feat(resource-policies): add statement evaluator by TheodoreSpeaks · Pull Request #6892 · simstudioai/sim

TheodoreSpeaks · 2026-08-20T18:09:58Z

Summary

replace credential group grants with statement-based resource policies supporting explicit allow/deny and bounded IAM-style conditions
bind persisted execution principals and current workflow authority into credential-use decisions, while keeping actor-owned credential access as a hidden system rule
add a raw JSON policy editor plus trigger-owned policy lifecycle and a bounded backfill

Type of Change

New feature

Testing

bun run lint
bun run type-check
bun run check:audits
bun run check:migrations origin/staging
67 database tests and 221 focused application/workflow tests

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-08-20T18:10:04Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 23, 2026 8:49pm

cursor · 2026-08-20T18:10:11Z

PR Summary

High Risk
Changes authorization for managed OAuth credentials and internal executor delegation, including policy evaluation, deployment-version binding, and token issuance. Mis-evaluation could over- or under-grant credential access.

Overview
Replaces enrollment-only Credential Group token checks with stored IAM-style resource policies (allow/deny, principals, flat conditions) plus a hidden actor-own system rule. Admins can edit the full policy as JSON; credential use is policy-gated while listing stays discovery-only.

Adds a required per-group policy lifecycle (create/delete/backfill), optimistic-concurrency admin GET/PUT, and a settings Access tab. Credential use now evaluates credential_groups.credentials.use with explicit-deny precedence.

Threads current workflow (draft vs active deployment version) through executor delegation and child-workflow execution so workflow principals and sim:WorkflowMode conditions bind to the child, not the root. Deployed state APIs now require deploymentVersionId; stale or cross-workspace child authority fails closed.

^{Reviewed by Cursor Bugbot for commit a01a557. Bugbot is set up for automated code reviews on this repo. Configure here.}

greptile-apps · 2026-08-20T18:13:08Z

Greptile Summary

Adds versioned allow-only access policies for Credential Groups and propagates deployed-workflow authority through nested execution.

Adds policy persistence, optimistic revisions, contracts, management operations, and admin access APIs.
Adds an Access settings tab for workflow, workspace-role, and Access Control Group grants.
Carries current workflow and deployment-version authority through internal delegation and nested workflow execution.
Adds focused authorization, persistence, route, contract, and executor tests.

Confidence Score: 5/5

The PR appears safe to merge because no eligible blocking failure remains in the follow-up review.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/resource-policies/authorization.ts	Evaluates allow-only policy subjects against canonical workspace and delegated workflow execution context.
apps/sim/lib/resource-policies/repository.ts	Persists one policy per resource using atomic optimistic-revision inserts and updates.
apps/sim/lib/credential-groups/application/manage-access.ts	Adds authorized read and replacement-update operations for Credential Group access grants.
apps/sim/lib/auth/internal-delegation.ts	Binds delegated current-workflow authority to canonical workspace and deployment state.
apps/sim/executor/handlers/workflow/workflow-handler.ts	Propagates draft or deployed child-workflow authority through nested execution.
apps/sim/ee/credential-groups/components/credential-group-access.tsx	Adds the administrative UI for listing, adding, and removing explicit access grants.
packages/db/migrations/0298_sparkling_hemingway.sql	Introduces resource-policy persistence and uniqueness constraints aligned with the schema.

Sequence Diagram

sequenceDiagram
  participant Admin as Workspace Admin
  participant API as Credential Group Access API
  participant Policy as Resource Policy Store
  participant Exec as Workflow Executor
  participant Auth as Delegation Binding
  participant Cred as Credential Resolver

  Admin->>API: PUT explicit grants + expected revision
  API->>Policy: Validate subjects and replace policy
  Policy-->>API: New revision and grants
  Exec->>Auth: Delegated principal + current workflow authority
  Auth->>Auth: Bind workspace and deployment version
  Exec->>Cred: Request managed credential
  Cred->>Policy: Evaluate actor default and explicit grants
  Policy-->>Cred: Allow or deny credential use

_{Reviews (3): Last reviewed commit: "test(resource-policies): cover actor gra..." | Re-trigger Greptile}

cursor · 2026-08-21T02:04:26Z

+        throw new OrchestrationError('conflict', error.message)
+      }
+      throw error
+    }


Duplicate grants become server errors

Low Severity

updateCredentialGroupAccessBodySchema accepts duplicate subjects or grant ids, and only parseResourcePolicyDocument rejects them later. That failure is a raw Zod/Error rather than an OrchestrationError, so the access route maps it to a generic 500 instead of a validation response.

Additional Locations (1)

apps/sim/lib/api/contracts/credential-groups.ts#L136-L151

^{Reviewed by Cursor Bugbot for commit 64f547f. Configure here.}

TheodoreSpeaks · 2026-08-21T04:48:47Z

@greptile

TheodoreSpeaks · 2026-08-21T04:48:54Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

3 issues from previous reviews remain unresolved.

