fix(org): key the Gmail mailbox cache on the provider subject

Managed credentials always store a null account id, so the key never told accounts apart. The
subject is what a reconnect actually changes on a managed credential.

Author: waleedlatif1

apps/sim/lib/credential-groups/viewer-accounts.ts

@@ -14,7 +14,7 @@ export async function listViewerOrganizationAccounts(input: {
   const accounts = await db
     .select({
       credentialId: credential.id,
-      accountId: credential.accountId,
+      providerSubjectId: credential.providerSubjectId,
       displayName: credential.displayName,
       status: credential.managedOauthStatus,
       groupId: credentialGroup.id,

apps/sim/lib/organizations/application/home-widgets.ts

@@ -107,7 +107,7 @@ interface WidgetReadResult<T> {
 
 /** One account's read: which grant it is, and how many accounts this widget read is sharing. */
 interface ViewerAccountRead extends ProviderTokenInput {
-  accountId: string | null
+  providerSubjectId: string | null
   readableAccounts: number
   withToken: AccountTokenRead
 }
@@ -173,7 +173,8 @@ async function readViewerAccounts<T>(
 
   const results = await Promise.all(
     candidates.map(async (candidate) => {
-      const { credentialId, accountId, displayName, provider, providerId, status, read } = candidate
+      const { credentialId, providerSubjectId, displayName, provider, providerId, status, read } =
+        candidate
       const settled = (state: HomeWidgetAccount['state'], rows: T[] = []) => ({
         account: { credentialId, displayName, state },
         rows: rows.map((row) => ({ ...row, credentialId })),
@@ -186,7 +187,7 @@ async function readViewerAccounts<T>(
         const tokenInput = { context, credentialId, providerId }
         const account = {
           ...tokenInput,
-          accountId,
+          providerSubjectId,
           readableAccounts: toRead.size,
           withToken: createAccountTokenRead(tokenInput),
         }
@@ -261,7 +262,7 @@ export const readOrganizationHomeEmail = defineOrganizationAccountsUseCase({
           accessToken,
           signal,
           credentialId: account.credentialId,
-          accountId: account.accountId,
+          providerSubjectId: account.providerSubjectId,
           count: Math.ceil(HOME_EMAIL_THREAD_LIMIT / account.readableAccounts),
         })
         cursors.set(account.credentialId, { ...cursor, account })

apps/sim/lib/organizations/home/provider-reads.test.ts

@@ -83,7 +83,7 @@ async function readGmailThreads(input: { accessToken: string; signal: AbortSigna
   const { threads } = await readGmailThreadsPage({
     ...input,
     credentialId: `credential-${credentialCount}`,
-    accountId: 'account',
+    providerSubjectId: 'google-sub',
     count: HOME_EMAIL_THREAD_LIMIT,
   })
   return threads
@@ -296,7 +296,13 @@ describe('sharing a Gmail read across accounts', () => {
         : respond(gmailThread('t', [metadataMessage('Ada', 'S', 'P')]))
     )
     const read = (accessToken: string, credentialId: string) =>
-      readGmailThreadsPage({ accessToken, signal, credentialId, accountId: 'account', count: 1 })
+      readGmailThreadsPage({
+        accessToken,
+        signal,
+        credentialId,
+        providerSubjectId: 'google-sub',
+        count: 1,
+      })
     await read('token-a', 'mailbox-cached')
     const rotated = await read('token-b', 'mailbox-cached')
     expect(mailboxEmail).toHaveBeenCalledTimes(1)
@@ -305,23 +311,23 @@ describe('sharing a Gmail read across accounts', () => {
     expect(mailboxEmail).toHaveBeenCalledTimes(2)
   })
 
-  it('reads the mailbox again when a reconnect moves the credential to another account', async () => {
+  it('reads the mailbox again when a reconnect binds a credential that had no subject', async () => {
     providerFetch.mockImplementation(async (url: string) =>
       url.includes('/threads?')
         ? respond({ threads: [{ id: 't' }] })
         : respond(gmailThread('t', [metadataMessage('Ada', 'S', 'P')]))
     )
-    const read = (accountId: string) =>
+    const read = (providerSubjectId: string | null) =>
       readGmailThreadsPage({
         accessToken: 'token',
         signal,
         credentialId: 'mailbox-reconnected',
-        accountId,
+        providerSubjectId,
         count: 1,
       })
-    await read('account-old')
+    await read(null)
     mailboxEmail.mockResolvedValue('new@example.com')
-    const reconnected = await read('account-new')
+    const reconnected = await read('google-sub-new')
     expect(reconnected.threads[0].url).toBe(gmailThreadUrl('t', 'new@example.com'))
   })
 
@@ -338,7 +344,7 @@ describe('sharing a Gmail read across accounts', () => {
       accessToken: 'token',
       signal,
       credentialId: 'mailbox-parallel',
-      accountId: 'account',
+      providerSubjectId: 'google-sub',
       count: 1,
     })
     await vi.waitFor(() => expect(mailboxEmail).toHaveBeenCalledOnce())
@@ -358,7 +364,7 @@ describe('sharing a Gmail read across accounts', () => {
         accessToken: 't',
         signal,
         credentialId: 'mailbox-failed',
-        accountId: 'account',
+        providerSubjectId: 'google-sub',
         count: 1,
       })
     await expect(read()).rejects.toMatchObject({ failure: 'unavailable' })

apps/sim/lib/organizations/home/provider-reads.ts

@@ -175,9 +175,9 @@ function mailboxReadFailure(error: unknown): HomeProviderReadError {
 }
 
 /**
- * The address thread links open as. A reconnect can point a credential at another Google account, on
- * any instance, so the key names the account too. It holds only the address: the token itself is
- * resolved fresh for every read.
+ * The address thread links open as. A reconnect can bind a credential to a Google account it had no
+ * identity for, on any instance, so the key names the account's subject too. It holds only the
+ * address: the token itself is resolved fresh for every read.
  */
 const gmailMailboxes = new LRUCache<string, string>({
   max: 10_000,
@@ -188,9 +188,9 @@ async function readGmailMailbox({
   accessToken,
   signal,
   credentialId,
-  accountId,
-}: ProviderReadInput & { credentialId: string; accountId: string | null }) {
-  const key = `${credentialId}:${accountId}`
+  providerSubjectId,
+}: ProviderReadInput & { credentialId: string; providerSubjectId: string | null }) {
+  const key = `${credentialId}:${providerSubjectId}`
   const cached = gmailMailboxes.get(key)
   if (cached !== undefined) return cached
   const mailbox = await getGmailMailboxEmail(accessToken, { signal }).catch((error: unknown) => {
@@ -211,9 +211,13 @@ export async function readGmailThreads({
   accessToken,
   signal,
   credentialId,
-  accountId,
+  providerSubjectId,
   count,
-}: ProviderReadInput & { credentialId: string; accountId: string | null; count: number }): Promise<{
+}: ProviderReadInput & {
+  credentialId: string
+  providerSubjectId: string | null
+  count: number
+}): Promise<{
   threads: HomeEmailThread[]
   cursor: GmailThreadCursor
 }> {
@@ -223,7 +227,7 @@ export async function readGmailThreads({
       { accessToken, labelIds: 'INBOX', maxResults: HOME_EMAIL_THREAD_LIMIT },
       signal
     ),
-    readGmailMailbox({ accessToken, signal, credentialId, accountId }),
+    readGmailMailbox({ accessToken, signal, credentialId, providerSubjectId }),
   ])
   if (!list.success) throw new HomeProviderReadError('unavailable')
   const cursor: GmailThreadCursor = {