improvement(custom-blocks): hardened delete with usage count + per-input required option

[TheodoreSpeaks]

Summary

• Deleting a custom block is hardened: the confirmation modal requires typing the block name, and shows how many workflows are still using the block (error-styled line under the confirm text). Delete audit record includes usage counts
• New GET /api/custom-blocks/[id]/usages endpoint returning { usageCount, deployedUsageCount } — a workflow counts when the block appears in its live editor state or its ACTIVE deployment snapshot (scanned independently with a cheap text pre-filter before the jsonb parse, so a block removed in the editor but still deployed is counted). Same manage authz as delete
• Per-input required option: a Required toggle on each custom block input (stored in the inputs overrides column, no migration). The consumer block gets the standard required asterisk + pre-deploy gate via the serializer's existing required-subBlock validation, and runs enforce it in the workflow handler against the child's live deployed Start fields — so a required override for a removed field is inert and newly added fields stay optional (schema drift never blocks a run)
• Extracted authorizeManage into a shared module for the [id] routes

Type of Change

• Improvement

Testing

Tested manually. Route tests for the usage-counts endpoint (401/404/403/200) and unit tests for required-input enforcement (empty/filled, stale-override, added-field, legacy name-keyed, multi-field). lint, check:api-validation:strict, check:migrations (no new migrations), and check:react-query pass; usage SQL exercised against a live database.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

🤖 Generated with Claude Code

https://claude.ai/code/session_01Jc1SjzdZkiyVLqUmCS1x9H

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 10, 2026 11:56pm

[cursor]

PR Summary

Medium Risk
Touches workflow execution boundaries (required-input validation and custom-block error handling) and org-scoped delete/usage SQL; authz is reused from manage routes, but wrong usage counts or enforcement could affect runs or destructive actions.

Overview
Hardens custom block deletion and adds publisher-defined required inputs for deploy-as-block workflows.

Delete flow: Unpublish now loads org-wide usage counts via GET /api/custom-blocks/[id]/usages (same authorizeManage as PATCH/DELETE). The settings UI prefetches counts, refetches when opening delete, shows how many workflows still reference the block, and requires typing the block name to confirm. Delete audit metadata records usageCount and deployedUsageCount. authorizeManage is extracted to a shared module for [id] routes.

Required inputs: Publishers can mark each exposed Start input required (stored in existing inputs JSON overrides—no migration). That flows into generated block config (required on sub-blocks for editor/serializer) and into getCustomBlockAuthority. At run time, findMissingRequiredCustomBlockInputs validates against the child’s live deployed Start fields; missing values throw a consumer-safe error (surfaced through ChildWorkflowError instead of the generic custom-block failure). Stale overrides for removed fields are ignored.

Usage counting:getCustomBlockUsageCounts unions workflows that place the block type in live workflow_blocks or in the active deployment snapshot (with a LIKE pre-filter before jsonb parsing).

^{Reviewed by Cursor Bugbot for commit 093a5cf. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

This PR hardens custom block deletion and adds required input controls. The main changes are:

• A new usage-count endpoint for custom blocks.
• Delete confirmation with the block name and current usage count.
• Delete audit metadata with live and deployed usage counts.
• Per-input required overrides for custom block consumers.
• Runtime validation for required custom block inputs.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
apps/sim/app/api/custom-blocks/[id]/usages/route.ts	Adds an authenticated usage-count endpoint that returns aggregate counts only.
apps/sim/lib/workflows/custom-blocks/operations.ts	Adds live and deployed usage counting for custom block types.
apps/sim/app/api/custom-blocks/[id]/route.ts	Adds usage-count audit metadata to custom block deletion.
apps/sim/executor/handlers/workflow/workflow-handler.ts	Adds runtime validation for required custom block inputs.
apps/sim/ee/custom-blocks/components/custom-block-detail.tsx	Adds required input toggles and a stronger delete confirmation flow.

_{Reviews (3): Last reviewed commit: "fix(custom-blocks): escape LIKE wildcard..." | Re-trigger Greptile}

[TheodoreSpeaks]

@greptile review

[TheodoreSpeaks]

@greptile review

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit df17670. Configure here.}