feat(credential-groups): complete managed account enrollment - #6729

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 15, 2026 8:42am

PR Summary

Medium Risk
Changes touch public enrollment completion, enrollment deletion with credential cascade, and Slack OAuth manifest URLs—important for auth and data lifecycle, though behavior is covered by updated tests.

Overview
Public enrollment no longer requires every account to be connected before submit. Completing posts to the same API but redirects to a new Accounts connected page (/credential-groups/complete) instead of the invite URL with submitted or incomplete query flags. The enroll UI always shows Submit, drops the post-submit success toast, and labels OAuth links Reconnect when an account is already linked.

Workspace People management replaces Revoke with Delete: the enrollment row is removed (managed credentials cascade) rather than marked revoked. Status chips on people rows are removed; group settings listing hides revoked enrollments and uses a safer encoded pagination cursor.

Configuration treats credential options as optional by default (including Slack managed-user setup). The Slack custom-bot modal adds a Managed user authorization capability that wires Credential Group OAuth redirect URLs into the app manifest.

Workflow canvas resolves dynamic dropdown IDs (e.g. credential group names) via useDynamicSubBlockOptionDisplayName, and the Credential Groups block gets purple identity styling in tags and icons. Settings navigation reorders the credential-groups section.

^{Reviewed by Cursor Bugbot for commit c3f455a. Bugbot is set up for automated code reviews on this repo. Configure here.}

Greptile Summary

The PR completes optional managed-account enrollment, adds Slack managed-user authorization, simplifies Credential Group membership management, and improves dynamic block-option labels. The pagination repair now survives deletion of its boundary row, but its replacement cursor can silently paginate from an unrelated or fabricated boundary.

• Adds optional enrollment completion and reconnect flows.
• Adds managed Slack user authorization to custom bot manifests.
• Replaces enrollment revocation with deletion and credential cleanup.
• Introduces self-contained keyset cursors and dynamic workflow-block label hydration.

Confidence Score: 4/5

The PR is not yet safe to merge because credential-group pagination can silently omit valid people when given a foreign or modified cursor.

The new self-contained cursor is used directly as a keyset boundary without establishing that it belongs to the current workspace, credential group, and stable filter identity, allowing successful responses that begin at an unrelated position.

Files Needing Attention: apps/sim/lib/credential-groups/enrollments.ts

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Invite[Credential Group invitation] --> Enroll[Recipient enrollment]
  Enroll --> OAuth[Optional account connections]
  OAuth --> Complete[Complete enrollment]
  Complete --> Done[Completion page]
  Admin[Workspace administrator] --> People[People list]
  People --> Cursor[Self-contained pagination cursor]
  People --> Delete[Delete enrollment]
  Delete --> Cleanup[Managed credentials removed]

_{Reviews (4): Last reviewed commit: "fix(credential-groups): hydrate canvas l..." | Re-trigger Greptile}

@greptile

@cursor review

@greptile

@cursor review

@cursor review

@greptile