improvement(config): gate feature flags by workspace id

[TheodoreSpeaks]

Summary

• Add a workspaceIds allowlist clause to the shared AppConfig gate rules (appconfig-rules.ts), alongside the existing enabled / orgIds / userIds / adminEnabled clauses — normalized and OR-matched the same way, so both the feature-flags and block-visibility documents inherit it
• Thread workspaceId through the credential-groups gate: resolveCredentialGroupsAvailability / isCredentialGroupsAvailable now take { workspaceId, ownerBilling } and evaluate isFeatureEnabled('credential-groups', { workspaceId })
• workspaceId is required, not optional — an omitted id would silently fall through to the global clause instead of the allowlist. All five call sites already had it on hand
• Credential groups can now be turned on for one workspace with an AppConfig edit and no code deploy: { "credential-groups": { "enabled": false, "workspaceIds": ["<workspace-id>"] } }
• Updated the add-feature-flag skill to document the new dimension

Note: getBlockVisibility callers only pass userId / orgId, so a workspaceIds rule in the block-visibility document would never match today — the clause is usable for feature flags.

Type of Change

• New feature (non-breaking change which adds functionality)

Testing

Unit tests added at all three levels — the new clause in appconfig-rules (normalize + match), the workspace-scoped rollout in feature-flags, and the availability resolver asserting the flag is evaluated with the workspace id. bun run type-check clean; lint:check, check:audits (37 audits), and check-block-registry all pass.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 28, 2026 1:50am

[greptile-apps]

Greptile Summary

The PR adds workspace-scoped AppConfig gates and applies them to credential-group availability while retaining the existing hosted Enterprise-plan requirement.

• Adds normalization and exact matching for workspaceIds in shared AppConfig gate rules.
• Threads each credential group’s canonical workspace ID through all availability checks.
• Adds unit coverage for normalization, feature-flag evaluation, and availability context.
• Updates feature-flag authoring guidance for workspace-scoped rollouts.

Confidence Score: 5/5

The PR appears safe to merge with no actionable correctness or security defects identified.

Workspace targeting is added through the shared gate evaluator, and every updated credential-group production path passes the same canonical workspace ID used to obtain its billing context while preserving the existing Enterprise restriction.

Important Files Changed

Filename	Overview
apps/sim/lib/core/config/appconfig-rules.ts	Adds normalized workspace allowlists and exact workspace-context matching consistently with existing gate clauses.
apps/sim/lib/core/config/feature-flags.ts	Exposes workspace targeting through the existing shared feature-flag context and updates credential-group flag documentation.
apps/sim/lib/credential-groups/availability.ts	Requires a workspace ID and evaluates credential-group enablement for that workspace before applying the existing billing restriction.
apps/sim/lib/credential-groups/application/context.ts	Passes the same workspace ID used to resolve owner billing into credential-group availability checks.
apps/sim/lib/credential-groups/enrollments.ts	Evaluates public enrollment availability against the enrollment row’s workspace.
apps/sim/lib/credentials/managed-oauth.ts	Evaluates managed credential availability against the credential’s canonical workspace.
apps/sim/lib/workspaces/host-context.ts	Computes host-context credential-group availability using the requested workspace and its corresponding owner billing.
apps/sim/lib/core/config/appconfig-rules.test.ts	Covers workspace allowlist normalization and matching behavior.
apps/sim/lib/core/config/feature-flags.test.ts	Covers allowlisted, non-allowlisted, omitted, and wrong-dimension workspace contexts.
apps/sim/lib/credential-groups/availability.test.ts	Verifies that credential-group availability forwards the workspace ID to feature-flag evaluation.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Config[AppConfig credential-groups rule] --> Gate[Feature flag evaluation]
  Workspace[Canonical workspace ID] --> Gate
  Gate -->|disabled or not allowlisted| Unavailable[Feature unavailable]
  Gate -->|enabled or allowlisted| Plan[Hosted Enterprise check]
  Billing[Workspace owner billing] --> Plan
  Plan -->|Enterprise or self-hosted| Available[Credential groups available]
  Plan -->|Hosted non-Enterprise| Unavailable

Loading

_{Reviews (1): Last reviewed commit: "improvement(config): gate feature flags ..." | Re-trigger Greptile}

[cubic-dev-ai]

No issues found across 12 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}