fix(credentials): let workspace admins disconnect a teammate's OAuth credential

Disconnecting an OAuth credential routed through POST /api/auth/oauth/disconnect,
a credential *user* operation scoped to the acting user's own `account` rows. A
workspace or org admin acting on a teammate's connection matched no accounts, so
the call returned `{ credentials: [] }` and the route still answered 200 — the UI
navigated away and the credential was still there. Not a denial, a silent no-op.

Route every type through the workspace-scoped credential delete instead, which
authorizes against credential admin and already resolves workspace and org admins
as derived credential admins for shared credential types.

That path only deleted the `credential` row, so send `oauth` through
`deleteCredentialRecord` — the manager that also tears down a credential's secret
source — and teach it to revoke the backing `account` grant once no credential
references it. Scoped by account id, not owner: the caller is already authorized
against the credential, and the grant belongs to the teammate.

Also make RoleLockTooltip layout-transparent. It wrapped locked controls in an
`inline-flex` div, which let the chip shrink to its label while unwrapped
controls stretched to the member row's fixed role track — so a credential's own
members list rendered Admin at two different widths. A `grid` wrapper stretches
like the unwrapped control, aligning the credential, secrets, and skills member
lists that share the row.

Author: waleedlatif1

apps/sim/app/workspace/[workspaceId]/integrations/connected/[credentialId]/connected-credential-detail.tsx

@@ -46,7 +46,6 @@ import {
 } from '@/hooks/queries/credentials'
 import {
   useConnectOAuthService,
-  useDisconnectOAuthService,
   useOAuthConnections,
 } from '@/hooks/queries/oauth/oauth-connections'
 import { useOAuthReturnRouter } from '@/hooks/use-oauth-return'
@@ -74,7 +73,6 @@ export function ConnectedCredentialDetail({
 
   const { data: oauthConnections = [] } = useOAuthConnections()
   const connectOAuthService = useConnectOAuthService()
-  const disconnectOAuthService = useDisconnectOAuthService()
   const createDraft = useCreateCredentialDraft()
   const deleteCredential = useDeleteWorkspaceCredential()
 
@@ -146,24 +144,18 @@ export function ConnectedCredentialDetail({
     }
   }
 
+  /**
+   * Every credential type disconnects through the workspace-scoped credential
+   * delete, which authorizes against credential admin — explicit members and
+   * derived workspace admins alike. The personal OAuth disconnect is scoped to
+   * the acting user's own `account` rows, so routing an admin through it
+   * silently matched nothing when the connection belonged to a teammate.
+   */
   const handleConfirmDelete = async () => {
     if (!credential) return
     try {
-      if (credential.type === 'service_account') {
-        await deleteCredential.mutateAsync(credential.id)
-      } else {
-        if (!credential.accountId || !credential.providerId) {
-          toast.error("Can't disconnect", {
-            description: 'Missing account information. Try reconnecting this credential first.',
-          })
-          return
-        }
-        await disconnectOAuthService.mutateAsync({
-          provider: credential.providerId.split('-')[0] || credential.providerId,
-          providerId: credential.providerId,
-          serviceId: credential.providerId,
-          accountId: credential.accountId,
-        })
+      await deleteCredential.mutateAsync(credential.id)
+      if (credential.type === 'oauth' && credential.providerId) {
         window.dispatchEvent(
           new CustomEvent('oauth-credentials-updated', {
             detail: { providerId: credential.providerId, workspaceId },
@@ -207,7 +199,7 @@ export function ConnectedCredentialDetail({
         </Chip>
         <Chip
           onClick={() => setShowDeleteConfirmDialog(true)}
-          disabled={disconnectOAuthService.isPending || deleteCredential.isPending}
+          disabled={deleteCredential.isPending}
         >
           Disconnect
         </Chip>
@@ -303,7 +295,7 @@ export function ConnectedCredentialDetail({
         confirm={{
           label: 'Disconnect',
           onClick: handleConfirmDelete,
-          pending: disconnectOAuthService.isPending || deleteCredential.isPending,
+          pending: deleteCredential.isPending,
           pendingLabel: 'Disconnecting...',
         }}
       />

apps/sim/components/permissions/role-lock.tsx

@@ -54,14 +54,20 @@ interface RoleLockTooltipProps {
 /**
  * Wraps a disabled role control in a tooltip explaining why the role is fixed.
  * Renders children unchanged when there is no lock reason.
+ *
+ * The trigger is a `grid` so the wrapper stays layout-transparent: an unwrapped
+ * control is a direct grid item of the member row and stretches to that row's
+ * fixed role track, and a lone grid child stretches identically. An
+ * `inline-flex` wrapper instead let the control shrink to its label, so locked
+ * and editable rows of the same list rendered at two different widths.
  */
 export function RoleLockTooltip({ reason, children }: RoleLockTooltipProps) {
   if (!reason) return <>{children}</>
 
