fix(credential-groups): make enrollment connections optional

Author: TheodoreSpeaks

apps/sim/app/api/credential-groups/enroll/[token]/complete/route.test.ts

@@ -49,7 +49,7 @@ describe('credential group enrollment completion route', () => {
     mocks.complete.mockResolvedValue({ completed: true })
   })
 
-  it('submits a fully connected enrollment through its invitation principal', async () => {
+  it('submits optional account selections through its invitation principal', async () => {
     const enrollmentRequest = request()
     const response = await POST(enrollmentRequest, context)
 
@@ -64,13 +64,13 @@ describe('credential group enrollment completion route', () => {
     })
   })
 
-  it('redirects an incomplete enrollment without marking it complete', async () => {
-    mocks.complete.mockResolvedValue({ completed: false })
+  it('returns to an unavailable enrollment when completion loses authorization', async () => {
+    mocks.complete.mockResolvedValue({ completed: null })
 
     const response = await POST(request(), context)
 
     expect(response.headers.get('location')).toBe(
-      '/credential-groups/enroll/invitation-token?oauth=incomplete'
+      '/credential-groups/enroll/invitation-token?oauth=unavailable'
     )
   })
 

apps/sim/app/api/credential-groups/enroll/[token]/complete/route.ts

@@ -39,7 +39,6 @@ export const POST = withRouteHandler(
     if (completed === null) {
       return createCredentialGroupEnrollmentRedirect(token, { oauth: 'unavailable' })
     }
-    if (completed) return createCredentialGroupCompletionRedirect()
-    return createCredentialGroupEnrollmentRedirect(token, { oauth: 'incomplete' })
+    return createCredentialGroupCompletionRedirect()
   }
 )

apps/sim/app/credential-groups/enroll/[token]/page.tsx

@@ -68,7 +68,6 @@ const OAUTH_MESSAGES = {
   permissions_required: 'All requested permissions are required to connect this account.',
   configuration_changed: 'This credential option changed. Reload the page and try again.',
   rate_limited: 'Too many authorization attempts. Wait a few minutes and try again.',
-  incomplete: 'Connect every account before submitting.',
   unavailable: 'Account authorization is temporarily unavailable. Please try again.',
   failed: 'Account authorization did not complete. Please try again.',
 } as const
@@ -125,12 +124,6 @@ export default async function CredentialGroupEnrollmentPage({
     : oauthMessage
       ? { message: oauthMessage, variant: 'error' as const }
       : null
-  const allConnected =
-    activeOptions.length > 0 &&
-    activeOptions.every(
-      (option) => option.connections.length === 1 && option.connections[0]?.status === 'connected'
-    )
-
   return (
     <PageShell>
       {notification && (
@@ -177,11 +170,7 @@ export default async function CredentialGroupEnrollmentPage({
           method='post'
           className='mt-6 flex justify-end'
         >
-          <Chip
-            type='submit'
-            variant='primary'
-            disabled={!allConnected || enrollment.status === 'completed'}
-          >
+          <Chip type='submit' variant='primary' disabled={enrollment.status === 'completed'}>
             {enrollment.status === 'completed' ? 'Submitted' : 'Submit'}
           </Chip>
         </form>

apps/sim/ee/credential-groups/components/credential-group-details.tsx

@@ -48,7 +48,7 @@ function toOptionUpdateInput(
   const common = {
     id: option.id,
     label: getCredentialGroupProviderService(option.provider).name,
-    required: true,
+    required: false,
   }
   if (option.provider !== 'slack') return { ...common, provider: option.provider }
   return {
@@ -101,7 +101,7 @@ export function CredentialGroupDetails({
     const nextOption: NonNullable<UpdateCredentialGroupBody['options']>[number] = {
       provider,
       label: service.name,
-      required: true,
+      required: false,
     }
     return updateOptions([...existing, nextOption], `${service.name} added`)
   }

