fix(search): apply shared personal account limits and eligibility

Author: waleedlatif1

apps/docs/content/docs/search/flow.mdx

@@ -13,6 +13,8 @@ Flow Engineering Search retrieves current engineering items when you search. It
 
 The default API host is `backend.branch.flowengineering.com`; use the host shown by your Flow instance. Sim saves the destination with the credential and verifies the current user before each Search operation. Other members cannot search with your connection. Reconnecting preserves the provider identity and workspace; use a new connection for a different account or workspace.
 
+You can connect up to five accounts per provider. Reconnect an existing account to rotate its credentials.
+
 ## Search and read
 
 Use a short phrase, optionally scoped to a known Flow project ID. Without a project, Sim searches at most six accessible projects. Each project returns up to 100 matches, subject to the requested result limit. Flow does not provide a continuation cursor for this search endpoint, so narrow the project or query when results are incomplete.

apps/docs/content/docs/search/jama.mdx

@@ -15,6 +15,8 @@ Sim exchanges the saved client credentials for a short-lived access token. Searc
 
 Self-hosted instance URLs may include a deployment context path. The instance must be reachable from Sim's server environment. If your organization uses dedicated outbound IPs, allowlist those addresses for HTTPS access.
 
+You can connect up to five accounts per provider. Reconnect an existing account to rotate its credentials.
+
 ## Search and read
 
 Search with a short phrase or distinctive requirement text. A native query can specify a numeric project ID. Each call retrieves up to 50 items; continue with the returned cursor to request another page.

apps/sim/app/api/search/personal-credentials/route.ts

@@ -7,7 +7,10 @@ import {
   internalRateLimits,
   internalSessionAuth,
 } from '@/lib/api/server/routes'
-import { internalCredentialErrorPolicy } from '@/lib/credentials/api/route-policies'
+import {
+  internalCredentialErrorPolicy,
+  internalPersonalCredentialConnectionErrorPolicy,
+} from '@/lib/credentials/api/route-policies'
 import {
   removeSearchPersonalCredential,
   saveSearchPersonalCredential,
@@ -18,7 +21,7 @@ export const POST = defineInternalJsonRoute({
   auth: internalSessionAuth,
   operation: saveSearchPersonalCredential.operation,
   rateLimit: internalRateLimits.user({ bucketName: 'search-personal-credentials' }),
-  errorPolicy: internalCredentialErrorPolicy,
+  errorPolicy: internalPersonalCredentialConnectionErrorPolicy,
   parseOptions: { maxBodyBytes: 16_384 },
   mapInput: ({ body }) => body,
   useCase: saveSearchPersonalCredential,

apps/sim/lib/credential-groups/member-integrations.test.ts

@@ -56,6 +56,30 @@ function entryFor(provider: string, viewerAccounts: unknown[], viewerMcpAccounts
 }
 
 describe('offering another account', () => {
+  it.each(['jama', 'flow'] as const)(
+    'keeps %s reconnects available but stops offering another account at the limit',
+    (provider) => {
+      const providerId = `${provider}-service-account` as const
+      const accounts = Array.from({ length: 5 }, (_, index) => ({
+        credentialId: `${provider}-${index}`,
+        displayName: `account-${index}@example.test`,
+        providerId,
+        status: 'active' as const,
+      }))
+      const project = (viewerSavedAccounts: typeof accounts) =>
+        memberIntegrationEntries({ ...settings([]), viewerSavedAccounts }, [
+          approved(provider),
+        ]).find((entry) => entry.provider === provider)
+
+      expect(project(accounts.slice(0, 4))?.connectionTarget).toEqual({
+        savedProviderId: providerId,
+      })
+      const full = project(accounts)
+      expect(full?.connectionTarget).toBeUndefined()
+      expect(full?.reconnectAccountIds).toEqual(accounts.map((entry) => entry.credentialId))
+    }
+  )
+
   it('still offers the provider to a member who has connected one account', () => {
     expect(entryFor('google_drive', [account(1, 'drive', 'google-drive')])).toMatchObject({
       connectionTarget: { optionId: 'drive' },

apps/sim/lib/credential-groups/member-integrations.ts

@@ -121,7 +121,10 @@ export function memberIntegrationEntries(
         ready,
         permissionAccountIds: [],
         reconnectAccountIds: ready ? savedAccounts.map((account) => account.credentialId) : [],
-        connectionTarget: ready ? { savedProviderId } : undefined,
+        connectionTarget:
+          ready && savedAccounts.length < CREDENTIAL_GROUP_ACCOUNTS_PER_PROVIDER_LIMIT
+            ? { savedProviderId }
+            : undefined,
         description: !policies
           ? undefined
           : approval?.available === false

