fix(release): address v1.6.0 code review findings

Backend:
- export job admission now synchronous (returns 429 at create-time
  instead of accepting then async-failing)
- export pruner unlinks files before deleting DB rows; idempotent on
  crash, no orphaned artifacts
- query share TTL rejects > max with 400 instead of silently clamping
- handleDownloadExportJob logs non-ErrNotExist stat errors instead of
  swallowing them
- OIDC startup warning when skip_email_verified_check=true so the
  bypass is visible in boot logs
- drop unreachable empty-format checks in export handlers
- remove dead TLSCACert field; system-roots TLS only (proper TLS
  with custom CA / skip_verify is a follow-up PR)

Frontend:
- useQuery: surface translate API errors instead of swallowing and
  proceeding to SQL mode with stale rawSql
- LogExplorer: AbortController on export poll, abort on unmount so
  navigation away does not leak polling
- useUrlState: readiness timeout now shows a non-blocking toast and
  returns boolean
- context store: clearSource() action; replace 4 direct
  contextStore.sourceId = null mutations in SavedQueriesView
- DataTable 🔑 fallback for undefined queryId so key stays stable
- move planning doc out of repo root (now in .plans/)

Author: mr-karan

frontend/src/composables/useQuery.ts

@@ -177,10 +177,13 @@ export function useQuery() {
             if (response.data?.full_sql) {
               exploreStore.setRawSql(response.data.full_sql);
             } else {
-              console.warn("useQuery: Backend did not return full_sql, response:", response.data);
+              queryError.value = "Could not generate SQL from your query. Please refine and try again.";
+              return;
             }
           } catch (error: any) {
             console.error("useQuery: Failed to get full SQL from backend:", error);
+            queryError.value = error?.message || "Failed to translate query to SQL. Please try again.";
+            return;
           }
         }
       }

frontend/src/composables/useUrlState.ts

@@ -4,6 +4,8 @@ import { useExploreStore } from '@/stores/explore';
 import { useTeamsStore } from '@/stores/teams';
 import { useSourcesStore } from '@/stores/sources';
 import { useContextStore } from '@/stores/context';
+import { useToast } from '@/composables/useToast';
+import { TOAST_DURATION } from '@/lib/constants';
 import { savedQueriesApi } from '@/api/savedQueries';
 import { exploreApi } from '@/api/explore';
 
@@ -24,6 +26,7 @@ export function useUrlState(): UrlStateReturn {
   const teamsStore = useTeamsStore();
   const sourcesStore = useSourcesStore();
   const contextStore = useContextStore();
+  const { toast } = useToast();
 
   const state = ref<UrlSyncState>('idle');
   const error = ref<string | null>(null);
@@ -262,16 +265,21 @@ export function useUrlState(): UrlStateReturn {
     }
   }
 
-  function waitForReadiness(maxWaitMs = 5000): Promise<void> {
+  function waitForReadiness(maxWaitMs = 5000): Promise<boolean> {
     if (checkReadiness()) {
-      return Promise.resolve();
+      return Promise.resolve(true);
     }
 
     return new Promise((resolve) => {
       const timeout = setTimeout(() => {
         stopWatch();
         console.warn('useUrlState: Readiness timeout, proceeding anyway');
-        resolve();
+        toast({
+          title: "Loading is taking longer than expected",
+          description: "Some teams or sources may not be ready yet — results could be incomplete.",
+          duration: TOAST_DURATION.WARNING,
+        });
+        resolve(false);
       }, maxWaitMs);
 
       const stopWatch = watch(
@@ -286,7 +294,7 @@ export function useUrlState(): UrlStateReturn {
           if (checkReadiness()) {
             clearTimeout(timeout);
             stopWatch();
-            resolve();
+            resolve(true);
           }
         },
         { immediate: true }

frontend/src/stores/context.ts

@@ -73,6 +73,10 @@ export const useContextStore = defineStore('context', () => {
     saveToStorage(persisted)
   }
 
