fix(credentials): prove a Chat managed-credential use only from a real tool call, and list or mint only live group bindings

Author: waleedlatif1

apps/sim/executor/utils/credential-token.test.ts

@@ -128,16 +128,22 @@ describe('resolveExecutorCredentialToken', () => {
   })
 
   it('leaves managed credentials unproven for a context that is not a trusted Chat call', async () => {
-    await resolveExecutorCredentialToken({
-      requestId: 'req-1',
-      credentialId: 'cred-1',
-      userId: 'user-1',
-      copilotExecutionContext: { userId: 'user-1', workspaceId: 'ws-1' },
-    })
+    for (const copilotExecutionContext of [
+      { userId: 'user-1', workspaceId: 'ws-1' },
+      { userId: 'user-1', workspaceId: 'ws-1', copilotToolExecution: true as const },
+    ]) {
+      mockResolveCredentialAccessToken.mockClear()
+      await resolveExecutorCredentialToken({
+        requestId: 'req-1',
+        credentialId: 'cred-1',
+        userId: 'user-1',
+        copilotExecutionContext,
+      })
 
-    expect(
-      mockResolveCredentialAccessToken.mock.calls[0][0].resolveManagedPrincipal
-    ).toBeUndefined()
+      expect(
+        mockResolveCredentialAccessToken.mock.calls[0][0].resolveManagedPrincipal
+      ).toBeUndefined()
+    }
   })
 
   it('fails before dispatch when the origin lacks current workflow authority', async () => {

apps/sim/executor/utils/credential-token.ts

@@ -57,10 +57,15 @@ export async function resolveExecutorCredentialToken(
     throw new Error('Managed credential delegation is missing current workflow authority')
   }
 
+  /**
+   * A Chat proof needs the per-call id the delegation is minted under; a
+   * context that lacks it is not a Chat tool call and leaves managed
+   * credentials unproven, so the resolver answers with its own refusal.
+   */
   const resolveManagedPrincipal = executorDelegationOrigin
     ? (managedCredentialId: string) =>
         bindExecutorManagedOAuthDelegation(executorDelegationOrigin, managedCredentialId)
-    : copilotExecutionContext?.copilotToolExecution
+    : copilotExecutionContext?.copilotToolExecution && copilotExecutionContext.toolCallId
       ? async (managedCredentialId: string) =>
           createCopilotManagedOAuthPrincipal(copilotExecutionContext, managedCredentialId)
       : undefined

apps/sim/lib/credential-groups/application/authorization.test.ts

@@ -9,11 +9,23 @@ import { credentialOperations } from '@/lib/credentials/application/operations'
 
 const mocks = vi.hoisted(() => ({
   loadEnrollmentAccess: vi.fn(),
+  loadBinding: vi.fn(),
   requirePolicy: vi.fn(),
 }))
 
 vi.mock('@/lib/credential-groups/credentials', () => ({
   loadCredentialGroupEnrollmentAccessForSubject: mocks.loadEnrollmentAccess,
+  loadManagedCredentialGroupBinding: mocks.loadBinding,
+  isManagedCredentialGroupBindingLive: (binding: {
+    managedOauthStatus: string
+    enrollmentStatus: string
+    groupStatus: string
+    optionStatus: string | null
+  }) =>
+    binding.managedOauthStatus === 'active' &&
+    ['in_progress', 'completed'].includes(binding.enrollmentStatus) &&
+    binding.groupStatus === 'active' &&
+    binding.optionStatus === 'active',
 }))
 
 vi.mock('@/lib/resource-policies/repository', () => ({
@@ -29,10 +41,23 @@ const context = {
   workspaceId: 'workspace-1',
   workspaceOrganizationId: null,
   allowPersonalApiKeys: true,
+  credentialId: 'credential-1',
   credentialGroupId: 'group-1',
   credentialGroupEnrollmentId: 'enrollment-1',
 }
 
