Handle Sentry org with no accessible projects during OAuth callback #SUPERLOG

[superlog-app]

Summary

When a user connects Sentry but the Superlog app has no access to any projects in their Sentry organization, the OAuth callback fails with a misleading or completely absent error message.

Onboarding flow: Users see "Sentry connected incompletely. Reconnect to retry the issue import." — misleading because reconnecting won't help; they need to grant the Superlog app project access in Sentry first.

Settings flow: No error message is shown at all. The ?sentry=error param only scrolls the Sentry card into view but SentryCard had no code to read or display the outcome.

Root cause

planSentryProjectSelection([]) throws a plain Error when the Sentry API returns an empty project list (HTTP 200, empty array). The generic catch block in the OAuth callback handler catches this alongside unexpected system errors, logs it at ERROR severity, and redirects with ?sentry=error. There was no way for the UI to distinguish "no projects accessible" from other failure modes.

Fix

1. project-selection.ts — Export a new SentryNoProjectsError class so the callback handler can identify this condition specifically.
2. installation.ts — Add a branch in the catch block: SentryNoProjectsError is logged at WARN (user configuration issue, not a system fault) and redirects with ?sentry=no-projects. Generic errors still log at ERROR and redirect with ?sentry=error. The sentryOAuthRedirect outcome union gains "no-projects".
3. SentryConnectFlow.tsx — Handle the "no-projects" outcome with an actionable message: "Your Sentry organization has no accessible projects. Grant the Superlog app access to at least one project in Sentry, then reconnect."
4. Settings.tsx SentryCard — Add outcomeError state + useEffect to read and clear the ?sentry= param, displaying tailored messages for "denied", "error", and "no-projects".

All 11 installation tests and 3 project-selection tests pass. tsc --noEmit is clean.

Incident: e94db2d5-1ca7-47f4-8277-cd16fcb71336

---

Was this PR helpful? Leave feedback — goes straight to the Superlog team.

---

Summary by cubic

Handle Sentry OAuth when an org has no accessible projects, and show a clear “no projects” message. This fixes misleading/missing errors in onboarding and settings and guides users to grant project access before reconnecting.

• Bug Fixes
  • API: Introduced SentryNoProjectsError and catch it in the OAuth callback to redirect with ?sentry=no-projects (logged as WARN).
  • UI: Onboarding and Settings now display an actionable “no accessible projects” message; Settings reads and clears the ?sentry param and also handles “denied” and “error”.
  • Tests: Updated project-selection tests to expect the new error class.

^{Written for commit 1581aff. Summary will update on new commits.}

[superlog-app]

Observability review

• 1 warning

[superlog-app]

logs · warning — Add the Sentry org identifier to the no-projects warn log

Include the Sentry organization slug or ID (available from callback.state or the token exchange response) as a structured field so operators can immediately scope the incident to a specific tenant without correlating surrounding log lines. Without it, a spike of no-projects warnings cannot be attributed to a single misconfigured org versus a systemic API change.

Suggested change

	if (error instanceof SentryNoProjectsError) {
	log.warn({ err: error, sentryOrgSlug: callback.state.sentryOrgSlug ?? undefined }, "sentry oauth callback: no accessible projects");

Useful? React with 👍 / 👎.