fix(auth): serialize domain administration and align SSO validation

Author: waleedlatif1

apps/docs/openapi-v2-resources.json

@@ -7954,7 +7954,7 @@
       "get": {
         "operationId": "listCredentialMembers",
         "summary": "List Credential Members",
-        "description": "List explicit credential grants, including revoked grants, and inherited workspace administrator access. Requires workspace read access. Personal API keys and OAuth tokens can access OAuth or service-account credentials; sessions can also access workspace environment credentials. Workspace API keys return `403`; use a personal API key or scoped OAuth token.\n\nOAuth scope: `api:read`.",
+        "description": "List explicit credential grants, including revoked grants, and inherited workspace administrator access. Requires workspace read access and the integrations.manage capability. Personal API keys and OAuth tokens can access OAuth or service-account credentials; sessions can also access workspace environment credentials. Workspace API keys return `403`; use a personal API key or scoped OAuth token.\n\nOAuth scope: `api:read`.",
         "x-sim-operation": "credentials.members.list",
         "x-oauth-scope": "api:read",
         "tags": ["Credentials"],
@@ -8080,7 +8080,7 @@
       "post": {
         "operationId": "upsertCredentialMember",
         "summary": "Upsert Credential Member",
-        "description": "Grant or change an existing workspace member’s credential role. Requires credential administrator access. Revoked grants become active again; inherited administrators cannot be demoted. A new grant returns 201; an existing grant returns 200. Workspace API keys return `403`; use a personal API key or scoped OAuth token.\n\nOAuth scope: `api:write`.",
+        "description": "Grant or change an existing workspace member’s credential role. Requires credential administrator access and the integrations.manage capability. Revoked grants become active again; inherited administrators cannot be demoted. A new grant returns 201; an existing grant returns 200. Workspace API keys return `403`; use a personal API key or scoped OAuth token.\n\nOAuth scope: `api:write`.",
         "x-sim-operation": "credentials.members.upsert",
         "x-oauth-scope": "api:write",
         "tags": ["Credentials"],
@@ -8198,7 +8198,7 @@
       "delete": {
         "operationId": "removeCredentialMember",
         "summary": "Remove Credential Member",
-        "description": "Revoke an active explicit credential grant. Requires credential administrator access. Inherited workspace administrators cannot be removed; an absent or already-revoked grant returns 404. Workspace API keys return `403`; use a personal API key or scoped OAuth token.\n\nOAuth scope: `api:write`.",
+        "description": "Revoke an active explicit credential grant. Requires credential administrator access and the integrations.manage capability. Inherited workspace administrators cannot be removed; an absent or already-revoked grant returns 404. Workspace API keys return `403`; use a personal API key or scoped OAuth token.\n\nOAuth scope: `api:write`.",
         "x-sim-operation": "credentials.members.remove",
         "x-oauth-scope": "api:write",
         "tags": ["Credentials"],

apps/sim/lib/api/contracts/v2/openapi/credential-members.ts

@@ -18,7 +18,7 @@ export const credentialMemberOpenApiRoutes = [
       applicationOperation: credentialOperations.listMembers,
       operationId: 'listCredentialMembers',
       summary: 'List Credential Members',
-      description: `List explicit credential grants, including revoked grants, and inherited workspace administrator access. Requires workspace read access. Personal API keys and OAuth tokens can access OAuth or service-account credentials; sessions can also access workspace environment credentials. ${WORKSPACE_API_KEY_DENIED}`,
+      description: `List explicit credential grants, including revoked grants, and inherited workspace administrator access. Requires workspace read access and the integrations.manage capability. Personal API keys and OAuth tokens can access OAuth or service-account credentials; sessions can also access workspace environment credentials. ${WORKSPACE_API_KEY_DENIED}`,
       tags: ['Credentials'],
       errors: RESOURCE_ERRORS,
       success: { description: 'List Credential Members result.', headers: RATE_LIMIT_HEADERS },
@@ -34,7 +34,7 @@ export const credentialMemberOpenApiRoutes = [
         v2ListCredentialMembersContract.query,
         'ListCredentialMembersQuery',
         'Query parameters',
-        'Filters and pagination controls.'
+        'Workspace scope, sorting, and pagination controls.'
       ),
       response: documentedSchema(
         v2ListCredentialMembersContract.response.schema,
@@ -50,7 +50,7 @@ export const credentialMemberOpenApiRoutes = [
       applicationOperation: credentialOperations.upsertMember,
       operationId: 'upsertCredentialMember',
       summary: 'Upsert Credential Member',
-      description: `Grant or change an existing workspace member’s credential role. Requires credential administrator access. Revoked grants become active again; inherited administrators cannot be demoted. A new grant returns 201; an existing grant returns 200. ${WORKSPACE_API_KEY_DENIED}`,
+      description: `Grant or change an existing workspace member’s credential role. Requires credential administrator access and the integrations.manage capability. Revoked grants become active again; inherited administrators cannot be demoted. A new grant returns 201; an existing grant returns 200. ${WORKSPACE_API_KEY_DENIED}`,
       tags: ['Credentials'],
       errors: RESOURCE_ERRORS,
       success: { description: 'Upsert Credential Member result.', headers: RATE_LIMIT_HEADERS },
@@ -66,7 +66,7 @@ export const credentialMemberOpenApiRoutes = [
         v2UpsertCredentialMemberContract.query,
         'UpsertCredentialMemberQuery',
         'Query parameters',
-        'Filters and pagination controls.'
+        'Workspace containing the credential.'
       ),
       body: documentedSchema(
         v2UpsertCredentialMemberContract.body,
@@ -88,7 +88,7 @@ export const credentialMemberOpenApiRoutes = [
       applicationOperation: credentialOperations.removeMember,
       operationId: 'removeCredentialMember',
       summary: 'Remove Credential Member',
-      description: `Revoke an active explicit credential grant. Requires credential administrator access. Inherited workspace administrators cannot be removed; an absent or already-revoked grant returns 404. ${WORKSPACE_API_KEY_DENIED}`,
+      description: `Revoke an active explicit credential grant. Requires credential administrator access and the integrations.manage capability. Inherited workspace administrators cannot be removed; an absent or already-revoked grant returns 404. ${WORKSPACE_API_KEY_DENIED}`,
       tags: ['Credentials'],
       errors: RESOURCE_ERRORS,
       success: { description: 'Remove Credential Member result.', headers: RATE_LIMIT_HEADERS },
@@ -104,7 +104,7 @@ export const credentialMemberOpenApiRoutes = [
         v2RemoveCredentialMemberContract.query,
         'RemoveCredentialMemberQuery',
         'Query parameters',
-        'Filters and pagination controls.'
+        'Workspace containing the credential.'
       ),
       response: documentedSchema(
         v2RemoveCredentialMemberContract.response.schema,