apps/sim/lib/credentials/application/search-personal-credentials.integration.ts

@@ -9,6 +9,10 @@ import {
 } from '@sim/db/schema'
 import { createSessionPrincipal } from '@sim/testing/factories/principal.factory'
 import { createDeferred } from '@sim/testing/helpers/deferred'
+import {
+  credentialGroupsAvailabilityMock,
+  credentialGroupsAvailabilityMockFns,
+} from '@sim/testing/mocks/credential-groups-availability.mock'
 import { generateId } from '@sim/utils/id'
 import { and, eq, inArray } from 'drizzle-orm'
 import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
@@ -20,6 +24,7 @@ import {
 import type { ServiceAccountSecretResult } from '@/lib/credentials/service-account-secret'
 
 const verifier = vi.hoisted(() => vi.fn())
+vi.mock('@/lib/credential-groups/scoped-availability', () => credentialGroupsAvailabilityMock)
 vi.mock('@/lib/credentials/service-account-secret', () => ({
   verifyAndBuildServiceAccountSecret: verifier,
 }))
@@ -81,6 +86,7 @@ describe('personal Search connections in PostgreSQL', () => {
   })
 
   beforeEach(async () => {
+    credentialGroupsAvailabilityMockFns.mockIsScopedCredentialGroupsAvailable.mockReset()
     verifier.mockReset().mockResolvedValue(verified())
     await db
       .delete(credential)
@@ -120,6 +126,27 @@ describe('personal Search connections in PostgreSQL', () => {
     await db.delete(user).where(inArray(user.id, [userId, adminId]))
   })
 
+  it('refuses provider verification and persistence when connected accounts are unavailable', async () => {
+    credentialGroupsAvailabilityMockFns.mockIsScopedCredentialGroupsAvailable.mockResolvedValueOnce(
+      false
+    )
+    await expect(save()).rejects.toMatchObject({ code: 'not_found' })
+    expect(verifier).not.toHaveBeenCalled()
+    expect(await ownRows()).toEqual([])
+  })
+
+  it('still removes a personal connection after connected accounts become unavailable', async () => {
+    const created = await save()
+    credentialGroupsAvailabilityMockFns.mockIsScopedCredentialGroupsAvailable.mockResolvedValue(
+      false
+    )
+    await removeSearchPersonalCredential.execute({
+      principal,
+      input: { organizationId, ...created },
+    })
+    expect(await ownRows()).toEqual([])
+  })
+
   it('creates a private connection, rotates its secret, and removes its membership with it', async () => {
     const created = await save()
     expect(await ownRows()).toMatchObject([
@@ -234,7 +261,7 @@ describe('personal Search connections in PostgreSQL', () => {
           ...created,
           ...(changed === 'tenant' ? { orgId: 'https://other.example.test/jama' } : {}),
         })
-      ).rejects.toMatchObject({ code: 'validation' })
+      ).rejects.toMatchObject({ failure: 'account_mismatch', statusCode: 409 })
       expect(await ownRows()).toMatchObject([
         { providerSubjectId: '42', providerTenantId: input.orgId },
       ])
@@ -252,10 +279,10 @@ describe('personal Search connections in PostgreSQL', () => {
     const created = await save(flow)
     await expect(
       save({ ...flow, ...created, providerWorkspaceId: 'workspace-b' })
-    ).rejects.toMatchObject({ code: 'validation' })
+    ).rejects.toMatchObject({ failure: 'account_mismatch', statusCode: 409 })
     await expect(
       save({ ...flow, ...created, domain: 'https://other-flow.example.test' })
-    ).rejects.toMatchObject({ code: 'validation' })
+    ).rejects.toMatchObject({ failure: 'account_mismatch', statusCode: 409 })
     expect(await ownRows()).toMatchObject([
       { providerTenantId: '["https://flow.example.test","workspace-a"]' },
     ])
@@ -294,16 +321,58 @@ describe('personal Search connections in PostgreSQL', () => {
         id: generateId(),
         organizationId,
         createdBy: userId,
-        providerId: 'jama-service-account',
+        providerId: 'coda-service-account',
         displayName: 'Limit fixture',
         type: 'service_account' as const,
       }))
     )
+    verifier.mockResolvedValueOnce(
+      verified({ principal: { kind: 'user', id: '43', label: email } })
+    )
     const results = await Promise.allSettled([save(), save()])
     expect(results.filter((result) => result.status === 'fulfilled')).toHaveLength(1)
     expect(results.filter((result) => result.status === 'rejected')).toMatchObject([
       { reason: { code: 'validation' } },
     ])
     expect(await ownRows()).toHaveLength(100)
   })
+
+  it('allows only one concurrent connection for the same verified provider identity', async () => {
+    const results = await Promise.allSettled([save(), save()])
+    expect(results.filter((result) => result.status === 'fulfilled')).toHaveLength(1)
+    expect(results.filter((result) => result.status === 'rejected')).toMatchObject([
+      { reason: { failure: 'account_already_connected', statusCode: 409 } },
+    ])
+    expect(await ownRows()).toHaveLength(1)
+  })
+
+  it('limits concurrent additions per provider while allowing reconnect at the limit', async () => {
+    const ids: string[] = []
+    for (let index = 0; index < 4; index++) {
+      verifier.mockResolvedValueOnce(
+        verified({ principal: { kind: 'user', id: `member-${index}`, label: email } })
+      )
+      ids.push((await save()).credentialId)
+    }
+    verifier.mockResolvedValueOnce(
+      verified({ principal: { kind: 'user', id: '43', label: email } })
+    )
+    const results = await Promise.allSettled([save(), save()])
+    expect(results.filter((result) => result.status === 'fulfilled')).toHaveLength(1)
+    expect(results.filter((result) => result.status === 'rejected')).toMatchObject([
+      { reason: { failure: 'account_limit_reached', statusCode: 409 } },
+    ])
+    verifier.mockResolvedValueOnce(
+      verified({
+        principal: { kind: 'user', id: 'member-0', label: email },
+        encryptedServiceAccountKey: 'rotated-at-limit',
+      })
+    )
+    await save({ credentialId: ids[0] })
+    const rows = await ownRows()
+    expect(rows).toHaveLength(5)
+    expect(rows.find((row) => row.id === ids[0])?.encryptedServiceAccountKey).toBe(
+      'rotated-at-limit'
+    )
+  })
 })