+const liveBinding = {
+  credentialId: 'credential-1',
+  workspaceId: 'workspace-1',
+  providerId: 'google-email',
+  credentialGroupId: 'group-1',
+  credentialGroupOptionId: 'option-1',
+  managedOauthStatus: 'active',
+  enrollmentStatus: 'completed',
+  groupStatus: 'active',
+  optionStatus: 'active',
+}
+
 function storedPolicy(allowedWorkflowIds: string[] = []) {
   return {
     id: 'policy-1',
@@ -112,6 +137,15 @@ describe('requireCredentialGroupCredentialAccess', () => {
       enrollmentId: 'enrollment-1',
       email: 'person@example.com',
     })
+    mocks.loadBinding.mockResolvedValue(liveBinding)
+  })
+
+  it('denies a Chat turn once the credential group or its option is disabled', async () => {
+    mocks.loadBinding.mockResolvedValue({ ...liveBinding, optionStatus: 'disabled' })
+    await expect(requireAccess(copilotPrincipal())).rejects.toMatchObject({ code: 'forbidden' })
+
+    mocks.loadBinding.mockResolvedValue({ ...liveBinding, groupStatus: 'disabled' })
+    await expect(requireAccess(copilotPrincipal())).rejects.toMatchObject({ code: 'forbidden' })
   })
 
   it("allows a Chat turn to use only the credential under the signed-in user's own enrollment", async () => {

apps/sim/lib/credential-groups/application/authorization.ts

@@ -16,7 +16,11 @@ import {
   evaluateCredentialGroupWorkflowAccess,
 } from '@/lib/credential-groups/application/workflow-access-policy'
 import type { CredentialGroupCredentialListContext } from '@/lib/credential-groups/credentials'
-import { loadCredentialGroupEnrollmentAccessForSubject } from '@/lib/credential-groups/credentials'
+import {
+  isManagedCredentialGroupBindingLive,
+  loadCredentialGroupEnrollmentAccessForSubject,
+  loadManagedCredentialGroupBinding,
+} from '@/lib/credential-groups/credentials'
 import type { ResourcePolicyBindingFor } from '@/lib/resource-policies/registry'
 import { requireResourcePolicy } from '@/lib/resource-policies/repository'
 
@@ -93,23 +97,28 @@ export function requireCredentialGroupWorkflowActor(principal: Principal): Princ
  */
 async function requireCredentialGroupActorCredentialAccess(
   principal: Extract<Principal, { kind: 'delegated' }>,
-  context: CredentialGroupAuthorizationContext & { credentialGroupEnrollmentId: string },
+  context: CredentialGroupAuthorizationContext & {
+    credentialId: string
+    credentialGroupEnrollmentId: string
+  },
   resourcePolicy: ResourcePolicyBindingFor<'credential_group'>
 ): Promise<void> {
   const subject = resolvePrincipalSubject(principal)
   if (subject?.kind !== 'sim_user' || !subject.userId) {
     throw new OrchestrationError('forbidden', 'Credential Group actor access required')
   }
-  const [policy, actorAccess] = await Promise.all([
+  const [policy, actorAccess, binding] = await Promise.all([
     requireResourcePolicy({
       workspaceId: context.workspaceId,
       resourceType: 'credential_group',
       resourceId: context.credentialGroupId,
       codec: credentialGroupWorkflowAccessPolicyCodec,
     }),
     loadCredentialGroupEnrollmentAccessForSubject(context.credentialGroupId, subject),
+    loadManagedCredentialGroupBinding(context.credentialId),
   ])
-  if (!actorAccess) {
+  /** A disabled group or option denies here, as it does for every other consumer of a binding. */
+  if (!actorAccess || !binding || !isManagedCredentialGroupBindingLive(binding)) {
     throw new OrchestrationError('forbidden', 'Credential Group credential access denied')
   }
   const decision = evaluateCredentialGroupActorCredentialAccess({
@@ -126,7 +135,10 @@ async function requireCredentialGroupActorCredentialAccess(
 
