feat(resource-policies): add statement evaluator by TheodoreSpeaks · Pull Request #6892 · simstudioai/sim

TheodoreSpeaks · 2026-08-20T18:09:58Z

Summary

replace credential group grants with statement-based resource policies supporting explicit allow/deny and bounded IAM-style conditions
bind persisted execution principals and current workflow authority into credential-use decisions, while keeping actor-owned credential access as a hidden system rule
add a raw JSON policy editor plus trigger-owned policy lifecycle and a bounded backfill

Type of Change

New feature

Testing

bun run lint
bun run type-check
bun run check:audits
bun run check:migrations origin/staging
67 database tests and 221 focused application/workflow tests

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-08-20T18:10:04Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 26, 2026 4:27am

cursor · 2026-08-20T18:10:11Z

PR Summary

High Risk
Changes authorization for managed OAuth credentials and internal executor delegation, including policy evaluation, deployment-version binding, and token issuance. Mis-evaluation could over- or under-grant credential access.

Overview
Replaces enrollment-only Credential Group token checks with stored IAM-style resource policies (allow/deny, principals, flat conditions) plus a hidden actor-own system rule. Admins can edit the full policy as JSON; credential use is policy-gated while listing stays discovery-only.

Adds a required per-group policy lifecycle (create/delete/backfill), optimistic-concurrency admin GET/PUT, and a settings Access tab. Credential use now evaluates credential_groups.credentials.use with explicit-deny precedence.

Threads current workflow (draft vs active deployment version) through executor delegation and child-workflow execution so workflow principals and sim:WorkflowMode conditions bind to the child, not the root. Deployed state APIs now require deploymentVersionId; stale or cross-workspace child authority fails closed.

^{Reviewed by Cursor Bugbot for commit a01a557. Bugbot is set up for automated code reviews on this repo. Configure here.}

greptile-apps · 2026-08-20T18:13:08Z

Greptile Summary

The PR replaces credential-group grants with revisioned statement-based resource policies and propagates execution authority into credential-use decisions.

Adds credential-group access management APIs and settings UI.
Adds policy persistence, lifecycle triggers, migration, backfill, and reconciliation tooling.
Carries workflow deployment identity and originating principals through delegated and resumed execution paths.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/credential-groups/application/authorization.ts	Enforces executor-principal, workflow-authority, enrollment, and resource-policy checks before credential-group credential use.
apps/sim/lib/credential-groups/application/workflow-access-policy.ts	Defines and evaluates the bounded workflow-only policy document with deployment-mode enforcement and deny-by-default behavior.
apps/sim/lib/auth/internal-delegation.ts	Binds delegated executor claims to canonical execution, workflow, workspace, and deployment-version context.
apps/sim/lib/resource-policies/repository.ts	Adds revisioned policy reads and transactionally guarded optimistic updates.
packages/db/credential-group-resource-policies.ts	Implements credential-group policy lifecycle triggers, bounded backfill batches, and relational-invariant validation.
apps/sim/ee/credential-groups/components/credential-group-access.tsx	Adds a revision-aware workflow-access editor that preserves drafts across refreshes and validates catalog availability before saving.
apps/sim/lib/workflows/executor/execution-core.ts	Propagates current deployed-workflow authority through workflow execution and resume boundaries.

Sequence Diagram

sequenceDiagram
  participant Admin
  participant AccessAPI
  participant PolicyStore
  participant Executor
  participant Delegation
  participant CredentialAuth

  Admin->>AccessAPI: Select allowed workflows
  AccessAPI->>PolicyStore: Write policy with expected revision
  PolicyStore-->>AccessAPI: New revision
  Executor->>Delegation: Bind principal and deployed workflow authority
  Delegation->>CredentialAuth: Resolve managed credential
  CredentialAuth->>PolicyStore: Read credential-group policy
  PolicyStore-->>CredentialAuth: Policy document
  CredentialAuth->>CredentialAuth: Evaluate actor rule and workflow statements
  CredentialAuth-->>Executor: Allow credential or deny safely

_{Reviews (5): Last reviewed commit: "improvement(credential-groups): simplify..." | Re-trigger Greptile}

TheodoreSpeaks · 2026-08-21T04:48:47Z

@greptile

TheodoreSpeaks · 2026-08-21T04:48:54Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

3 issues from previous reviews remain unresolved.

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit eccb03a. Configure here.}

TheodoreSpeaks · 2026-08-21T05:08:25Z

@greptile

TheodoreSpeaks · 2026-08-21T05:08:32Z

@cursor review

cursor

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

There are 5 total unresolved issues (including 3 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ede2aba. Configure here.}

TheodoreSpeaks · 2026-08-25T17:18:49Z

@greptile

TheodoreSpeaks · 2026-08-25T17:18:57Z

@cursor review

cursor · 2026-08-25T17:19:01Z

Skipping Bugbot: Bugbot is disabled for this repository. Visit the Bugbot dashboard to update your settings.

