fix(credentials): scope personal connections to organizations

[TheodoreSpeaks]

Summary

• Stop creating credential groups when provisioning workspaces. Personal OAuth connections use the organization's configured group and require current organization membership.
• Store personal GitLab tokens under the organization and connecting user, so one connection works across accessible workspaces. Update creation, lookup, rotation, and disconnect to use that ownership.
• Keep Assistant's own-account access private and separate from the workflow workspace allowlist. Existing legacy groups remain available during the transition.
• Add a resumable, dry-run-first GitLab data migration that preserves credential IDs and re-encrypts ownership bindings. Run it after deployment; duplicate identities and conflicting enrollments fail rather than being overwritten. No new Drizzle schema migration is needed.

Type of Change

• Bug fix

Testing

• Focused workspace provisioning and personal-connection tests passed.
• 801 credential unit tests and 9 PostgreSQL integration tests passed, covering migration, cross-workspace use, identity isolation, revocation, reconnect, rotation, and deletion of the original workspace.
• App/auth type checks, repository lint, shipping audits, migration safety, and generated-artifact checks passed.
• No staging or production data migration has been run.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 8, 2026 9:43pm UTC

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; no concrete correctness, security, or repository-rule violation remains.

Summary

• Requires current organization membership, feature availability, an active organization group, and valid organization account setup before enrollment.
• Preserves workspace ownership on personal-token credential records and supports existing workspace-scoped token enrollments.
• Stops creating credential groups during workspace provisioning while leaving existing workspace groups unchanged.
• Updates route messaging and focused tests for organization-scoped behavior.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    User[Authenticated user] --> WorkspaceAuth[Authorize workspace operation]
    WorkspaceAuth --> OrgMembership[Require current organization membership]
    OrgMembership --> Availability[Check organization account availability]
    Availability --> OrgGroup[Load active organization credential group]
    OrgGroup --> Setup[Validate organization account policy]
    Setup --> Kind{Connection type}
    Kind -->|OAuth| Enrollment[Create or reuse personal enrollment]
    Enrollment --> OAuth[Start provider OAuth]
    Kind -->|GitLab token| Verify[Verify and encrypt personal token]
    Verify --> TokenEnrollment[Enroll user in organization group]
    TokenEnrollment --> Credential[Store workspace-owned credential]

Loading