apps/sim/lib/api/mcp/generated/v2-operations.ts

@@ -1726,7 +1726,7 @@ export const V2_MCP_OPERATIONS = {
     contract: v2ListCredentialMembersContract,
     summary: 'List Credential Members',
     description:
-      'List explicit credential grants, including revoked grants, and inherited workspace administrator access. Requires workspace read access. Personal API keys and OAuth tokens can access OAuth or service-account credentials; sessions can also access workspace environment credentials. Workspace API keys return `403`; use a personal API key or scoped OAuth token.\n\nOAuth scope: `api:read`.',
+      'List explicit credential grants, including revoked grants, and inherited workspace administrator access. Requires workspace read access and the integrations.manage capability. Personal API keys and OAuth tokens can access OAuth or service-account credentials; sessions can also access workspace environment credentials. Workspace API keys return `403`; use a personal API key or scoped OAuth token.\n\nOAuth scope: `api:read`.',
     workspaceKeyUnsupported: true,
     handler: () =>
       import('@/app/api/v2/credentials/[credentialId]/members/route').then((route) => route.GET),
@@ -2344,7 +2344,7 @@ export const V2_MCP_OPERATIONS = {
     contract: v2RemoveCredentialMemberContract,
     summary: 'Remove Credential Member',
     description:
-      'Revoke an active explicit credential grant. Requires credential administrator access. Inherited workspace administrators cannot be removed; an absent or already-revoked grant returns 404. Workspace API keys return `403`; use a personal API key or scoped OAuth token.\n\nOAuth scope: `api:write`.',
+      'Revoke an active explicit credential grant. Requires credential administrator access and the integrations.manage capability. Inherited workspace administrators cannot be removed; an absent or already-revoked grant returns 404. Workspace API keys return `403`; use a personal API key or scoped OAuth token.\n\nOAuth scope: `api:write`.',
     workspaceKeyUnsupported: true,
     handler: () =>
       import('@/app/api/v2/credentials/[credentialId]/members/[userId]/route').then(
@@ -2941,7 +2941,7 @@ export const V2_MCP_OPERATIONS = {
     contract: v2UpsertCredentialMemberContract,
     summary: 'Upsert Credential Member',
     description:
-      'Grant or change an existing workspace member’s credential role. Requires credential administrator access. Revoked grants become active again; inherited administrators cannot be demoted. A new grant returns 201; an existing grant returns 200. Workspace API keys return `403`; use a personal API key or scoped OAuth token.\n\nOAuth scope: `api:write`.',
+      'Grant or change an existing workspace member’s credential role. Requires credential administrator access and the integrations.manage capability. Revoked grants become active again; inherited administrators cannot be demoted. A new grant returns 201; an existing grant returns 200. Workspace API keys return `403`; use a personal API key or scoped OAuth token.\n\nOAuth scope: `api:write`.',
     workspaceKeyUnsupported: true,
     handler: () =>
       import('@/app/api/v2/credentials/[credentialId]/members/route').then((route) => route.POST),

apps/sim/lib/auth/sso/registration-input.ts

@@ -2,10 +2,10 @@ import { z } from 'zod'
 
 const ssoMappingSchema = z
   .object({
-    id: z.string().default('sub'),
-    email: z.string().default('email'),
-    name: z.string().default('name'),
-    image: z.string().default('picture'),
+    id: z.string().min(1).max(255).default('sub'),
+    email: z.string().min(1).max(255).default('email'),
+    name: z.string().min(1).max(255).default('name'),
+    image: z.string().min(1).max(255).default('picture'),
   })
   .default({
     id: 'sub',
@@ -16,7 +16,7 @@ const ssoMappingSchema = z
 
 export const ssoRegistrationInputSchema = z.discriminatedUnion('providerType', [
   z.object({
-    providerType: z.literal('oidc').default('oidc'),
+    providerType: z.literal('oidc'),
     providerId: z.string().min(1, 'Provider ID is required').max(255),
     issuer: z.string().url('Issuer must be a valid URL'),
     domain: z.string().min(1, 'Domain is required'),
@@ -33,7 +33,7 @@ export const ssoRegistrationInputSchema = z.discriminatedUnion('providerType', [
             .map((value) => value.trim())
             .filter((value) => value !== '')
         ),
-        z.array(z.string()),
+        z.array(z.string().trim().min(1)),
       ])
       .default(['openid', 'profile', 'email']),
     pkce: z.boolean().default(true),