feat(credential-groups): add seventeen OAuth providers

[TheodoreSpeaks]

Summary

• Adds 17 OAuth providers to Credential Groups: Airtable, Asana, Attio, Box, Cal.com, ClickUp, DocuSign, Dropbox, HubSpot, Linear, LinkedIn, monday.com, Notion, Pipedrive, Salesforce, WordPress.com, Zoom
• Adds createUserInfoManagedOAuthConnector, so a provider contributes a parse rather than its own connector factory
• Fixes tokenType being compared against exactly Bearer — RFC 6749 §7.1 makes it case-insensitive, and several providers send lowercase bearer, which was rejected as an incomplete authorization
• Adds ManagedOAuthScopeResolution for providers that report granted scopes somewhere other than the token response. Better Auth derives tokens.scopes from the token response's scope field, so a provider that omits it yields an empty list and the scope check rejects a grant the user actually approved
• Adds scopeless for Notion, ClickUp and Cal.com, which authorize with an empty scope list and previously tripped the "no scope policy" guard before the flow could start
• Surfaces which providers this deployment has an OAuth client for, so the picker no longer offers an account type that fails on click
• Adds a search field to the account-type picker, now that the list is 21 rows

Every verifyIdentity is written fresh rather than reusing the connector layer's getUserInfo: that one exists to satisfy Better Auth's email_is_missing guard, so it substitutes a synthetic address when the provider returns none and asserts emailVerified: true in places the provider never verified. Managed enrollment binds a credential to an invited person, so it reports only what the provider proves. LinkedIn now reads the real email_verified claim.

Two deliberate omissions:

• Spotify — its user profile endpoint returns an email the provider documents as unverified, so it cannot satisfy the invitation binding
• Zoho Desk — its data-center Desk base is persisted as a marker inside the credential's scope string, and managed credentials store granted scopes as an array. Adding it now would silently fall back to the default host for every non-US data center; that marker needs plumbing through the managed-credential path first

Type of Change

• New feature

Testing

Tested manually. bun run type-check, bun run lint, and all 37 audits pass; 2202 tests across the credential-group, connector, contract and hook suites pass.

Per-provider OAuth walkthroughs still need a live run — the empty granted-scope case in particular only reproduces against a real provider.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 28, 2026 6:13am

[cubic-dev-ai]

All reported issues were addressed across 20 files

_{You’re at about 99% of the monthly reviewed-line limit. You may want to disable incremental reviews to conserve quota. Reviews will continue until that limit is exceeded. If you need help avoiding interruptions, please contact contact@cubic.dev.}

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[greptile-apps]

Greptile Summary

This PR expands Credential Groups with seventeen managed OAuth providers and aligns provider availability, scope resolution, identity verification, and picker behavior across the server and client.

• Adds provider registry entries and managed OAuth implementations for the new services.
• Supports provider-specific granted-scope resolution, scopeless authorization, and case-insensitive bearer token types.
• Exposes deployment-configured providers and adds searchable account-type selection.
• Corrects credential-group prefetching so the shared React Query cache stores the complete response envelope.

Confidence Score: 5/5

The PR appears safe to merge.

The previously reported cache-shape mismatch has been corrected, and no blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/app/workspace/[workspaceId]/settings/[section]/prefetch.ts	The prefetch now hydrates the complete contract response, matching every consumer of the shared query key.
apps/sim/hooks/queries/utils/credential-group-queries.ts	The shared query utility consistently returns the credential-group settings envelope.
apps/sim/hooks/queries/credential-groups.ts	Credential-group queries consume the unified envelope containing groups and provider availability.
apps/sim/lib/credential-groups/provider-registry.ts	The provider registry is expanded to define the new managed OAuth providers.
apps/sim/lib/auth/connectors/managed-oauth.ts	Managed OAuth handling adds reusable user-info parsing and more flexible token and scope resolution.
apps/sim/ee/credential-groups/components/credential-group-details.tsx	The account picker filters by search text and deployment-configured provider availability while preserving configured options.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Settings[Credential Group settings] --> SharedKey[Shared React Query cache]
  Prefetch[Server prefetch] -->|Full response envelope| SharedKey
  API[Credential Groups API] -->|Groups and available providers| SharedKey
  SharedKey --> List[Credential group list]
  SharedKey --> Picker[Searchable provider picker]
  Picker --> Registry[Provider registry]
  Registry --> OAuth[Managed OAuth authorization]
  OAuth --> Scope[Granted-scope resolution]
  Scope --> Identity[Verified provider identity]
  Identity --> Credential[Managed credential enrollment]

Loading

_{Reviews (2): Last reviewed commit: "fix(credential-groups): hydrate the list..." | Re-trigger Greptile}

[TheodoreSpeaks]

@greptile