.parse(credential.credentials || '{}') ?? {})
     const nameIsEqual = isEqual(name, credential.name)
 
     setCredentialsUpdated(!credsAreEqual || !nameIsEqual)

frontend/graphql/queries/syncing/GetOrgSyncs.gql

@@ -25,7 +25,6 @@ query GetOrganisationSyncs($orgId: ID!) {
     authentication {
       id
       name
-      credentials
     }
     createdAt
     history {
@@ -36,19 +35,6 @@ query GetOrganisationSyncs($orgId: ID!) {
       meta
     }
   }
-  savedCredentials(orgId: $orgId) {
-    id
-    name
-    credentials
-    createdAt
-    provider {
-      id
-      name
-      expectedCredentials
-      optionalCredentials
-    }
-    syncCount
-  }
   apps(organisationId: $orgId, appId: null) {
     id
     name

frontend/graphql/queries/syncing/getAppSyncStatus.gql

@@ -27,7 +27,6 @@ query GetAppSyncStatus($appId: ID!) {
     authentication {
       id
       name
-      credentials
     }
     createdAt
     history {

frontend/graphql/queries/syncing/getSavedCredentialIds.gql

@@ -0,0 +1,5 @@
+query GetSavedCredentialIds($orgId: ID!) {
+  savedCredentials(orgId: $orgId) {
+    id
+  }
+}