fix(credential-groups): list all managed credentials

Author: TheodoreSpeaks

apps/sim/lib/credential-groups/application/list-credentials.test.ts

@@ -153,48 +153,40 @@ describe('listCredentialGroupCredentials', () => {
     expect(mocks.listCredentials).not.toHaveBeenCalled()
   })
 
-  it('rejects workflows whose original principal has no human subject', async () => {
+  it('lists credentials when the original principal has no human subject', async () => {
     const principal = executorPrincipal()
+    principal.subjectUserId = undefined
     principal.delegationContext.principal = {
       kind: 'workspace_api_key',
       workspaceId: 'workspace-1',
       keyId: 'workspace-key-1',
     }
 
-    await expect(
-      listCredentialGroupCredentials.execute({ principal, input })
-    ).rejects.toMatchObject({
-      code: 'forbidden',
-      message: 'Credential Group enrollment access required',
-    })
+    await listCredentialGroupCredentials.execute({ principal, input })
+
     expect(mocks.loadEnrollmentAccess).not.toHaveBeenCalled()
-    expect(mocks.listCredentials).not.toHaveBeenCalled()
+    expect(mocks.listCredentials).toHaveBeenCalledWith(
+      expect.not.objectContaining({ credentialGroupEnrollmentId: expect.anything() })
+    )
   })
 
-  it('rejects a user who is not enrolled in the group', async () => {
+  it('lists credentials without requiring the actor to be enrolled', async () => {
     mocks.loadEnrollmentAccess.mockResolvedValueOnce(null)
 
-    await expect(
-      listCredentialGroupCredentials.execute({ principal: executorPrincipal(), input })
-    ).rejects.toMatchObject({
-      code: 'forbidden',
-      message: 'Credential Group enrollment access required',
-    })
-    expect(mocks.listCredentials).not.toHaveBeenCalled()
+    await listCredentialGroupCredentials.execute({ principal: executorPrincipal(), input })
+
+    expect(mocks.loadEnrollmentAccess).not.toHaveBeenCalled()
+    expect(mocks.listCredentials).toHaveBeenCalled()
   })
 
-  it('rejects an executor subject that does not match the original workflow principal', async () => {
+  it('does not use the executor subject to filter credential references', async () => {
     const principal = executorPrincipal()
     principal.subjectUserId = 'different-user'
 
-    await expect(
-      listCredentialGroupCredentials.execute({ principal, input })
-    ).rejects.toMatchObject({
-      code: 'forbidden',
-      message: 'Credential Group enrollment access required',
-    })
+    await listCredentialGroupCredentials.execute({ principal, input })
+
     expect(mocks.loadEnrollmentAccess).not.toHaveBeenCalled()
-    expect(mocks.listCredentials).not.toHaveBeenCalled()
+    expect(mocks.listCredentials).toHaveBeenCalled()
   })
 
   it('returns a bounded page after current workspace and entitlement checks', async () => {
@@ -211,7 +203,6 @@ describe('listCredentialGroupCredentials', () => {
       credentialGroupId: 'group-1',
       limit: 50,
       cursor: undefined,
-      credentialGroupEnrollmentId: 'enrollment-1',
       credentialProviderIds: undefined,
       credentialGroupOptionIds: ['option-1'],
     })
@@ -243,14 +234,14 @@ describe('listCredentialGroupCredentials', () => {
     )
   })
 
-  it('ignores caller-supplied email and uses the principal enrollment', async () => {
+  it('does not use caller-supplied identity fields to filter credential references', async () => {
     await listCredentialGroupCredentials.execute({
       principal: executorPrincipal(),
       input: { ...input, email: ' Person@Example.COM ' },
     })
 
     expect(mocks.listCredentials).toHaveBeenCalledWith(
-      expect.objectContaining({ credentialGroupEnrollmentId: 'enrollment-1' })
+      expect.not.objectContaining({ credentialGroupEnrollmentId: expect.anything() })
     )
   })
 

