fix(resource-policies): authorize credential use only

Author: TheodoreSpeaks

apps/sim/lib/credential-groups/application/list-credentials.test.ts

@@ -230,21 +230,6 @@ describe('listCredentialGroupCredentials', () => {
     })
   })
 
-  it('lists the entire group for a matching resource-policy grant', async () => {
-    mocks.findPolicyGrant.mockResolvedValueOnce({
-      id: 'grant-1',
-      subject: { type: 'workflow', workflowId: 'workflow-1' },
-      actions: ['credential_groups.credentials.list', 'credential_groups.credentials.use'],
-    })
-
-    await listCredentialGroupCredentials.execute({ principal: executorPrincipal(), input })
-
-    expect(mocks.loadEnrollmentAccess).not.toHaveBeenCalled()
-    expect(mocks.listCredentials).toHaveBeenCalledWith(
-      expect.objectContaining({ credentialGroupEnrollmentId: undefined })
-    )
-  })
-
   it('filters by canonical providers active in the group', async () => {
     await listCredentialGroupCredentials.execute({
       principal: executorPrincipal(),

apps/sim/lib/credential-groups/application/manage-access.test.ts

@@ -142,7 +142,7 @@ describe('Credential Group access policy operations', () => {
           {
             id: expect.any(String),
             subject,
-            actions: ['credential_groups.credentials.list', 'credential_groups.credentials.use'],
+            actions: ['credential_groups.credentials.use'],
           },
         ],
       },

apps/sim/lib/credential-groups/application/manage-access.ts

@@ -16,10 +16,7 @@ import {
   resourcePolicySubjectSchema,
 } from '@/lib/resource-policies/types'
 
-const CREDENTIAL_GROUP_ALL_ACTIONS = [
-  'credential_groups.credentials.list',
-  'credential_groups.credentials.use',
-] as const
+const CREDENTIAL_GROUP_ACCESS_ACTIONS = ['credential_groups.credentials.use'] as const
 
 interface CredentialGroupAccessTargetInput {
   assertedWorkspaceId: string
@@ -91,7 +88,7 @@ export const updateCredentialGroupAccess = defineAuthorizedWorkspaceUseCase({
           grants: input.grants.map((grant, index) => ({
             id: grant.id ?? generateId(),
             subject: subjects[index],
-            actions: [...CREDENTIAL_GROUP_ALL_ACTIONS],
+            actions: [...CREDENTIAL_GROUP_ACCESS_ACTIONS],
           })),
         },
       })

apps/sim/lib/resource-policies/authorization.test.ts

@@ -78,7 +78,7 @@ function policy(subject: Record<string, unknown>) {
         {
           id: 'grant-1',
           subject,
-          actions: ['credential_groups.credentials.list', 'credential_groups.credentials.use'],
+          actions: ['credential_groups.credentials.use'],
         },
       ],
     },
@@ -98,7 +98,7 @@ describe('findResourcePolicyGrant', () => {
       context,
       resourceType: 'credential_group' as const,
       resourceId: 'group-1',
-      action: 'credential_groups.credentials.list' as const,
+      action: 'credential_groups.credentials.use' as const,
     }
 
     await expect(

apps/sim/lib/resource-policies/types.test.ts

@@ -13,10 +13,7 @@ describe('resource policy documents', () => {
         {
           id: 'grant-1',
           subject: { type: 'workflow' as const, workflowId: 'workflow-1' },
-          actions: [
-            'credential_groups.credentials.list' as const,
-            'credential_groups.credentials.use' as const,
-          ],
+          actions: ['credential_groups.credentials.use' as const],
         },
       ],
     }
@@ -53,7 +50,7 @@ describe('resource policy documents', () => {
             {
               id: 'grant-2',
               subject: { type: 'workflow', workflowId: 'workflow-1' },
-              actions: ['credential_groups.credentials.list'],
+              actions: ['credential_groups.credentials.use'],
             },
           ],
         },

apps/sim/lib/resource-policies/types.ts

@@ -2,10 +2,7 @@ import { z } from 'zod'
 
