chore: import upstream snapshot with attribution

apps/sim/app/api/credentials/[id]/members/route.ts

@@ -0,0 +1,406 @@
+import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
+import { db } from '@sim/db'
+import { credential, credentialMember, user } from '@sim/db/schema'
+import { createLogger } from '@sim/logger'
+import { generateId } from '@sim/utils/id'
+import { and, eq } from 'drizzle-orm'
+import { type NextRequest, NextResponse } from 'next/server'
+import {
+  upsertWorkspaceCredentialMemberContract,
+  type WorkspaceCredentialMember,
+} from '@/lib/api/contracts/credentials'
+import { parseRequest } from '@/lib/api/server'
+import { getSession } from '@/lib/auth'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { deriveCredentialAdmin, isSharedCredentialType } from '@/lib/credentials/access'
+import { captureServerEvent } from '@/lib/posthog/server'
+import {
+  getUserEntityPermissions,
+  getUsersWithPermissions,
+} from '@/lib/workspaces/permissions/utils'
+
+const logger = createLogger('CredentialMembersAPI')
+
+interface RouteContext {
+  params: Promise<{ id: string }>
+}
+
+async function requireCredentialAdmin(credentialId: string, userId: string) {
+  const [cred] = await db
+    .select({ id: credential.id, workspaceId: credential.workspaceId, type: credential.type })
+    .from(credential)
+    .where(eq(credential.id, credentialId))
+    .limit(1)
+
+  if (!cred) return null
+
+  const perm = await getUserEntityPermissions(userId, 'workspace', cred.workspaceId)
+  if (perm === null) return null
+
+  const [membership] = await db
+    .select({ role: credentialMember.role, status: credentialMember.status })
+    .from(credentialMember)
+    .where(
+      and(eq(credentialMember.credentialId, credentialId), eq(credentialMember.userId, userId))
+    )
+    .limit(1)
+
+  const isAdmin = deriveCredentialAdmin({
+    credentialType: cred.type,
+    memberRole: membership?.status === 'active' ? membership.role : null,
+    workspaceCanAdmin: perm === 'admin',
+  })
+
+  if (!isAdmin) {
+    return null
+  }
+  return { credentialType: cred.type, workspaceId: cred.workspaceId }
+}
+
+export const GET = withRouteHandler(async (_request: NextRequest, context: RouteContext) => {
+  try {
+    const session = await getSession()
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    const { id: credentialId } = await context.params
+
+    const [cred] = await db
+      .select({ id: credential.id, workspaceId: credential.workspaceId, type: credential.type })
+      .from(credential)
+      .where(eq(credential.id, credentialId))
+      .limit(1)
+
+    if (!cred) {
+      return NextResponse.json({ error: 'Not found' }, { status: 404 })
+    }
+
+    const callerPerm = await getUserEntityPermissions(
+      session.user.id,
+      'workspace',
+      cred.workspaceId
+    )
+    if (callerPerm === null) {
+      return NextResponse.json({ error: 'Not found' }, { status: 404 })
+    }
+
+    const explicitMembers = await db
+      .select({
+        id: credentialMember.id,
+        userId: credentialMember.userId,
+        role: credentialMember.role,
+        status: credentialMember.status,
+        joinedAt: credentialMember.joinedAt,
+        userName: user.name,
+        userEmail: user.email,
+      })
+      .from(credentialMember)
+      .innerJoin(user, eq(credentialMember.userId, user.id))
+      .where(eq(credentialMember.credentialId, credentialId))
+
+    const byUser = new Map<string, WorkspaceCredentialMember>(
+      explicitMembers.map((m) => [
+        m.userId,
+        {
+          id: m.id,
+          userId: m.userId,
+          role: m.role,
+          status: m.status,
+          joinedAt: m.joinedAt ? m.joinedAt.toISOString() : null,
+          userName: m.userName,
+          userEmail: m.userEmail,
+          roleSource: 'explicit' as const,
+        },
+      ])
+    )
+
+    if (isSharedCredentialType(cred.type)) {
+      const workspaceMembers = await getUsersWithPermissions(cred.workspaceId)
+      for (const wsMember of workspaceMembers) {
+        if (wsMember.permissionType !== 'admin') continue
+        const existing = byUser.get(wsMember.userId)
+        if (existing) {
+          existing.role = 'admin'
+          existing.status = 'active'
+          existing.roleSource = 'workspace-admin'
+        } else {
+          byUser.set(wsMember.userId, {
+            id: `workspace-admin-${wsMember.userId}`,
+            userId: wsMember.userId,
+            role: 'admin',
+            status: 'active',
+            joinedAt: null,
+            userName: wsMember.name,
+            userEmail: wsMember.email,
