fix(knowledge): preserve credential access guidance

Author: icecrasher321

apps/sim/lib/copilot/tools/server/knowledge/knowledge-base.test.ts

@@ -631,6 +631,33 @@ describe('knowledge_base trusted application delegation', () => {
     })
   })
 
+  it('preserves credential access guidance for connector creation', async () => {
+    mockCreateKnowledgeConnector.mockRejectedValueOnce(
+      new OrchestrationError(
+        'validation',
+        'Credential is not available to you in this workspace. Ask a credential administrator to grant access or select another credential.'
+      )
+    )
+
+    const result = await knowledgeBaseServerTool.execute(
+      {
+        operation: 'add_connector',
+        args: {
+          knowledgeBaseId: KNOWLEDGE_BASE.id,
+          connectorType: 'notion',
+          credentialId: 'credential-1',
+        },
+      },
+      CONTEXT
+    )
+
+    expect(result).toEqual({
+      success: false,
+      message:
+        'Credential is not available to you in this workspace. Ask a credential administrator to grant access or select another credential.',
+    })
+  })
+
   it('preserves caller-actionable tag provenance conflicts', async () => {
     mockDeleteKnowledgeTag.mockRejectedValueOnce(
       new OrchestrationError(

apps/sim/lib/knowledge/application/connectors.test.ts

@@ -363,7 +363,11 @@ describe('knowledge connector application use cases', () => {
           resolveBillingAttribution: mocks.resolveBilling,
         },
       })
-    ).rejects.toMatchObject({ code: 'validation' })
+    ).rejects.toMatchObject({
+      code: 'validation',
+      message:
+        'Credential is not available to you in this workspace. Ask a credential administrator to grant access or select another credential.',
+    })
 
     expect(mocks.getCredentialActorContext).toHaveBeenCalledWith('credential-1', 'shared-user')
     expect(mocks.resolveTokenIdentity).not.toHaveBeenCalled()
@@ -423,9 +427,10 @@ describe('knowledge connector application use cases', () => {
         },
         { space: 'ENG' }
       )
-    ).resolves.toEqual({
-      message: 'Credential is no longer usable in this workspace. Please reconnect it.',
-      errorCode: 'validation',
+    ).rejects.toMatchObject({
+      code: 'validation',
+      message:
+        'Credential is not available to you in this workspace. Ask a credential administrator to grant access or select another credential.',
     })
     expect(mocks.resolveTokenIdentity).not.toHaveBeenCalled()
     expect(mocks.refreshToken).not.toHaveBeenCalled()

apps/sim/lib/knowledge/application/connectors.ts

@@ -131,7 +131,10 @@ async function resolveAuthorizedConnectorCredentialIdentity(input: {
     access.credential.workspaceId !== input.workspaceId ||
     !canUseCredential(access)
   ) {
-    return null
+    throw new OrchestrationError(
+      'validation',
+      'Credential is not available to you in this workspace. Ask a credential administrator to grant access or select another credential.'
+    )
   }
   return resolveCredentialTokenIdentity(input.credentialId, input.workspaceId)
 }