feat(credential-groups): allowlist integrations by workspace by TheodoreSpeaks · Pull Request #7885 · simstudioai/sim

TheodoreSpeaks · 2026-09-16T18:43:25Z

Summary

Keep Credential Groups visible whenever its feature flag is enabled, including with Sim Search enabled.
Add workspace-specific integration allowlists in the Access tab. The modal places All integrations first in the integration picker and preserves the existing integration settings.
Evaluate credential types through resource policies across credential discovery, OAuth/MCP/token use, and credential trigger delivery. Existing all-integration grants retain their behavior.

Type of Change

New feature

Testing

2,093 focused credential, policy, MCP, settings, and UI tests; 22 DB policy reconciliation tests.
App, auth, and DB type-checks; repository lint and audit suite; block registry and generated documentation checks.
Regenerated the module-graph baseline after measuring 2–5 added modules per affected route; the executable tool registry remains unreachable from guarded routes.
Local workflow checks: all-integration and Gmail-only grants allow Gmail; a different integration-only grant hides Gmail and denies both explicit lookup and execution with a saved Gmail credential ID.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-09-16T18:43:32Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 16, 2026 7:59pm UTC

cubic-dev-ai

1 issue found across 57 files

Confidence score: 3/5

In apps/sim/lib/credentials/application/workspace-account-visibility.ts, stale or cross-scoped enrollment group ownership can cause the policy lookup to rely only on credential.organizationId, risking incorrect workspace visibility or authorization decisions. Verify the enrollment’s canonical credentialGroup owner before querying requireResourcePolicy.

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/sim/lib/credentials/application/workspace-account-visibility.ts">

<violation number="1" location="apps/sim/lib/credentials/application/workspace-account-visibility.ts:26">
P2: When an enrollment’s group owner is stale or cross-scoped, this query uses only `credential.organizationId` and never verifies the enrollment’s canonical `credentialGroup` owner. `requireResourcePolicy` is then queried with the wrong scope, so a malformed binding raises a policy-not-found error and breaks credential listing/lookup instead of hiding the entry; join `credentialGroup` and reject owner mismatches before loading its policy.

(Based on your team's feedback about Credential Group ownership.)</violation>
</file>

_{Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic}

greptile-apps · 2026-09-16T18:49:31Z

Confidence Score: 5/5

The PR appears safe to merge; no new actionable issue was introduced since the previous review, and the only previous finding was manually resolved.

Summary

This PR adds workspace-specific integration allowlists to Credential Groups and consistently enforces those grants across credential discovery and use.

Keeps Credential Groups visible when Sim Search is enabled.
Adds per-workspace integration selection while preserving all-integration grants.
Applies canonical credential-type policy checks to OAuth, MCP, personal-token, workflow, Copilot, and trigger paths.
Updates resource-policy reconciliation, API contracts, settings UI, and focused regression coverage.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    A[Organization credential group] --> B[Workspace grant]
    B --> C{Integration scope}
    C -->|All integrations| D[Workspace may discover credentials]
    C -->|Selected integrations| E[Canonical credential-type condition]
    E --> D
    D --> F{Authorization and policy evaluation}
    F --> G[OAuth and token use]
    F --> H[MCP connections]
    F --> I[Workflow and Copilot access]
    F --> J[Credential triggers]

_{Reviews (4) · Last reviewed commit: "fix(credential-groups): refresh selector..."}

TheodoreSpeaks · 2026-09-16T19:01:34Z

@greptile

TheodoreSpeaks · 2026-09-16T19:01:35Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-16T19:01:41Z

@cubic-dev-ai review this PR

@TheodoreSpeaks I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 60 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

…ership

TheodoreSpeaks · 2026-09-16T19:57:56Z

@greptile

TheodoreSpeaks · 2026-09-16T19:58:01Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-16T19:58:08Z

@cubic-dev-ai review this PR

@TheodoreSpeaks I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 60 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

TheodoreSpeaks · 2026-09-16T20:03:25Z

@greptile Please re-review against the current staging merge base, f6bc72378c2c93eb207c00e7e144c2ffe671cf23. This branch was rebased; its only PR commits are 53ad61308e and 18d6048e76. GitHub's current PR diff contains 60 files. The Insights changes from #7884 and authentication changes from #7886 are already on staging, not additions from this PR. In particular, git diff origin/staging HEAD -- apps/sim/lib/billing/core/organization-activity-queries.ts is empty.

The daily-bucket concern also appears inconsistent with the current query and schema: both source started_at columns are timestamps without time zone, and the query attaches UTC, converts to the requested timezone, then truncates. The existing organization-activity.postgres.test.ts suite covers Los Angeles day boundaries across daylight saving time with a Pacific/Auckland database session; all 7 tests passed in this head's PostgreSQL CI job. Please reassess the concern against that implementation and refresh the summary for the current PR diff. Credential-group behavior remains deny-by-default, with selected grants matching the canonical credential type.

TheodoreSpeaks · 2026-09-16T20:03:56Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-16T20:04:02Z

@cubic-dev-ai review this PR

@TheodoreSpeaks I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 60 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

vercel Bot deployed to Preview September 16, 2026 18:44 View deployment

cubic-dev-ai Bot reviewed Sep 16, 2026

View reviewed changes

greptile-apps Bot reviewed Sep 16, 2026

View reviewed changes

Comment thread apps/sim/ee/credential-groups/components/organization-workspace-grant-modal.tsx Outdated

TheodoreSpeaks force-pushed the fix/cred-op-blocks branch from 6238f14 to b26ea1e Compare September 16, 2026 19:00

vercel Bot deployed to Preview September 16, 2026 19:02 View deployment

cubic-dev-ai Bot reviewed Sep 16, 2026

View reviewed changes

TheodoreSpeaks added 2 commits September 16, 2026 12:55

feat(credential-groups): allowlist integrations by workspace

53ad613

fix(credential-groups): refresh selectors and validate credential own…

18d6048

…ership

TheodoreSpeaks force-pushed the fix/cred-op-blocks branch from b26ea1e to 18d6048 Compare September 16, 2026 19:57

vercel Bot deployed to Preview September 16, 2026 19:59 View deployment

cubic-dev-ai Bot reviewed Sep 16, 2026

View reviewed changes

TheodoreSpeaks merged commit 000356f into staging Sep 16, 2026
33 checks passed

TheodoreSpeaks deleted the fix/cred-op-blocks branch September 16, 2026 20:10

waleedlatif1 mentioned this pull request Sep 16, 2026

v0.8.40: browser agent improvements, permission requests #7876

Merged

Conversation

TheodoreSpeaks commented Sep 16, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Uh oh!

Uh oh!

TheodoreSpeaks commented Sep 16, 2026

Uh oh!

TheodoreSpeaks commented Sep 16, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 16, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

TheodoreSpeaks commented Sep 16, 2026

Uh oh!

TheodoreSpeaks commented Sep 16, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 16, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

TheodoreSpeaks commented Sep 16, 2026

Uh oh!

TheodoreSpeaks commented Sep 16, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 16, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Sep 16, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

greptile-apps Bot commented Sep 16, 2026 •

edited

Loading