 export const RESOURCE_POLICY_VERSION = 1 as const
 export const RESOURCE_POLICY_RESOURCE_TYPES = ['credential_group'] as const
-export const RESOURCE_POLICY_ACTIONS = [
-  'credential_groups.credentials.list',
-  'credential_groups.credentials.use',
-] as const
+export const RESOURCE_POLICY_ACTIONS = ['credential_groups.credentials.use'] as const
 export type ResourcePolicyResourceType = (typeof RESOURCE_POLICY_RESOURCE_TYPES)[number]
 export type ResourcePolicyAction = (typeof RESOURCE_POLICY_ACTIONS)[number]
 

design/credential-group-authorization.md

@@ -8,7 +8,7 @@ Credential Groups collect external users' managed credentials and let workflows
 
 The default is simple:
 
-> An execution with a verified actor may list and use only that actor's credentials.
+> An execution may list every non-secret credential reference, but it may use only the verified actor's credential.
 
 Explicit resource-policy grants can expand a user, Access Control Group, workspace role, or deployed workflow to every credential in the Credential Group.
 
@@ -60,7 +60,7 @@ List Credentials
 
 Its contract is:
 
-> Return every credential that this execution is currently authorized to use.
+> Return every active credential reference in the group; selecting a reference does not authorize its use.
 
 Inputs may select the Credential Group, provider option, and pagination. Inputs never select identity or authorization scope:
 
@@ -83,28 +83,7 @@ The input does not contain:
 
 ## List authorization
 
-The application operation loads the canonical Credential Group, verifies workspace access, and evaluates the current resource policy.
-
-```text
-matching credentials.list grant
-  -> list all active credentials in the group
-
-otherwise verified actor with active enrollment
-  -> list only credentials for that exact enrollment
-
-otherwise
-  -> fail
-```
-
-The internal result is a database query constraint, not persisted policy state:
-
-```ts
-type CredentialListAuthorization =
-  | { enrollmentId: string }
-  | { grantId: string }
-```
-
-The exact enrollment constraint is applied to cursor validation and every page query. A credential ID returned from an earlier call is not an authorization capability.
+The application operation loads the canonical Credential Group, verifies executor delegation, workspace binding, group scope, status, and entitlement, then returns a bounded page of all active credential references in the group. The result contains opaque IDs and account metadata but no token material, and a returned credential ID is never an authorization capability.
 
 ## Credential use authorization
 
@@ -131,7 +110,6 @@ Tokens and refresh tokens never appear in block output or execution logs. List r
 The Credential Group resource policy can grant:
 
 ```text
-credential_groups.credentials.list
 credential_groups.credentials.use
 ```
 
@@ -144,10 +122,7 @@ Example workflow grant:
     "type": "workflow",
     "workflowId": "wf_support"
   },
-  "actions": [
-    "credential_groups.credentials.list",
-    "credential_groups.credentials.use"
-  ]
+  "actions": ["credential_groups.credentials.use"]
 }
 ```
 
@@ -162,18 +137,17 @@ Example Access Control Group grant:
     "type": "access_control_group",
     "accessControlGroupId": "pg_support_admins"
   },
-  "actions": [
-    "credential_groups.credentials.list",
-    "credential_groups.credentials.use"
-  ]
+  "actions": ["credential_groups.credentials.use"]
 }
 ```
 
 Membership is evaluated at operation time. Removing a user from the Access Control Group revokes access immediately on the next protected operation.
 
 ## Execution behavior
 
-| Execution | Result |
+All executions that pass the list operation's workspace and group checks can see the same credential references. Using a selected credential resolves as follows:
+
+| Execution | Credential use result |
 | --- | --- |
 | Manual actor without an explicit grant | Actor's enrollment only |
 | Manual actor in a granted Access Control Group | All credentials |
@@ -184,7 +158,7 @@ Membership is evaluated at operation time. Removing a user from the Access Contr
 | Actorless schedule without a workflow grant | Fail |
 | Actor with no enrollment and no explicit grant | Fail |
 
-There is no silent fallback from a requested all-credentials mode because the block has no caller-controlled access mode. It simply returns the set authorized for the current execution.
+There is no silent fallback from a requested all-credentials mode because the block has no caller-controlled access mode. Authorization happens when the selected credential is assumed.
 