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit eccb03a. Configure here.}

TheodoreSpeaks · 2026-08-21T05:08:25Z

@greptile

TheodoreSpeaks · 2026-08-21T05:08:32Z

@cursor review

cursor

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

There are 5 total unresolved issues (including 3 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ede2aba. Configure here.}

cursor · 2026-08-21T05:16:29Z

+      queryClient.invalidateQueries({
+        queryKey: credentialGroupKeys.access(variables.workspaceId, variables.groupId),
+      }),
+  })


Stale revision on rapid access edits

Medium Severity

useUpdateCredentialGroupAccess only invalidates the access query after settle and never writes the mutation response into the cache. saveGrants keeps sending expectedRevision from the last fetched policy, so a second remove or add that starts before refetch finishes uses a stale revision and hits a conflict even though the first save succeeded.

Additional Locations (1)

apps/sim/ee/credential-groups/components/credential-group-access.tsx#L122-L176

^{Reviewed by Cursor Bugbot for commit ede2aba. Configure here.}

TheodoreSpeaks force-pushed the feat/credential-group-resource-policies branch from 9995853 to 0c9fb23 Compare August 20, 2026 18:12

vercel Bot deployed to Preview August 20, 2026 18:17 View deployment

vercel Bot temporarily deployed to Preview August 20, 2026 20:42 Inactive

cursor Bot reviewed Aug 20, 2026

View reviewed changes

Comment thread apps/sim/ee/credential-groups/components/credential-group-access.tsx Outdated

vercel Bot temporarily deployed to Preview August 20, 2026 21:22 Inactive

TheodoreSpeaks force-pushed the feat/credential-group-resource-policies branch from aaea6ae to 52e3168 Compare August 21, 2026 00:17

vercel Bot deployed to Preview August 21, 2026 00:22 View deployment

TheodoreSpeaks force-pushed the feat/credential-group-resource-policies branch 2 times, most recently from 95eafd9 to 9d5f513 Compare August 21, 2026 01:41

vercel Bot deployed to Preview August 21, 2026 01:46 View deployment

TheodoreSpeaks force-pushed the feat/credential-group-resource-policies branch 2 times, most recently from c2d891e to 64f547f Compare August 21, 2026 01:53

vercel Bot deployed to Preview August 21, 2026 01:58 View deployment

cursor Bot reviewed Aug 21, 2026

View reviewed changes

TheodoreSpeaks force-pushed the feat/credential-group-resource-policies branch from 64f547f to eccb03a Compare August 21, 2026 04:47

vercel Bot deployed to Preview August 21, 2026 04:53 View deployment

cursor Bot reviewed Aug 21, 2026

View reviewed changes

TheodoreSpeaks force-pushed the feat/credential-group-resource-policies branch from eccb03a to ede2aba Compare August 21, 2026 05:07

vercel Bot deployed to Preview August 21, 2026 05:15 View deployment

cursor Bot reviewed Aug 21, 2026

View reviewed changes

TheodoreSpeaks changed the title ~~feat(credential-groups): add resource access policies~~ feat(resource-policies): add statement evaluator Aug 23, 2026

vercel Bot deployed to Preview August 23, 2026 20:13 View deployment

TheodoreSpeaks added 5 commits August 23, 2026 13:14

feat(credential-groups): add resource access policies

f4baa7b

fix(credential-groups): clarify empty access subjects

4e222e6

fix(resource-policies): authorize credential use only

2efa24e

test(resource-policies): cover actor grant resolution

4d5bb9c

feat(resource-policies): add statement evaluator

a01a557

TheodoreSpeaks force-pushed the feat/credential-group-resource-policies branch from fab4e47 to a01a557 Compare August 23, 2026 20:44

vercel Bot deployed to Preview August 23, 2026 20:49 View deployment

Uh oh!

Conversation

TheodoreSpeaks commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-apps Bot commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

Uh oh!

cursor Bot Aug 21, 2026

Choose a reason for hiding this comment

Duplicate grants become server errors

Uh oh!

TheodoreSpeaks commented Aug 21, 2026

Uh oh!

TheodoreSpeaks commented Aug 21, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

TheodoreSpeaks commented Aug 21, 2026

Uh oh!

TheodoreSpeaks commented Aug 21, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Aug 21, 2026

Choose a reason for hiding this comment

Stale revision on rapid access edits

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

TheodoreSpeaks commented Aug 20, 2026 •

edited

Loading

vercel Bot commented Aug 20, 2026 •

edited

Loading

cursor Bot commented Aug 20, 2026 •

edited

Loading

greptile-apps Bot commented Aug 20, 2026 •

edited

Loading