Skip to content

Commit b198080

Browse files
TheodoreSpeaksTheodoreSpeaks
authored
feat(credential-groups): complete managed account enrollment (#6729)
* fix(credential-groups): show reconnect after authorization * feat(slack): include managed user auth in custom bots * feat(credential-groups): add enrollment completion page * fix(credential-groups): align settings order and block color * fix(credential-groups): delete credentials on access revoke * fix(credential-groups): use person icon for enrollments * fix(credential-groups): keep enrollment submit visible * fix(credential-groups): make enrollment connections optional * fix(credential-groups): simplify people actions * fix(credential-groups): preserve pagination after deletion * fix(credential-groups): delete removed enrollments * fix(credential-groups): hydrate canvas labels
1 parent 6006870 commit b198080

38 files changed

Lines changed: 658 additions & 358 deletions

File tree

‎apps/sim/app/api/credential-groups/enroll/[token]/complete/route.test.ts‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -49,29 +49,28 @@ describe('credential group enrollment completion route', () => {
4949
mocks.complete.mockResolvedValue({ completed: true })
5050
})
5151

52-
it('submits a fully connected enrollment through its invitation principal', async () => {
52+
it('submits optional account selections through its invitation principal', async () => {
5353
const enrollmentRequest = request()
5454
const response = await POST(enrollmentRequest, context)
5555

56-
expect(response.status).toBe(307)
57-
expect(response.headers.get('location')).toBe(
58-
'/credential-groups/enroll/invitation-token?submitted=1'
59-
)
56+
expect(response.status).toBe(303)
57+
expect(response.headers.get('location')).toBe('/credential-groups/complete')
6058
expect(response.headers.get('cache-control')).toBe('no-store')
59+
expect(response.headers.get('referrer-policy')).toBe('no-referrer')
6160
expect(mocks.complete).toHaveBeenCalledWith({
6261
principal,
6362
input: {},
6463
request: enrollmentRequest,
6564
})
6665
})
6766

68-
it('redirects an incomplete enrollment without marking it complete', async () => {
69-
mocks.complete.mockResolvedValue({ completed: false })
67+
it('returns to an unavailable enrollment when completion loses authorization', async () => {
68+
mocks.complete.mockResolvedValue({ completed: null })
7069

7170
const response = await POST(request(), context)
7271

7372
expect(response.headers.get('location')).toBe(
74-
'/credential-groups/enroll/invitation-token?oauth=incomplete'
73+
'/credential-groups/enroll/invitation-token?oauth=unavailable'
7574
)
7675
})
7776

‎apps/sim/app/api/credential-groups/enroll/[token]/complete/route.ts‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,10 @@ import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
66
import { authenticateCredentialGroupEnrollment } from '@/lib/credential-groups/application/enrollment-auth'
77
import { completePublicCredentialGroupEnrollment } from '@/lib/credential-groups/application/public-enrollment'
88
import { enforcePublicCredentialGroupIpRateLimit } from '@/lib/credential-groups/rate-limit'
9-
import { createCredentialGroupEnrollmentRedirect } from '@/app/api/credential-groups/enrollment-redirect'
9+
import {
10+
createCredentialGroupCompletionRedirect,
11+
createCredentialGroupEnrollmentRedirect,
12+
} from '@/app/api/credential-groups/enrollment-redirect'
1013

1114
export const dynamic = 'force-dynamic'
1215
export const runtime = 'nodejs'
@@ -36,9 +39,6 @@ export const POST = withRouteHandler(
3639
if (completed === null) {
3740
return createCredentialGroupEnrollmentRedirect(token, { oauth: 'unavailable' })
3841
}
39-
return createCredentialGroupEnrollmentRedirect(
40-
token,
41-
completed ? { submitted: '1' } : { oauth: 'incomplete' }
42-
)
42+
return createCredentialGroupCompletionRedirect()
4343
}
4444
)

‎apps/sim/app/api/credential-groups/enrollment-redirect.ts‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
import { NextResponse } from 'next/server'
22

