fix(credential-groups): harden cursor and cache isolation - #6731

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 15, 2026 10:25am

PR Summary

Medium Risk
Changes enrollment pagination security and shared query cancellation behavior; existing unsigned cursors will be rejected after deploy, which is intentional fail-closed behavior.

Overview
Enrollment list pagination now issues signed, scope-bound cursors instead of plain base64 payloads. Each nextCursor is an HMAC over the boundary (id, invitedAt) and a scope derived from workspace, credential group, email filter, and status filters—replaying a cursor on another group, different filters, or a tampered boundary returns 400 Enrollment cursor is invalid. API validation allows longer cursors via CREDENTIAL_GROUP_ENROLLMENT_CURSOR_MAX_LENGTH (256).

On the Credential Groups workflow block, dynamic dropdown fetchOptionById paths no longer forward abort signals into the shared React Query credential-group list fetch, so option-resolution cancellation does not interfere with the workspace list cache; list loading still uses the query client’s signal.

^{Reviewed by Cursor Bugbot for commit f4c8f10. Bugbot is set up for automated code reviews on this repo. Configure here.}

@greptile

@cursor review

Greptile Summary

The PR signs and scope-binds Credential Group enrollment cursors, raises the request bound to accommodate the new token format, and prevents caller cancellation from affecting the shared Credential Group cache.

• Adds versioned, HMAC-authenticated enrollment cursors bound to workspace, group, and normalized filters.
• Uses a shared 256-character cursor limit and verifies emitted cursors against the request schema.
• Isolates shared cached list requests from dynamic-option cancellation.

Confidence Score: 5/5

The PR appears safe to merge.

The previously reported cursor-length failure is fixed, and no blocking failure remains.

sequenceDiagram
  participant Client
  participant Schema as Request Schema
  participant Enrollment as Enrollment Service
  participant DB
  Client->>Schema: Request first page
  Schema->>Enrollment: Validated filters
  Enrollment->>DB: Query enrollments
  Enrollment-->>Client: Results + signed, scope-bound nextCursor
  Client->>Schema: Request next page with cursor
  Schema->>Enrollment: Cursor within shared length bound
  Enrollment->>Enrollment: Verify HMAC and request scope
  Enrollment->>DB: Query after authenticated boundary
  Enrollment-->>Client: Next page

_{Reviews (2): Last reviewed commit: "fix(credential-groups): accept signed en..." | Re-trigger Greptile}

@greptile

@cursor review