feat(credentials): add managed credential groups - #6697

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 15, 2026 1:39am

PR Summary

High Risk
Changes OAuth token issuance, scoped workflow delegation, and a public enrollment/OAuth surface alongside broad credential API filtering—core auth paths with large new application surface area.

Overview
Introduces Credential Groups so workspace admins can define account types (Gmail, Google Calendar, Slack custom app), invite people by email, and store connections as managed_oauth credentials that workflows use without exposing tokens in the UI.

Admin and enrollment surfaces include workspace settings (create/edit groups, invite/resend/revoke, Slack managed-user setup), invitation emails, a public /credential-groups/enroll/[token] flow with OAuth start/callback/complete routes, and internal workspace APIs behind shared error policies and invitation rate limits.

OAuth and credential APIs are tightened: managed_oauth rows are omitted from Connected Accounts–style listing and CRUD; the OAuth token route resolves managed IDs through workflow delegation (x-sim-managed-oauth-delegation), requires a tool ID, and applies trusted scope policies (e.g. Slack canonical scopes). Ordinary credentials ignore a stale delegation header.

Workflow integration adds a Credential Groups block and executor handler (list credentials/people/groups, send invites with rate limits) plus a new credential_group block type in the registry.

Gating: CREDENTIAL_GROUPS / enterprise billing drives settings nav, sidebar, and isCredentialGroupsAvailable; enrollment principals cannot create uploads.

^{Reviewed by Cursor Bugbot for commit c884334. Bugbot is set up for automated code reviews on this repo. Configure here.}

@greptile-apps

Greptile Summary

Adds enterprise-managed credential groups, including invitation enrollment, custom-app OAuth adapters, managed credential execution, administrative settings, and workflow operations.

• Introduces credential-group persistence, enrollment lifecycle management, provider-policy validation, and managed OAuth delegation.
• Adds Gmail, Google Calendar, and Slack enrollment and execution paths.
• Serializes grant persistence, resend, completion, and revocation transitions so terminal and credential-readiness state is revalidated before writes.
• Adds API contracts, settings UI, workflow-block support, schema migration, and targeted regression tests.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

sequenceDiagram
  participant Admin
  participant API as Credential Group API
  participant DB as PostgreSQL
  participant User
  participant OAuth as OAuth Provider
  participant Exec as Workflow Executor

  Admin->>API: Create group and send invitation
  API->>DB: Persist enrollment and invitation token
  API-->>User: Enrollment email
  User->>API: Open invitation and start OAuth
  API->>OAuth: Authorization request
  OAuth-->>API: Callback and verified grant
  API->>DB: Lock lifecycle and revalidate policy
  API->>DB: Persist managed credential
  User->>API: Complete enrollment
  API->>DB: Lock and revalidate required credentials
  API->>DB: Mark enrollment completed
  Exec->>API: Request token with scoped delegation
  API->>DB: Authorize and resolve managed credential
  API-->>Exec: Access token

_{Reviews (15): Last reviewed commit: "fix(lint): use optional chain for pagina..." | Re-trigger Greptile}

@greptile-apps

@cursor review

@greptile-apps

@cursor review

@greptile-apps

@cursor review

@greptile-apps

@cursor review

@greptile-apps

@cursor review

@greptile

@cursor review

@greptile

@cursor review