fix(webhooks): authorize the stored credential only when the save uses it

Author: waleedlatif1

apps/sim/app/api/webhooks/route.test.ts

@@ -634,8 +634,30 @@ describe('POST /api/webhooks credential references', () => {
     }
   )
 
-  it('authorizes both credentials when a re-save replaces the stored one', async () => {
+  /** Rotation without recreation never touches the old credential, so it needs no access to it. */
+  it('rotates the credential without access to the stored one when nothing is recreated', async () => {
+    mocks.authorizeCredentialUseForAuth.mockImplementation(async (_auth, { credentialId }) =>
+      credentialId === 'new-credential'
+        ? { ok: true, workspaceId: 'workspace-1' }
+        : { ok: false, error: 'You do not have access to this credential.' }
+    )
+    queueUpdatePathRows(true, { credentialId: 'stored-credential' })
+
+    const response = await POST(upsertRequest({ credentialId: 'new-credential' }))
+
+    expect(response.status).toBe(200)
+    expect(mocks.authorizeCredentialUseForAuth.mock.calls.map(([, params]) => params)).toEqual([
+      { credentialId: 'new-credential', workflowId: 'workflow-1' },
+    ])
+    expect(dbChainMockFns.set).toHaveBeenCalledWith(
+      expect.objectContaining({ providerConfig: { credentialId: 'new-credential' } })
+    )
+  })
+
+  /** Recreation cleans up the previous subscription with the stored credential. */
+  it('authorizes both credentials when a rotation recreates the subscription', async () => {
     mocks.authorizeCredentialUseForAuth.mockResolvedValue({ ok: true, workspaceId: 'workspace-1' })
+    mocks.shouldRecreateExternalWebhookSubscription.mockReturnValue(true)
     queueUpdatePathRows(true, { credentialId: 'stored-credential' })
 
     const response = await POST(upsertRequest({ credentialId: 'new-credential' }))

apps/sim/app/api/webhooks/route.ts

@@ -418,18 +418,32 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       existingWebhook = existingRows[0] || null
     }
 
+    const shouldRecreateSubscription =
+      existingWebhook &&
+      shouldRecreateExternalWebhookSubscription({
+        previousProvider: existingWebhook.provider as string,
+        nextProvider: provider,
+        previousConfig: ((existingWebhook.providerConfig as Record<string, unknown>) ||
+          {}) as Record<string, unknown>,
+        nextConfig: resolvedProviderConfig,
+      })
+
     /**
      * Subscription handlers, pollers, and subscription cleanup look `credentialId`
-     * up by id alone and mint tokens as its owner. A save can act with both the
-     * requested credential and the stored one — the stored one is merged back when
-     * the request omits it, or used to clean up the previous subscription — so
-     * each must be usable by the actor in the workflow's workspace before anything
-     * is subscribed, cleaned up, or saved.
+     * up by id alone and mint tokens as its owner, so every credential this save
+     * acts with must be usable by the actor in the workflow's workspace before
+     * anything is subscribed, cleaned up, or saved. That is the requested
+     * credential, plus the stored one when the save uses it: merged back because
+     * the request omits `credentialId`, or used to clean up the previous
+     * subscription on recreation.
      */
+    const usesStoredCredential =
+      existingWebhook && (shouldRecreateSubscription || !('credentialId' in originalProviderConfig))
     const credentialIds = new Set(
-      [originalProviderConfig.credentialId, existingWebhook?.providerConfig?.credentialId].filter(
-        (id) => id != null && id !== ''
-      )
+      [
+        originalProviderConfig.credentialId,
+        usesStoredCredential ? existingWebhook.providerConfig?.credentialId : undefined,
+      ].filter((id) => id != null && id !== '')
     )
     for (const credentialId of credentialIds) {
       if (typeof credentialId !== 'string') {
@@ -492,16 +506,6 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       }
     }
 
-    const shouldRecreateSubscription =
-      existingWebhook &&
-      shouldRecreateExternalWebhookSubscription({
-        previousProvider: existingWebhook.provider as string,
-        nextProvider: provider,
-        previousConfig: ((existingWebhook.providerConfig as Record<string, unknown>) ||
-          {}) as Record<string, unknown>,
-        nextConfig: resolvedProviderConfig,
-      })
-
     if (!existingWebhook || shouldRecreateSubscription) {
       try {
         const result = await createExternalWebhookSubscription(