feat(credentials): add managed credential groups by TheodoreSpeaks · Pull Request #6697 · simstudioai/sim

TheodoreSpeaks · 2026-08-14T15:06:32Z

Summary

add enterprise Credential Groups settings, email enrollment, and managed credential storage
support Gmail, Google Calendar, and Slack custom-app OAuth through provider adapters
add a Credential Groups workflow block for listing credentials and people, sending invites, and listing groups
keep managed credentials hidden from Connected Accounts while allowing fail-closed credential ID execution

Type of Change

Feature

Testing

264 targeted tests
bun run lint:check
bun run check:audits
bunx turbo run type-check --filter=sim --filter=@sim/auth
bun run check:migrations origin/staging

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-08-14T15:06:39Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 14, 2026 7:42pm

cursor · 2026-08-14T15:06:46Z

PR Summary

High Risk
Large surface area across OAuth token issuance, public enrollment, and credential hiding; misconfiguration could leak managed tokens or expose credentials through the wrong API path.

Overview
Introduces enterprise Credential Groups: workspace admins can define collections (Gmail, Calendar, Slack custom app), invite people by email, and collect OAuth via tokenized public enrollment routes with IP/OAuth rate limits and provider callbacks. Workspace settings UI, invitation email, and a Credential Groups workflow block support listing credentials/people/groups and sending invites under executor delegation.

Managed OAuth credentials (managed_oauth) are stored for enrollments but are excluded from Connected Accounts listings, memberships, drafts, and member APIs; the OAuth token route adds a dedicated path that requires workflow delegation, a tool ID, and tool-trusted scopes before issuing tokens (ordinary credentials ignore stray delegation headers).

Documents CREDENTIAL_GROUPS in .env.example and gates the settings nav, block visibility, and uploads for enrollment principals.

^{Reviewed by Cursor Bugbot for commit 8253b2d. Bugbot is set up for automated code reviews on this repo. Configure here.}

TheodoreSpeaks · 2026-08-14T15:07:19Z

@greptile-apps

greptile-apps · 2026-08-14T15:11:27Z

Greptile Summary

The PR adds enterprise-managed credential groups, public enrollment and custom-app OAuth flows, delegated managed-credential execution, administrative settings, and the supporting database schema.

Adds credential-group creation, enrollment, revocation, resend, completion, and Slack managed-user flows.
Adds provider adapters and delegated token resolution for Gmail, Google Calendar, and Slack.
Adds a workflow block and executor handler for credential-group operations.
Hides managed credentials from ordinary Connected Accounts APIs while requiring scoped workflow delegation for execution.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/credential-groups/enrollments.ts	Implements invitation, resend, revocation, and completion lifecycles with shared locking and transactional revalidation; the previously reported races are addressed.
apps/sim/lib/credential-groups/oauth.ts	Persists OAuth grants under lifecycle and group locks while rejecting revoked enrollments, validating current policy, and preserving completed reconnect state.
apps/sim/app/api/auth/oauth/token/route.ts	Adds a fail-closed managed OAuth path requiring a credential-scoped workflow delegation and trusted tool scope policy.
apps/sim/lib/credentials/managed-oauth.ts	Adds managed credential token storage, status handling, refresh, and provider-policy validation.
packages/db/schema.ts	Adds the credential-group, enrollment, option, managed-credential, and supporting relational schema.
packages/db/migrations/0291_fuzzy_wong.sql	Introduces the database objects and constraints required by managed credential groups.
apps/sim/executor/handlers/credential-group/credential-group-handler.ts	Adds executor support for credential-group listing, people, invitations, and credential operations.