+            roleSource: 'workspace-admin',
+          })
+        }
+      }
+    }
+
+    const members = Array.from(byUser.values())
+
+    return NextResponse.json({ members })
+  } catch (error) {
+    logger.error('Failed to fetch credential members', { error })
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
+  }
+})
+
+export const POST = withRouteHandler(async (request: NextRequest, context: RouteContext) => {
+  try {
+    const session = await getSession()
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    const { id: credentialId } = await context.params
+
+    const admin = await requireCredentialAdmin(credentialId, session.user.id)
+    if (!admin) {
+      logger.warn('Credential member share denied', {
+        credentialId,
+        actorId: session.user.id,
+        reason: 'not-admin',
+      })
+      return NextResponse.json({ error: 'Admin access required' }, { status: 403 })
+    }
+    if (!isSharedCredentialType(admin.credentialType)) {
+      logger.warn('Credential member share denied', {
+        credentialId,
+        actorId: session.user.id,
+        reason: 'env_personal-cannot-be-shared',
+      })
+      return NextResponse.json({ error: 'Personal secrets cannot be shared' }, { status: 400 })
+    }
+
+    const parsed = await parseRequest(upsertWorkspaceCredentialMemberContract, request, context)
+    if (!parsed.success) return parsed.response
+
+    const { userId, role } = parsed.data.body
+
+    const targetWorkspacePerm = await getUserEntityPermissions(
+      userId,
+      'workspace',
+      admin.workspaceId
+    )
+    if (targetWorkspacePerm === 'admin' && role !== 'admin') {
+      return NextResponse.json(
+        { error: 'Workspace admins are automatically credential admins and cannot be demoted' },
+        { status: 400 }
+      )
+    }
+
+    const now = new Date()
+
+    const [existing] = await db
+      .select({ id: credentialMember.id, status: credentialMember.status })
+      .from(credentialMember)
+      .where(
+        and(eq(credentialMember.credentialId, credentialId), eq(credentialMember.userId, userId))
+      )
+      .limit(1)
+
+    if (existing) {
+      const result = await db.transaction(async (tx) => {
+        const [current] = await tx
+          .select({ role: credentialMember.role, status: credentialMember.status })
+          .from(credentialMember)
+          .where(eq(credentialMember.id, existing.id))
+          .limit(1)
+          .for('update')
+        if (
+          !isSharedCredentialType(admin.credentialType) &&
+          current?.role === 'admin' &&
+          current?.status === 'active' &&
+          role !== 'admin'
+        ) {
+          const activeAdmins = await tx
+            .select({ id: credentialMember.id })
+            .from(credentialMember)
+            .where(
+              and(
+                eq(credentialMember.credentialId, credentialId),
+                eq(credentialMember.role, 'admin'),
+                eq(credentialMember.status, 'active')
+              )
+            )
+            .for('update')
+          if (activeAdmins.length <= 1) return { ok: false as const }
+        }
+        await tx
+          .update(credentialMember)
+          .set({ role, status: 'active', updatedAt: now })
+          .where(eq(credentialMember.id, existing.id))
+        return { ok: true as const, fromRole: current?.role }
+      })
+      if (!result.ok) {
+        return NextResponse.json({ error: 'Cannot demote the last admin' }, { status: 400 })
+      }
+
+      recordAudit({
+        workspaceId: admin.workspaceId,
+        actorId: session.user.id,
+        actorName: session.user.name,
+        actorEmail: session.user.email,
+        action: AuditAction.CREDENTIAL_MEMBER_ROLE_CHANGED,
+        resourceType: AuditResourceType.CREDENTIAL,
+        resourceId: credentialId,
+        description: `Changed credential member role to "${role}"`,
+        metadata: { targetUserId: userId, fromRole: result.fromRole, toRole: role },
+        request,
+      })
+
+      return NextResponse.json({ success: true })
+    }
+
+    await db.insert(credentialMember).values({
+      id: generateId(),
+      credentialId,
+      userId,
+      role,
+      status: 'active',
+      joinedAt: now,
+      invitedBy: session.user.id,
+      createdAt: now,
+      updatedAt: now,
+    })
+
+    captureServerEvent(session.user.id, 'credential_shared', {
+      credential_type: admin.credentialType,
+      role,
+      workspace_id: admin.workspaceId,
+    })
+
+    recordAudit({
+      workspaceId: admin.workspaceId,
+      actorId: session.user.id,
+      actorName: session.user.name,