3+
const NO_STORE_REDIRECT_HEADERS = {
4+
'Cache-Control': 'no-store',
5+
'Referrer-Policy': 'no-referrer',
6+
} as const
7+
38
export function createCredentialGroupEnrollmentRedirect(
49
token: string,
510
params: Record<string, string>
@@ -10,8 +15,17 @@ export function createCredentialGroupEnrollmentRedirect(
1015
status: 307,
1116
headers: {
1217
Location: location,
13-
'Cache-Control': 'no-store',
14-
'Referrer-Policy': 'no-referrer',
18+
...NO_STORE_REDIRECT_HEADERS,
19+
},
20+
})
21+
}
22+
23+
export function createCredentialGroupCompletionRedirect(): NextResponse {
24+
return new NextResponse(null, {
25+
status: 303,
26+
headers: {
27+
Location: '/credential-groups/complete',
28+
...NO_STORE_REDIRECT_HEADERS,
1529
},
1630
})
1731
}

‎apps/sim/app/api/workspaces/[id]/credential-groups/[groupId]/enrollments/[enrollmentId]/route.ts‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,27 @@
1-
import { revokeCredentialGroupEnrollmentContract } from '@/lib/api/contracts/credential-groups'
1+
import { deleteCredentialGroupEnrollmentContract } from '@/lib/api/contracts/credential-groups'
22
import {
33
defineInternalJsonRoute,
44
internalRateLimits,
55
internalSessionAuth,
66
} from '@/lib/api/server/routes'
7-
import { revokeCredentialGroupEnrollmentSettings } from '@/lib/credential-groups/application/manage-enrollments'
7+
import { deleteCredentialGroupEnrollmentSettings } from '@/lib/credential-groups/application/manage-enrollments'
88
import { credentialGroupOperations } from '@/lib/credential-groups/application/operations'
99
import { createCredentialGroupInternalErrorPolicy } from '@/app/api/workspaces/[id]/credential-groups/error-policy'
1010

1111
export const DELETE = defineInternalJsonRoute({
12-
contract: revokeCredentialGroupEnrollmentContract,
12+
contract: deleteCredentialGroupEnrollmentContract,
1313
auth: internalSessionAuth,
14-
operation: credentialGroupOperations.revokeEnrollment,
14+
operation: credentialGroupOperations.deleteEnrollment,
1515
rateLimit: internalRateLimits.none({
16-
reason: 'Preserve existing internal Credential Group revocation behavior',
16+
reason: 'Preserve existing internal Credential Group deletion behavior',
1717
}),
1818
errorPolicy: createCredentialGroupInternalErrorPolicy(
19-
'Failed to revoke credential group enrollment'
19+
'Failed to delete person from credential group'
2020
),
2121
mapInput: ({ params }) => ({
2222
assertedWorkspaceId: params.id,
2323
credentialGroupId: params.groupId,
2424
enrollmentId: params.enrollmentId,
2525
}),
26-
useCase: revokeCredentialGroupEnrollmentSettings,
26+
useCase: deleteCredentialGroupEnrollmentSettings,
2727
})

‎apps/sim/app/credential-groups/complete/page.tsx‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
import type { Metadata } from 'next'
2+
import { AuthHeader, AuthShell } from '@/app/(auth)/components'
3+
4+
export const metadata: Metadata = {
5+
title: 'Accounts connected',
6+
robots: { index: false, follow: false },
7+
}
8+
9+
export default function CredentialGroupCompletePage() {
10+
return (
11+
<AuthShell>
12+
<AuthHeader
13+
title='Accounts connected'
14+
description='Your accounts are ready to use — you can close this tab.'
15+
/>
16+
</AuthShell>
17+
)
18+
}

‎apps/sim/app/credential-groups/enroll/[token]/oauth-reconnect-link.test.tsx‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ vi.mock('@sim/emcn', () => ({
1212
import { OAuthConnectLink } from '@/app/credential-groups/enroll/[token]/oauth-reconnect-link'
1313

1414
describe('OAuthConnectLink', () => {
15-
it('presents enrollment authorization as Connect', () => {
15+
it('presents an unconnected authorization as Connect', () => {
1616
;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
1717
const container = document.createElement('div')
1818
const root = createRoot(container)
@@ -24,4 +24,17 @@ describe('OAuthConnectLink', () => {
2424
expect(link?.getAttribute('href')).toBe('/oauth/start')
2525
act(() => root.unmount())
2626
})
27+
28+
it('presents a connected authorization as Reconnect', () => {
29+
;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
30+
const container = document.createElement('div')
31+
const root = createRoot(container)
32+
33+
act(() => root.render(<OAuthConnectLink href='/oauth/start' reconnect />))
34+
35+
const link = container.querySelector('a')
36+
expect(link?.textContent).toBe('Reconnect')
37+
expect(link?.getAttribute('href')).toBe('/oauth/start')
38+
act(() => root.unmount())
39+
})
2740
})