apps/sim/lib/credential-groups/application/list-credentials.ts

@@ -1,9 +1,6 @@
 import { defineAuthorizedWorkspaceUseCase } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
-import {
-  credentialGroupDelegationPolicy,
-  requireCredentialGroupEnrollmentAccess,
-} from '@/lib/credential-groups/application/authorization'
+import { credentialGroupDelegationPolicy } from '@/lib/credential-groups/application/authorization'
 import {
   requireCredentialGroupsAvailable,
   resolveCredentialGroupContext,
@@ -39,12 +36,6 @@ export const listCredentialGroupCredentials = defineAuthorizedWorkspaceUseCase({
   resolveContext: ({ input }: { input: ListCredentialGroupCredentialsInput }) =>
     resolveCredentialGroupContext(input.credentialGroupId),
   authorizationOptions: { delegation: credentialGroupDelegationPolicy },
-  async authorizeResource({ principal, context }) {
-    context.enrollmentAccess = await requireCredentialGroupEnrollmentAccess(
-      principal,
-      context.credentialGroupId
-    )
-  },
   execute: async ({ input, context }): Promise<ListCredentialGroupCredentialsResult> => {
     if (
       !Number.isInteger(input.limit) ||
@@ -84,9 +75,6 @@ export const listCredentialGroupCredentials = defineAuthorizedWorkspaceUseCase({
     }
 
     await requireCredentialGroupsAvailable(context.workspaceId)
-    if (!context.enrollmentAccess) {
-      throw new Error('Credential Group credential listing executed without enrollment access')
-    }
 
     let page
     try {
@@ -96,7 +84,6 @@ export const listCredentialGroupCredentials = defineAuthorizedWorkspaceUseCase({
         credentialGroupOptionIds: activeOptions.map((option) => option.id),
         limit: input.limit,
         cursor: input.cursor,
-        credentialGroupEnrollmentId: context.enrollmentAccess.enrollmentId,
         credentialProviderIds: credentialProviderIds.length > 0 ? credentialProviderIds : undefined,
       })
     } catch (error) {

apps/sim/lib/credential-groups/credentials.test.ts

@@ -27,7 +27,6 @@ describe('listCredentialGroupCredentialReferences', () => {
     const result = await listCredentialGroupCredentialReferences({
       workspaceId: 'workspace-1',
       credentialGroupId: 'group-1',
-      credentialGroupEnrollmentId: 'enrollment-1',
       credentialGroupOptionIds: ['option-1'],
       limit: 50,
     })

apps/sim/lib/credential-groups/credentials.ts

@@ -44,7 +44,6 @@ interface ListCredentialGroupCredentialReferencesInput {
   credentialGroupId: string
   limit: number
   cursor?: string
-  credentialGroupEnrollmentId: string
   credentialProviderIds?: string[]
   credentialGroupOptionIds: string[]
 }
@@ -97,7 +96,6 @@ export async function listCredentialGroupCredentialReferences({
   credentialGroupId,
   limit,
   cursor,
-  credentialGroupEnrollmentId,
   credentialProviderIds,
   credentialGroupOptionIds,
 }: ListCredentialGroupCredentialReferencesInput): Promise<{
@@ -125,7 +123,6 @@ export async function listCredentialGroupCredentialReferences({
           eq(credential.type, 'managed_oauth'),
           eq(credential.managedOauthStatus, 'active'),
           eq(credentialGroupEnrollment.credentialGroupId, credentialGroupId),
-          eq(credentialGroupEnrollment.id, credentialGroupEnrollmentId),
           inArray(credential.credentialGroupOptionId, credentialGroupOptionIds),
           credentialProviderIds?.length
             ? inArray(credential.providerId, credentialProviderIds)
@@ -159,7 +156,6 @@ export async function listCredentialGroupCredentialReferences({
         eq(credential.type, 'managed_oauth'),
         eq(credential.managedOauthStatus, 'active'),
         eq(credentialGroupEnrollment.credentialGroupId, credentialGroupId),
-        eq(credentialGroupEnrollment.id, credentialGroupEnrollmentId),
         inArray(credential.credentialGroupOptionId, credentialGroupOptionIds),
         credentialProviderIds?.length
           ? inArray(credential.providerId, credentialProviderIds)