fix(oauth): key Notion connections on their workspace

A Notion token reaches one workspace, but Sim keyed Notion accounts on the person
alone, so a second workspace on the same login was refused. Record the workspace
as the tenant. A connection saved before then takes on its workspace when the
person reconnects, and must be reconnected before another workspace is added so
it is never overwritten. Other providers keep treating a missing tenant as distinct.

Author: waleedlatif1

apps/docs/content/docs/search/connect-your-account.mdx

@@ -26,6 +26,7 @@ To connect another account of the same app, such as Google Drive for two differe
 
 - Slack accounts must belong to your organization's connected workspace.
 - For another Confluence or Jira site on the same Atlassian login, choose **Add account** or **Reconnect** and pick the site. The site joins your existing account, and Search covers every site that login can reach.
+- Each Notion workspace is its own account, so add one per workspace. If Sim asks you to reconnect first, reconnect your existing Notion account once, then add the other workspace.
 - Zoom, Lucid, and Databricks allow one account, because Sim cannot yet tell their accounts apart.
 - If the provider signs you straight back into a connected account, sign in to the other account with the provider first, then choose **Add account** again.
 

apps/sim/lib/auth/connectors/managed-oauth.test.ts

@@ -276,6 +276,8 @@ describe('userinfo-backed managed OAuth connectors', () => {
           type: 'user',
           user: { id: 'user-1', name: 'Person', person: { email: 'person@example.com' } },
         },
+        workspace_id: 'workspace-1',
+        workspace_name: 'Engineering',
       },
     })
 
@@ -286,6 +288,7 @@ describe('userinfo-backed managed OAuth connectors', () => {
 
     expect(identity).toMatchObject({
       providerSubjectId: 'user-1',
+      providerTenantId: 'workspace-1',
       email: 'person@example.com',
       emailVerified: true,
     })

apps/sim/lib/auth/connectors/managed-oauth.ts

@@ -905,7 +905,12 @@ const USER_INFO_MANAGED_OAUTH_CONNECTORS = new Map<string, () => ManagedOAuthCon
               /** Notion only exposes `person.email` for a confirmed workspace member. */
               emailVerified: true,
             },
-            { displayName: user.name, avatarUrl: user.avatar_url }
+            /** A Notion token reaches one workspace, so one person's workspaces are separate accounts. */
+            {
+              displayName: user.name,
+              avatarUrl: user.avatar_url,
+              providerTenantId: bot.workspace_id,
+            }
           )
         },
       }),

apps/sim/lib/credential-groups/__integration__/multiple-provider-accounts.integration.ts

@@ -94,6 +94,7 @@ const DRIVE = optionFor('google-drive')
 const GITHUB = optionFor('github-repositories')
 const SLACK = optionFor('slack')
 const CONFLUENCE = optionFor('confluence')
+const NOTION = optionFor('notion')
 
 function connect(
   code: string,
@@ -111,7 +112,7 @@ function connect(
     email,
     enrollmentStatus: 'completed',
     option,
-    options: [DRIVE, GITHUB, SLACK, CONFLUENCE],
+    options: [DRIVE, GITHUB, SLACK, CONFLUENCE, NOTION],
   }
   const attempt: CredentialGroupOAuthAttempt = {
     userId,
@@ -189,7 +190,7 @@ beforeAll(async () => {
     organizationId,
     publicId: generateId(),
     name: 'Connected accounts',
-    options: [DRIVE, GITHUB, SLACK, CONFLUENCE],
+    options: [DRIVE, GITHUB, SLACK, CONFLUENCE, NOTION],
   })
   await db.insert(member).values({
     id: generateId(),
@@ -358,6 +359,56 @@ describe('adding another site to an Atlassian login', () => {
   })
 })
 
+describe('an account recorded before its tenant was known', () => {
+  it('stays separate on a provider that always recorded its tenant', async () => {
+    const legacy = await connect('person', { kind: 'create' })
+    expect(
+      await failureOf(
+        connect('person@workspace-a', { kind: 'reconnect', credentialId: legacy.credentialId })
+      )
+    ).toBe('account_mismatch')
+  })
+
+  it('takes on its tenant when reconnected or refreshed', async () => {
+    const legacy = await connect('person', { kind: 'create' }, NOTION)
+
+    await expect(
+      connect(
+        'person@workspace-a',
+        { kind: 'reconnect', credentialId: legacy.credentialId },
+        NOTION
+      )
+    ).resolves.toMatchObject({ created: false, credentialId: legacy.credentialId })
+    expect(await rows()).toMatchObject([{ subject: 'person', tenant: 'workspace-a' }])
+  })
+
+  it('takes on its tenant through an invitation link', async () => {
+    const legacy = await connect('person', { kind: 'create' }, NOTION)
+    await expect(connect('person@workspace-a', undefined, NOTION)).resolves.toMatchObject({
+      credentialId: legacy.credentialId,
+    })
+    expect(await rows()).toMatchObject([{ tenant: 'workspace-a' }])
+  })
+
+  it('must be reconnected before another tenant of the same login is added, so it is never overwritten', async () => {
+    const legacy = await connect('person', { kind: 'create' }, NOTION)
+    const [before] = await rows()
+
+    expect(await failureOf(connect('person@workspace-b', { kind: 'create' }, NOTION))).toBe(
+      'account_identity_required'
+    )
+    expect(await rows()).toEqual([before])
+
+    await connect(
+      'person@workspace-a',
+      { kind: 'reconnect', credentialId: legacy.credentialId },
+      NOTION
+    )
+    await connect('person@workspace-b', { kind: 'create' }, NOTION)
+    expect((await rows()).map((row) => row.tenant).sort()).toEqual(['workspace-a', 'workspace-b'])
+  })
+})
+
 describe('adding an account that needs reconnecting', () => {
   it('refreshes it instead of calling it already connected', async () => {
     const first = await connect('work@first-tenant.test', { kind: 'create' })

