fix(search): add an Atlassian site to the login that already holds it

Atlassian keeps one grant per login and adds each consented site to it, so
connecting the same login for another Confluence or Jira site was refused as an
already connected account. Treat it as a refresh of that account, which keeps the
new grant; every other provider still refuses a duplicate.

Author: waleedlatif1

apps/docs/content/docs/search/connect-your-account.mdx

@@ -25,6 +25,7 @@ After your admin adds a source in **Settings → Sources**, connect your own acc
 To connect another account of the same app, such as Google Drive for two different work accounts, open the app and choose **Add account**, then pick the other account when the provider asks. You can connect up to five accounts per app, and Search looks across all of them. Open an account to see its tool permissions when the app supports them; each account's menu has **Reconnect** and **Disconnect**.
 
 - Slack accounts must belong to your organization's connected workspace.
+- For another Confluence or Jira site on the same Atlassian login, choose **Add account** or **Reconnect** and pick the site. The site joins your existing account, and Search covers every site that login can reach.
 - Zoom, Lucid, and Databricks allow one account, because Sim cannot yet tell their accounts apart.
 - If the provider signs you straight back into a connected account, sign in to the other account with the provider first, then choose **Add account** again.
 

apps/sim/lib/credential-groups/__integration__/multiple-provider-accounts.integration.ts

@@ -93,6 +93,7 @@ const optionFor = (provider: CredentialGroupProvider) => ({
 const DRIVE = optionFor('google-drive')
 const GITHUB = optionFor('github-repositories')
 const SLACK = optionFor('slack')
+const CONFLUENCE = optionFor('confluence')
 
 function connect(
   code: string,
@@ -110,7 +111,7 @@ function connect(
     email,
     enrollmentStatus: 'completed',
     option,
-    options: [DRIVE, GITHUB, SLACK],
+    options: [DRIVE, GITHUB, SLACK, CONFLUENCE],
   }
   const attempt: CredentialGroupOAuthAttempt = {
     userId,
@@ -188,7 +189,7 @@ beforeAll(async () => {
     organizationId,
     publicId: generateId(),
     name: 'Connected accounts',
-    options: [DRIVE, GITHUB, SLACK],
+    options: [DRIVE, GITHUB, SLACK, CONFLUENCE],
   })
   await db.insert(member).values({
     id: generateId(),
@@ -337,6 +338,26 @@ describe('reconnecting one of several accounts', () => {
   })
 })
 
+describe('adding another site to an Atlassian login', () => {
+  it('keeps the new grant on the existing account instead of refusing it', async () => {
+    const first = await connect('person@atlassian', { kind: 'create' }, CONFLUENCE)
+    const [before] = await rows()
+
+    const added = await connect('person@atlassian', { kind: 'create' }, CONFLUENCE)
+
+    expect(added).toMatchObject({ created: false, credentialId: first.credentialId })
+    const after = await rows()
+    expect(after).toHaveLength(1)
+    expect(after[0]?.tokens).not.toBe(before?.tokens)
+  })
+
+  it('still adds a different Atlassian login as its own account', async () => {
+    await connect('person@atlassian', { kind: 'create' }, CONFLUENCE)
+    await connect('other@atlassian', { kind: 'create' }, CONFLUENCE)
+    expect(await rows()).toHaveLength(2)
+  })
+})
+
 describe('adding an account that needs reconnecting', () => {
   it('refreshes it instead of calling it already connected', async () => {
     const first = await connect('work@first-tenant.test', { kind: 'create' })

apps/sim/lib/credential-groups/account-rules.ts

@@ -34,9 +34,12 @@ export function resolveAccountWrite<Account extends ConnectedAccount>({
   limit,
   accounts,
   identity,
+  grantSpansSites = false,
 }: {
   intent?: CredentialGroupConnectionIntent
   limit: number
+  /** Connecting the same login again extends its grant, so it refreshes that account. */
+  grantSpansSites?: boolean
   accounts: Account[]
   identity: { subject: string; tenant: string | null } | null
 }): Account | undefined {
@@ -75,7 +78,7 @@ export function resolveAccountWrite<Account extends ConnectedAccount>({
 
   if (intent?.kind === 'create') {
     if (existing && !existing.revokedAt) {
-      if (existing.managedOauthStatus === 'active')
+      if (existing.managedOauthStatus === 'active' && !grantSpansSites)
         throw accountConflict('account_already_connected')
       return existing
     }

apps/sim/lib/credential-groups/oauth.ts

@@ -35,6 +35,7 @@ import {
 import { getCredentialGroupProviderAdapter } from '@/lib/credential-groups/provider-registry'
 import {
   type CredentialGroupProvider,
+  credentialGroupGrantSpansSites,
   getCredentialGroupProviderService,
   isCredentialGroupProvider,
 } from '@/lib/credential-groups/providers'
@@ -247,6 +248,7 @@ async function persistGrant(
       limit: CREDENTIAL_GROUP_ACCOUNTS_PER_PROVIDER_LIMIT,
       accounts,
       identity: { subject: grant.providerSubjectId, tenant: grant.providerTenantId },
+      grantSpansSites: credentialGroupGrantSpansSites(adapter.provider),
     })
 
     let refreshToken = grant.refreshToken

apps/sim/lib/credential-groups/providers.ts

@@ -52,6 +52,11 @@ interface CredentialGroupProviderSupport {
   serviceId: string
   description: string
   configuration: 'oauth' | 'slack_custom_bot'
+  /**
+   * One login holds a single grant that gains each site it consents to, so connecting that login
+   * again adds a site to the existing account rather than a second account.
+   */
+  grantSpansSites?: true
 }
 
 const CREDENTIAL_GROUP_PROVIDER_SUPPORT: Record<
@@ -127,11 +132,13 @@ const CREDENTIAL_GROUP_PROVIDER_SUPPORT: Record<
     serviceId: 'confluence',
     description: 'Let each person connect one Confluence account',
     configuration: 'oauth',
+    grantSpansSites: true,
   },
   jira: {
     serviceId: 'jira',
     description: 'Let each person connect one Jira account',
     configuration: 'oauth',
+    grantSpansSites: true,
   },
   airtable: {
     serviceId: 'airtable',
@@ -258,6 +265,10 @@ export function getCredentialGroupProviderService(
   return service
 }
 
+export function credentialGroupGrantSpansSites(provider: CredentialGroupProvider): boolean {
+  return CREDENTIAL_GROUP_PROVIDER_SUPPORT[provider].grantSpansSites === true
+}
+
 export function getCredentialGroupProviderId(provider: CredentialGroupProvider): string {
   return getCredentialGroupProviderService(provider).providerId
 }