UX: clarify the need for authorized extension

config/locales/server.en.yml

@@ -6,6 +6,7 @@ en:
       recurring_data_explorer_result_pm:
         title: Schedule a PM with Data Explorer results
         description: Get scheduled reports sent to your messages
+        no_csv_allowed: "When using `attach_csv` field, `csv` must be added to the list of authorized extensions in the site settings."
       recurring_data_explorer_result_topic:
         title: Schedule a post in a topic with Data Explorer results
         description: Get scheduled reports posted to a specific topic

plugin.rb

@@ -82,7 +82,18 @@ module ::DiscourseDataExplorer
         field :query_id, component: :choices, required: true, extra: { content: queries }
         field :query_params, component: :"key-value", accepts_placeholders: true
         field :skip_empty, component: :boolean
-        field :attach_csv, component: :boolean
+        field :attach_csv,
+              component: :boolean,
+              validator: ->(attach_csv) do
+                return if !attach_csv
+
+                extensions = SiteSetting.authorized_extensions.split("|")
+                if (extensions & %w[csv *]).empty?
+                  I18n.t(
+                    "discourse_automation.scriptables.recurring_data_explorer_result_pm.no_csv_allowed",
+                  )
+                end
+              end
 
         version 1
         triggerables [:recurring]

spec/automation/recurring_data_explorer_result_pm_spec.rb

@@ -126,4 +126,27 @@
       )
     end
   end
+
+  context "when using attach_csv" do
+    it "requires csv to be in authorized extensions" do
+      SiteSetting.authorized_extensions = "pdf|txt"
+
+      expect { automation.upsert_field!("attach_csv", "boolean", { value: true }) }.to raise_error(
+        ActiveRecord::RecordInvalid,
+        /#{I18n.t("discourse_automation.scriptables.recurring_data_explorer_result_pm.no_csv_allowed")}/,
+      )
+
+      SiteSetting.authorized_extensions = "pdf|txt|csv"
+
+      expect {
+        automation.upsert_field!("attach_csv", "boolean", { value: true })
+      }.to_not raise_error
+
+      SiteSetting.authorized_extensions = "*"
+
+      expect {
+        automation.upsert_field!("attach_csv", "boolean", { value: true })
+      }.to_not raise_error
+    end
+  end
 end