+      actorEmail: session.user.email,
+      action: AuditAction.CREDENTIAL_MEMBER_ADDED,
+      resourceType: AuditResourceType.CREDENTIAL,
+      resourceId: credentialId,
+      description: `Shared credential with member as "${role}"`,
+      metadata: { targetUserId: userId, role },
+      request,
+    })
+
+    return NextResponse.json({ success: true }, { status: 201 })
+  } catch (error) {
+    logger.error('Failed to add credential member', { error })
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
+  }
+})
+
+export const DELETE = withRouteHandler(async (request: NextRequest, context: RouteContext) => {
+  try {
+    const session = await getSession()
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    const { id: credentialId } = await context.params
+    const targetUserId = new URL(request.url).searchParams.get('userId')
+    if (!targetUserId) {
+      return NextResponse.json({ error: 'userId query parameter required' }, { status: 400 })
+    }
+
+    const admin = await requireCredentialAdmin(credentialId, session.user.id)
+    if (!admin) {
+      logger.warn('Credential member removal denied', {
+        credentialId,
+        actorId: session.user.id,
+        reason: 'not-admin',
+      })
+      return NextResponse.json({ error: 'Admin access required' }, { status: 403 })
+    }
+
+    const [target] = await db
+      .select({
+        id: credentialMember.id,
+        role: credentialMember.role,
+      })
+      .from(credentialMember)
+      .where(
+        and(
+          eq(credentialMember.credentialId, credentialId),
+          eq(credentialMember.userId, targetUserId),
+          eq(credentialMember.status, 'active')
+        )
+      )
+      .limit(1)
+
+    if (!target) {
+      return NextResponse.json({ error: 'Member not found' }, { status: 404 })
+    }
+
+    if (isSharedCredentialType(admin.credentialType)) {
+      const targetWorkspacePerm = await getUserEntityPermissions(
+        targetUserId,
+        'workspace',
+        admin.workspaceId
+      )
+      if (targetWorkspacePerm === 'admin') {
+        return NextResponse.json(
+          { error: 'Workspace admins are automatically credential admins and cannot be removed' },
+          { status: 400 }
+        )
+      }
+    }
+
+    const revoked = await db.transaction(async (tx) => {
+      if (!isSharedCredentialType(admin.credentialType) && target.role === 'admin') {
+        const activeAdmins = await tx
+          .select({ id: credentialMember.id })
+          .from(credentialMember)
+          .where(
+            and(
+              eq(credentialMember.credentialId, credentialId),
+              eq(credentialMember.role, 'admin'),
+              eq(credentialMember.status, 'active')
+            )
+          )
+          .for('update')
+
+        if (activeAdmins.length <= 1) {
+          return false
+        }
+      }
+
+      await tx
+        .update(credentialMember)
+        .set({ status: 'revoked', updatedAt: new Date() })
+        .where(eq(credentialMember.id, target.id))
+
+      return true
+    })
+
+    if (!revoked) {
+      return NextResponse.json({ error: 'Cannot remove the last admin' }, { status: 400 })
+    }
+
+    captureServerEvent(session.user.id, 'credential_unshared', {
+      credential_type: admin.credentialType,
+      workspace_id: admin.workspaceId,
+    })
+
+    recordAudit({
+      workspaceId: admin.workspaceId,
+      actorId: session.user.id,
+      actorName: session.user.name,
+      actorEmail: session.user.email,
+      action: AuditAction.CREDENTIAL_MEMBER_REMOVED,
+      resourceType: AuditResourceType.CREDENTIAL,
+      resourceId: credentialId,
+      description: 'Removed credential member',
+      metadata: { targetUserId },
+      request,
+    })
+
+    return NextResponse.json({ success: true })
+  } catch (error) {
+    logger.error('Failed to remove credential member', { error })
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
+  }
+})

apps/sim/app/api/credentials/[id]/route.ts

@@ -0,0 +1,155 @@
+import { createLogger } from '@sim/logger'
+import { type NextRequest, NextResponse } from 'next/server'
+import { updateWorkspaceCredentialContract } from '@/lib/api/contracts/credentials'
+import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
+import { getSession } from '@/lib/auth'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { type CredentialActorContext, getCredentialActorContext } from '@/lib/credentials/access'
+import { performDeleteCredential, performUpdateCredential } from '@/lib/credentials/orchestration'
+
+const logger = createLogger('CredentialByIdAPI')
+
