fix(webapp): handle disabled Vercel installations and uninstall Vercel when deleting an organization

Deleting an organization now uninstalls its Vercel integration. A Vercel
installation that was disabled on Vercel's side is reported as such
instead of being treated as an expired connection: removing it no longer
pretends to succeed, and the settings page explains that a Vercel team
owner has to restore or remove it.

Mono-RevId: dea49bc21ac7550b5a05fcf46cf792f89fa4a1a8

Author: kathiekiwi

.server-changes/vercel-uninstall.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Deleting an organization now uninstalls its Vercel integration. A Vercel installation disabled on Vercel's side is reported as such instead of as an expired connection, and removing it no longer reports success.

apps/webapp/app/components/integrations/VercelOnboardingModal.tsx

@@ -136,7 +136,7 @@ export function VercelOnboardingModal({
   const hasCustomEnvs = customEnvironments.length > 0 && hasStagingEnvironment;
 
   const computeInitialState = useCallback((): OnboardingState => {
-    if (!hasOrgIntegration || onboardingData?.authInvalid) {
+    if (!hasOrgIntegration || onboardingData?.authInvalid || onboardingData?.disabled) {
       return "idle";
     }
     const projectSelected = onboardingData?.hasProjectSelected ?? false;
@@ -331,16 +331,21 @@ export function VercelOnboardingModal({
   const loadingStateRef = useRef<OnboardingState | null>(null);
 
   useEffect(() => {
-    if (!isOpen || state === "idle") {
+    if (!isOpen) {
       loadingStateRef.current = null;
       return;
     }
 
-    if (onboardingData?.authInvalid) {
+    if (onboardingData?.authInvalid || onboardingData?.disabled) {
       onClose();
       return;
     }
 
+    if (state === "idle") {
+      loadingStateRef.current = null;
+      return;
+    }
+
     if (loadingStateRef.current === state) {
       return;
     }
@@ -376,29 +381,49 @@ export function VercelOnboardingModal({
         loadingStateRef.current = null;
         break;
     }
-  }, [isOpen, state, onboardingData?.authInvalid, vercelStagingEnvironment, onDataReload, onClose]);
+  }, [
+    isOpen,
+    state,
+    onboardingData?.authInvalid,
+    onboardingData?.disabled,
+    vercelStagingEnvironment,
+    onDataReload,
+    onClose,
+  ]);
 
   useEffect(() => {
     if (
       !onboardingData?.authInvalid &&
+      !onboardingData?.disabled &&
       state === "loading-projects" &&
       onboardingData?.availableProjects !== undefined
     ) {
       // oxlint-disable-next-line react/set-state-in-effect -- This effect intentionally synchronizes local state after an external or lifecycle change.
       setState("project-selection");
     }
-  }, [state, onboardingData?.availableProjects, onboardingData?.authInvalid]);
+  }, [
+    state,
+    onboardingData?.availableProjects,
+    onboardingData?.authInvalid,
+    onboardingData?.disabled,
+  ]);
 
   useEffect(() => {
     if (
       !onboardingData?.authInvalid &&
+      !onboardingData?.disabled &&
       state === "loading-env-vars" &&
       onboardingData?.environmentVariables
     ) {
       // oxlint-disable-next-line react/set-state-in-effect -- This effect intentionally synchronizes local state after an external or lifecycle change.
       setState("env-var-sync");
     }
-  }, [state, onboardingData?.environmentVariables, onboardingData?.authInvalid]);
+  }, [
+    state,
+    onboardingData?.environmentVariables,
+    onboardingData?.authInvalid,
+    onboardingData?.disabled,
+  ]);
 
   useEffect(() => {
     if (
@@ -710,7 +735,7 @@ export function VercelOnboardingModal({
     }
   }, [state, availableProjects, selectedVercelProject]);
 
