fix(credential-groups): stop requiring a human subject on workflow ops

[TheodoreSpeaks]

Summary

• list_groups, list_people, and send_invite required a Sim user subject, so every unattended run failed with Credential Group user access required — a Slack-triggered run's subject is the external Slack user, and a schedule or public-API run has no subject at all
• Replaced that gate with requireCredentialGroupWorkflowActor, which keeps the assert that a delegation's subject matches the run it was minted for but no longer demands a Sim user. Authority for an actorless caller is unchanged: executor delegation, matching workspace, in-scope resource, deployment-mode current workflow
• get_invite_link already had no such check, so the four workflow-facing ops are now consistent
• Invitations no longer name an inviter when there is none, instead of borrowing the run's actor and claiming a person invited when they did not — inviterName is optional through send-invite → enrollments → email render → subject line, and the copy branches:
  • subject: You have been invited to connect accounts for <workspace> on Sim
  • body: <recipient> has been invited to connect accounts for …
• Dropped the invented 'A workspace admin' fallback on the enrollment landing page; PublicCredentialGroupEnrollment.inviterName is now nullable and the page reads "You have been invited to connect accounts for ."
• Session-only admin surfaces (batch invite, resend) still pass a real inviter name — a human admin did invite them

Type of Change

• Bug fix

Testing

New send-invite.test.ts covers Slack-triggered, actorless schedule, session-actor, email-fallback, admin-permission, and spoofed-subject cases; added requireCredentialGroupWorkflowActor coverage to authorization.test.ts. Credential-groups, email, and enrollment-surface suites pass (241 tests). bun run type-check, bun run lint, bun run check:audits (39/39), and the block-registry audit all pass.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 29, 2026 7:41am

[greptile-apps]

Greptile Summary

This PR allows deployed workflow operations to run without requiring a Sim-user subject while retaining delegation-subject consistency and existing workspace/resource authorization.

• Replaces the human-subject gate for workflow credential-group listing and invitation operations with actor consistency validation.
• Supports actorless invitation persistence, audit attribution, email copy, subject lines, and public enrollment rendering.
• Adds tests for Slack-triggered, scheduled, session-actor, permission-denied, and spoofed-subject cases.

Confidence Score: 5/5

The PR appears safe to merge with no actionable correctness, security, or compatibility defects identified.

The relaxed gate retains delegation-subject consistency, workspace and deployment authorization, and credential-group scope checks, while downstream persistence, auditing, email rendering, and enrollment UI safely support missing human attribution.

Important Files Changed

Filename	Overview
apps/sim/lib/credential-groups/application/authorization.ts	Replaces the Sim-user-only workflow gate with validation that the delegation subject remains consistent with its execution principal.
apps/sim/lib/credential-groups/application/send-invite.ts	Allows actorless workflow invitations while deriving human attribution only from a verified Sim-user subject.
apps/sim/lib/credential-groups/enrollments.ts	Propagates an optional issuer through invitation creation and exposes nullable inviter attribution to the public enrollment page.
apps/sim/components/emails/credential-groups/credential-group-invitation-email.tsx	Adds explicit invitation copy for workflow-issued invitations without a named human inviter.
apps/sim/app/credential-groups/enroll/[token]/page.tsx	Renders neutral enrollment copy when the invitation has no persisted human issuer.
apps/sim/lib/credential-groups/application/send-invite.test.ts	Covers actorless, external-user, human-session, permission failure, fallback identity, and spoofed-subject invitation paths.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Run[Workflow execution] --> Delegation[Executor delegation]
  Delegation --> Consistency[Validate delegated subject consistency]
  Consistency --> Workspace[Check workspace and deployment authority]
  Workspace --> Scope[Check credential-group resource scope]
  Scope --> Operation[List groups, list people, or send invite]
  Operation --> Attribution{Sim user actor?}
  Attribution -->|Yes| Human[Load inviter identity]
  Attribution -->|No| Actorless[Use no human inviter]
  Human --> Invitation[Issue invitation]
  Actorless --> Invitation
  Invitation --> Email[Render actor-aware email copy]
  Invitation --> Audit[Record workflow execution attribution]

Loading

_{Reviews (1): Last reviewed commit: "fix(credential-groups): stop requiring a..." | Re-trigger Greptile}

[cubic-dev-ai]

No issues found across 11 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}