+function formatCredentialResponse(access: CredentialActorContext) {
+  const cred = access.credential
+  if (!cred) return null
+
+  return {
+    id: cred.id,
+    workspaceId: cred.workspaceId,
+    type: cred.type,
+    displayName: cred.displayName,
+    description: cred.description,
+    providerId: cred.providerId,
+    accountId: cred.accountId,
+    envKey: cred.envKey,
+    envOwnerUserId: cred.envOwnerUserId,
+    createdBy: cred.createdBy,
+    createdAt: cred.createdAt,
+    updatedAt: cred.updatedAt,
+    role: access.isAdmin ? 'admin' : (access.member?.role ?? null),
+    status: access.member?.status ?? (access.isAdmin ? 'active' : null),
+  }
+}
+
+export const GET = withRouteHandler(
+  async (request: NextRequest, { params }: { params: Promise<{ id: string }> }) => {
+    const session = await getSession()
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    const { id } = await params
+
+    try {
+      const access = await getCredentialActorContext(id, session.user.id)
+      if (!access.credential) {
+        return NextResponse.json({ error: 'Credential not found' }, { status: 404 })
+      }
+      if (!access.hasWorkspaceAccess || (!access.member && !access.isAdmin)) {
+        return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+      }
+
+      return NextResponse.json({ credential: formatCredentialResponse(access) }, { status: 200 })
+    } catch (error) {
+      logger.error('Failed to fetch credential', error)
+      return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
+    }
+  }
+)
+
+export const PUT = withRouteHandler(
+  async (request: NextRequest, context: { params: Promise<{ id: string }> }) => {
+    const session = await getSession()
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    try {
+      const parsed = await parseRequest(updateWorkspaceCredentialContract, request, context, {
+        validationErrorResponse: (error) =>
+          NextResponse.json({ error: getValidationErrorMessage(error) }, { status: 400 }),
+      })
+      if (!parsed.success) return parsed.response
+
+      const { id } = parsed.data.params
+      const body = parsed.data.body
+
+      const result = await performUpdateCredential({
+        credentialId: id,
+        userId: session.user.id,
+        actorName: session.user.name,
+        actorEmail: session.user.email,
+        displayName: body.displayName,
+        description: body.description,
+        serviceAccountJson: body.serviceAccountJson,
+        signingSecret: body.signingSecret,
+        botToken: body.botToken,
+        apiToken: body.apiToken,
+        domain: body.domain,
+        request,
+      })
+      if (!result.success) {
+        const status =
+          result.errorCode === 'not_found'
+            ? 404
+            : result.errorCode === 'forbidden'
+              ? 403
+              : result.errorCode === 'conflict'
+                ? 409
+                : result.errorCode === 'validation'
+                  ? 400
+                  : 500
+        return NextResponse.json(
+          {
+            error: result.error,
+            ...(result.providerErrorCode ? { code: result.providerErrorCode } : {}),
+          },
+          { status }
+        )
+      }
+
+      const access = await getCredentialActorContext(id, session.user.id)
+      return NextResponse.json({ credential: formatCredentialResponse(access) }, { status: 200 })
+    } catch (error) {
+      logger.error('Failed to update credential', error)
+      return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
+    }
+  }
+)
+
+export const DELETE = withRouteHandler(
+  async (request: NextRequest, { params }: { params: Promise<{ id: string }> }) => {
+    const session = await getSession()
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    const { id } = await params
+
+    try {
+      const result = await performDeleteCredential({
+        credentialId: id,
+        userId: session.user.id,
+        actorName: session.user.name,
+        actorEmail: session.user.email,
+        request,
+      })
+      if (!result.success) {
+        const status =
+          result.errorCode === 'not_found'
+            ? 404
+            : result.errorCode === 'forbidden'
+              ? 403
+              : result.errorCode === 'validation'
+                ? 400
+                : 500
+        return NextResponse.json({ error: result.error }, { status })
+      }
+
+      return NextResponse.json({ success: true }, { status: 200 })
+    } catch (error) {
+      logger.error('Failed to delete credential', error)
+      return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
+    }
+  }
+)