refactor(credentials): consolidate credential deletion onto one path

Follow-ups from review of the previous commit.

- Collapse the delete use case's remaining `service_account` carve-out. Both
  ternary arms reached the same `deleteConnectionCredential` tail, but the
  carve-out skipped `deleteCredentialRecord`'s Slack custom-bot guard — and
  custom bots are exactly the type it guards, so the single-delete surface
  could orphan a credential group that the batch path refuses to.
- Make `deleteOrphanedOAuthAccount` one conditional statement instead of a
  read then a write. `credential.accountId` is ON DELETE CASCADE, so a
  credential racing the gap would have been reaped by Postgres without
  `clearCredentialRefs` running, stranding its id in workflow state.
- Give oauth its own branch in `deleteCredentialRecord`, matching the shape
  the env types already use, rather than a conditional tail after the return.
- Point `handleReconnectCredential` at the shared helper; it carried its own
  copy of the same orphan-grant rule.
- Invalidate the OAuth connections query on credential delete. The removed
  disconnect hook owned that invalidation, and the detail page reads it. This
  also retires the hand-dispatched `oauth-credentials-updated` event from the
  delete path; the connect/reconnect path still dispatches it for its listener.
- Delete `useDisconnectOAuthService`, now callerless.
- Trim comments to the behavior rather than the bug that motivated it.

Author: waleedlatif1

apps/sim/app/workspace/[workspaceId]/integrations/connected/[credentialId]/connected-credential-detail.tsx

@@ -147,21 +147,12 @@ export function ConnectedCredentialDetail({
   /**
    * Every credential type disconnects through the workspace-scoped credential
    * delete, which authorizes against credential admin — explicit members and
-   * derived workspace admins alike. The personal OAuth disconnect is scoped to
-   * the acting user's own `account` rows, so routing an admin through it
-   * silently matched nothing when the connection belonged to a teammate.
+   * derived workspace admins alike.
    */
   const handleConfirmDelete = async () => {
     if (!credential) return
     try {
       await deleteCredential.mutateAsync(credential.id)
-      if (credential.type === 'oauth' && credential.providerId) {
-        window.dispatchEvent(
-          new CustomEvent('oauth-credentials-updated', {
-            detail: { providerId: credential.providerId, workspaceId },
-          })
-        )
-      }
       setShowDeleteConfirmDialog(false)
       router.push(integrationsHref)
     } catch (error) {

apps/sim/components/permissions/role-lock.tsx

@@ -55,11 +55,8 @@ interface RoleLockTooltipProps {
  * Wraps a disabled role control in a tooltip explaining why the role is fixed.
  * Renders children unchanged when there is no lock reason.
  *
- * The trigger is a `grid` so the wrapper stays layout-transparent: an unwrapped
- * control is a direct grid item of the member row and stretches to that row's
- * fixed role track, and a lone grid child stretches identically. An
- * `inline-flex` wrapper instead let the control shrink to its label, so locked
- * and editable rows of the same list rendered at two different widths.
+ * The trigger is a `grid` so the wrapper stays layout-transparent; a
+ * shrink-to-content wrapper would size locked and unlocked rows differently.
  */
 export function RoleLockTooltip({ reason, children }: RoleLockTooltipProps) {
   if (!reason) return <>{children}</>

apps/sim/hooks/queries/credentials.ts

@@ -20,6 +20,7 @@ import {
   type WorkspaceCredentialType,
 } from '@/lib/api/contracts'
 import { environmentKeys } from '@/hooks/queries/environment'
+import { oauthConnectionsKeys } from '@/hooks/queries/oauth/oauth-connections'
 import { workspaceCredentialKeys } from '@/hooks/queries/utils/credential-keys'
 import {
   fetchWorkspaceCredentialList,
@@ -211,6 +212,7 @@ export function useDeleteWorkspaceCredential() {
       queryClient.invalidateQueries({ queryKey: workspaceCredentialKeys.lists() })
       queryClient.invalidateQueries({ queryKey: OAUTH_CREDENTIALS_KEY })
       queryClient.invalidateQueries({ queryKey: environmentKeys.all })
+      queryClient.invalidateQueries({ queryKey: oauthConnectionsKeys.connections() })
     },
   })
 }

apps/sim/hooks/queries/oauth/oauth-connections.ts

@@ -3,7 +3,6 @@ import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
 import { requestJson } from '@/lib/api/client/request'
 import {
   type ConnectedAccount,
-  disconnectOAuthContract,
   listOAuthConnectionsContract,
   type OAuthAccountSummary,
   type OAuthConnection,
@@ -199,68 +198,5 @@ export function useConnectOAuthService() {
   })
 }
 
