fix(credential-groups): delete removed enrollments

Author: TheodoreSpeaks

apps/sim/app/api/workspaces/[id]/credential-groups/[groupId]/enrollments/[enrollmentId]/route.ts

@@ -1,19 +1,19 @@
-import { revokeCredentialGroupEnrollmentContract } from '@/lib/api/contracts/credential-groups'
+import { deleteCredentialGroupEnrollmentContract } from '@/lib/api/contracts/credential-groups'
 import {
   defineInternalJsonRoute,
   internalRateLimits,
   internalSessionAuth,
 } from '@/lib/api/server/routes'
-import { revokeCredentialGroupEnrollmentSettings } from '@/lib/credential-groups/application/manage-enrollments'
+import { deleteCredentialGroupEnrollmentSettings } from '@/lib/credential-groups/application/manage-enrollments'
 import { credentialGroupOperations } from '@/lib/credential-groups/application/operations'
 import { createCredentialGroupInternalErrorPolicy } from '@/app/api/workspaces/[id]/credential-groups/error-policy'
 
 export const DELETE = defineInternalJsonRoute({
-  contract: revokeCredentialGroupEnrollmentContract,
+  contract: deleteCredentialGroupEnrollmentContract,
   auth: internalSessionAuth,
-  operation: credentialGroupOperations.revokeEnrollment,
+  operation: credentialGroupOperations.deleteEnrollment,
   rateLimit: internalRateLimits.none({
-    reason: 'Preserve existing internal Credential Group revocation behavior',
+    reason: 'Preserve existing internal Credential Group deletion behavior',
   }),
   errorPolicy: createCredentialGroupInternalErrorPolicy(
     'Failed to delete person from credential group'
@@ -23,5 +23,5 @@ export const DELETE = defineInternalJsonRoute({
     credentialGroupId: params.groupId,
     enrollmentId: params.enrollmentId,
   }),
-  useCase: revokeCredentialGroupEnrollmentSettings,
+  useCase: deleteCredentialGroupEnrollmentSettings,
 })

apps/sim/ee/credential-groups/components/credential-group-detail.tsx

@@ -33,8 +33,8 @@ import { CredentialGroupInviteModal } from '@/ee/credential-groups/components/cr
 import {
   useCredentialGroupDetail,
   useDeleteCredentialGroup,
+  useDeleteCredentialGroupEnrollment,
   useResendCredentialGroupEnrollment,
-  useRevokeCredentialGroupEnrollment,
   useUpdateCredentialGroup,
 } from '@/hooks/queries/credential-groups'
 import { useWorkspaceCredentials } from '@/hooks/queries/credentials'
@@ -94,7 +94,7 @@ export function CredentialGroupDetail({
     providerId: SLACK_CUSTOM_BOT_PROVIDER_ID,
   })
   const resend = useResendCredentialGroupEnrollment()
-  const deleteEnrollment = useRevokeCredentialGroupEnrollment()
+  const deleteEnrollment = useDeleteCredentialGroupEnrollment()
   const updateGroup = useUpdateCredentialGroup()
   const deleteGroup = useDeleteCredentialGroup()
   const [activeTab, setActiveTab] = useQueryState(credentialGroupTabParam.key, {

apps/sim/hooks/queries/credential-groups.ts

@@ -6,10 +6,10 @@ import type { ContractBodyInput } from '@/lib/api/contracts'
 import {
   createCredentialGroupContract,
   deleteCredentialGroupContract,
+  deleteCredentialGroupEnrollmentContract,
   getCredentialGroupContract,
   inviteCredentialGroupEnrollmentsContract,
   resendCredentialGroupEnrollmentContract,
-  revokeCredentialGroupEnrollmentContract,
   startSlackCredentialGroupConfigurationContract,
   updateCredentialGroupContract,
 } from '@/lib/api/contracts/credential-groups'
@@ -184,7 +184,7 @@ export function useResendCredentialGroupEnrollment() {
   })
 }
 
-export function useRevokeCredentialGroupEnrollment() {
+export function useDeleteCredentialGroupEnrollment() {
   const queryClient = useQueryClient()
   return useMutation({
     mutationFn: async ({
@@ -196,7 +196,7 @@ export function useRevokeCredentialGroupEnrollment() {
       groupId: string
       enrollmentId: string
     }) =>
-      requestJson(revokeCredentialGroupEnrollmentContract, {
+      requestJson(deleteCredentialGroupEnrollmentContract, {
         params: { id: workspaceId, groupId, enrollmentId },
       }),
     onSettled: (_data, _error, variables) => {

apps/sim/lib/api/contracts/credential-groups.ts

@@ -351,7 +351,7 @@ export const resendCredentialGroupEnrollmentContract = defineRouteContract({
   },
 })
 
-export const revokeCredentialGroupEnrollmentContract = defineRouteContract({
+export const deleteCredentialGroupEnrollmentContract = defineRouteContract({
   method: 'DELETE',
   path: '/api/workspaces/[id]/credential-groups/[groupId]/enrollments/[enrollmentId]',
   params: credentialGroupEnrollmentParamsSchema,

apps/sim/lib/credential-groups/application/list-people.ts

@@ -69,7 +69,11 @@ export const listCredentialGroupPeople = defineAuthorizedWorkspaceUseCase({
     } catch (error) {
       if (error instanceof CredentialGroupEnrollmentError) {
         throw new OrchestrationError(
-          error.status === 404 ? 'validation' : error.status === 409 ? 'conflict' : 'internal',
+          error.status === 400 || error.status === 404
+            ? 'validation'
+            : error.status === 409
+              ? 'conflict'
+              : 'internal',
           error.message
         )
       }

apps/sim/lib/credential-groups/application/manage-enrollments.test.ts

@@ -21,15 +21,15 @@ vi.mock('@/lib/credential-groups/enrollments', () => ({
   CredentialGroupEnrollmentError: class CredentialGroupEnrollmentError extends Error {
     constructor(
       message: string,
-      readonly status: 404 | 409 | 502
+      readonly status: 400 | 404 | 409 | 502
     ) {
       super(message)
     }
   },
+  deleteCredentialGroupEnrollment: vi.fn(),
   inviteCredentialGroupEnrollments: mocks.invite,
   loadCredentialGroupInviterIdentity: mocks.loadInviter,
   resendCredentialGroupEnrollment: vi.fn(),
-  revokeCredentialGroupEnrollment: vi.fn(),
 }))
 
 vi.mock('@sim/platform-authz/workspace', () => ({

apps/sim/lib/credential-groups/application/manage-enrollments.ts

@@ -9,10 +9,10 @@ import { credentialGroupOperations } from '@/lib/credential-groups/application/o
 import { validateCredentialGroupInvitationEmails } from '@/lib/credential-groups/application/validation'
 import {
   CredentialGroupEnrollmentError,
+  deleteCredentialGroupEnrollment,
   inviteCredentialGroupEnrollments,
   loadCredentialGroupInviterIdentity,
   resendCredentialGroupEnrollment,
-  revokeCredentialGroupEnrollment,
 } from '@/lib/credential-groups/enrollments'
 
 interface CredentialGroupEnrollmentSettingsInput {
@@ -109,20 +109,20 @@ export const resendCredentialGroupEnrollmentSettings = defineAuthorizedWorkspace
   }),
 })
 
-export interface RevokeCredentialGroupEnrollmentSettingsInput
+export interface DeleteCredentialGroupEnrollmentSettingsInput
   extends CredentialGroupEnrollmentSettingsInput {
   enrollmentId: string
 }
 
-export const revokeCredentialGroupEnrollmentSettings = defineAuthorizedWorkspaceUseCase({
-  operation: credentialGroupOperations.revokeEnrollment,
-  resolveContext: ({ input }: { input: RevokeCredentialGroupEnrollmentSettingsInput }) =>
+export const deleteCredentialGroupEnrollmentSettings = defineAuthorizedWorkspaceUseCase({
+  operation: credentialGroupOperations.deleteEnrollment,
+  resolveContext: ({ input }: { input: DeleteCredentialGroupEnrollmentSettingsInput }) =>
     resolveCredentialGroupSettingsContext(input.credentialGroupId, input.assertedWorkspaceId),
   authorizationOptions: {},
   async execute({ input, context }) {
     await requireCredentialGroupSettingsAvailable(context.workspaceId)
     try {
-      const credentialGroupEnrollment = await revokeCredentialGroupEnrollment(
+      const credentialGroupEnrollment = await deleteCredentialGroupEnrollment(
         context.workspaceId,
         context.credentialGroupId,
         input.enrollmentId
@@ -137,7 +137,7 @@ export const revokeCredentialGroupEnrollmentSettings = defineAuthorizedWorkspace
     resourceType: AuditResourceType.CREDENTIAL_GROUP,
     resourceId: context.credentialGroupId,
     resourceName: context.name,
-    description: `Revoked Credential Group access for ${result.credentialGroupEnrollment.email}`,
+    description: `Deleted ${result.credentialGroupEnrollment.email} from the Credential Group`,
     metadata: { enrollmentId: result.credentialGroupEnrollment.id },
   }),
 })

apps/sim/lib/credential-groups/application/operations.ts

@@ -43,8 +43,8 @@ export const credentialGroupOperations = {
     workspaceApiKey: 'deny',
     principalKinds: ['session'],
   }),
-  revokeEnrollment: defineWorkspaceOperation({
-    id: 'credential_groups.enrollments.revoke',
+  deleteEnrollment: defineWorkspaceOperation({
+    id: 'credential_groups.enrollments.delete',
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     principalKinds: ['session'],

apps/sim/lib/credential-groups/enrollments.test.ts

@@ -32,9 +32,9 @@ vi.mock('@/lib/credential-groups/provider-registry', () => ({
 
 import {
   completeCredentialGroupEnrollment,
+  deleteCredentialGroupEnrollment,
   listCredentialGroupEnrollments,
   resendCredentialGroupEnrollment,
-  revokeCredentialGroupEnrollment,
 } from '@/lib/credential-groups/enrollments'
 import { CREDENTIAL_GROUP_PROVIDER_IDS } from '@/lib/credential-groups/providers'
 import { sendEmail } from '@/lib/messaging/email/mailer'
@@ -143,29 +143,43 @@ describe('listCredentialGroupEnrollments', () => {
     }
     dbChainMockFns.limit
       .mockResolvedValueOnce([{ options: [] }])
-      .mockResolvedValueOnce([
-        { id: ENROLLMENT.id, invitedAt: new Date('2026-08-11T12:00:00.000Z') },
-      ])
+      .mockResolvedValueOnce([{ enrollment: ENROLLMENT }, { enrollment: remainingEnrollment }])
+      .mockResolvedValueOnce([{ options: [] }])
       .mockResolvedValueOnce([{ enrollment: remainingEnrollment }])
 
+    const firstPage = await listCredentialGroupEnrollments('workspace-1', 'group-1', 1, undefined, {
+      statuses: ['invited', 'in_progress', 'completed', 'delivery_failed'],
+    })
+    if (!firstPage.nextCursor) throw new Error('Expected a next enrollment cursor')
     const result = await listCredentialGroupEnrollments(
       'workspace-1',
       'group-1',
       50,
-      ENROLLMENT.id,
+      firstPage.nextCursor,
       { statuses: ['invited', 'in_progress', 'completed', 'delivery_failed'] }
     )
 
+    expect(firstPage.nextCursor).toEqual(expect.any(String))
     expect(result.enrollments).toHaveLength(1)
     expect(result.enrollments[0]?.id).toBe(remainingEnrollment.id)
-    expect(inArray).toHaveBeenCalledOnce()
+    expect(dbChainMockFns.limit).toHaveBeenCalledTimes(4)
     expect(inArray).toHaveBeenCalledWith(schemaMock.credentialGroupEnrollment.status, [
       'invited',
       'in_progress',
       'completed',
       'delivery_failed',
     ])
   })
+
+  it('rejects a malformed enrollment cursor', async () => {
+    dbChainMockFns.limit.mockResolvedValueOnce([{ options: [] }])
+
+    await expect(
+      listCredentialGroupEnrollments('workspace-1', 'group-1', 50, 'not-a-cursor')
+    ).rejects.toMatchObject({ message: 'Enrollment cursor is invalid', status: 400 })
+
+    expect(dbChainMockFns.limit).toHaveBeenCalledOnce()
+  })
 })
 
 describe('resendCredentialGroupEnrollment', () => {
@@ -236,25 +250,22 @@ describe('resendCredentialGroupEnrollment', () => {
   })
 })
 
-describe('revokeCredentialGroupEnrollment', () => {
+describe('deleteCredentialGroupEnrollment', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     resetDbChainMock()
   })
 
-  it('deletes every managed credential collected under the revoked enrollment', async () => {
+  it('deletes the enrollment and lets its foreign-key cascade remove managed credentials', async () => {
     dbChainMockFns.limit.mockResolvedValueOnce([{ email: ENROLLMENT.email }])
-    dbChainMockFns.returning.mockResolvedValueOnce([
-      { ...ENROLLMENT, status: 'revoked', revokedAt: new Date() },
-    ])
+    dbChainMockFns.returning.mockResolvedValueOnce([ENROLLMENT])
 
-    const result = await revokeCredentialGroupEnrollment('workspace-1', 'group-1', ENROLLMENT.id)
+    const result = await deleteCredentialGroupEnrollment('workspace-1', 'group-1', ENROLLMENT.id)
 
-    expect(result.status).toBe('revoked')
-    expect(dbChainMockFns.update).toHaveBeenCalledOnce()
-    expect(dbChainMockFns.update).toHaveBeenCalledWith(schemaMock.credentialGroupEnrollment)
+    expect(result.id).toBe(ENROLLMENT.id)
+    expect(dbChainMockFns.update).not.toHaveBeenCalled()
     expect(dbChainMockFns.delete).toHaveBeenCalledOnce()
-    expect(dbChainMockFns.delete).toHaveBeenCalledWith(schemaMock.credential)
+    expect(dbChainMockFns.delete).toHaveBeenCalledWith(schemaMock.credentialGroupEnrollment)
   })
 })