apps/sim/lib/credentials/application/search-personal-credentials.ts

@@ -11,7 +11,12 @@ import { authorizeOrganizationOperation } from '@/lib/core/application/organizat
 import { defineOrganizationOperation } from '@/lib/core/application/organization-operation'
 import { withResourceOutboundScope } from '@/lib/core/network/resource-scope.server'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
-import { ORGANIZATION_VIEWER_ACCOUNT_LIMIT } from '@/lib/credential-groups/limits'
+import { resolveAccountWrite } from '@/lib/credential-groups/account-rules'
+import {
+  CREDENTIAL_GROUP_ACCOUNTS_PER_PROVIDER_LIMIT,
+  ORGANIZATION_VIEWER_ACCOUNT_LIMIT,
+} from '@/lib/credential-groups/limits'
+import { isScopedCredentialGroupsAvailable } from '@/lib/credential-groups/scoped-availability'
 import { CredentialProviderOperationError } from '@/lib/credentials/application/crud'
 import {
   listCredentialProviderCatalog,
@@ -63,6 +68,14 @@ export const saveSearchPersonalCredential: OperationUseCase<
   operation: searchPersonalCredentialOperations.save,
   async execute({ principal, input, request }) {
     const context = await authorizeOrganizationOperation(principal, this.operation, input)
+    if (
+      !(await isScopedCredentialGroupsAvailable({
+        kind: 'organization',
+        organizationId: context.organizationId,
+      }))
+    ) {
+      throw new OrchestrationError('not_found', 'Connected accounts are not available')
+    }
     const provider = input.providerId === 'jama-service-account' ? 'jama' : 'flow'
     await requireOrganizationSearchApproval(context.organizationId, provider)
     if (
@@ -134,6 +147,7 @@ export const saveSearchPersonalCredential: OperationUseCase<
         .limit(1)
       if (
         !person?.verified ||
+        verified.principal?.kind !== 'user' ||
         !providerEmail ||
         providerEmail !== person.email.trim().toLowerCase()
       ) {
@@ -142,53 +156,44 @@ export const saveSearchPersonalCredential: OperationUseCase<
           'Use your own provider account with the same email as your verified Sim account'
         )
       }
-      if (input.credentialId) {
-        const [existing] = await tx
-          .select({
-            tenantId: credential.providerTenantId,
-            subjectId: credential.providerSubjectId,
-          })
-          .from(credential)
-          .where(ownedCredential(context.organizationId, context.userId, input.credentialId))
-          .for('update')
-          .limit(1)
-        if (
-          !existing ||
-          existing.tenantId !== tenantId ||
-          verified.principal?.kind !== 'user' ||
-          existing.subjectId !== verified.principal.id
-        ) {
-          throw new OrchestrationError(
-            'validation',
-            'Reconnect with the same provider account and workspace. Add a new connection to use a different account.'
+      const accounts = await tx
+        .select({
+          id: credential.id,
+          revokedAt: credential.revokedAt,
+          providerSubjectId: credential.providerSubjectId,
+          providerTenantId: credential.providerTenantId,
+        })
+        .from(credential)
+        .where(
+          and(
+            eq(credential.organizationId, context.organizationId),
+            isNull(credential.workspaceId),
+            eq(credential.createdBy, context.userId),
+            eq(credential.type, 'service_account'),
+            eq(credential.providerId, input.providerId)
           )
-        }
