fix(knowledge): resolve connector tokens as the credential owner, not the KB owner

[waleedlatif1]

Summary

• KB connector syncs resolved OAuth tokens as the knowledge base owner. Token reads are scoped to account.userId, so a shared workspace credential authorized by a different member resolved no token at all — surfacing as Failed to obtain access token for credential X (provider: confluence)
• Added resolveCredentialTokenIdentity and used it in the sync engine and the connector PATCH route, matching how authorizeCredentialUse (65 request-bound routes) and getCredentialOwner (webhooks + subscription-renewal cron) already resolve credentials
• Connectors were the only module in the app treating resource ownership as credential ownership
• Also scopes the credential to the KB's workspace and requires its owner to still have workspace access; service-account credentials pass through unchanged since they mint their own token and ignore the acting user

Reported from a live workspace: the KB was owned by one member while the Confluence credential was authorized by another, so every sync failed and swapping service accounts couldn't help.

Type of Change

• Bug fix

Testing

Verified against production data: all 102 existing credential-backed connectors resolve to the same user before and after this change, so it is a no-op for every current connector and only alters the already-broken case. Also confirmed zero connectors would be newly rejected by the added workspace/permission guards, and zero use service-account credentials.

830 tests passing across credentials/oauth/webhooks (9 new), typecheck clean, check:api-validation passing.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 28, 2026 11:11pm

[cursor]

PR Summary

Medium Risk
Changes OAuth token resolution for connector sync and PATCH validation in a credential-sensitive path; behavior is narrowed with workspace/permission checks and is intended to be a no-op for correctly configured connectors.

Overview
Fixes knowledge connector OAuth syncs and config validation when the knowledge base owner differs from the member who authorized the workspace credential — token refresh was keyed to account.userId, so using the KB owner often returned no token and syncs failed.

Adds resolveCredentialTokenIdentity to pick the credential’s OAuth account owner (with workspace match, owner still has workspace access, legacy account-id fallback, and service-account handling). The sync engine and connector PATCH route use that identity for refreshAccessTokenIfNeeded instead of the KB owner.

The add-connector OAuth picker excludes service accounts, since connectors don’t support that auth path today.

^{Reviewed by Cursor Bugbot for commit 3f89cce. Configure here.}

[greptile-apps]

Greptile Summary

Fixes KB connector OAuth token resolution so syncs and connector PATCH use the credential account owner (scoped to the KB workspace), not the knowledge base owner.

• Adds resolveCredentialTokenIdentity with workspace + owner-access checks (service accounts pass through).
• Wires it into the connector sync engine and connector PATCH route.
• Hides service-account credentials from the add-connector modal (connectors only support OAuth/API key auth shapes).

Confidence Score: 5/5

The PR appears safe to merge; prior Greptile findings are not outstanding against this HEAD and no new follow-up-eligible defects were established.

No blocking failure remains for connector credential token identity resolution on the changed paths.

Important Files Changed

Filename	Overview
apps/sim/lib/credentials/access.ts	New shared helper resolves OAuth token identity by credential account owner with workspace and permission gates.
apps/sim/lib/knowledge/connectors/sync-engine.ts	Sync uses credential owner userId for OAuth token refresh instead of KB owner.
apps/sim/app/api/knowledge/[id]/connectors/[connectorId]/route.ts	PATCH OAuth path uses the same identity resolution and requires KB workspace context.
apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/add-connector-modal/add-connector-modal.tsx	Filters service-account credentials out of the connector picker.
apps/sim/lib/credentials/access.test.ts	Covers owner resolution, workspace mismatch, service accounts, legacy account ids, and departed owners.

Sequence Diagram

sequenceDiagram
  participant Sync as executeSync / PATCH
  participant Resolve as resolveCredentialTokenIdentity
  participant Cred as credential table
  participant Acct as account table
  participant Perm as getUserEntityPermissions
  participant OAuth as refreshAccessTokenIfNeeded

  Sync->>Resolve: credentialId, workspaceId
  Resolve->>Cred: load credential
  alt wrong workspace / unsupported type
    Resolve-->>Sync: null
  else service_account
    Resolve-->>Sync: kind service_account
    Sync->>OAuth: refresh(credentialId, callerUserId)
  else oauth
    Resolve->>Acct: "accountId -> userId"
    Resolve->>Perm: owner still in workspace?
    alt no access or missing account
      Resolve-->>Sync: null
    else ok
      Resolve-->>Sync: kind oauth, userId
      Sync->>OAuth: refresh(credentialId, ownerUserId)
    end
  end

Loading

_{Reviews (3): Last reviewed commit: "fix(knowledge): resolve connector tokens..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit bfb1d1c. Configure here.}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 3f89cce. Configure here.}