feat(automations): filter the automations list by creator

[henriquehirako]

This PR was created by an AI agent (OpenHands) on behalf of the user.

Why

Agent Canvas is adding a "Created by" filter (Anyone / Me / Others) to the Automations list (OpenHands/OpenHands#17814). The list endpoint has no creator filter, so Canvas can only filter the rows it has already loaded. The list loads 50 at a time, newest first. In an org with more than 50 automations, "Me" checks only the newest 50: if none of them are the caller's, the user is told they have no automations when they do.

Summary

• GET /api/automation/v1 takes an optional created_by query param: me keeps the caller's automations (Automation.user_id == user.user_id), others keeps the rest of the caller's org.
• The filter applies before the count, so total and limit / offset paging cover only the matching automations. The org scope, the soft-delete filter, and the newest-first order do not change.
• Without the param the response is the same as today. Any other value is a 422.
• Automations imported by Git Sync belong to the admin who configured the sync, as for the existing creator checks. In local mode every automation has the one local user, so me returns all of them and others none.

Consumer: OpenHands/OpenHands#17814 sends created_by from the "Created by" filter. An automation service without this change ignores the unknown param, and Canvas keeps its client-side filter as the fallback.

How to Test

1. uv run python -m pytest tests/test_router.py -k TestListAutomations. The new tests cover: no param lists every creator; me and others; two filtered pages keep the newest-first order with no duplicates, and total counts only the matches; an unknown value is a 422.
2. End to end: run Agent Canvas on this checkout (OH_AUTOMATION_LOCAL_PATH=<this repo> npm run dev in OpenHands/OpenHands). Local mode has one user, so give some automations another user_id in the local SQLite DB. Results below.

What I ran:

• uv run pre-commit run --all-files: pass.

• uv run python -m pytest tests/: 1801 passed, 60 skipped.

• Local service with 5 of my automations and 2 with another user_id:

  Request	total	Rows
  no param	5	all 5
  created_by=me	3	mine
  created_by=others	2	the teammate's
  created_by=me&limit=2, then &offset=2	3	2, then 1, all mine
  created_by=team	—	422 Input should be 'me' or 'others'

• Full stack: Agent Canvas (feat(automations): filter the automations dashboard by creator OpenHands#17814 on top of fix(automations): page the list by offset so Load more works past 100 OpenHands#17839) on this service, 60 automations, with mine the 5 oldest. With no filter, none of mine are on the first page. "Me" sent created_by=me and showed all 5. "Others" showed 50, and "Load more" sent offset=50&created_by=others and showed 55.

[github-actions]

Warning

Your comment is too long (maximum is 65536 characters), so the coverage report was not added. See the job log for how to reduce it.

[all-hands-bot]

This review was posted by an AI agent (OpenHands).

Review: feat(automations): filter the automations list by creator

Scope — Correct repository. The change extends GET /api/automation/v1 in the automation service, which is the component this repo owns (list endpoint, org scope, paging). The linked product requests are ready-for-dev: OpenHands/OpenHands#17816 and OpenHands/extensions#708. No product/architecture decision is pending.

What I verified on head 4384439

• created_by is typed Literal["me", "others"] | None, so any other value is rejected with 422 by FastAPI validation, as documented and tested.
• me / others add Automation.user_id == / != user.user_id to the base query, so the predicate runs inside the DB query, is applied before the count, and composes with the existing org_id + deleted_at IS NULL scope and the created_at DESC ordering. total and limit/offset therefore cover only the matching set — the stated bug (client-side filtering of the newest 50) is fixed at the correct layer.
• With no param the query is byte-for-byte the previous behavior.
• Automation.user_id is nullable=False and carries ix_automations_user_id, so the new predicate cannot miss NULL rows and is index-backed.
• Consumer integration: Canvas builds the request via buildListQuery, which omits keys whose value is undefined; automations-list.tsx sets serverCreatedBy = createdByFilter !== "all" ? createdByFilter : undefined. "Anyone" sends no param (unfiltered), "Me"/"Others" send me/others — exactly the three accepted shapes. There is no path that sends all to the service, so the strict 422 cannot fire in normal use.
• CI on the exact head: 8 checks passed, 2 skipped; no failures.

Tests — _seed_automation/_seed_mine_teammate_and_other_org cover unfiltered, me, others, filtered paging with total counting only matches, newest-first order, and the 422. Other-org exclusion is implicitly asserted (total == 2). I could not execute the suite here because it requires a Docker-backed PostgreSQL container and Docker is unavailable in this sandbox; CI unit-tests is green on this head, and the new tests read as correct against the implementation.

Non-blocking note — With created_by=me, an automation whose user_id differs from the caller is invisible to a member; admins/owners likewise cannot find another member's automation under "Me". That matches the stated product intent (automations imported by Git Sync belong to the configured admin), so it is not a blocker.

No blocking bugs, security problems, or design flaws found.

✅ APPROVED