fix(settings): protect generated keys and identity transitions (#8761)

* fix(settings): protect generated keys and identity transitions

* fix(settings): keep identity transitions guarded until redirect

Author: waleedlatif1

apps/sim/app/workspace/[workspaceId]/settings/components/admin/admin.tsx

@@ -91,13 +91,15 @@ export function Admin() {
 
   const [workflowId, setWorkflowId] = useState('')
   const [targetWorkspaceId, setTargetWorkspaceId] = useState('')
+  const [impersonatingUserId, setImpersonatingUserId] = useState<string | null>(null)
+  const isImpersonating = impersonatingUserId !== null || impersonateUser.isPending
   const discardImport = () => {
     setWorkflowId('')
     setTargetWorkspaceId('')
   }
   const importGuard = useSettingsUnsavedGuard({
     isDirty: Boolean(workflowId.trim() || targetWorkspaceId.trim()),
-    navigationBlocked: importWorkflow.isPending,
+    navigationBlocked: importWorkflow.isPending || isImpersonating,
     onDiscard: discardImport,
   })
 
@@ -109,7 +111,6 @@ export function Admin() {
   const [searchInput, setSearchInput] = useState(searchQuery)
   const [pendingAction, setPendingAction] = useState<PendingUserAction | null>(null)
   const [banReason, setBanReason] = useState('')
-  const [impersonatingUserId, setImpersonatingUserId] = useState<string | null>(null)
   const [impersonationGuardError, setImpersonationGuardError] = useState<string | null>(null)
   const [isAddUserOpen, setIsAddUserOpen] = useState(false)
   const [provisionWarning, setProvisionWarning] = useState<string | null>(null)
@@ -151,6 +152,7 @@ export function Admin() {
   }
 
   const handleImpersonate = (userId: string, email: string) => {
+    if (isImpersonating || importWorkflow.isPending) return
     setImpersonationGuardError(null)
     if (session?.user?.role !== 'admin') {
       setImpersonatingUserId(null)
@@ -180,7 +182,7 @@ export function Admin() {
   const handleImport = () => {
     const sourceId = workflowId.trim()
     const targetId = targetWorkspaceId.trim()
-    if (!sourceId || !targetId || importWorkflow.isPending || impersonateUser.isPending) return
+    if (!sourceId || !targetId || importWorkflow.isPending || isImpersonating) return
     importWorkflow.mutate(
       { workflowId: sourceId, targetWorkspaceId: targetId },
       {
@@ -244,7 +246,7 @@ export function Admin() {
             <Chip
               aria-label={`Impersonate ${u.email}`}
               onClick={() => handleImpersonate(u.id, u.email)}
-              disabled={importWorkflow.isPending || pendingUserIds.has(u.id)}
+              disabled={importWorkflow.isPending || isImpersonating || pendingUserIds.has(u.id)}
             >
               {impersonatingUserId === u.id ? 'Switching...' : 'Impersonate'}
             </Chip>
@@ -359,7 +361,7 @@ export function Admin() {
               importWorkflow.reset()
             }}
             placeholder='Source workflow ID'
-            disabled={importWorkflow.isPending || impersonateUser.isPending}
+            disabled={importWorkflow.isPending || isImpersonating}
           />
           <ChipInput
             value={targetWorkspaceId}
@@ -368,14 +370,14 @@ export function Admin() {
               importWorkflow.reset()
             }}
             placeholder='Target workspace ID'
-            disabled={importWorkflow.isPending || impersonateUser.isPending}
+            disabled={importWorkflow.isPending || isImpersonating}
           />
           <Button
             variant='primary'
             onClick={handleImport}
             disabled={
               importWorkflow.isPending ||
-              impersonateUser.isPending ||
+              isImpersonating ||
               !workflowId.trim() ||
               !targetWorkspaceId.trim()
             }

apps/sim/app/workspace/[workspaceId]/settings/components/mothership/mothership.tsx

@@ -1,9 +1,10 @@
 'use client'
 
-import { useCallback, useMemo, useState } from 'react'
+import { useMemo, useState } from 'react'
 import {
   Badge,
   Button,
+  Chip,
   ChipCopyInput,
   ChipInput,
   ChipModalTabs,
@@ -361,19 +362,23 @@ function LicensesTab({ environment }: { environment: MothershipEnv }) {
   const [newExpiry, setNewExpiry] = useState('')
   const [approvalReference, setApprovalReference] = useState('')
   const [generatedKey, setGeneratedKey] = useState<string | null>(null)
-  const discardDraft = useCallback(() => {
+  const resetForm = () => {
     setNewName('')
     setNewExpiry('')
     setApprovalReference('')
-  }, [])
+  }
   useSettingsUnsavedGuard({
-    isDirty: Boolean(newName.trim() || newExpiry || approvalReference.trim()),
+    isDirty: Boolean(newName.trim() || newExpiry || approvalReference.trim() || generatedKey),
     navigationBlocked: generateLicense.isPending,
-    onDiscard: discardDraft,
+    onDiscard: () => {
+      resetForm()
+      setGeneratedKey(null)
+    },
   })
 
-  const handleGenerate = useCallback(() => {
-    if (!newName.trim() || !approvalReference.trim() || generateLicense.isPending) return
+  const handleGenerate = () => {
+    if (!newName.trim() || !approvalReference.trim() || generateLicense.isPending || generatedKey)
+      return
     generateLicense.mutate(
       {
         name: newName.trim(),
@@ -383,18 +388,11 @@ function LicensesTab({ environment }: { environment: MothershipEnv }) {
       {
         onSuccess: (result) => {
           setGeneratedKey(result.license_key)
-          discardDraft()
+          resetForm()
         },
       }
     )
-  }, [
-    newName,
-    newExpiry,
-    approvalReference,
-    generateLicense.mutate,
-    generateLicense.isPending,
-    discardDraft,
-  ])
+  }
 
   return (
     <div className='flex flex-col gap-5'>
@@ -405,10 +403,7 @@ function LicensesTab({ environment }: { environment: MothershipEnv }) {
           <ChipInput
             disabled={generateLicense.isPending}
             value={newName}
-            onChange={(e) => {
-              setNewName(e.target.value)
-              setGeneratedKey(null)
-            }}
+            onChange={(e) => setNewName(e.target.value)}
             placeholder='e.g. Acme Corp'
             className='w-[200px]'
           />
@@ -437,7 +432,12 @@ function LicensesTab({ environment }: { environment: MothershipEnv }) {
           variant='primary'
           className='h-[32px]'
           onClick={handleGenerate}
-          disabled={generateLicense.isPending || !newName.trim() || !approvalReference.trim()}
+          disabled={
+            generateLicense.isPending ||
+            Boolean(generatedKey) ||
+            !newName.trim() ||
+            !approvalReference.trim()
+          }
         >
           {generateLicense.isPending ? 'Generating...' : 'Generate'}
         </Button>
@@ -448,7 +448,10 @@ function LicensesTab({ environment }: { environment: MothershipEnv }) {
           <p className='text-[var(--text-secondary)] text-caption'>
             License key (only shown once):
           </p>
-          <ChipCopyInput value={generatedKey} copyLabel='Copy license key' />
+          <div className='flex items-center gap-2'>
+            <ChipCopyInput value={generatedKey} copyLabel='Copy license key' className='flex-1' />
+            <Chip onClick={() => setGeneratedKey(null)}>Done</Chip>
+          </div>
         </div>
       )}