‎apps/sim/app/credential-groups/enroll/[token]/oauth-reconnect-link.tsx‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,13 @@ import { chipVariants } from '@sim/emcn'
44

55
interface OAuthConnectLinkProps {
66
href: string
7+
reconnect?: boolean
78
}
89

9-
export function OAuthConnectLink({ href }: OAuthConnectLinkProps) {
10+
export function OAuthConnectLink({ href, reconnect = false }: OAuthConnectLinkProps) {
1011
return (
1112
<a href={href} className={chipVariants()}>
12-
Connect
13+
{reconnect ? 'Reconnect' : 'Connect'}
1314
</a>
1415
)
1516
}

‎apps/sim/app/credential-groups/enroll/[token]/page.tsx‎

Lines changed: 18 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,6 @@ const OAUTH_MESSAGES = {
6868
permissions_required: 'All requested permissions are required to connect this account.',
6969
configuration_changed: 'This credential option changed. Reload the page and try again.',
7070
rate_limited: 'Too many authorization attempts. Wait a few minutes and try again.',
71-
incomplete: 'Connect every account before submitting.',
7271
unavailable: 'Account authorization is temporarily unavailable. Please try again.',
7372
failed: 'Account authorization did not complete. Please try again.',
7473
} as const
@@ -109,7 +108,6 @@ export default async function CredentialGroupEnrollmentPage({
109108
const resolvedSearchParams = await searchParams
110109
const oauthStatus = getSearchParam(resolvedSearchParams, 'oauth')
111110
const connectedOptionId = getSearchParam(resolvedSearchParams, 'connected')
112-
const submitted = getSearchParam(resolvedSearchParams, 'submitted')
113111
const oauthMessage =
114112
oauthStatus && oauthStatus in OAUTH_MESSAGES
115113
? OAUTH_MESSAGES[oauthStatus as keyof typeof OAUTH_MESSAGES]
@@ -118,22 +116,14 @@ export default async function CredentialGroupEnrollmentPage({
118116
const connectedOption = connectedOptionId
119117
? activeOptions.find((option) => option.id === connectedOptionId)
120118
: undefined
121-
const notification = submitted
122-
? { message: 'Accounts submitted successfully.', variant: 'success' as const }
123-
: connectedOptionId
124-
? {
125-
message: `${connectedOption ? getCredentialGroupProviderService(connectedOption.provider).name : 'Account'} connected successfully.`,
126-
variant: 'success' as const,
127-
}
128-
: oauthMessage
129-
? { message: oauthMessage, variant: 'error' as const }
130-
: null
131-
const allConnected =
132-
activeOptions.length > 0 &&
133-
activeOptions.every(
134-
(option) => option.connections.length === 1 && option.connections[0]?.status === 'connected'
135-
)
136-
119+
const notification = connectedOptionId
120+
? {
121+
message: `${connectedOption ? getCredentialGroupProviderService(connectedOption.provider).name : 'Account'} connected successfully.`,
122+
variant: 'success' as const,
123+
}
124+
: oauthMessage
125+
? { message: oauthMessage, variant: 'error' as const }
126+
: null
137127
return (
138128
<PageShell>
139129
{notification && (
@@ -167,24 +157,23 @@ export default async function CredentialGroupEnrollmentPage({
167157
trailing={
168158
<OAuthConnectLink
169159
href={`/api/credential-groups/enroll/${token}/oauth/${option.id}`}
160+
reconnect={Boolean(connection)}
170161
/>
171162
}
172163
/>
173164
)
174165
})}
175166
</div>
176167
</SettingsSection>
177-
{(allConnected || enrollment.status === 'completed') && (
178-
<form
179-
action={`/api/credential-groups/enroll/${token}/complete`}
180-
method='post'
181-
className='mt-6 flex justify-end'
182-
>
183-
<Chip type='submit' variant='primary' disabled={enrollment.status === 'completed'}>
184-
{enrollment.status === 'completed' ? 'Submitted' : 'Submit'}
185-
</Chip>
186-
</form>
187-
)}
168+
<form
169+
action={`/api/credential-groups/enroll/${token}/complete`}
170+
method='post'
171+
className='mt-6 flex justify-end'
172+
>
173+
<Chip type='submit' variant='primary' disabled={enrollment.status === 'completed'}>
174+
{enrollment.status === 'completed' ? 'Submitted' : 'Submit'}
175+
</Chip>
176+
</form>
188177
</div>
189178
</PageShell>
190179
)