apps/sim/lib/credential-groups/enrollments.test.ts

@@ -229,14 +229,6 @@ describe('completeCredentialGroupEnrollment', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     resetDbChainMock()
-    adapter.getPolicy.mockResolvedValue({
-      provider: 'gmail',
-      providerId: 'google-email',
-      authorizationAppId: 'google:client',
-      requiredScopes: ['scope'],
-      scopeVersion: 1,
-    })
-    adapter.hasRequiredScopes.mockReturnValue(true)
   })
 
   it('returns unavailable when revocation wins before completion acquires the lifecycle lock', async () => {
@@ -261,18 +253,6 @@ describe('completeCredentialGroupEnrollment', () => {
         inviterName: 'Inviter',
       },
     ])
-    queueTableRows(schemaMock.credential, [
-      {
-        optionId: 'option-1',
-        status: 'active',
-        scopeVersion: 1,
-        authorizationAppId: 'google:client',
-        grantedScopes: ['scope'],
-        displayName: 'alex@example.com',
-        metadata: { email: 'alex@example.com' },
-        grantedAt: new Date('2026-08-11T12:05:00.000Z'),
-      },
-    ])
     queueTableRows(schemaMock.credentialGroupEnrollment, [
       {
         status: 'revoked',
@@ -287,10 +267,10 @@ describe('completeCredentialGroupEnrollment', () => {
     expect(dbChainMockFns.update).not.toHaveBeenCalled()
   })
 
-  it('refuses completion when a connection needs reauthorization under the row locks', async () => {
+  it('completes when the recipient skips every optional account', async () => {
     queueTableRows(schemaMock.credentialGroupEnrollment, [
       {
-        enrollment: { ...ENROLLMENT, status: 'in_progress' },
+        enrollment: { ...ENROLLMENT, status: 'invited' },
         groupId: 'group-1',
         groupName: 'Group',
         groupStatus: 'active',
@@ -311,7 +291,7 @@ describe('completeCredentialGroupEnrollment', () => {
     ])
     queueTableRows(schemaMock.credentialGroupEnrollment, [
       {
-        status: 'in_progress',
+        status: 'invited',
         invitationTokenHash: ENROLLMENT.invitationTokenHash,
         invitationExpiresAt: ENROLLMENT.invitationExpiresAt,
       },
@@ -330,20 +310,12 @@ describe('completeCredentialGroupEnrollment', () => {
         ],
       },
     ])
-    queueTableRows(schemaMock.credential, [
-      {
-        optionId: 'option-1',
-        status: 'needs_reauth',
-        scopeVersion: 1,
-        authorizationAppId: 'google:client',
-        grantedScopes: ['scope'],
-        grantedAt: new Date('2026-08-11T12:05:00.000Z'),
-      },
-    ])
+    dbChainMockFns.returning.mockResolvedValueOnce([{ id: ENROLLMENT.id }])
 
-    await expect(completeCredentialGroupEnrollment('invitation-token')).resolves.toBe(false)
+    await expect(completeCredentialGroupEnrollment('invitation-token')).resolves.toBe(true)
 
-    expect(dbChainMockFns.update).not.toHaveBeenCalled()
+    expect(dbChainMockFns.update).toHaveBeenCalledWith(schemaMock.credentialGroupEnrollment)
+    expect(dbChainMockFns.from).not.toHaveBeenCalledWith(schemaMock.credential)
     expect(adapter.getPolicy).not.toHaveBeenCalled()
   })
 })

apps/sim/lib/credential-groups/enrollments.ts

@@ -779,8 +779,8 @@ async function buildPublicCredentialGroupEnrollment(
   }
 }
 
-/** Finalizes an enrollment only after every active credential option has one usable connection. */
-export async function completeCredentialGroupEnrollment(token: string): Promise<boolean | null> {
+/** Finalizes an enrollment after the recipient finishes their optional account selections. */
+export async function completeCredentialGroupEnrollment(token: string): Promise<true | null> {
   const row = await resolvePublicEnrollmentRowByIdentity({
     invitationTokenHash: hashInvitationToken(token),
   })
@@ -790,7 +790,7 @@ export async function completeCredentialGroupEnrollment(token: string): Promise<
 