Sequence Diagram

sequenceDiagram
  participant Admin
  participant API as Credential Group API
  participant DB as Postgres
  participant Recipient
  participant OAuth as Provider OAuth
  participant Exec as Workflow Executor
  Admin->>API: Create group and send invitation
  API->>DB: Persist group, options, and enrollment
  API-->>Recipient: Enrollment link
  Recipient->>API: Open enrollment and start OAuth
  API->>OAuth: Authorize configured provider
  OAuth-->>API: Callback grant
  API->>DB: Lock lifecycle and persist managed credential
  Recipient->>API: Complete enrollment
  API->>DB: Lock and validate current policy/readiness
  Exec->>API: Request token with scoped delegation
  API->>DB: Authorize and resolve managed credential
  API-->>Exec: Access token

_{Reviews (13): Last reviewed commit: "fix(credentials): redirect unavailable o..." | Re-trigger Greptile}

TheodoreSpeaks · 2026-08-14T15:11:44Z

@greptile-apps

TheodoreSpeaks · 2026-08-14T15:11:55Z

@cursor review

TheodoreSpeaks · 2026-08-14T15:18:39Z

@greptile-apps

TheodoreSpeaks · 2026-08-14T15:18:49Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit caad5d0. Configure here.}

TheodoreSpeaks · 2026-08-14T15:24:52Z

@greptile-apps

TheodoreSpeaks · 2026-08-14T15:25:01Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 4a2a6e7. Configure here.}

TheodoreSpeaks · 2026-08-14T16:16:12Z

@greptile-apps

TheodoreSpeaks · 2026-08-14T16:16:20Z

@cursor review

TheodoreSpeaks · 2026-08-14T17:40:06Z

@greptile-apps

TheodoreSpeaks · 2026-08-14T17:40:14Z

@cursor review

TheodoreSpeaks · 2026-08-14T19:14:34Z

@cursor review

TheodoreSpeaks · 2026-08-14T19:14:35Z

@greptile-apps

TheodoreSpeaks · 2026-08-14T19:24:36Z

@cursor review

TheodoreSpeaks · 2026-08-14T19:24:40Z

@greptile-apps

cursor

✅ Bugbot reviewed your changes and found no new issues!

1 issue from previous review remains unresolved.

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 063ff6e. Configure here.}

TheodoreSpeaks · 2026-08-14T19:34:37Z

@cursor review

TheodoreSpeaks · 2026-08-14T19:34:39Z

@greptile-apps

TheodoreSpeaks · 2026-08-14T19:42:39Z

@greptile-apps

TheodoreSpeaks · 2026-08-14T19:42:40Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 8253b2d. Configure here.}

TheodoreSpeaks force-pushed the feat/slack-user-oauth branch from 5341d8e to 8663a42 Compare August 14, 2026 15:11

greptile-apps Bot reviewed Aug 14, 2026

View reviewed changes

Comment thread apps/sim/lib/credential-groups/oauth.ts Outdated

cursor Bot reviewed Aug 14, 2026

View reviewed changes

Comment thread apps/sim/app/api/auth/oauth/token/route.ts Outdated

Comment thread apps/sim/app/credential-groups/enroll/[token]/oauth-reconnect-link.tsx

vercel Bot deployed to Preview August 14, 2026 15:17 View deployment

vercel Bot temporarily deployed to Preview August 14, 2026 15:17 Inactive

greptile-apps Bot reviewed Aug 14, 2026

View reviewed changes

Comment thread apps/sim/lib/credential-groups/enrollments.ts Outdated

cursor Bot reviewed Aug 14, 2026

View reviewed changes

github-advanced-security AI found potential problems Aug 14, 2026

View reviewed changes

Comment thread apps/sim/lib/credential-groups/enrollments.ts Fixed

vercel Bot temporarily deployed to Preview August 14, 2026 15:24 Inactive

cursor Bot reviewed Aug 14, 2026

View reviewed changes

vercel Bot temporarily deployed to Preview August 14, 2026 15:33 Inactive

greptile-apps Bot reviewed Aug 14, 2026

View reviewed changes

Comment thread apps/sim/lib/credential-groups/enrollments.ts Outdated

cursor Bot reviewed Aug 14, 2026

View reviewed changes

Comment thread apps/sim/lib/credential-groups/enrollments.ts Outdated

Comment thread apps/sim/lib/credential-groups/enrollments.ts

TheodoreSpeaks force-pushed the feat/slack-user-oauth branch from 9f64dfd to 3f504cd Compare August 14, 2026 17:39

cursor Bot reviewed Aug 14, 2026

View reviewed changes

Comment thread apps/sim/ee/credential-groups/components/credential-group-detail.tsx

