fix(credentials): clarify enrollment actions and entitlement errors

Author: TheodoreSpeaks

apps/sim/app/credential-groups/enroll/[token]/oauth-reconnect-link.test.tsx

@@ -0,0 +1,27 @@
+/**
+ * @vitest-environment jsdom
+ */
+import { act } from 'react'
+import { createRoot } from 'react-dom/client'
+import { describe, expect, it, vi } from 'vitest'
+
+vi.mock('@sim/emcn', () => ({
+  chipVariants: () => 'chip',
+}))
+
+import { OAuthConnectLink } from '@/app/credential-groups/enroll/[token]/oauth-reconnect-link'
+
+describe('OAuthConnectLink', () => {
+  it('presents enrollment authorization as Connect', () => {
+    ;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+    const container = document.createElement('div')
+    const root = createRoot(container)
+
+    act(() => root.render(<OAuthConnectLink href='/oauth/start' />))
+
+    const link = container.querySelector('a')
+    expect(link?.textContent).toBe('Connect')
+    expect(link?.getAttribute('href')).toBe('/oauth/start')
+    act(() => root.unmount())
+  })
+})

apps/sim/app/credential-groups/enroll/[token]/oauth-reconnect-link.tsx

@@ -2,14 +2,14 @@
 
 import { chipVariants } from '@sim/emcn'
 
-interface OAuthReconnectLinkProps {
+interface OAuthConnectLinkProps {
   href: string
 }
 
-export function OAuthReconnectLink({ href }: OAuthReconnectLinkProps) {
+export function OAuthConnectLink({ href }: OAuthConnectLinkProps) {
   return (
     <a href={href} className={chipVariants()}>
-      Reconnect
+      Connect
     </a>
   )
 }

apps/sim/app/credential-groups/enroll/[token]/page.tsx

@@ -9,7 +9,7 @@ import { getCredentialGroupProviderService } from '@/lib/credential-groups/provi
 import { enforcePublicCredentialGroupIpRateLimit } from '@/lib/credential-groups/rate-limit'
 import { SupportFooter } from '@/app/(auth)/components'
 import { LogoShell } from '@/app/(landing)/components'
-import { OAuthReconnectLink } from '@/app/credential-groups/enroll/[token]/oauth-reconnect-link'
+import { OAuthConnectLink } from '@/app/credential-groups/enroll/[token]/oauth-reconnect-link'
 import { CredentialGroupOAuthToast } from '@/app/credential-groups/enroll/[token]/oauth-toast'
 import {
   RESOURCE_LIST_STACK,
@@ -164,7 +164,7 @@ export default async function CredentialGroupEnrollmentPage({
                   title={option.label}
                   description={connection?.email ?? 'Not connected'}
                   trailing={
-                    <OAuthReconnectLink
+                    <OAuthConnectLink
                       href={`/api/credential-groups/enroll/${token}/oauth/${option.id}`}
                     />
                   }

apps/sim/lib/credential-groups/application/context.ts

@@ -1,14 +1,20 @@
 import { getWorkspaceOwnerSubscriptionAccess } from '@/lib/billing/core/workspace-access'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import type { CredentialGroupApplicationContext } from '@/lib/credential-groups/application/authorization'
-import { isCredentialGroupsAvailable } from '@/lib/credential-groups/availability'
+import {
+  isCredentialGroupsAvailable,
+  isCredentialGroupsEnterprisePlanRequired,
+} from '@/lib/credential-groups/availability'
 import { loadCredentialGroupCredentialListContext } from '@/lib/credential-groups/credentials'
 import { loadActiveWorkspaceApplicationContext } from '@/lib/workspaces/application/workspace-context'
 
 export async function requireCredentialGroupsAvailable(workspaceId: string): Promise<void> {
   const ownerBilling = await getWorkspaceOwnerSubscriptionAccess(workspaceId)
   if (!(await isCredentialGroupsAvailable(ownerBilling))) {
-    throw new OrchestrationError('forbidden', 'Credential Groups are not available')
+    const message = isCredentialGroupsEnterprisePlanRequired(ownerBilling)
+      ? 'Credential Groups are not available. Enterprise plan required.'
+      : 'Credential Groups are not available'
+    throw new OrchestrationError('forbidden', message)
   }
 }
 

apps/sim/lib/credential-groups/application/list-credentials.test.ts

@@ -7,6 +7,7 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 const mocks = vi.hoisted(() => ({
   getWorkspaceOwnerSubscriptionAccess: vi.fn(),
   isCredentialGroupsAvailable: vi.fn(),
+  isCredentialGroupsEnterprisePlanRequired: vi.fn(),
   listCredentials: vi.fn(),
   loadGroup: vi.fn(),
   loadWorkspace: vi.fn(),
@@ -19,6 +20,7 @@ vi.mock('@/lib/billing/core/workspace-access', () => ({
 
 vi.mock('@/lib/credential-groups/availability', () => ({
   isCredentialGroupsAvailable: mocks.isCredentialGroupsAvailable,
+  isCredentialGroupsEnterprisePlanRequired: mocks.isCredentialGroupsEnterprisePlanRequired,
 }))
 
 vi.mock('@/lib/credential-groups/credentials', () => ({
@@ -105,6 +107,7 @@ describe('listCredentialGroupCredentials', () => {
     mocks.resolvePermission.mockResolvedValue('read')
     mocks.getWorkspaceOwnerSubscriptionAccess.mockResolvedValue({ isEnterprise: true })
     mocks.isCredentialGroupsAvailable.mockResolvedValue(true)
+    mocks.isCredentialGroupsEnterprisePlanRequired.mockReturnValue(false)
     mocks.listCredentials.mockResolvedValue({
       credentials: [
         {
@@ -230,6 +233,20 @@ describe('listCredentialGroupCredentials', () => {
     expect(mocks.listCredentials).not.toHaveBeenCalled()
   })
 
+  it('identifies the Enterprise requirement for unavailable hosted workspaces', async () => {
+    mocks.getWorkspaceOwnerSubscriptionAccess.mockResolvedValue({ isEnterprise: false })
+    mocks.isCredentialGroupsAvailable.mockResolvedValue(false)
+    mocks.isCredentialGroupsEnterprisePlanRequired.mockReturnValue(true)
+
+    await expect(
+      listCredentialGroupCredentials.execute({ principal: executorPrincipal(), input })
+    ).rejects.toMatchObject({
+      code: 'forbidden',
+      message: 'Credential Groups are not available. Enterprise plan required.',
+    })
+    expect(mocks.listCredentials).not.toHaveBeenCalled()
+  })
+
   it('rejects limits outside the bounded page size', async () => {
     await expect(
       listCredentialGroupCredentials.execute({

apps/sim/lib/credential-groups/availability.ts

@@ -1,10 +1,16 @@
 import { isHosted } from '@/lib/core/config/env-flags'
 import { isFeatureEnabled } from '@/lib/core/config/feature-flags'
 
+export function isCredentialGroupsEnterprisePlanRequired(ownerBilling: {
+  isEnterprise: boolean
+}): boolean {
+  return isHosted && !ownerBilling.isEnterprise
+}
+
 /** Credential Groups are globally gated and restricted to Enterprise workspaces on Sim Cloud. */
 export async function isCredentialGroupsAvailable(ownerBilling: {
   isEnterprise: boolean
 }): Promise<boolean> {
   if (!(await isFeatureEnabled('credential-groups'))) return false
-  return !isHosted || ownerBilling.isEnterprise
+  return !isCredentialGroupsEnterprisePlanRequired(ownerBilling)
 }