improvement(governance): org-ws-credential roles clarity#5134
improvement(governance): org-ws-credential roles clarity#5134icecrasher321 wants to merge 4 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
PR SummaryHigh Risk Overview Access model is aligned end-to-end: organization owners/admins are treated as workspace admins on that org’s workspaces (including workspaces they never received an explicit invite for), and workspace admins are credential admins on shared OAuth, service accounts, and workspace env secrets. APIs now use Many routes stop joining the Reviewed by Cursor Bugbot for commit a301eb8. Configure here. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Greptile SummaryThis PR implements a governance inheritance model where organization owners/admins automatically become workspace admins, and workspace admins automatically become credential admins for shared credential types. A new
Confidence Score: 4/5The governance inheritance model is implemented consistently across all credential, workspace, and OAuth credential paths; the only unresolved gap is the multi-org membership query in The multi-org apps/sim/lib/workspaces/utils.ts — Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[User] -->|member of| B[Organization]
B -->|has role| C{Org Role}
C -->|owner / admin| D[Derived Workspace Admin]
C -->|member| E[No Derived WS Access]
A -->|explicit permission row| F[Workspace Permission]
F --> G{Effective WS Permission}
D --> G
G -->|resolveEffectiveWorkspacePermission| H[admin / write / read / null]
H -->|admin| I[Derived Credential Admin for shared credentials]
H -->|write / read| J[No Credential Admin Derivation]
A -->|explicit credentialMember row| K[Credential Member Role]
K --> L{deriveCredentialAdmin}
I --> L
L -->|memberRole=admin OR workspaceCanAdmin + sharedType| M[Credential Admin]
L -->|otherwise| N[Credential Member / No Access]
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
A[User] -->|member of| B[Organization]
B -->|has role| C{Org Role}
C -->|owner / admin| D[Derived Workspace Admin]
C -->|member| E[No Derived WS Access]
A -->|explicit permission row| F[Workspace Permission]
F --> G{Effective WS Permission}
D --> G
G -->|resolveEffectiveWorkspacePermission| H[admin / write / read / null]
H -->|admin| I[Derived Credential Admin for shared credentials]
H -->|write / read| J[No Credential Admin Derivation]
A -->|explicit credentialMember row| K[Credential Member Role]
K --> L{deriveCredentialAdmin}
I --> L
L -->|memberRole=admin OR workspaceCanAdmin + sharedType| M[Credential Admin]
L -->|otherwise| N[Credential Member / No Access]
Reviews (3): Last reviewed commit: "address comments" | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
|
@greptile |
|
bugbot run |
|
@greptile |
|
bugbot run |
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit a301eb8. Configure here.
| ) { | ||
| logger.warn(`[${requestId}] Execution access denied: ${executionId}`) | ||
| return NextResponse.json({ error: 'Workflow execution not found' }, { status: 404 }) | ||
| } |
There was a problem hiding this comment.
Archived workspace logs blocked
Medium Severity
Log and metrics routes now gate access with checkWorkspaceAccess, which loads workspaces only when they are not archived. Users who still hold explicit permission rows on archived workspaces are treated as having no access, so executions, exports, and stats that previously worked now return empty results or 404.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit a301eb8. Configure here.
1 participant
Summary
Org Admins are auto Workspace Admins. And workspace admins are auto credential admins.
Type of Change
Testing
Tested manually
Checklist