apps/sim/lib/credential-groups/account-rules.ts

@@ -35,11 +35,14 @@ export function resolveAccountWrite<Account extends ConnectedAccount>({
   accounts,
   identity,
   grantSpansSites = false,
+  tenantRecordedLater = false,
 }: {
   intent?: CredentialGroupConnectionIntent
   limit: number
   /** Connecting the same login again extends its grant, so it refreshes that account. */
   grantSpansSites?: boolean
+  /** An account saved without a tenant may be this identity's, at a tenant not yet recorded. */
+  tenantRecordedLater?: boolean
   accounts: Account[]
   identity: { subject: string; tenant: string | null } | null
 }): Account | undefined {
@@ -55,6 +58,14 @@ export function resolveAccountWrite<Account extends ConnectedAccount>({
   const disconnectedUnidentified = accounts.find(
     (account) => account.revokedAt && account.providerSubjectId === null
   )
+  /** Saved before its provider reported a tenant: the same person, at a tenant still unknown. */
+  const tenantUnknown =
+    tenantRecordedLater && identity && identity.tenant !== null && !existing
+      ? accounts.find(
+          (account) =>
+            account.providerSubjectId === identity.subject && account.providerTenantId === null
+        )
+      : undefined
 
   if (intent?.kind === 'reconnect') {
     const target = accounts.find((account) => account.id === intent.credentialId)
@@ -64,7 +75,11 @@ export function resolveAccountWrite<Account extends ConnectedAccount>({
         409
       )
     if (identity) {
-      if (existing ? existing.id !== target.id : target.providerSubjectId !== null)
+      if (
+        existing
+          ? existing.id !== target.id
+          : target.providerSubjectId !== null && target.id !== tenantUnknown?.id
+      )
         throw accountConflict('account_mismatch')
     } else if (
       target.providerSubjectId !== null &&
@@ -83,13 +98,15 @@ export function resolveAccountWrite<Account extends ConnectedAccount>({
       return existing
     }
     if (live.length > 0 && !identity) throw accountConflict('account_unverified')
-    if (hasUnidentifiedLive) throw accountConflict('account_identity_required')
+    if (hasUnidentifiedLive || (tenantUnknown && !tenantUnknown.revokedAt))
+      throw accountConflict('account_identity_required')
     if (live.length >= limit) throw accountConflict('account_limit_reached')
-    return existing ?? (live.length === 0 ? disconnectedUnidentified : undefined)
+    return existing ?? (live.length === 0 ? (tenantUnknown ?? disconnectedUnidentified) : undefined)
   }
 
   if (existing && !existing.revokedAt) return existing
-  if (live.length === 0) return existing ?? disconnectedUnidentified
+  if (live.length === 0) return existing ?? tenantUnknown ?? disconnectedUnidentified
+  if (tenantUnknown && !tenantUnknown.revokedAt) return tenantUnknown
   if (live.length === 1 && !existing && (!identity || hasUnidentifiedLive)) return live[0]
   throw accountConflict(identity ? 'account_mismatch' : 'account_unverified')
 }

apps/sim/lib/credential-groups/oauth.ts

@@ -36,6 +36,7 @@ import { getCredentialGroupProviderAdapter } from '@/lib/credential-groups/provi
 import {
   type CredentialGroupProvider,
   credentialGroupGrantSpansSites,
+  credentialGroupTenantRecordedLater,
   getCredentialGroupProviderService,
   isCredentialGroupProvider,
 } from '@/lib/credential-groups/providers'
@@ -249,6 +250,7 @@ async function persistGrant(
       accounts,
       identity: { subject: grant.providerSubjectId, tenant: grant.providerTenantId },
       grantSpansSites: credentialGroupGrantSpansSites(adapter.provider),
+      tenantRecordedLater: credentialGroupTenantRecordedLater(adapter.provider),
     })
 
     let refreshToken = grant.refreshToken

apps/sim/lib/credential-groups/providers.ts

@@ -57,6 +57,12 @@ interface CredentialGroupProviderSupport {
    * again adds a site to the existing account rather than a second account.
    */
   grantSpansSites?: true
+  /**
+   * Sim began recording this provider's tenant after accounts were saved without one. Such an
+   * account takes on its tenant when the same person reconnects; elsewhere a missing tenant never
+   * matches another.
+   */
+  tenantRecordedLater?: true
 }
 
 const CREDENTIAL_GROUP_PROVIDER_SUPPORT: Record<
@@ -196,6 +202,7 @@ const CREDENTIAL_GROUP_PROVIDER_SUPPORT: Record<
     configuration: 'oauth',
   },
   notion: {
+    tenantRecordedLater: true,
     serviceId: 'notion',
     description: 'Let each person connect one Notion account',
     configuration: 'oauth',
@@ -269,6 +276,10 @@ export function credentialGroupGrantSpansSites(provider: CredentialGroupProvider
   return CREDENTIAL_GROUP_PROVIDER_SUPPORT[provider].grantSpansSites === true
 }
 
+export function credentialGroupTenantRecordedLater(provider: CredentialGroupProvider): boolean {
+  return CREDENTIAL_GROUP_PROVIDER_SUPPORT[provider].tenantRecordedLater === true
+}
+
 export function getCredentialGroupProviderId(provider: CredentialGroupProvider): string {
   return getCredentialGroupProviderService(provider).providerId
 }