-interface DisconnectServiceParams {
-  provider: string
-  providerId?: string
-  serviceId: string
-  accountId?: string
-}
-
-/**
- * Disconnects an OAuth service account.
- * Performs optimistic update and rolls back on failure.
- */
-export function useDisconnectOAuthService() {
-  const queryClient = useQueryClient()
-
-  return useMutation({
-    mutationFn: async ({ provider, providerId, accountId }: DisconnectServiceParams) => {
-      return requestJson(disconnectOAuthContract, {
-        body: {
-          provider,
-          providerId,
-          accountId,
-        },
-      })
-    },
-    onMutate: async ({ serviceId, accountId }) => {
-      await queryClient.cancelQueries({ queryKey: oauthConnectionsKeys.connections() })
-
-      const previousServices = queryClient.getQueryData<ServiceInfo[]>(
-        oauthConnectionsKeys.connections()
-      )
-
-      if (previousServices) {
-        queryClient.setQueryData<ServiceInfo[]>(
-          oauthConnectionsKeys.connections(),
-          previousServices.map((svc) => {
-            if (svc.id === serviceId) {
-              const updatedAccounts =
-                accountId && svc.accounts ? svc.accounts.filter((acc) => acc.id !== accountId) : []
-              return {
-                ...svc,
-                accounts: updatedAccounts,
-                isConnected: updatedAccounts.length > 0,
-              }
-            }
-            return svc
-          })
-        )
-      }
-
-      return { previousServices }
-    },
-    onError: (_err, _variables, context) => {
-      if (context?.previousServices) {
-        queryClient.setQueryData(oauthConnectionsKeys.connections(), context.previousServices)
-      }
-      logger.error('Failed to disconnect service')
-    },
-    onSettled: () => {
-      queryClient.invalidateQueries({ queryKey: oauthConnectionsKeys.connections() })
-    },
-  })
-}
-
 /** Connected OAuth account for a specific provider. */
 export type { ConnectedAccount }

apps/sim/lib/credentials/application/service-account.test.ts

@@ -13,7 +13,6 @@ const mocks = vi.hoisted(() => ({
   requireProvider: vi.fn(),
   getCredential: vi.fn(),
   getActor: vi.fn(),
-  delete: vi.fn(),
   deleteRecord: vi.fn(),
   capture: vi.fn(),
 }))
@@ -29,7 +28,6 @@ vi.mock('@sim/platform-authz/workspace', () => ({
 }))
 vi.mock('@/lib/credentials/orchestration', () => ({
   createServiceAccountCredential: mocks.create,
-  deleteConnectionCredential: mocks.delete,
   deleteCredentialRecord: mocks.deleteRecord,
 }))
 vi.mock('@/lib/credentials/application/provider-catalog', () => ({
@@ -96,7 +94,6 @@ describe('credential service-account application operations', () => {
       auditMetadata: { tenantId: 'tenant-1' },
     })
     mocks.listCatalog.mockResolvedValue([{ providerId: 'zoom-service-account' }])
-    mocks.delete.mockResolvedValue(true)
     mocks.deleteRecord.mockResolvedValue(true)
     mocks.requireProvider.mockReturnValue({
       type: 'service_account',
@@ -196,7 +193,7 @@ describe('credential service-account application operations', () => {
       code: 'forbidden',
       detailCode: 'CREDENTIAL_ADMIN_ACCESS_REQUIRED',
     })
-    expect(mocks.delete).not.toHaveBeenCalled()
+    expect(mocks.deleteRecord).not.toHaveBeenCalled()
   })
 
   it('rejects workspace keys before canonical loading on disconnect', async () => {
@@ -215,7 +212,7 @@ describe('credential service-account application operations', () => {
     })
     expect(mocks.loadWorkspace).not.toHaveBeenCalled()
     expect(mocks.getActor).not.toHaveBeenCalled()
-    expect(mocks.delete).not.toHaveBeenCalled()
+    expect(mocks.deleteRecord).not.toHaveBeenCalled()
   })
 
   it('allows an explicit credential admin with workspace read access to disconnect', async () => {
@@ -227,7 +224,7 @@ describe('credential service-account application operations', () => {
         input: { workspaceId: WORKSPACE_ID, credentialId: credential.id },
       })
     ).resolves.toEqual({ credential, deleted: true })
-    expect(mocks.delete).toHaveBeenCalledOnce()
+    expect(mocks.deleteRecord).toHaveBeenCalledOnce()
   })
 
   it('applies credential admin policy during authorization-only checks', async () => {
@@ -237,7 +234,7 @@ describe('credential service-account application operations', () => {
     })
 
     expect(mocks.getActor).toHaveBeenCalledWith(credential.id, principal.userId)
-    expect(mocks.delete).not.toHaveBeenCalled()
+    expect(mocks.deleteRecord).not.toHaveBeenCalled()
   })
 
   it('enforces personal-key workspace policy before credential authorization', async () => {
@@ -253,7 +250,7 @@ describe('credential service-account application operations', () => {
       detailCode: 'PERSONAL_API_KEYS_DISABLED',
     })
     expect(mocks.getActor).not.toHaveBeenCalled()
-    expect(mocks.delete).not.toHaveBeenCalled()
+    expect(mocks.deleteRecord).not.toHaveBeenCalled()
   })
 
   it('disconnects an administered credential', async () => {
@@ -263,14 +260,10 @@ describe('credential service-account application operations', () => {
     })
 
     expect(result).toEqual({ credential, deleted: true })
-    expect(mocks.delete).toHaveBeenCalledWith({
-      credentialId: credential.id,
-      workspaceId: WORKSPACE_ID,
-      reason: 'user_delete',
-    })
+    expect(mocks.deleteRecord).toHaveBeenCalledWith({ credential, reason: 'user_delete' })
   })
 
-  it('disconnects an oauth credential through the record manager so its grant is revoked', async () => {
+  it('deletes every type through the record manager so secret sources are torn down', async () => {
     const oauthCredential = {
       ...credential,
       type: 'oauth',
@@ -295,11 +288,10 @@ describe('credential service-account application operations', () => {
       credential: oauthCredential,
       reason: 'user_delete',
     })
-    expect(mocks.delete).not.toHaveBeenCalled()
   })
 
   it('treats a concurrent disconnect as an idempotent success', async () => {
-    mocks.delete.mockResolvedValue(false)
+    mocks.deleteRecord.mockResolvedValue(false)
 
     const result = await deleteCredentialUseCase.execute({
       principal,

apps/sim/lib/credentials/application/service-account.ts

@@ -15,7 +15,6 @@ import {
 import {
   type CreateServiceAccountCredentialParams,
   createServiceAccountCredential,
-  deleteConnectionCredential,
   deleteCredentialRecord,
 } from '@/lib/credentials/orchestration'
 import type { CredentialRow } from '@/lib/credentials/queries'
@@ -159,18 +158,7 @@ export const deleteCredentialUseCase = defineAuthorizedCredentialUseCase({
       )
     }
     const reason = principal.kind === 'delegated' ? 'copilot_delete' : 'user_delete'
-    // Every type but `service_account` goes through the record manager so it also
-    // tears down the credential's secret source — for `oauth` that is the backing
-    // `account` row, which an admin deleting a teammate's connection must revoke
-    // too, not just the credential that pointed at it.
-    const deleted =
-      context.credential.type === 'service_account'
-        ? await deleteConnectionCredential({
-            credentialId: context.credential.id,
-            workspaceId: context.workspaceId,
-            reason,
-          })
-        : await deleteCredentialRecord({ credential: context.credential, reason })
+    const deleted = await deleteCredentialRecord({ credential: context.credential, reason })
     return { credential: context.credential, deleted }
   },
   projectAudit: ({ principal, result }) => {

apps/sim/lib/credentials/deletion.ts

@@ -2,7 +2,7 @@ import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { db } from '@sim/db'
 import * as schema from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { and, eq, or, sql } from 'drizzle-orm'
+import { and, eq, notExists, or, sql } from 'drizzle-orm'
 import type { NextRequest } from 'next/server'
 import { CREDENTIAL_SUBBLOCK_IDS } from '@/lib/workflows/persistence/utils'
 