+  function clearSource() {
+    sourceId.value = null
+  }
+
   function clear() {
     console.log('ContextStore: Clearing all context')
     teamId.value = null
@@ -127,6 +131,7 @@ export const useContextStore = defineStore('context', () => {
     hasValidContext,
     selectTeam,
     selectSource,
+    clearSource,
     clear,
     clearStorage,
     setFromRoute,

frontend/src/views/collections/SavedQueriesView.vue

@@ -166,7 +166,7 @@ onMounted(async () => {
     
     // If no source was specified in URL, enforce All Sources mode
     if (!initialSourceParam && contextStore.sourceId) {
-      contextStore.sourceId = null;
+      contextStore.clearSource();
       const q = { ...route.query };
       delete q.source;
       router.replace({ query: q });
@@ -214,7 +214,7 @@ async function handleTeamChange(teamId: string) {
     if (teamId === "all") {
       isAllTeamsMode.value = true;
       // Clear stale team/source context so permission checks don't use the previous team
-      contextStore.sourceId = null;
+      contextStore.clearSource();
       localTeamQueries.value = [];
       const result = await savedQueriesStore.fetchMyCollections();
       if (result.success) {
@@ -230,7 +230,7 @@ async function handleTeamChange(teamId: string) {
     await contextHandleTeamChange(teamIdNum);
 
     // Default to All Sources when switching teams
-    contextStore.sourceId = null;
+    contextStore.clearSource();
     const query = { ...route.query };
     delete query.source;
     router.replace({ query });
@@ -253,7 +253,7 @@ async function handleSourceChange(sourceId: string) {
   try {
     // Handle All Sources selection
     if (!sourceId || sourceId === "all") {
-      contextStore.sourceId = null;
+      contextStore.clearSource();
       const query = { ...route.query };
       delete query.source;
       await router.replace({ query });

frontend/src/views/explore/LogExplorer.vue

@@ -4,6 +4,7 @@ import {
   computed,
   watch,
   onMounted,
+  onBeforeUnmount,
   nextTick,
 } from "vue";
 import { storeToRefs } from "pinia";
@@ -116,6 +117,7 @@ const isChangingContext = computed(() => {
   return teamLoading || sourceLoading;
 });
 const isExporting = ref(false);
+let exportAbortController: AbortController | null = null;
 
 const getQueryParamValue = (key: string) => {
   const value = route.query[key];
@@ -701,14 +703,23 @@ const triggerBrowserDownload = (downloadUrl: string, fileName?: string) => {
   link.remove();
 };
 
-const waitForExportCompletion = async (exportId: string, timeoutSeconds: number) => {
+class ExportAbortedError extends Error {
+  constructor() {
+    super("Export polling aborted");
+    this.name = "ExportAbortedError";
+  }
+}
+
+const waitForExportCompletion = async (exportId: string, timeoutSeconds: number, signal: AbortSignal) => {
   if (!currentTeamId.value || !currentSourceId.value) {
     throw new Error("Team and source are required for export");
   }
 
   const deadline = Date.now() + (timeoutSeconds + 60) * 1000;
   while (Date.now() < deadline) {
+    if (signal.aborted) throw new ExportAbortedError();
     const response = await exploreApi.getExportJob(currentSourceId.value, exportId, currentTeamId.value);
+    if (signal.aborted) throw new ExportAbortedError();
     const job = response.data;
     if (!job) {
       throw new Error("Export status is unavailable");
@@ -740,6 +751,10 @@ const handleExport = async () => {
     return;
   }
 
+  exportAbortController?.abort();
+  exportAbortController = new AbortController();
+  const signal = exportAbortController.signal;
+
   try {
     isExporting.value = true;
     const queryTimeout = Math.max(exploreStore.queryTimeout, 120);
@@ -754,24 +769,33 @@ const handleExport = async () => {
       throw new Error("Export job was not created");
     }
 