-  if (!isOpen || onboardingData?.authInvalid) {
+  if (!isOpen || onboardingData?.authInvalid || onboardingData?.disabled) {
     return null;
   }
 

apps/webapp/app/models/vercelIntegration.server.ts

@@ -36,6 +36,7 @@ import { isReservedForExternalSync } from "~/v3/environmentVariableRules.server"
 import { boundedIn } from "@trigger.dev/database";
 import { toVercelApiError, type VercelApiError } from "~/v3/vercel/vercelApiError";
 import { createVercelClient, type VercelClient as Vercel } from "~/v3/vercel/vercelClient.server";
+import { vercelErrorLogMetadata } from "~/v3/vercel/vercelErrorLogMetadata";
 import {
   callVercelWithRecovery,
   wrapVercelCallWithRecovery,
@@ -236,7 +237,11 @@ export class VercelIntegrationRepository {
 
     if (!clientId || !clientSecret) {
       logger.error("Vercel integration not configured");
-      return errAsync({ message: "Vercel integration not configured", authInvalid: false });
+      return errAsync({
+        message: "Vercel integration not configured",
+        reason: "other",
+        authInvalid: false,
+      });
     }
 
     return ResultAsync.fromPromise(
@@ -580,8 +585,9 @@ export class VercelIntegrationRepository {
             const body = await response.text().catch(() => "");
             const error = new Error(
               `Failed to fetch Vercel shared environment variables: ${response.status} ${response.statusText} — ${body}`
-            ) as Error & { status?: number };
+            ) as Error & { status?: number; body?: string };
             error.status = response.status;
+            error.body = body;
             throw error;
           }
 
@@ -2000,23 +2006,42 @@ export class VercelIntegrationRepository {
 
   static uninstallVercelIntegration(
     integration: OrganizationIntegration & { tokenReference: SecretReference }
-  ): ResultAsync<{ authInvalid: boolean }, VercelApiError> {
-    return this.getVercelClient(integration).andThen((client) =>
-      ResultAsync.fromPromise(
-        (async () => {
-          const secret = await getSecretStore(integration.tokenReference.provider).getSecret(
-            VercelSecretSchema,
-            integration.tokenReference.key
-          );
+  ): ResultAsync<{ authInvalid: boolean; sharedWith?: string }, VercelApiError> {
+    return ResultAsync.fromPromise(
+      (async () => {
+        const secret = await getSecretStore(integration.tokenReference.provider).getSecret(
+          VercelSecretSchema,
+          integration.tokenReference.key
+        );
 
-          if (!secret?.installationId) {
-            throw new Error("Installation ID not found in Vercel integration");
-          }
+        if (!secret?.installationId) {
+          throw new Error("Installation ID not found in Vercel integration");
+        }
 
-          return secret.installationId;
-        })(),
-        toVercelApiError
-      ).andThen((installationId) =>
+        const sharedWith = await prisma.organizationIntegration.findFirst({
+          where: {
+            id: { not: integration.id },
+            service: "VERCEL",
+            deletedAt: null,
+            integrationData: { path: ["installationId"], equals: secret.installationId },
+          },
+          select: { id: true },
+        });
+
+        return { installationId: secret.installationId, sharedWith: sharedWith?.id };
+      })(),
+      toVercelApiError
+    ).andThen(({ installationId, sharedWith }) => {
+      if (sharedWith) {
+        logger.info("Vercel installation still used by another integration, not uninstalling", {
+          installationId,
+          integrationId: integration.id,
+          sharedWith,
+        });
+        return okAsync({ authInvalid: false, sharedWith });
+      }
+
+      return this.getVercelClient(integration).andThen((client) =>
         ResultAsync.fromPromise(
           client.integrations.deleteConfiguration({
             id: installationId,
@@ -2025,19 +2050,25 @@ export class VercelIntegrationRepository {
         )
           .map(() => ({ authInvalid: false }))
           .orElse((error) => {
-            const isAuthError = toVercelApiError(error).authInvalid;
+            if (vercelErrorLogMetadata(error).status === 404) {
+              logger.info("Vercel configuration already removed", { installationId });
+              return okAsync({ authInvalid: false });
+            }
+
+            const apiError = toVercelApiError(error);
             logger.error("Failed to uninstall Vercel integration", {
               installationId,
               error: error instanceof Error ? error.message : "Unknown error",
-              isAuthError,
+              isAuthError: apiError.authInvalid,
+              reason: apiError.reason,
             });
-            // Auth errors (401/403): still clean up on our side, return flag for caller
-            if (isAuthError) {
+            // Revoked token: still clean up on our side, return flag for caller
+            if (apiError.authInvalid) {
               return okAsync({ authInvalid: true });
             }
-            return errAsync(toVercelApiError(error));
+            return errAsync(apiError);
           })
-      )
-    );
+      );
+    });
   }
 }