 Manual testing exercises the actor path with the tester's credential. Full group-wide behavior is tested through a deployed execution, preferably against a staging Credential Group in a forked workspace.
 
@@ -197,7 +171,7 @@ Slack signature and installation verified
   -> webhook Principal with (teamId, userId) subject
   -> workflow execution
   -> Credential Group enrollment resolution
-  -> actor-scoped credential list/use
+  -> actor-scoped credential use
 ```
 
 The Slack trigger subscription credential only receives events. It is not the external user's downstream credential.
@@ -208,7 +182,7 @@ Bot events and events without a verified human subject have no actor. They requi
 
 Credential Group creation, options, invitations, enrollment lifecycle, and resource-policy changes remain control-plane operations requiring current workspace-admin authorization and audit.
 
-Managing the policy does not automatically grant the administrator permission to list or use credentials. Data-plane access still requires actor ownership or an explicit grant.
+Managing the policy does not automatically grant the administrator permission to use credentials. Data-plane credential use still requires actor ownership or an explicit grant.
 
 ## Current implementation delta
 
@@ -217,12 +191,12 @@ The branch:
 - threads the original Principal into Credential Group executor delegation;
 - removes caller-supplied email filtering from credential listing;
 - resolves a verified Sim user to an exact active enrollment;
-- filters list pagination by that enrollment;
+- lists bounded non-secret references for every active credential in the group;
 - rechecks the same enrollment when resolving managed OAuth tokens;
 - fails actorless execution instead of substituting a billing or workflow owner.
 - stores and evaluates generic allow-only resource policies;
 - resolves user, workspace-role, Access Control Group, external-identity, and deployed-workflow subjects;
-- grants whole-group list and use access when an explicit policy matches;
+- grants whole-group credential use when an explicit policy matches;
 - binds Slack's verified provider subject to an active enrollment;
 - exposes an audited, optimistic-concurrency admin management API and structured Access tab.
 

design/resource-policies.md

@@ -100,21 +100,15 @@ Policies store stable subject references, never session IDs, API keys, delegatio
         "type": "workflow",
         "workflowId": "wf_support"
       },
-      "actions": [
-        "credential_groups.credentials.list",
-        "credential_groups.credentials.use"
-      ]
+      "actions": ["credential_groups.credentials.use"]
     },
     {
       "id": "support-admins",
       "subject": {
         "type": "access_control_group",
         "accessControlGroupId": "pg_support_admins"
       },
-      "actions": [
-        "credential_groups.credentials.list",
-        "credential_groups.credentials.use"
-      ]
+      "actions": ["credential_groups.credentials.use"]
     }
   ]
 }
@@ -261,7 +255,7 @@ Routes, blocks, tools, Copilot adapters, and executor handlers do not query poli
 
 ## Current implementation
 
-The generic policy document, strict parser, optimistic repository, subject evaluator, and subject-management validation are implemented. Credential Groups are the first resource type and currently expose one managed permission in the UI: list and use every credential in the group.
+The generic policy document, strict parser, optimistic repository, subject evaluator, and subject-management validation are implemented. Credential Groups are the first resource type and currently expose one managed permission in the UI: use every credential in the group.
 
 Future resource types extend the exact resource/action registry and call the same evaluator from their application operations. Knowledge Base/table enforcement and log-provenance redaction remain separate follow-up work.
 
@@ -288,7 +282,7 @@ Provenance and viewer-specific log shielding are a later phase. They use the sam
 1. Add strict policy types, validation, storage, and evaluator.
 2. Add admin policy read/write application operations and audit.
 3. Add deployed-workflow authority to execution identity.
-4. Integrate Credential Group list and use authorization.
+4. Integrate Credential Group credential-use authorization.
 5. Add user, workspace-role, and Access Control Group subject resolution.
 6. Add policy management UI on Credential Groups.
 7. Extend the same evaluator to Knowledge Bases and tables.