   return (
     <Tooltip.Root>
       <Tooltip.Trigger asChild>
-        <div className='inline-flex'>{children}</div>
+        <div className='grid'>{children}</div>
       </Tooltip.Trigger>
       <Tooltip.Content>{reason}</Tooltip.Content>
     </Tooltip.Root>

apps/sim/lib/credentials/application/service-account.test.ts

@@ -270,6 +270,34 @@ describe('credential service-account application operations', () => {
     })
   })
 
+  it('disconnects an oauth credential through the record manager so its grant is revoked', async () => {
+    const oauthCredential = {
+      ...credential,
+      type: 'oauth',
+      providerId: 'google-email',
+      accountId: 'acct-1',
+    }
+    mocks.getCredential.mockResolvedValue(oauthCredential)
+    mocks.getActor.mockResolvedValue({
+      credential: oauthCredential,
+      member: { role: 'admin' },
+      hasWorkspaceAccess: true,
+      isAdmin: true,
+    })
+
+    const result = await deleteCredentialUseCase.execute({
+      principal,
+      input: { workspaceId: WORKSPACE_ID, credentialId: oauthCredential.id },
+    })
+
+    expect(result).toEqual({ credential: oauthCredential, deleted: true })
+    expect(mocks.deleteRecord).toHaveBeenCalledWith({
+      credential: oauthCredential,
+      reason: 'user_delete',
+    })
+    expect(mocks.delete).not.toHaveBeenCalled()
+  })
+
   it('treats a concurrent disconnect as an idempotent success', async () => {
     mocks.delete.mockResolvedValue(false)
 

apps/sim/lib/credentials/application/service-account.ts

@@ -159,8 +159,12 @@ export const deleteCredentialUseCase = defineAuthorizedCredentialUseCase({
       )
     }
     const reason = principal.kind === 'delegated' ? 'copilot_delete' : 'user_delete'
+    // Every type but `service_account` goes through the record manager so it also
+    // tears down the credential's secret source — for `oauth` that is the backing
+    // `account` row, which an admin deleting a teammate's connection must revoke
+    // too, not just the credential that pointed at it.
     const deleted =
-      context.credential.type === 'oauth' || context.credential.type === 'service_account'
+      context.credential.type === 'service_account'
         ? await deleteConnectionCredential({
             credentialId: context.credential.id,
             workspaceId: context.workspaceId,

apps/sim/lib/credentials/deletion.ts

@@ -101,6 +101,35 @@ export async function deleteConnectionCredential(
   return deleted.length === 1
 }
 
+/**
+ * Deletes the OAuth grant backing a credential once no credential references it
+ * any more, and reports whether it went. The `account` row is an OAuth
+ * credential's secret source, so leaving it behind keeps the provider grant
+ * alive after the credential it backed is gone.
+ *
+ * Scoped by `accountId` rather than by owner: the caller has already been
+ * authorized against the credential, and the grant may belong to a different
+ * user than the one deleting it (a workspace admin removing a teammate's
+ * connection). Returns false when another credential still uses the grant.
+ */
+export async function deleteOrphanedOAuthAccount(accountId: string): Promise<boolean> {
+  const [stillReferenced] = await db
+    .select({ id: schema.credential.id })
+    .from(schema.credential)
+    .where(eq(schema.credential.accountId, accountId))
+    .limit(1)
+  if (stillReferenced) return false
+
+  const deleted = await db
+    .delete(schema.account)
+    .where(eq(schema.account.id, accountId))
+    .returning({ id: schema.account.id })
+  if (deleted.length > 0) {
+    logger.info('Deleted orphaned OAuth account', { accountId })
+  }
+  return deleted.length > 0
+}
+
 /**
  * Clears stored references to a credential across mutable workspace state
  * (editor blocks, copilot checkpoints, knowledge connectors) and frozen

