PR Custody

MCPG-274 - fix(siem): Fix persistent "SIEM forwarding disabled" banner after a successful save

@arthurterozendi-plankchecks n/achecks…worktree-fix+siem-forwarding-disabled-warning → main10 files · +183 −16updated 15h ago

GitHub

▸Description · 2 noise

Problem

After saving a SIEM provider config successfully, the yellow "SIEM forwarding disabled" banner could remain — even after a page refresh — implying the config didn't apply. The server actually stored enabled: true; the stale state was coming from the read path.

Root cause & fix

The tRPC route handler set no Cache-Control. httpBatchLink sends queries (including siem.getConfig) as GET, and a header-less GET is HTTP-cacheable by the browser/CDN/proxy — so a refresh could be served the pre-save enabled: false response (React Query's in-memory cache clears on refresh; an HTTP cache does not). Added Cache-Control: no-store to tRPC responses, matching the OAuth routes.

Adjacent robustness fixes (found while investigating)

regenerate-scim-credentials now rebuilds settings from raw org.settings instead of the normalized base, which could strip unknown keys / apply Zod defaults and drop the siem block (disabling forwarding).
Added normalizeSiemConfig / normalizeAuditLogStorageMode that parse the siem/audit sub-objects independently, used in admin get-config and the proxy worker — so one malformed unrelated settings field no longer wipes a valid SIEM config or stops forwarding (audit mode parsed independently keeps metadata-only redaction intact).
Splunk buildTestInput now guards an empty endpoint, with a provider-specific prompt.

▸ 2 bot/status comments hidden

@linear-code[bot]15h ago

Description: After configuring SIEM forwarding and successfully saving the provider credentials, the warning message indicating that SIEM forwarding is disabled continues to be displayed. The alert remains visible even after refreshing the page, creating the impression that the configuration was not successfully applied.

Steps to Reproduce:

Navigate to SIEM Forwarding.
Configure a supported provider (e.g., Datadog) with valid credentials.
Save the configuration successfully.
Refresh the page.
Observe the warning banner at the top of the screen.

Expected Result: The warning message should disappear once SIEM forwarding has been successfully configured and enabled.

Actual Result: The warning banner ("SIEM forwarding disabled") continues to be displayed even after successful configuration and page refresh.

Screen Capture 09-06-26, 17.15.24.mp4

@vercel[bot]15h ago

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
composio-enterprise-internal	Blocked		Jun 12, 2026 5:38pm

loading diff…