TheodoreSpeaks · 2026-08-26T04:24:18Z

@greptile

TheodoreSpeaks · 2026-08-26T04:24:35Z

@cursor review

cursor · 2026-08-26T04:24:38Z

Skipping Bugbot: Bugbot is disabled for this repository. Visit the Bugbot dashboard to update your settings.

TheodoreSpeaks force-pushed the feat/credential-group-resource-policies branch from 9995853 to 0c9fb23 Compare August 20, 2026 18:12

vercel Bot deployed to Preview August 20, 2026 18:17 View deployment

vercel Bot temporarily deployed to Preview August 20, 2026 20:42 Inactive

cursor Bot reviewed Aug 20, 2026

View reviewed changes

Comment thread apps/sim/ee/credential-groups/components/credential-group-access.tsx Outdated

vercel Bot temporarily deployed to Preview August 20, 2026 21:22 Inactive

TheodoreSpeaks force-pushed the feat/credential-group-resource-policies branch from aaea6ae to 52e3168 Compare August 21, 2026 00:17

vercel Bot deployed to Preview August 21, 2026 00:22 View deployment

TheodoreSpeaks force-pushed the feat/credential-group-resource-policies branch 2 times, most recently from 95eafd9 to 9d5f513 Compare August 21, 2026 01:41

vercel Bot deployed to Preview August 21, 2026 01:46 View deployment

TheodoreSpeaks force-pushed the feat/credential-group-resource-policies branch 2 times, most recently from c2d891e to 64f547f Compare August 21, 2026 01:53

vercel Bot deployed to Preview August 21, 2026 01:58 View deployment

cursor Bot reviewed Aug 21, 2026

View reviewed changes

Comment thread packages/db/migrations/0298_sparkling_hemingway.sql

Comment thread apps/sim/lib/credential-groups/application/manage-access.ts

TheodoreSpeaks force-pushed the feat/credential-group-resource-policies branch from 64f547f to eccb03a Compare August 21, 2026 04:47

vercel Bot deployed to Preview August 21, 2026 04:53 View deployment

cursor Bot reviewed Aug 21, 2026

View reviewed changes

TheodoreSpeaks force-pushed the feat/credential-group-resource-policies branch from eccb03a to ede2aba Compare August 21, 2026 05:07

vercel Bot deployed to Preview August 21, 2026 05:15 View deployment

cursor Bot reviewed Aug 21, 2026

View reviewed changes

Comment thread apps/sim/hooks/queries/credential-groups.ts

Comment thread apps/sim/lib/api/contracts/credential-groups.ts

TheodoreSpeaks changed the title ~~feat(credential-groups): add resource access policies~~ feat(resource-policies): add statement evaluator Aug 23, 2026

vercel Bot deployed to Preview August 23, 2026 20:13 View deployment

TheodoreSpeaks added 5 commits August 23, 2026 13:14

feat(credential-groups): add resource access policies

f4baa7b

fix(credential-groups): clarify empty access subjects

4e222e6

fix(resource-policies): authorize credential use only

2efa24e

test(resource-policies): cover actor grant resolution

4d5bb9c

feat(resource-policies): add statement evaluator

a01a557

TheodoreSpeaks force-pushed the feat/credential-group-resource-policies branch from fab4e47 to a01a557 Compare August 23, 2026 20:44

vercel Bot deployed to Preview August 23, 2026 20:49 View deployment

feat(resource-policies): add visual policy editor

e19faee

vercel Bot deployed to Preview August 25, 2026 17:22 View deployment

refactor(resource-policies): register principals and conditions

c8c2507

vercel Bot deployed to Preview August 25, 2026 23:54 View deployment

TheodoreSpeaks added 2 commits August 25, 2026 18:43

refactor(credential-groups): simplify workflow access

d57ae1c

improvement(credential-groups): simplify workflow access

98a053c

TheodoreSpeaks requested a review from a team as a code owner August 26, 2026 04:22

vercel Bot deployed to Preview August 26, 2026 04:27 View deployment

Uh oh!

Conversation

TheodoreSpeaks commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-apps Bot commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TheodoreSpeaks commented Aug 21, 2026

Uh oh!

TheodoreSpeaks commented Aug 21, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

TheodoreSpeaks commented Aug 21, 2026

Uh oh!

TheodoreSpeaks commented Aug 21, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

TheodoreSpeaks commented Aug 25, 2026

Uh oh!

TheodoreSpeaks commented Aug 25, 2026

Uh oh!

cursor Bot commented Aug 25, 2026

Uh oh!

TheodoreSpeaks commented Aug 26, 2026

Uh oh!

TheodoreSpeaks commented Aug 26, 2026

Uh oh!

cursor Bot commented Aug 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

TheodoreSpeaks commented Aug 20, 2026 •

edited

Loading

vercel Bot commented Aug 20, 2026 •

edited

Loading

cursor Bot commented Aug 20, 2026 •

edited

Loading

greptile-apps Bot commented Aug 20, 2026 •

edited

Loading