fix(credential-groups): restore email credential filtering

Author: TheodoreSpeaks

apps/sim/blocks/blocks/credential-group.ts

@@ -100,7 +100,7 @@ export const CredentialGroupBlock: BlockConfig<CredentialGroupBlockOutput> = {
     'List usable managed credentials, inspect invited people, send an account-connection invitation, or discover Credential Groups in the current workspace. The block returns credential IDs and account metadata without exposing OAuth tokens.',
   bestPractices: `
   - Use "List Credentials" with a ForEach loop to run a provider block once for every connected account.
-  - "List Credentials" returns only the current workflow caller's enrolled credentials. Filter by provider to select one account type.
+  - "List Credentials" returns every active credential. Filter by email to select one enrolled person, by provider to select one account type, or by both for an exact match.
   - Continue with nextCursor until hasMore is false when a list operation returns multiple pages.
   - "List Credentials" returns active, usable credentials only. Reconnect-needed and revoked credentials are excluded.
   - Use "List People" to inspect invitation and connection progress without exposing credential secrets.
@@ -119,6 +119,7 @@ export const CredentialGroupBlock: BlockConfig<CredentialGroupBlockOutput> = {
             field: ['credentialGroup', 'manualCredentialGroup'],
             core: true,
           },
+          { text: ', for', field: 'email' },
           { text: ', from', field: ['providerFilter', 'manualProviderIds'] },
           { text: ', up to', field: 'limit', after: 'credentials' },
         ],
@@ -183,7 +184,7 @@ export const CredentialGroupBlock: BlockConfig<CredentialGroupBlockOutput> = {
       type: 'short-input',
       required: { field: 'operation', value: 'send_invite' },
       placeholder: 'person@example.com',
-      condition: { field: 'operation', value: ['send_invite', 'list_people'] },
+      condition: { field: 'operation', value: [...GROUP_OPERATIONS] },
     },
     {
       id: 'providerFilter',
@@ -251,7 +252,7 @@ export const CredentialGroupBlock: BlockConfig<CredentialGroupBlockOutput> = {
     credentialGroupId: { type: 'string', description: 'Credential Group ID' },
     email: {
       type: 'string',
-      description: 'Recipient email for invites or an optional people-list filter',
+      description: 'Recipient email for invites or an optional credential/people-list filter',
     },
     credentialProviderIds: {
       type: 'json',

apps/sim/executor/handlers/credential-group/credential-group-handler.test.ts

@@ -100,7 +100,7 @@ describe('CredentialGroupBlockHandler', () => {
     )
   })
 
-  it('lists credentials without accepting an email selector', async () => {
+  it('lists credentials with an optional email selector', async () => {
     mocks.listCredentials.mockResolvedValue({
       credentials: [],
       count: 0,
@@ -111,6 +111,7 @@ describe('CredentialGroupBlockHandler', () => {
     const result = await new CredentialGroupBlockHandler().execute(context, block, {
       operation: 'list_credentials',
       credentialGroupId: ' group-1 ',
+      email: ' person@example.com ',
       credentialProviderIds: '["google-email", "google-email"]',
       limit: '25',
       cursor: ' credential-1 ',
@@ -121,6 +122,7 @@ describe('CredentialGroupBlockHandler', () => {
       principal,
       input: {
         credentialGroupId: 'group-1',
+        email: 'person@example.com',
         credentialProviderIds: ['google-email'],
         limit: 25,
         cursor: 'credential-1',

apps/sim/executor/handlers/credential-group/credential-group-handler.ts

@@ -122,6 +122,7 @@ export class CredentialGroupBlockHandler implements BlockHandler {
             credentialGroupId: credentialGroupId!,
             limit: parseLimit(inputs.limit),
             cursor: parseOptionalString(inputs.cursor, 'Cursor'),
+            email: parseOptionalString(inputs.email, 'Email'),
             credentialProviderIds,
           },
         })

apps/sim/lib/credential-groups/application/list-credentials.test.ts

@@ -203,6 +203,7 @@ describe('listCredentialGroupCredentials', () => {
       credentialGroupId: 'group-1',
       limit: 50,
       cursor: undefined,
+      email: undefined,
       credentialProviderIds: undefined,
       credentialGroupOptionIds: ['option-1'],
     })
@@ -234,17 +235,27 @@ describe('listCredentialGroupCredentials', () => {
     )
   })
 
-  it('does not use caller-supplied identity fields to filter credential references', async () => {
+  it('normalizes an optional email filter independently of caller identity', async () => {
     await listCredentialGroupCredentials.execute({
       principal: executorPrincipal(),
       input: { ...input, email: ' Person@Example.COM ' },
     })
 
     expect(mocks.listCredentials).toHaveBeenCalledWith(
-      expect.not.objectContaining({ credentialGroupEnrollmentId: expect.anything() })
+      expect.objectContaining({ email: 'person@example.com' })
     )
   })
 