 export async function requireCredentialGroupCredentialAccess(
   principal: Principal,
-  context: CredentialGroupAuthorizationContext & { credentialGroupEnrollmentId: string },
+  context: CredentialGroupAuthorizationContext & {
+    credentialId: string
+    credentialGroupEnrollmentId: string
+  },
   resourcePolicy: ResourcePolicyBindingFor<'credential_group'>
 ): Promise<void> {
   if (principal.kind === 'delegated' && principal.serviceId === 'copilot') {

apps/sim/lib/credentials/environment.ts

@@ -14,7 +14,7 @@ import { chunkArray } from '@sim/utils/helpers'
 import { generateId } from '@sim/utils/id'
 import { and, asc, eq, inArray, isNotNull, isNull, notInArray, or, sql } from 'drizzle-orm'
 import { acquireUserBillingIdentityLock } from '@/lib/billing/organizations/billing-identity-lock'
-import { LIVE_ENROLLMENT_STATUSES } from '@/lib/credential-groups/credentials'
+import { isManagedCredentialGroupBindingLive } from '@/lib/credential-groups/credentials'
 import type { DbOrTx } from '@/lib/db/types'
 import {
   getEffectiveWorkspacePermission,
@@ -843,10 +843,11 @@ export interface AccessibleOAuthCredential {
 
 /**
  * The Credential Group credentials a verified person holds through their own
- * live enrollments in the workspace: active managed OAuth rows whose enrollment
- * email is the person's. These are theirs to use as themselves; the policy's
- * actor statement is what a use is authorized against, so nothing here widens
- * access, it only tells the person (and the agent acting for them) what exists.
+ * enrollments in the workspace and may use right now: the credential, its
+ * enrollment, its option, and its group are all live, the same bar every mint
+ * applies. These are theirs to use as themselves; the policy's actor statement
+ * is what a use is authorized against, so nothing here widens access, it only
+ * tells the person (and the agent acting for them) what exists.
  */
 export async function getEnrolledManagedOAuthCredentials(
   workspaceId: string,
@@ -857,7 +858,12 @@ export async function getEnrolledManagedOAuthCredentials(
       id: credential.id,
       providerId: credential.providerId,
       displayName: credential.displayName,
+      credentialGroupOptionId: credential.credentialGroupOptionId,
+      managedOauthStatus: credential.managedOauthStatus,
+      enrollmentStatus: credentialGroupEnrollment.status,
       groupName: credentialGroup.name,
+      groupStatus: credentialGroup.status,
+      groupOptions: credentialGroup.options,
       updatedAt: credential.updatedAt,
     })
     .from(credential)
@@ -871,15 +877,25 @@ export async function getEnrolledManagedOAuthCredentials(
       and(
         eq(credential.workspaceId, workspaceId),
         eq(credential.type, 'managed_oauth'),
-        eq(credential.managedOauthStatus, 'active'),
-        inArray(credentialGroupEnrollment.status, [...LIVE_ENROLLMENT_STATUSES]),
         eq(user.id, userId),
         eq(user.emailVerified, true)
       )
     )
 
   return rows
-    .filter((row): row is typeof row & { providerId: string } => Boolean(row.providerId))
+    .filter(
+      (row): row is typeof row & { providerId: string } =>
+        Boolean(row.providerId) &&
+        row.managedOauthStatus !== null &&
+        isManagedCredentialGroupBindingLive({
+          managedOauthStatus: row.managedOauthStatus,
+          enrollmentStatus: row.enrollmentStatus,
+          groupStatus: row.groupStatus,
+          optionStatus:
+            row.groupOptions.find((option) => option.id === row.credentialGroupOptionId)?.status ??
+            null,
+        })
+    )
     .map((row) => ({
       id: row.id,
       providerId: row.providerId,