feat(credentials): add managed credential groups

[TheodoreSpeaks]

Summary

• add enterprise Credential Groups settings, email enrollment, and managed credential storage
• support Gmail, Google Calendar, and Slack custom-app OAuth through provider adapters
• add a Credential Groups workflow block for listing credentials and people, sending invites, and listing groups
• keep managed credentials hidden from Connected Accounts while allowing fail-closed credential ID execution

Type of Change

• Feature

Testing

• 264 targeted tests
• bun run lint:check
• bun run check:audits
• bunx turbo run type-check --filter=sim --filter=@sim/auth
• bun run check:migrations origin/staging

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 15, 2026 1:39am

[cursor]

PR Summary

High Risk
Changes OAuth token issuance, scoped workflow delegation, and a public enrollment/OAuth surface alongside broad credential API filtering—core auth paths with large new application surface area.

Overview
Introduces Credential Groups so workspace admins can define account types (Gmail, Google Calendar, Slack custom app), invite people by email, and store connections as managed_oauth credentials that workflows use without exposing tokens in the UI.

Admin and enrollment surfaces include workspace settings (create/edit groups, invite/resend/revoke, Slack managed-user setup), invitation emails, a public /credential-groups/enroll/[token] flow with OAuth start/callback/complete routes, and internal workspace APIs behind shared error policies and invitation rate limits.

OAuth and credential APIs are tightened: managed_oauth rows are omitted from Connected Accounts–style listing and CRUD; the OAuth token route resolves managed IDs through workflow delegation (x-sim-managed-oauth-delegation), requires a tool ID, and applies trusted scope policies (e.g. Slack canonical scopes). Ordinary credentials ignore a stale delegation header.

Workflow integration adds a Credential Groups block and executor handler (list credentials/people/groups, send invites with rate limits) plus a new credential_group block type in the registry.

Gating: CREDENTIAL_GROUPS / enterprise billing drives settings nav, sidebar, and isCredentialGroupsAvailable; enrollment principals cannot create uploads.

^{Reviewed by Cursor Bugbot for commit c884334. Bugbot is set up for automated code reviews on this repo. Configure here.}

[TheodoreSpeaks]

@greptile-apps

[greptile-apps]

Greptile Summary

Adds enterprise-managed credential groups, including invitation enrollment, custom-app OAuth adapters, managed credential execution, administrative settings, and workflow operations.

• Introduces credential-group persistence, enrollment lifecycle management, provider-policy validation, and managed OAuth delegation.
• Adds Gmail, Google Calendar, and Slack enrollment and execution paths.
• Serializes grant persistence, resend, completion, and revocation transitions so terminal and credential-readiness state is revalidated before writes.
• Adds API contracts, settings UI, workflow-block support, schema migration, and targeted regression tests.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/credential-groups/oauth.ts	Persists verified OAuth grants under lifecycle and policy locks while preserving completed reconnect state and rejecting revoked or stale-policy callbacks.
apps/sim/lib/credential-groups/enrollments.ts	Implements invitation, resend, revocation, public enrollment, and completion transitions with compatible locks and conditional state updates.
apps/sim/app/api/auth/oauth/token/route.ts	Adds fail-closed managed OAuth token resolution using scoped workflow delegation and trusted tool metadata.
apps/sim/lib/credentials/application/resolve-managed-oauth-token.ts	Resolves managed credentials through the application-operation boundary with provider and scope enforcement.
packages/db/schema.ts	Adds the credential-group and managed OAuth persistence model used by enrollment and delegated execution.
packages/db/migrations/0291_fuzzy_wong.sql	Introduces the database structures and constraints required for managed credential groups.

Sequence Diagram

sequenceDiagram
  participant Admin
  participant API as Credential Group API
  participant DB as PostgreSQL
  participant User
  participant OAuth as OAuth Provider
  participant Exec as Workflow Executor

  Admin->>API: Create group and send invitation
  API->>DB: Persist enrollment and invitation token
  API-->>User: Enrollment email
  User->>API: Open invitation and start OAuth
  API->>OAuth: Authorization request
  OAuth-->>API: Callback and verified grant
  API->>DB: Lock lifecycle and revalidate policy
  API->>DB: Persist managed credential
  User->>API: Complete enrollment
  API->>DB: Lock and revalidate required credentials
  API->>DB: Mark enrollment completed
  Exec->>API: Request token with scoped delegation
  API->>DB: Authorize and resolve managed credential
  API-->>Exec: Access token

Loading

_{Reviews (15): Last reviewed commit: "fix(lint): use optional chain for pagina..." | Re-trigger Greptile}

[TheodoreSpeaks]

@greptile-apps

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile-apps

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit caad5d0. Configure here.}

[TheodoreSpeaks]

@greptile-apps

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 4a2a6e7. Configure here.}

[TheodoreSpeaks]

@greptile-apps

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile-apps

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit c884334. Configure here.}