+  it('rejects an invalid email filter', async () => {
+    await expect(
+      listCredentialGroupCredentials.execute({
+        principal: executorPrincipal(),
+        input: { ...input, email: 'not-an-email' },
+      })
+    ).rejects.toMatchObject({ code: 'validation', message: 'Email must be a valid address' })
+    expect(mocks.listCredentials).not.toHaveBeenCalled()
+  })
+
   it('rejects providers that are not active in the group before credential access', async () => {
     await expect(
       listCredentialGroupCredentials.execute({

apps/sim/lib/credential-groups/application/list-credentials.ts

@@ -1,3 +1,4 @@
+import { isValidEmailSyntax, normalizeEmail } from '@sim/utils/string'
 import { defineAuthorizedWorkspaceUseCase } from '@/lib/core/application'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { credentialGroupDelegationPolicy } from '@/lib/credential-groups/application/authorization'
@@ -21,6 +22,7 @@ export interface ListCredentialGroupCredentialsInput {
   credentialGroupId: string
   limit: number
   cursor?: string
+  email?: string
   credentialProviderIds?: string[]
 }
 
@@ -51,6 +53,11 @@ export const listCredentialGroupCredentials = defineAuthorizedWorkspaceUseCase({
       throw new OrchestrationError('conflict', 'Credential group is disabled')
     }
 
+    const email = input.email ? normalizeEmail(input.email) : undefined
+    if (email && !isValidEmailSyntax(email)) {
+      throw new OrchestrationError('validation', 'Email must be a valid address')
+    }
+
     const credentialProviderIds = [...new Set(input.credentialProviderIds ?? [])]
     if (credentialProviderIds.some((providerId) => !providerId.trim())) {
       throw new OrchestrationError('validation', 'Credential provider IDs must not be empty')
@@ -84,6 +91,7 @@ export const listCredentialGroupCredentials = defineAuthorizedWorkspaceUseCase({
         credentialGroupOptionIds: activeOptions.map((option) => option.id),
         limit: input.limit,
         cursor: input.cursor,
+        email,
         credentialProviderIds: credentialProviderIds.length > 0 ? credentialProviderIds : undefined,
       })
     } catch (error) {

apps/sim/lib/credential-groups/credentials.test.ts

@@ -1,7 +1,7 @@
 /**
  * @vitest-environment node
  */
-import { dbChainMockFns, resetDbChainMock } from '@sim/testing'
+import { dbChainMockFns, hasMockCondition, resetDbChainMock } from '@sim/testing'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { listCredentialGroupCredentialReferences } from '@/lib/credential-groups/credentials'
 
@@ -45,4 +45,24 @@ describe('listCredentialGroupCredentialReferences', () => {
       nextCursor: null,
     })
   })
+
+  it('filters credential references by normalized enrollment email', async () => {
+    dbChainMockFns.limit.mockResolvedValueOnce([])
+
+    await listCredentialGroupCredentialReferences({
+      workspaceId: 'workspace-1',
+      credentialGroupId: 'group-1',
+      credentialGroupOptionIds: ['option-1'],
+      email: 'person@example.com',
+      limit: 50,
+    })
+
+    const where = dbChainMockFns.where.mock.calls.at(-1)?.[0]
+    expect(
+      hasMockCondition(
+        where,
+        (condition) => condition.type === 'eq' && condition.right === 'person@example.com'
+      )
+    ).toBe(true)
+  })
 })

apps/sim/lib/credential-groups/credentials.ts

@@ -44,6 +44,7 @@ interface ListCredentialGroupCredentialReferencesInput {
   credentialGroupId: string
   limit: number
   cursor?: string
+  email?: string
   credentialProviderIds?: string[]
   credentialGroupOptionIds: string[]
 }
@@ -96,6 +97,7 @@ export async function listCredentialGroupCredentialReferences({
   credentialGroupId,
   limit,
   cursor,
+  email,
   credentialProviderIds,
   credentialGroupOptionIds,
 }: ListCredentialGroupCredentialReferencesInput): Promise<{
@@ -123,6 +125,7 @@ export async function listCredentialGroupCredentialReferences({
           eq(credential.type, 'managed_oauth'),
           eq(credential.managedOauthStatus, 'active'),
           eq(credentialGroupEnrollment.credentialGroupId, credentialGroupId),
+          email ? eq(credentialGroupEnrollment.email, email) : undefined,
           inArray(credential.credentialGroupOptionId, credentialGroupOptionIds),
           credentialProviderIds?.length
             ? inArray(credential.providerId, credentialProviderIds)
@@ -156,6 +159,7 @@ export async function listCredentialGroupCredentialReferences({
         eq(credential.type, 'managed_oauth'),
         eq(credential.managedOauthStatus, 'active'),
         eq(credentialGroupEnrollment.credentialGroupId, credentialGroupId),
+        email ? eq(credentialGroupEnrollment.email, email) : undefined,
         inArray(credential.credentialGroupOptionId, credentialGroupOptionIds),
         credentialProviderIds?.length
           ? inArray(credential.providerId, credentialProviderIds)