@@ -102,32 +102,36 @@ export async function deleteConnectionCredential(
 }
 
 /**
- * Deletes the OAuth grant backing a credential once no credential references it
- * any more, and reports whether it went. The `account` row is an OAuth
- * credential's secret source, so leaving it behind keeps the provider grant
- * alive after the credential it backed is gone.
+ * Deletes the stored OAuth grant behind a credential once nothing references
+ * it. The `account` row is an OAuth credential's secret source, so leaving it
+ * behind keeps a usable grant; nothing is revoked provider-side.
  *
- * Scoped by `accountId` rather than by owner: the caller has already been
- * authorized against the credential, and the grant may belong to a different
- * user than the one deleting it (a workspace admin removing a teammate's
- * connection). Returns false when another credential still uses the grant.
+ * Scoped by `accountId`, not by owner — the caller is already authorized
+ * against the credential, which may belong to another user.
+ *
+ * The reference check is a predicate on the delete: `credential.accountId` is
+ * `ON DELETE CASCADE`, so a credential racing a separate check would be reaped
+ * by Postgres without {@link clearCredentialRefs} ever running.
  */
-export async function deleteOrphanedOAuthAccount(accountId: string): Promise<boolean> {
-  const [stillReferenced] = await db
-    .select({ id: schema.credential.id })
-    .from(schema.credential)
-    .where(eq(schema.credential.accountId, accountId))
-    .limit(1)
-  if (stillReferenced) return false
-
+export async function deleteOrphanedOAuthAccount(accountId: string): Promise<void> {
   const deleted = await db
     .delete(schema.account)
-    .where(eq(schema.account.id, accountId))
+    .where(
+      and(
+        eq(schema.account.id, accountId),
+        notExists(
+          db
+            .select({ referenced: sql`1` })
+            .from(schema.credential)
+            .where(eq(schema.credential.accountId, accountId))
+        )
+      )
+    )
     .returning({ id: schema.account.id })
+
   if (deleted.length > 0) {
     logger.info('Deleted orphaned OAuth account', { accountId })
   }
-  return deleted.length > 0
 }
 
 /**

apps/sim/lib/credentials/draft-hooks.ts

@@ -4,6 +4,7 @@ import * as schema from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { generateId } from '@sim/utils/id'
 import { and, eq, sql } from 'drizzle-orm'
+import { deleteOrphanedOAuthAccount } from '@/lib/credentials/deletion'
 import { clearDeadFlag } from '@/lib/oauth/terminal-errors'
 import { captureServerEvent } from '@/lib/posthog/server'
 
@@ -184,15 +185,6 @@ export async function handleReconnectCredential(params: {
   })
 
   if (oldAccountId) {
-    const [stillReferenced] = await db
-      .select({ id: schema.credential.id })
-      .from(schema.credential)
-      .where(eq(schema.credential.accountId, oldAccountId))
-      .limit(1)
-
-    if (!stillReferenced) {
-      await db.delete(schema.account).where(eq(schema.account.id, oldAccountId))
-      logger.info('Deleted orphaned account after reconnect', { accountId: oldAccountId })
-    }
+    await deleteOrphanedOAuthAccount(oldAccountId)
   }
 }

apps/sim/lib/credentials/orchestration/index.test.ts

@@ -599,7 +599,7 @@ describe('deleteCredentialRecord', () => {
         workspaceId: 'ws-1',
         type: 'service_account',
         providerId: 'google-service-account',
-        accountId: null,
+        accountId: 'acct-1',
       } as never,
       reason: 'user_delete',
     })

apps/sim/lib/credentials/orchestration/index.ts

@@ -558,22 +558,23 @@ export async function deleteCredentialRecord(
     return true
   }
 
-  const deleted = await deleteConnectionCredential({
+  if (credentialRow.type === 'oauth') {
+    const deleted = await deleteConnectionCredential({
+      credentialId: credentialRow.id,
+      workspaceId: credentialRow.workspaceId,
+      reason: params.reason,
+    })
+    if (deleted && credentialRow.accountId) {
+      await deleteOrphanedOAuthAccount(credentialRow.accountId)
+    }
+    return deleted
+  }
+
+  return deleteConnectionCredential({
     credentialId: credentialRow.id,
     workspaceId: credentialRow.workspaceId,
     reason: params.reason,
   })
-
-  // An OAuth credential's secret source is its `account` row, so deleting the
-  // credential alone would leave the provider grant behind. Revoke it here
-  // rather than only on the personal disconnect path, so an admin removing a
-  // teammate's connection tears down the same state the owner's own disconnect
-  // would. Idempotent for the disconnect path, which sweeps accounts after.
-  if (deleted && credentialRow.type === 'oauth' && credentialRow.accountId) {
-    await deleteOrphanedOAuthAccount(credentialRow.accountId)
-  }
-
-  return deleted
 }
 
 /** Preserves the legacy callers while application adapters migrate to the manager above. */