-    const completedJob = await waitForExportCompletion(job.id, queryTimeout);
+    const completedJob = await waitForExportCompletion(job.id, queryTimeout, signal);
     if (!completedJob.download_url) {
       throw new Error("Export download is unavailable");
     }
 
     triggerBrowserDownload(completedJob.download_url, completedJob.file_name);
   } catch (error: any) {
+    if (error instanceof ExportAbortedError) return;
     toast({
       title: "Download Failed",
       description: getErrorMessage(error),
       variant: "destructive",
       duration: TOAST_DURATION.ERROR,
     });
   } finally {
+    if (exportAbortController?.signal === signal) {
+      exportAbortController = null;
+    }
     isExporting.value = false;
   }
 };
 
+onBeforeUnmount(() => {
+  exportAbortController?.abort();
+  exportAbortController = null;
+});
+
 const calendarDatePartToDate = (value: any) => {
   if (!value) return undefined;
 
@@ -1487,7 +1511,7 @@ onMounted(async () => {
                   <component
                     v-if="exploreStore.columns?.length > 0"
                     :is="displayMode === 'table' ? DataTable : CompactLogList"
-                    :key="`${exploreStore.sourceId}-${exploreStore.activeMode}-${exploreStore.queryId}-${displayMode}`"
+                    :key="`${exploreStore.sourceId}-${exploreStore.activeMode}-${exploreStore.queryId ?? 'noquery'}-${displayMode}`"
                     :columns="exploreStore.columns as any"
                     :data="exploreStore.logs"
                     :stats="exploreStore.queryStats"

internal/auth/oidc.go

@@ -120,6 +120,10 @@ func NewOIDCProvider(ctx context.Context, oidcCfg *config.OIDCConfig, log *slog.
 		SkipIssuerCheck: true,
 	})
 
+	if oidcCfg.SkipEmailVerifiedCheck {
+		log.Warn("OIDC skip_email_verified_check is enabled — logins will succeed when the email_verified claim is missing")
+	}
+
 	return &OIDCProvider{
 		provider:  provider,
 		verifier:  verifier,

internal/clickhouse/client.go

@@ -9,7 +9,6 @@ import (
 	"fmt"
 	"log/slog"
 	"math"
-	"os"
 	"reflect"
 	"regexp"
 	"strings"
@@ -72,7 +71,6 @@ type ClientOptions struct {
 	SourceID  string                 // Source ID for metrics tracking.
 	Source    *models.Source         // Source model for enhanced metrics.
 	TLSEnable bool                   // Enable TLS for the connection.
-	TLSCACert string                 // Optional path to a CA certificate file for TLS verification.
 }
 
 // ExtendedColumnInfo provides detailed column metadata, including nullability,
@@ -114,22 +112,15 @@ func NewClient(opts ClientOptions, logger *slog.Logger) (*Client, error) {
 		}
 	}
 
-	// Build TLS config if enabled.
+	// Build TLS config if enabled. Uses the system root CA pool; operators
+	// who need a custom CA bundle should install it into the OS trust store.
 	var tlsCfg *tls.Config
 	if opts.TLSEnable {
 		rootCAs, err := x509.SystemCertPool()
 		if err != nil {
+			logger.Warn("failed to load system cert pool, falling back to empty pool", "error", err)
 			rootCAs = x509.NewCertPool()
 		}
-		if opts.TLSCACert != "" {
-			caCert, err := os.ReadFile(opts.TLSCACert)
-			if err != nil {
-				return nil, fmt.Errorf("reading TLS CA certificate: %w", err)
-			}
-			if !rootCAs.AppendCertsFromPEM(caCert) {
-				return nil, fmt.Errorf("failed to append CA certificate from %s", opts.TLSCACert)
-			}
-		}
 		tlsCfg = &tls.Config{
 			RootCAs:    rootCAs,
 			MinVersion: tls.VersionTLS12,

internal/server/export_handlers.go

@@ -61,7 +61,7 @@ func (s *Server) handleExportLogs(c *fiber.Ctx) error {
 		}
 		format = normalized
 	}
-	if format == "" || !isExportFormatAllowed(format, s.config.Export.Formats) {
+	if !isExportFormatAllowed(format, s.config.Export.Formats) {
 		return SendErrorWithType(c, fiber.StatusBadRequest, "Unsupported export format. Use csv or ndjson.", models.ValidationErrorType)
 	}
 	if format == "csv" {