Skip to content

fix(settings): an empty enabled_providers means all providers on the backend but none on the page #1531

Closed

Description

@cristim

Found in the cold review of #1530 (Refs #539). This is older than that PR, which only makes it easier to reach.

Problem: an empty enabled_providers means "every provider" on the backend. The recommendations filter is permissive when the list is empty (internal/api/handler_recommendations.go ~199-202). On the Settings page, though, unchecking every provider looks like "no providers". Since #1530, Save rebases the provider list onto the server's current value. So an admin who unchecks the last provider still enabled on the server sends [], and the backend then reads that as all providers. The page doesn't reflect this: #1530 deliberately doesn't write the checkboxes back after Save.

Failure scenario: the server has ['aws'], and an admin unchecks AWS and saves to turn recommendations off. The result is that recommendations from every provider appear.

Options:

  1. Refuse a Save that would leave the list empty, with an inline message.
  2. Give "no providers" its own explicit representation, separate from the default "all".

Option 2 changes the API contract.

Acceptance: whichever option is chosen, the Settings page and the backend agree on what an empty selection means, and a test pins it.

🤖 Generated with Claude Code

Activity

  1. cristim commented on Oct 27, 2026

    @cristim
    MemberAuthor

    Checked on main (7d049bc), the backend is itself split on an empty enabled_providers:

    • The recommendation filters treat empty as "all": config.FilterRecommendationsByEnabledProviders returns every rec when the list is empty (internal/config/recommendation_enabled_providers.go:7-9). The Opportunities handler, the scan handler and the plan-step resolver all use it.
    • The scheduler collects only for the providers in the list (internal/scheduler/scheduler.go:322), so empty means collect nothing.

    So unchecking the last provider stops collection, while already-stored recommendations from every provider keep showing and staying purchasable through plans.

    Picking up option 1 (claude-cc-platform), as a safe default that needs no owner decision: Settings Save refuses a save whose resulting enabled_providers would be empty, after the #1530 rebase onto the server's list. It shows "Enable at least one provider". The stored default [] on fresh installs and the API contract are unchanged.

    What an empty list should mean (option 2: all, none, or an explicit value) stays open for the owner. Pausing collection already has its own switch, auto_collect.

  2. cristim commented on Oct 27, 2026

    @cristim
    MemberAuthor

    Follow-ups from the #1542 reviews (merged as 4284ac9, which closed this with option 1):

    • The API still accepts PUT /api/config with enabled_providers: [], because validation.go:428-434 only checks each name. A backend refusal would close that path at the root. Whether to add one, or to give empty an explicit meaning (option 2), is the owner's call.
    • Test (a) checks the refusal toast but not that it is the only toast. Adding toHaveBeenCalledTimes(1) would catch a throw-instead-of-return mutant.
    • frontend/src/recommendations.ts ~673-676 says Settings shows the "all providers" default on the checkboxes. It doesn't: a stored [] loads with every box unchecked (settings.ts ~3097-3099).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions