fix(credentials): preserve entitlement failure reasons

Author: TheodoreSpeaks

apps/sim/lib/credential-groups/application/context.ts

@@ -3,17 +3,19 @@ import { OrchestrationError } from '@/lib/core/orchestration/types'
 import type { CredentialGroupApplicationContext } from '@/lib/credential-groups/application/authorization'
 import {
   isCredentialGroupsAvailable,
-  isCredentialGroupsEnterprisePlanRequired,
+  resolveCredentialGroupsAvailability,
 } from '@/lib/credential-groups/availability'
 import { loadCredentialGroupCredentialListContext } from '@/lib/credential-groups/credentials'
 import { loadActiveWorkspaceApplicationContext } from '@/lib/workspaces/application/workspace-context'
 
 export async function requireCredentialGroupsAvailable(workspaceId: string): Promise<void> {
   const ownerBilling = await getWorkspaceOwnerSubscriptionAccess(workspaceId)
-  if (!(await isCredentialGroupsAvailable(ownerBilling))) {
-    const message = isCredentialGroupsEnterprisePlanRequired(ownerBilling)
-      ? 'Credential Groups are not available. Enterprise plan required.'
-      : 'Credential Groups are not available'
+  const availability = await resolveCredentialGroupsAvailability(ownerBilling)
+  if (!availability.available) {
+    const message =
+      availability.reason === 'enterprise_plan_required'
+        ? 'Credential Groups are not available. Enterprise plan required.'
+        : 'Credential Groups are not available'
     throw new OrchestrationError('forbidden', message)
   }
 }

apps/sim/lib/credential-groups/application/list-credentials.test.ts

@@ -6,11 +6,10 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const mocks = vi.hoisted(() => ({
   getWorkspaceOwnerSubscriptionAccess: vi.fn(),
-  isCredentialGroupsAvailable: vi.fn(),
-  isCredentialGroupsEnterprisePlanRequired: vi.fn(),
   listCredentials: vi.fn(),
   loadGroup: vi.fn(),
   loadWorkspace: vi.fn(),
+  resolveCredentialGroupsAvailability: vi.fn(),
   resolvePermission: vi.fn(),
 }))
 
@@ -19,8 +18,7 @@ vi.mock('@/lib/billing/core/workspace-access', () => ({
 }))
 
 vi.mock('@/lib/credential-groups/availability', () => ({
-  isCredentialGroupsAvailable: mocks.isCredentialGroupsAvailable,
-  isCredentialGroupsEnterprisePlanRequired: mocks.isCredentialGroupsEnterprisePlanRequired,
+  resolveCredentialGroupsAvailability: mocks.resolveCredentialGroupsAvailability,
 }))
 
 vi.mock('@/lib/credential-groups/credentials', () => ({
@@ -106,8 +104,7 @@ describe('listCredentialGroupCredentials', () => {
     mocks.loadWorkspace.mockResolvedValue(workspaceContext)
     mocks.resolvePermission.mockResolvedValue('read')
     mocks.getWorkspaceOwnerSubscriptionAccess.mockResolvedValue({ isEnterprise: true })
-    mocks.isCredentialGroupsAvailable.mockResolvedValue(true)
-    mocks.isCredentialGroupsEnterprisePlanRequired.mockReturnValue(false)
+    mocks.resolveCredentialGroupsAvailability.mockResolvedValue({ available: true })
     mocks.listCredentials.mockResolvedValue({
       credentials: [
         {
@@ -225,18 +222,26 @@ describe('listCredentialGroupCredentials', () => {
   })
 
   it('fails before listing when Credential Groups are unavailable', async () => {
-    mocks.isCredentialGroupsAvailable.mockResolvedValue(false)
+    mocks.resolveCredentialGroupsAvailability.mockResolvedValue({
+      available: false,
+      reason: 'feature_disabled',
+    })
 
     await expect(
       listCredentialGroupCredentials.execute({ principal: executorPrincipal(), input })
-    ).rejects.toMatchObject({ code: 'forbidden' })
+    ).rejects.toMatchObject({
+      code: 'forbidden',
+      message: 'Credential Groups are not available',
+    })
     expect(mocks.listCredentials).not.toHaveBeenCalled()
   })
 
   it('identifies the Enterprise requirement for unavailable hosted workspaces', async () => {
     mocks.getWorkspaceOwnerSubscriptionAccess.mockResolvedValue({ isEnterprise: false })
-    mocks.isCredentialGroupsAvailable.mockResolvedValue(false)
-    mocks.isCredentialGroupsEnterprisePlanRequired.mockReturnValue(true)
+    mocks.resolveCredentialGroupsAvailability.mockResolvedValue({
+      available: false,
+      reason: 'enterprise_plan_required',
+    })
 
     await expect(
       listCredentialGroupCredentials.execute({ principal: executorPrincipal(), input })

apps/sim/lib/credential-groups/availability.test.ts

@@ -0,0 +1,50 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockIsFeatureEnabled } = vi.hoisted(() => ({
+  mockIsFeatureEnabled: vi.fn(),
+}))
+
+vi.mock('@/lib/core/config/env-flags', () => ({
+  isHosted: true,
+}))
+
+vi.mock('@/lib/core/config/feature-flags', () => ({
+  isFeatureEnabled: mockIsFeatureEnabled,
+}))
+
+import { resolveCredentialGroupsAvailability } from '@/lib/credential-groups/availability'
+
+describe('resolveCredentialGroupsAvailability', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('attributes a disabled feature flag before considering the plan', async () => {
+    mockIsFeatureEnabled.mockResolvedValue(false)
+
+    await expect(resolveCredentialGroupsAvailability({ isEnterprise: false })).resolves.toEqual({
+      available: false,
+      reason: 'feature_disabled',
+    })
+  })
+
+  it('requires Enterprise when the hosted feature is enabled', async () => {
+    mockIsFeatureEnabled.mockResolvedValue(true)
+
+    await expect(resolveCredentialGroupsAvailability({ isEnterprise: false })).resolves.toEqual({
+      available: false,
+      reason: 'enterprise_plan_required',
+    })
+  })
+
+  it('allows Enterprise workspaces when the hosted feature is enabled', async () => {
+    mockIsFeatureEnabled.mockResolvedValue(true)
+
+    await expect(resolveCredentialGroupsAvailability({ isEnterprise: true })).resolves.toEqual({
+      available: true,
+    })
+  })
+})

apps/sim/lib/credential-groups/availability.ts

@@ -1,16 +1,25 @@
 import { isHosted } from '@/lib/core/config/env-flags'
 import { isFeatureEnabled } from '@/lib/core/config/feature-flags'
 
-export function isCredentialGroupsEnterprisePlanRequired(ownerBilling: {
+export type CredentialGroupsAvailability =
+  | { available: true }
+  | { available: false; reason: 'feature_disabled' | 'enterprise_plan_required' }
+
+export async function resolveCredentialGroupsAvailability(ownerBilling: {
   isEnterprise: boolean
-}): boolean {
-  return isHosted && !ownerBilling.isEnterprise
+}): Promise<CredentialGroupsAvailability> {
+  if (!(await isFeatureEnabled('credential-groups'))) {
+    return { available: false, reason: 'feature_disabled' }
+  }
+  if (isHosted && !ownerBilling.isEnterprise) {
+    return { available: false, reason: 'enterprise_plan_required' }
+  }
+  return { available: true }
 }
 
 /** Credential Groups are globally gated and restricted to Enterprise workspaces on Sim Cloud. */
 export async function isCredentialGroupsAvailable(ownerBilling: {
   isEnterprise: boolean
 }): Promise<boolean> {
-  if (!(await isFeatureEnabled('credential-groups'))) return false
-  return !isCredentialGroupsEnterprisePlanRequired(ownerBilling)
+  return (await resolveCredentialGroupsAvailability(ownerBilling)).available
 }