fix(webhooks): authorize the stored credential and drop stored userId on re-save

Author: waleedlatif1

apps/sim/app/api/webhooks/route.test.ts

@@ -573,26 +573,38 @@ describe('POST /api/webhooks credential references', () => {
   })
 
   /**
-   * A re-save that omits the identity fields keeps the ones the server stored,
-   * so an existing integration is not broken by the client never sending them.
+   * A re-save that omits `credentialId` still acts with the stored credential
+   * (polling setup and subscription cleanup read it), so that credential is
+   * authorized and kept, while a stored `userId` is never carried forward.
    */
-  it('keeps the stored credential and server-set userId on a re-save that omits them', async () => {
-    queueUpdatePathRows(true, { credentialId: 'stored-credential', userId: 'credential-owner' })
+  it('authorizes and keeps the stored credential on a re-save that omits it', async () => {
+    mocks.authorizeCredentialUseForAuth.mockResolvedValue({ ok: true, workspaceId: 'workspace-1' })
+    queueUpdatePathRows(true, { credentialId: 'stored-credential', userId: 'stored-user' })
 
-    const response = await POST(
-      upsertRequest({ userId: 'victim-user', eventType: 'record.created' })
-    )
+    const response = await POST(upsertRequest({ eventType: 'record.created' }))
 
     expect(response.status).toBe(200)
-    expect(mocks.authorizeCredentialUseForAuth).not.toHaveBeenCalled()
+    expect(mocks.authorizeCredentialUseForAuth).toHaveBeenCalledWith(expect.anything(), {
+      credentialId: 'stored-credential',
+      workflowId: 'workflow-1',
+    })
     expect(dbChainMockFns.set).toHaveBeenCalledWith(
       expect.objectContaining({
-        providerConfig: {
-          eventType: 'record.created',
-          credentialId: 'stored-credential',
-          userId: 'credential-owner',
-        },
+        providerConfig: { eventType: 'record.created', credentialId: 'stored-credential' },
       })
     )
   })
+
+  it('refuses a re-save whose stored credential the actor cannot use', async () => {
+    mocks.authorizeCredentialUseForAuth.mockResolvedValue({
+      ok: false,
+      error: 'You do not have access to this credential.',
+    })
+    queueUpdatePathRows(true, { credentialId: 'stored-credential' })
+
+    const response = await POST(upsertRequest({ eventType: 'record.created' }))
+
+    expect(response.status).toBe(403)
+    expect(dbChainMockFns.set).not.toHaveBeenCalled()
+  })
 })

apps/sim/app/api/webhooks/route.ts

@@ -379,7 +379,9 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     let existingWebhook: any = null
     /**
      * `userId` is server-owned: the polling token resolver falls back to that
-     * user's own OAuth account when no credential is set.
+     * user's own OAuth account when no credential is set. It is neither accepted
+     * from the client nor carried forward from a stored row; Gmail and Outlook
+     * polling setup derive it again from the credential after the save.
      */
     const originalProviderConfig: Record<string, unknown> = omit(providerConfig || {}, ['userId'])
     let resolvedProviderConfig = await resolveEnvVarsInObject(
@@ -388,36 +390,12 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       workflowRecord.workspaceId || undefined
     )
 
-    /**
-     * Subscription handlers and pollers look `credentialId` up by id alone and
-     * mint tokens as its owner, so the actor must be able to use it in the
-     * workflow's workspace before anything is subscribed or saved.
-     */
-    const requestedCredentialId = originalProviderConfig.credentialId
-    if (requestedCredentialId != null && requestedCredentialId !== '') {
-      /** The row stores the unresolved text, so only a literal id is what gets authorized. */
-      if (
-        typeof requestedCredentialId !== 'string' ||
-        resolvedProviderConfig.credentialId !== requestedCredentialId
-      ) {
-        return NextResponse.json(
-          { error: 'providerConfig.credentialId must be a literal credential id' },
-          { status: 400 }
-        )
-      }
-      const credentialAccess = await authorizeCredentialUseForAuth(
-        { success: true, userId, authType: AuthType.SESSION },
-        { credentialId: requestedCredentialId, workflowId }
+    /** The row stores the unresolved text, so only a literal credential id can be authorized. */
+    if (resolvedProviderConfig.credentialId !== originalProviderConfig.credentialId) {
+      return NextResponse.json(
+        { error: 'providerConfig.credentialId must be a literal credential id' },
+        { status: 400 }
       )
-      if (!credentialAccess.ok) {
-        logger.warn(`[${requestId}] Webhook credential reference denied`, {
-          userId,
-          workflowId,
-          credentialId: requestedCredentialId,
-          reason: credentialAccess.error,
-        })
-        return NextResponse.json({ error: credentialAccess.error }, { status: 403 })
-      }
     }
 
     let externalSubscriptionCreated = false
@@ -440,6 +418,39 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       existingWebhook = existingRows[0] || null
     }
 
+    /**
+     * Subscription handlers, pollers, and subscription cleanup look `credentialId`
+     * up by id alone and mint tokens as its owner. A save acts with the requested
+     * credential or, when the request omits it, the stored one, so that credential
+     * must be usable by the actor in the workflow's workspace before anything is
+     * subscribed, cleaned up, or saved.
+     */
+    const effectiveCredentialId =
+      'credentialId' in originalProviderConfig
+        ? originalProviderConfig.credentialId
+        : existingWebhook?.providerConfig?.credentialId
+    if (effectiveCredentialId != null && effectiveCredentialId !== '') {
+      if (typeof effectiveCredentialId !== 'string') {
+        return NextResponse.json(
+          { error: 'providerConfig.credentialId must be a literal credential id' },
+          { status: 400 }
+        )
+      }
+      const credentialAccess = await authorizeCredentialUseForAuth(
+        { success: true, userId, authType: AuthType.SESSION },
+        { credentialId: effectiveCredentialId, workflowId }
+      )
+      if (!credentialAccess.ok) {
+        logger.warn(`[${requestId}] Webhook credential reference denied`, {
+          userId,
+          workflowId,
+          credentialId: effectiveCredentialId,
+          reason: credentialAccess.error,
+        })
+        return NextResponse.json({ error: credentialAccess.error }, { status: 403 })
+      }
+    }
+
     /**
      * permission-group-enforced: triggers.webhook — a raw upsert handler with no
      * application operation to declare the capability on, so it is asserted
@@ -519,6 +530,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
         userProvided
       )
     }
+    configToSave.userId = undefined
 
     try {
       if (targetWebhookId) {