fix(authz): enforce credential and workspace boundaries

[icecrasher321]

Summary

• enforce credential membership for knowledge connector OAuth use
• scope MCP token revocation and require write access for refresh
• preserve personal API-key policy when forking workspaces

Type of Change

• Bug fix

Testing

• 10 focused Vitest files, 146 tests
• Sim type-check
• lint, block registry check, and 25 repository audits

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 12, 2026 2:30am

[cursor]

PR Summary

High Risk
Changes authorization checks around credential use and MCP OAuth token revocation—security-sensitive boundaries where incorrect scoping could allow cross-workspace or unauthorized access.

Overview
Tightens several authorization boundaries so callers can only use credentials and MCP servers they are already allowed to touch.

Knowledge connectors now require credential membership (canUseCredential) before OAuth token refresh or source-config validation, rejecting writers who lack access with actionable guidance.

MCP OAuth revocation is workspace-scoped: revokeMcpOauthTokens requires a workspaceId and only loads tokens for servers in that workspace. MCP server refresh also now requires write permission because it persists workflow changes.

Workspace forking preserves the source allowPersonalApiKeys policy on the child instead of always enabling it, and the workflow detail contract now includes forkSyncExcluded (default false).

^{Reviewed by Cursor Bugbot for commit 526b85e. Configure here.}

[greptile-apps]

Greptile Summary

This PR strengthens authorization boundaries around knowledge connector credentials and MCP server operations while preserving workspace API-key policy during forks.

• Requires write permission when refreshing MCP servers because refresh persists workflow changes.
• Verifies credential membership and workspace ownership before knowledge connectors resolve OAuth identities.
• Scopes MCP OAuth revocation to the authorized workspace.
• Copies allowPersonalApiKeys from a source workspace into its fork.

Confidence Score: 5/5

The PR appears safe to merge, with the changed authorization and policy-propagation paths consistently scoped and covered by focused tests.

The credential gate uses the delegated subject or authorized workspace actor, MCP lifecycle callers pass canonically authorized workspace IDs into revocation, refresh now requires the permission level appropriate for its writes, and fork creation receives a concrete source policy value.

Important Files Changed

Filename	Overview
apps/sim/lib/knowledge/application/connectors.ts	Adds workspace and credential-membership checks before resolving OAuth identities for connector creation and source-config validation.
apps/sim/lib/mcp/oauth/revoke.ts	Requires a workspace identifier and verifies server containment before loading and revoking OAuth tokens.
apps/sim/lib/mcp/orchestration/server-lifecycle.ts	Propagates the authorized workspace into every MCP OAuth revocation call.
apps/sim/app/api/mcp/servers/[id]/refresh/route.ts	Raises refresh authorization from read to write because the operation persists workflow changes.
apps/sim/ee/workspace-forking/lib/create-fork.ts	Preserves the source workspace's personal API-key policy in the inserted and returned fork.
apps/sim/lib/workspaces/permissions/utils.ts	Extends workspace resolution to return the personal API-key policy required by fork creation.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Actor[Authenticated actor] --> WorkspaceAuth[Resolve workspace permission]
  WorkspaceAuth -->|write allowed| Operation{Operation}
  Operation --> Refresh[MCP refresh]
  Operation --> Connector[Knowledge connector]
  Operation --> Lifecycle[MCP update or delete]
  Connector --> CredentialContext[Resolve credential actor context]
  CredentialContext --> Membership{Workspace and credential access?}
  Membership -->|yes| OAuthIdentity[Resolve OAuth identity]
  Membership -->|no| Reject[Reject credential use]
  Lifecycle --> ScopedServer[Resolve server by ID and workspace]
  ScopedServer --> Revoke[Best-effort OAuth revocation]
  Refresh --> Persist[Persist workflow schema changes]

Loading

_{Reviews (1): Last reviewed commit: "fix(authz): enforce credential and works..." | Re-trigger Greptile}

[icecrasher321]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 526b85e. Configure here.}