apps/webapp/app/models/vercelSdkRecovery.server.ts

@@ -124,7 +124,7 @@ export function wrapVercelCallWithRecovery<T>(
       ...(error.status === undefined ? {} : { status: error.status }),
       authInvalid: apiError.authInvalid,
     });
-    return { message, authInvalid: apiError.authInvalid };
+    return { message, reason: apiError.reason, authInvalid: apiError.authInvalid };
   });
 }
 

apps/webapp/app/presenters/v3/VercelSettingsPresenter.server.ts

@@ -24,6 +24,7 @@ export type VercelSettingsResult = {
   enabled: boolean;
   hasOrgIntegration: boolean;
   authInvalid?: boolean;
+  disabled?: boolean;
   authError?: string;
   connectedProject?: {
     id: string;
@@ -61,6 +62,7 @@ export type VercelOnboardingData = {
   availableProjects: VercelAvailableProject[];
   hasProjectSelected: boolean;
   authInvalid?: boolean;
+  disabled?: boolean;
   authError?: string;
   existingVariables: Record<string, { environments: string[] }>; // Environment slugs (non-archived only)
   gitHubAppInstallations: GitHubAppInstallation[];
@@ -131,10 +133,12 @@ export class VercelSettingsPresenter extends BasePresenter {
     if (hasOrgIntegration) {
       const tokenResult = await VercelIntegrationRepository.validateVercelToken(orgIntegration);
       if (tokenResult.isErr() || !tokenResult.value.isValid) {
+        const disabled = tokenResult.isErr() && tokenResult.error.reason === "disabled";
         return ok({
           enabled: true,
           hasOrgIntegration: true,
-          authInvalid: true,
+          authInvalid: !disabled,
+          disabled,
           authError: tokenResult.isErr() ? tokenResult.error.message : "Vercel token is invalid",
           connectedProject: undefined,
           isGitHubConnected: false,
@@ -267,6 +271,7 @@ export class VercelSettingsPresenter extends BasePresenter {
           connectedProject,
         ]) => {
           const fetchVercelData = async (): Promise<{
+            disabled?: boolean;
             customEnvironments: VercelCustomEnvironment[];
             autoAssignCustomDomains: boolean | null;
             vercelManageAccessUrl?: string;
@@ -363,7 +368,12 @@ export class VercelSettingsPresenter extends BasePresenter {
               );
             }
 