Comment thread apps/sim/app/api/credential-groups/oauth/[provider]/callback/route.ts

vercel Bot deployed to Preview August 14, 2026 17:45 View deployment

greptile-apps Bot reviewed Aug 14, 2026

View reviewed changes

Comment thread apps/sim/lib/credential-groups/oauth.ts

vercel Bot deployed to Preview August 14, 2026 19:20 View deployment

cursor Bot reviewed Aug 14, 2026

View reviewed changes

Comment thread apps/sim/ee/credential-groups/components/credential-group-detail.tsx Outdated

vercel Bot temporarily deployed to Preview August 14, 2026 19:24 Inactive

cursor Bot reviewed Aug 14, 2026

View reviewed changes

TheodoreSpeaks added 11 commits August 14, 2026 12:33

feat(credentials): add managed credential groups

82259b2

fix(audit): sync credential group mock

3a822ec

fix(credentials): serialize enrollment revocation

7629310

fix(credentials): isolate managed delegation

50523b7

fix(credentials): serialize invitation lifecycle

dce2820

fix(credentials): preserve enrollment lifecycle

bbbf45a

refactor(credentials): migrate groups to application boundary

9317e17

fix(credentials): serialize enrollment readiness

f8da445

fix(credentials): preserve completed reconnect state

8bb7813

fix(credentials): revalidate policy before grant persistence

b840004

fix(credentials): prioritize expired invitations

c6c1296

TheodoreSpeaks force-pushed the feat/slack-user-oauth branch from 063ff6e to c6c1296 Compare August 14, 2026 19:34

cursor Bot reviewed Aug 14, 2026

View reviewed changes

Comment thread apps/sim/app/api/credential-groups/enroll/[token]/oauth/[optionId]/route.ts Outdated

vercel Bot deployed to Preview August 14, 2026 19:39 View deployment

fix(credentials): redirect unavailable oauth starts

8253b2d

vercel Bot temporarily deployed to Preview August 14, 2026 19:42 Inactive

cursor Bot reviewed Aug 14, 2026

View reviewed changes

Uh oh!

Conversation

TheodoreSpeaks commented Aug 14, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

TheodoreSpeaks commented Aug 14, 2026

Uh oh!

greptile-apps Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

TheodoreSpeaks commented Aug 14, 2026

Uh oh!

TheodoreSpeaks commented Aug 14, 2026

Uh oh!

Uh oh!

Uh oh!

TheodoreSpeaks commented Aug 14, 2026

Uh oh!

TheodoreSpeaks commented Aug 14, 2026

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

TheodoreSpeaks commented Aug 14, 2026

Uh oh!

TheodoreSpeaks commented Aug 14, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

TheodoreSpeaks commented Aug 14, 2026

Uh oh!

TheodoreSpeaks commented Aug 14, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TheodoreSpeaks commented Aug 14, 2026

Uh oh!

TheodoreSpeaks commented Aug 14, 2026

Uh oh!

Uh oh!

Uh oh!

TheodoreSpeaks commented Aug 14, 2026

Uh oh!

TheodoreSpeaks commented Aug 14, 2026

Uh oh!

Uh oh!

Uh oh!

TheodoreSpeaks commented Aug 14, 2026

Uh oh!

TheodoreSpeaks commented Aug 14, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

TheodoreSpeaks commented Aug 14, 2026

Uh oh!

TheodoreSpeaks commented Aug 14, 2026

Uh oh!

Uh oh!

TheodoreSpeaks commented Aug 14, 2026

Uh oh!

vercel Bot commented Aug 14, 2026 •

edited

Loading

cursor Bot commented Aug 14, 2026 •

edited

Loading

greptile-apps Bot commented Aug 14, 2026 •

edited

Loading