 export async function completeAuthorizedCredentialGroupEnrollment(
   identity: PublicCredentialGroupEnrollmentIdentity
-): Promise<boolean | null> {
+): Promise<true | null> {
   const row = await resolveAuthorizedPublicEnrollmentRow(identity)
   if (!row) return null
   return completeResolvedCredentialGroupEnrollment(row, identity)
@@ -799,7 +799,7 @@ export async function completeAuthorizedCredentialGroupEnrollment(
 async function completeResolvedCredentialGroupEnrollment(
   row: NonNullable<Awaited<ReturnType<typeof resolvePublicEnrollmentRowByIdentity>>>,
   identity: PublicCredentialGroupEnrollmentIdentity
-): Promise<boolean | null> {
+): Promise<true | null> {
   return db.transaction(async (tx) => {
     await lockCredentialGroupEnrollmentLifecycle(tx, row.enrollment.id)
     const now = new Date()
@@ -825,7 +825,6 @@ async function completeResolvedCredentialGroupEnrollment(
     const [group] = await tx
       .select({
         status: credentialGroup.status,
-        options: credentialGroup.options,
       })
       .from(credentialGroup)
       .where(
@@ -838,52 +837,6 @@ async function completeResolvedCredentialGroupEnrollment(
       .for('update')
     if (!group || group.status !== 'active') return null
 
-    const activeOptions = group.options.filter((option) => option.status === 'active')
-    if (activeOptions.length === 0) return false
-    const connections = await tx
-      .select({
-        optionId: credential.credentialGroupOptionId,
-        status: credential.managedOauthStatus,
-        scopeVersion: credential.managedOauthScopeVersion,
-        authorizationAppId: credential.authorizationAppId,
-        grantedScopes: credential.grantedScopes,
-        grantedAt: credential.grantedAt,
-      })
-      .from(credential)
-      .where(
-        and(
-          eq(credential.type, 'managed_oauth'),
-          eq(credential.credentialGroupEnrollmentId, row.enrollment.id)
-        )
-      )
-      .for('update')
-
-    for (const option of activeOptions) {
-      if (!isCredentialGroupProvider(option.provider)) {
-        throw new Error(`Unsupported Credential Group provider: ${option.provider}`)
-      }
-      const matchingConnections = connections.filter(
-        (connection) => connection.optionId === option.id
-      )
-      if (matchingConnections.length !== 1) return false
-      const [connection] = matchingConnections
-      if (!connection || connection.status !== 'active' || !connection.grantedAt) return false
-
-      const adapter = getCredentialGroupProviderAdapter(option.provider)
-      const policy = await adapter.getPolicy(option, {
-        workspaceId: identity.workspaceId,
-        credentialGroupId: identity.credentialGroupId,
-        executor: tx,
-      })
-      if (
-        connection.authorizationAppId !== policy.authorizationAppId ||
-        connection.scopeVersion !== policy.scopeVersion ||
-        !adapter.hasRequiredScopes(connection.grantedScopes ?? [], policy.requiredScopes)
-      ) {
-        return false
-      }
-    }
-
     const [completed] = await tx
       .update(credentialGroupEnrollment)
       .set({ status: 'completed', completedAt: now, updatedAt: now })

apps/sim/lib/credential-groups/slack-managed-users.ts

@@ -671,7 +671,7 @@ export async function exchangeAndConfigureSlackManagedUsers(params: {
       authorizationAppId,
       requiredScopes: [...SLACK_MANAGED_USER_SCOPES],
       scopeVersion,
-      required: existingOption?.required ?? true,
+      required: false,
       status: existingOption?.status ?? ('active' as const),
     }
     const options = existingOption