apps/sim/lib/credentials/orchestration/index.test.ts

@@ -18,6 +18,7 @@ const {
   mockIsClientCredentialAccountProviderId,
   mockGetClientCredentialAccountDescriptor,
   mockDeleteConnectionCredential,
+  mockDeleteOrphanedOAuthAccount,
 } = vi.hoisted(() => ({
   mockRecordAudit: vi.fn(),
   mockGetCredentialActorContext: vi.fn(),
@@ -28,6 +29,7 @@ const {
   // providers must not trigger the stored-blob read for authMethod/username.
   mockGetClientCredentialAccountDescriptor: vi.fn(() => undefined),
   mockDeleteConnectionCredential: vi.fn(),
+  mockDeleteOrphanedOAuthAccount: vi.fn(),
 }))
 
 vi.mock('@sim/audit', () => ({
@@ -51,6 +53,7 @@ vi.mock('@/lib/credentials/client-credential-accounts/descriptors', () => ({
 }))
 vi.mock('@/lib/credentials/deletion', () => ({
   deleteConnectionCredential: mockDeleteConnectionCredential,
+  deleteOrphanedOAuthAccount: mockDeleteOrphanedOAuthAccount,
 }))
 vi.mock('@/lib/credentials/environment', () => ({
   deleteWorkspaceEnvCredentials: vi.fn(),
@@ -550,4 +553,57 @@ describe('deleteCredentialRecord', () => {
     })
     expect(mockDeleteConnectionCredential).not.toHaveBeenCalled()
   })
+
+  it('revokes the backing OAuth grant of a deleted oauth credential', async () => {
+    mockDeleteConnectionCredential.mockResolvedValueOnce(true)
+
+    const deleted = await deleteCredentialRecord({
+      credential: {
+        id: 'cred-1',
+        workspaceId: 'ws-1',
+        type: 'oauth',
+        providerId: 'google-email',
+        accountId: 'acct-1',
+      } as never,
+      reason: 'user_delete',
+    })
+
+    expect(deleted).toBe(true)
+    expect(mockDeleteOrphanedOAuthAccount).toHaveBeenCalledWith('acct-1')
+  })
+
+  it('leaves the OAuth grant alone when the credential row was already gone', async () => {
+    mockDeleteConnectionCredential.mockResolvedValueOnce(false)
+
+    const deleted = await deleteCredentialRecord({
+      credential: {
+        id: 'cred-1',
+        workspaceId: 'ws-1',
+        type: 'oauth',
+        providerId: 'google-email',
+        accountId: 'acct-1',
+      } as never,
+      reason: 'user_delete',
+    })
+
+    expect(deleted).toBe(false)
+    expect(mockDeleteOrphanedOAuthAccount).not.toHaveBeenCalled()
+  })
+
+  it('does not touch OAuth grants for a service-account credential', async () => {
+    mockDeleteConnectionCredential.mockResolvedValueOnce(true)
+
+    await deleteCredentialRecord({
+      credential: {
+        id: 'cred-1',
+        workspaceId: 'ws-1',
+        type: 'service_account',
+        providerId: 'google-service-account',
+        accountId: null,
+      } as never,
+      reason: 'user_delete',
+    })
+
+    expect(mockDeleteOrphanedOAuthAccount).not.toHaveBeenCalled()
+  })
 })

apps/sim/lib/credentials/orchestration/index.ts

@@ -24,7 +24,11 @@ import {
   getClientCredentialAccountDescriptor,
   isClientCredentialAccountProviderId,
 } from '@/lib/credentials/client-credential-accounts/descriptors'
-import { type CredentialDeleteReason, deleteConnectionCredential } from '@/lib/credentials/deletion'
+import {
+  type CredentialDeleteReason,
+  deleteConnectionCredential,
+  deleteOrphanedOAuthAccount,
+} from '@/lib/credentials/deletion'
 import { slackCustomBotDisplayName } from '@/lib/credentials/display-name'
 import {
   deleteWorkspaceEnvCredentials,
@@ -554,11 +558,22 @@ export async function deleteCredentialRecord(
     return true
   }
 
-  return deleteConnectionCredential({
+  const deleted = await deleteConnectionCredential({
     credentialId: credentialRow.id,
     workspaceId: credentialRow.workspaceId,
     reason: params.reason,
   })
+
+  // An OAuth credential's secret source is its `account` row, so deleting the
+  // credential alone would leave the provider grant behind. Revoke it here
+  // rather than only on the personal disconnect path, so an admin removing a
+  // teammate's connection tears down the same state the owner's own disconnect
+  // would. Idempotent for the disconnect path, which sweeps accounts after.
+  if (deleted && credentialRow.type === 'oauth' && credentialRow.accountId) {
+    await deleteOrphanedOAuthAccount(credentialRow.accountId)
+  }
+
+  return deleted
 }
 
 /** Preserves the legacy callers while application adapters migrate to the manager above. */