fix(webhooks): authorize both requested and stored credentials on upsert

Author: waleedlatif1

apps/sim/app/api/webhooks/route.test.ts

@@ -607,4 +607,43 @@ describe('POST /api/webhooks credential references', () => {
     expect(response.status).toBe(403)
     expect(dbChainMockFns.set).not.toHaveBeenCalled()
   })
+
+  /**
+   * Clearing `credentialId` does not stop the save from acting with the stored
+   * credential: a recreate still cleans up the previous subscription with it.
+   */
+  it.each([null, ''])(
+    'still authorizes the stored credential when a re-save sends credentialId %j',
+    async (credentialId) => {
+      mocks.authorizeCredentialUseForAuth.mockResolvedValue({
+        ok: false,
+        error: 'You do not have access to this credential.',
+      })
+      mocks.shouldRecreateExternalWebhookSubscription.mockReturnValue(true)
+      queueUpdatePathRows(true, { credentialId: 'stored-credential' })
+
+      const response = await POST(upsertRequest({ credentialId }))
+
+      expect(response.status).toBe(403)
+      expect(mocks.authorizeCredentialUseForAuth).toHaveBeenCalledWith(expect.anything(), {
+        credentialId: 'stored-credential',
+        workflowId: 'workflow-1',
+      })
+      expect(mocks.createExternalWebhookSubscription).not.toHaveBeenCalled()
+      expect(dbChainMockFns.set).not.toHaveBeenCalled()
+    }
+  )
+
+  it('authorizes both credentials when a re-save replaces the stored one', async () => {
+    mocks.authorizeCredentialUseForAuth.mockResolvedValue({ ok: true, workspaceId: 'workspace-1' })
+    queueUpdatePathRows(true, { credentialId: 'stored-credential' })
+
+    const response = await POST(upsertRequest({ credentialId: 'new-credential' }))
+
+    expect(response.status).toBe(200)
+    expect(mocks.authorizeCredentialUseForAuth.mock.calls.map(([, params]) => params)).toEqual([
+      { credentialId: 'new-credential', workflowId: 'workflow-1' },
+      { credentialId: 'stored-credential', workflowId: 'workflow-1' },
+    ])
+  })
 })

apps/sim/app/api/webhooks/route.ts

@@ -420,31 +420,33 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
     /**
      * Subscription handlers, pollers, and subscription cleanup look `credentialId`
-     * up by id alone and mint tokens as its owner. A save acts with the requested
-     * credential or, when the request omits it, the stored one, so that credential
-     * must be usable by the actor in the workflow's workspace before anything is
-     * subscribed, cleaned up, or saved.
+     * up by id alone and mint tokens as its owner. A save can act with both the
+     * requested credential and the stored one — the stored one is merged back when
+     * the request omits it, or used to clean up the previous subscription — so
+     * each must be usable by the actor in the workflow's workspace before anything
+     * is subscribed, cleaned up, or saved.
      */
-    const effectiveCredentialId =
-      'credentialId' in originalProviderConfig
-        ? originalProviderConfig.credentialId
-        : existingWebhook?.providerConfig?.credentialId
-    if (effectiveCredentialId != null && effectiveCredentialId !== '') {
-      if (typeof effectiveCredentialId !== 'string') {
+    const credentialIds = new Set(
+      [originalProviderConfig.credentialId, existingWebhook?.providerConfig?.credentialId].filter(
+        (id) => id != null && id !== ''
+      )
+    )
+    for (const credentialId of credentialIds) {
+      if (typeof credentialId !== 'string') {
         return NextResponse.json(
           { error: 'providerConfig.credentialId must be a literal credential id' },
           { status: 400 }
         )
       }
       const credentialAccess = await authorizeCredentialUseForAuth(
         { success: true, userId, authType: AuthType.SESSION },
-        { credentialId: effectiveCredentialId, workflowId }
+        { credentialId, workflowId }
       )
       if (!credentialAccess.ok) {
         logger.warn(`[${requestId}] Webhook credential reference denied`, {
           userId,
           workflowId,
-          credentialId: effectiveCredentialId,
+          credentialId,
           reason: credentialAccess.error,
         })
         return NextResponse.json({ error: credentialAccess.error }, { status: 403 })