-      }
+        )
+        .for('update')
+      const existing = resolveAccountWrite({
+        intent: input.credentialId
+          ? { kind: 'reconnect', credentialId: input.credentialId }
+          : { kind: 'create' },
+        limit: CREDENTIAL_GROUP_ACCOUNTS_PER_PROVIDER_LIMIT,
+        accounts: accounts.map((account) => ({ ...account, managedOauthStatus: 'active' })),
+        identity: { subject: verified.principal.id, tenant: tenantId },
+      })
       const now = new Date()
-      const credentialId = input.credentialId ?? generateId()
+      const credentialId = existing?.id ?? generateId()
       const fields = {
         displayName: input.displayName?.trim() || verified.displayName,
         description: input.description?.trim() || null,
         encryptedServiceAccountKey: verified.encryptedServiceAccountKey,
-        providerSubjectId: verified.principal?.kind === 'user' ? verified.principal.id : null,
+        providerSubjectId: verified.principal.id,
         providerTenantId: tenantId,
         revokedAt: null,
         updatedAt: now,
       }
-      if (input.credentialId) {
-        const updated = await tx
-          .update(credential)
-          .set(fields)
-          .where(
-            and(
-              ownedCredential(context.organizationId, context.userId, credentialId),
-              eq(credential.providerId, input.providerId)
-            )
-          )
-          .returning({ id: credential.id })
-        if (!updated.length)
-          throw new OrchestrationError('not_found', 'Personal connection not found')
-      } else {
+      if (!existing || existing.revokedAt) {
         const [saved] = await tx
           .select({ count: count() })
           .from(credential)
@@ -208,6 +213,21 @@ export const saveSearchPersonalCredential: OperationUseCase<
             'Remove an unused personal Search connection before adding another'
           )
         }
+      }
+      if (existing) {
+        const updated = await tx
+          .update(credential)
+          .set(fields)
+          .where(
+            and(
+              ownedCredential(context.organizationId, context.userId, credentialId),
+              eq(credential.providerId, input.providerId)
+            )
+          )
+          .returning({ id: credential.id })
+        if (!updated.length)
+          throw new OrchestrationError('not_found', 'Personal connection not found')
+      } else {
         await tx.insert(credential).values({
           id: credentialId,
           organizationId: context.organizationId,
@@ -225,7 +245,7 @@ export const saveSearchPersonalCredential: OperationUseCase<
           joinedAt: now,
         })
       }
-      return { credentialId }
+      return { credentialId, created: !existing }
     })
     recordProjectedUseCaseAuditEntries(
       this.operation,
@@ -234,17 +254,15 @@ export const saveSearchPersonalCredential: OperationUseCase<
       request,
       [
         {
-          action: input.credentialId
-            ? AuditAction.CREDENTIAL_UPDATED
-            : AuditAction.CREDENTIAL_CREATED,
+          action: result.created ? AuditAction.CREDENTIAL_CREATED : AuditAction.CREDENTIAL_UPDATED,
           resourceType: AuditResourceType.CREDENTIAL,
           resourceId: result.credentialId,
           metadata: { providerId: input.providerId, ...verified.auditMetadata },
         },
       ],
       context.organizationId
     )
-    return result
+    return { credentialId: result.credentialId }
   },
 }