‎apps/sim/app/workspace/[workspaceId]/integrations/components/connect-slack-bot-modal/connect-slack-bot-modal.tsx‎

Lines changed: 21 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -23,19 +23,29 @@ import {
2323
useCreateWorkspaceCredential,
2424
useUpdateWorkspaceCredential,
2525
} from '@/hooks/queries/credentials'
26-
import { buildSlackManifest, SLACK_CAPABILITIES } from '@/triggers/slack/capabilities'
26+
import {
27+
buildSlackManifest,
28+
getSlackManagedUserAuthorizationManifestConfig,
29+
SLACK_CAPABILITIES,
30+
SLACK_MANAGED_USER_AUTHORIZATION_CAPABILITY,
31+
} from '@/triggers/slack/capabilities'
2732

2833
const logger = createLogger('ConnectSlackBotModal')
2934

3035
const DEFAULT_APP_NAME = 'Sim Bot'
3136
const DONE_STEP = 4
3237

3338
/** Every capability is granted by default; trimming is an opt-in dropdown. */
34-
const ALL_CAPABILITIES = new Set(SLACK_CAPABILITIES.map((c) => c.id))
39+
const CUSTOM_BOT_CAPABILITIES = [
40+
...SLACK_CAPABILITIES,
41+
SLACK_MANAGED_USER_AUTHORIZATION_CAPABILITY,
42+
] as const
43+
44+
const ALL_CAPABILITIES = new Set(CUSTOM_BOT_CAPABILITIES.map((capability) => capability.id))
3545

36-
const CAPABILITY_OPTIONS: ChipDropdownOption[] = SLACK_CAPABILITIES.map((c) => ({
37-
value: c.id,
38-
label: c.label,
46+
const CAPABILITY_OPTIONS: ChipDropdownOption[] = CUSTOM_BOT_CAPABILITIES.map((capability) => ({
47+
value: capability.id,
48+
label: capability.label,
3949
}))
4050

4151
interface ConnectSlackBotModalProps {
@@ -118,10 +128,14 @@ export function ConnectSlackBotModal({
118128
)
119129

120130
const manifestJson = useMemo(() => {
131+
const managedUserAuthorization = selected.has(SLACK_MANAGED_USER_AUTHORIZATION_CAPABILITY.id)
132+
? getSlackManagedUserAuthorizationManifestConfig(getBaseUrl())
133+
: undefined
121134
const manifest = buildSlackManifest(selected, {
122135
appName: appName.trim() || DEFAULT_APP_NAME,
123136
webhookUrl: requestUrl,
124137
description: appDescription,
138+
...(managedUserAuthorization ? { managedUserAuthorization } : {}),
125139
})
126140
return JSON.stringify(manifest, null, 2)
127141
}, [selected, appName, appDescription, requestUrl])
@@ -269,7 +283,7 @@ function StepConfigure({
269283
capabilityIds,
270284
onCapabilityIdsChange,
271285
}: StepConfigureProps) {
272-
const allSelected = capabilityIds.length === SLACK_CAPABILITIES.length
286+
const allSelected = capabilityIds.length === CUSTOM_BOT_CAPABILITIES.length
273287

274288
return (
275289
<div className='space-y-4'>
@@ -310,7 +324,7 @@ function StepConfigure({
310324
{allSelected && (
311325
<p className='text-[var(--text-muted)] text-caption'>
312326
Full access — the bot can read and send messages, react, upload files, and chat as an AI
313-
assistant.
327+
assistant, and people can authorize it through Credential Groups.
314328
</p>
315329
)}
316330
</div>

‎apps/sim/app/workspace/[workspaceId]/settings/navigation.test.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,14 +69,14 @@ describe('unified settings navigation', () => {
6969
expect(idsForSection('workspace')).toEqual([
7070
'teammates',
7171
'secrets',
72-
'credential-groups',
7372
'mcp',
7473
'custom-tools',
7574
'byok',
7675
'inbox',
7776
'workflow-mcp-servers',
7877
'apikeys',
7978
'sandboxes',
79+
'credential-groups',
8080
'recently-deleted',
8181
])
8282
expect(idsForSection('organization')).toEqual([

0 commit comments

Comments
 (0)