+            const disabled = [customEnvsResult, autoAssignResult, triggerVersionResult].some(
+              (r) => r.isErr() && r.error.reason === "disabled"
+            );
+
             return {
+              disabled,
               customEnvironments: customEnvsResult.isOk() ? customEnvsResult.value : [],
               autoAssignCustomDomains: autoAssignResult.isOk() ? autoAssignResult.value : null,
               vercelManageAccessUrl,
@@ -377,26 +387,39 @@ export class VercelSettingsPresenter extends BasePresenter {
             cause: error,
           })).map(
             ({
+              disabled,
               customEnvironments,
               autoAssignCustomDomains,
               vercelManageAccessUrl,
               currentTriggerVersion,
               currentTriggerVersionFetchFailed,
             }) =>
-              ({
-                enabled: true,
-                hasOrgIntegration,
-                authInvalid: false,
-                connectedProject,
-                isGitHubConnected,
-                hasStagingEnvironment,
-                hasPreviewEnvironment,
-                customEnvironments,
-                autoAssignCustomDomains,
-                vercelManageAccessUrl,
-                currentTriggerVersion,
-                currentTriggerVersionFetchFailed,
-              }) as VercelSettingsResult
+              (disabled
+                ? {
+                    enabled: true,
+                    hasOrgIntegration,
+                    authInvalid: false,
+                    disabled: true,
+                    connectedProject: undefined,
+                    isGitHubConnected: false,
+                    hasStagingEnvironment: false,
+                    hasPreviewEnvironment: false,
+                    customEnvironments: [],
+                  }
+                : {
+                    enabled: true,
+                    hasOrgIntegration,
+                    authInvalid: false,
+                    connectedProject,
+                    isGitHubConnected,
+                    hasStagingEnvironment,
+                    hasPreviewEnvironment,
+                    customEnvironments,
+                    autoAssignCustomDomains,
+                    vercelManageAccessUrl,
+                    currentTriggerVersion,
+                    currentTriggerVersionFetchFailed,
+                  }) as VercelSettingsResult
           );
         }
       )
@@ -497,12 +520,14 @@ export class VercelSettingsPresenter extends BasePresenter {
 
         const tokenResult = await VercelIntegrationRepository.validateVercelToken(orgIntegration);
         if (tokenResult.isErr() || !tokenResult.value.isValid) {
+          const disabled = tokenResult.isErr() && tokenResult.error.reason === "disabled";
           return {
             customEnvironments: [],
             environmentVariables: [],
             availableProjects: [],
             hasProjectSelected: false,
-            authInvalid: true,
+            authInvalid: !disabled,
+            disabled,
             authError: tokenResult.isErr() ? tokenResult.error.message : "Vercel token is invalid",
             existingVariables: {},
             gitHubAppInstallations,
@@ -520,6 +545,7 @@ export class VercelSettingsPresenter extends BasePresenter {
             availableProjects: [],
             hasProjectSelected: false,
             authInvalid: clientResult.error.authInvalid,
+            disabled: clientResult.error.reason === "disabled",
             authError: clientResult.error.authInvalid ? clientResult.error.message : undefined,
             existingVariables: {},
             gitHubAppInstallations,
@@ -555,6 +581,7 @@ export class VercelSettingsPresenter extends BasePresenter {
             availableProjects: [],
             hasProjectSelected: false,
             authInvalid: availableProjectsResult.error.authInvalid,
+            disabled: availableProjectsResult.error.reason === "disabled",
             authError: availableProjectsResult.error.authInvalid
               ? availableProjectsResult.error.message
               : undefined,
@@ -607,6 +634,26 @@ export class VercelSettingsPresenter extends BasePresenter {
                   }>
                 ),
           ]);
+        const disabled =
+          (customEnvironmentsResult.isErr() &&
+            customEnvironmentsResult.error.reason === "disabled") ||
+          (projectEnvVarsResult.isErr() && projectEnvVarsResult.error.reason === "disabled") ||
+          (sharedEnvVarsResult.isErr() && sharedEnvVarsResult.error.reason === "disabled");
+
+        if (disabled) {
+          return {
+            customEnvironments: [],
+            environmentVariables: [],
+            availableProjects: availableProjectsResult.value,
+            hasProjectSelected: true,
+            disabled: true,
+            existingVariables: {},
+            gitHubAppInstallations,
+            isGitHubConnected,
+            isOnboardingComplete: false,
+          };
+        }
+
         const authInvalid =
           (customEnvironmentsResult.isErr() && customEnvironmentsResult.error.authInvalid) ||
           (projectEnvVarsResult.isErr() && projectEnvVarsResult.error.authInvalid) ||