fix(connectors): deploy connectors with workspace API keys

[netanelgilad]

Note

Description

base44 deploy with a BASE44_API_KEY workspace key failed with Error listing connectors: Forbidden as soon as a project had at least one connector, because connector sync went through the per-connector external-auth/* and payments/stripe/* routes, which all require a platform user. This PR routes connector sync through the key-capable PUT /api/apps/{id}/deployment/connectors endpoint when a workspace API key is in use, mirroring the auth-config fix in #565. The previous "skip reconcile when there are no local connectors" workaround is removed, so key-based deploys now reconcile stale remote connectors the same way OAuth deploys do.

Related Issue

None (reported by the BRIK/Wix team; follows the same pattern as #565)

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional changes)
• Other (please describe):

Changes Made

• connector/api.ts: new syncDeploymentConnectors() calling PUT deployment/connectors, with ApiError.fromHttpError() handling and Zod validation
• connector/schema.ts: SyncDeploymentConnectorsResponseSchema with the standard snake_case-to-camelCase transform
• connector/push.ts: pushConnectors() branches on hasWorkspaceApiKeyAuth() and syncs via the deployment route, never touching external-auth/* or Stripe routes under a key; each returned connector is reported as synced
• A local Stripe connector under a workspace key is reported as an explicit error ("not supported with a workspace API key") instead of a confusing status-call failure, and no Stripe request is made
• project/deploy.ts: removed the skipConnectorSync workaround so key-based deploys reconcile removals like OAuth deploys (deliberate behavior change; the skip only existed because of the 403)
• Testkit: added mockDeploymentConnectorsSync() to TestAPIServer
• Docs: updated docs/resources.md (deploy step 5) and docs/api-patterns.md (guidance to prefer key-capable deployment/* routes for resources in deploy)

Testing

• I have tested these changes locally
• I have added/updated tests as needed
• All tests pass (npm test)

Changelog

• New core unit tests for the workspace-key branch of pushConnectors: OAuth-only sync, empty-list reconcile, and the Stripe error path (asserting no list/set/remove/Stripe calls)
• New CLI tests for deploy under a workspace key with and without local connectors, asserting the deployment-route request body and api_key header while the 403-ing routes stay mocked as forbidden
• New CLI test for the Stripe message via connectors push, asserting the Stripe status route is never called
• Updated the auth-config workspace-key deploy test to mock the connector deployment route
• bun run typecheck, bun run lint, and bun run knip pass; full vitest run reports 763 passed with 2 pre-existing dev.spec.ts failures that reproduce with this change stashed (sandbox has no Deno)

Checklist

• My code follows the project's style guidelines
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (if applicable)
• My changes generate no new warnings
• I have updated docs/ (AGENTS.md) if I made architectural changes

Additional Notes

Connectors created by the deployment route start disconnected and must be authorized once from the dashboard; already-authorized connectors (the reported BRIK case) are unaffected. Not in scope: base44 connectors pull under a workspace key still hits external-auth/list and 403s.

---

_{🤖 Generated by Claude | 2026-09-10 09:30 UTC | 31be75e}

[github-actions]

🚀 Package Preview Available!

---

Install this PR's preview build with npm:

npm i @base44-preview/cli@0.1.14-pr.617.31be75e

Prefer not to change any import paths? Install using npm alias so your code still imports base44:

npm i "base44@npm:@base44-preview/cli@0.1.14-pr.617.31be75e"

Or add it to your package.json dependencies:

{
  "dependencies": {
    "base44": "npm:@base44-preview/cli@0.1.14-pr.617.31be75e"
  }
}

• 📦 Preview Package: @base44-preview/cli@0.1.14-pr.617.31be75e
• 🔗 View this commit on GitHub

---

_{Preview published to npm registry — try new features instantly!}