fix(credentials): hide gated service accounts from connected list

[TheodoreSpeaks]

Summary

• hide service-account credentials when their owning block is gated
• preserve existing credential lookup behavior and avoid visibility checks for ungated credentials

Type of Change

• Bug fix

Testing

• 15 focused tests passed
• app/auth type-check passed
• lint and all 32 audits passed

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 20, 2026 8:10pm

[cursor]

PR Summary

Medium Risk
Changes which credentials the list API returns, so a filter bug could hide valid connections or leak preview-gated ones. Lookup and create/update paths are untouched.

Overview
Stops listing service-account credentials whose gating block is preview-hidden, so the connected-credentials API matches block/integration visibility.

listInternalCredentials now filters those rows with getBlockVisibility and createIntegrationCredentialVisibility. Visibility work is skipped when no gated providers are present, and single-credential lookup is unchanged.

^{Reviewed by Cursor Bugbot for commit e479efb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

The PR filters preview-gated service-account credentials from the user-facing connected-credentials list while preserving direct credential lookup behavior.

• Detects whether returned credentials include providers associated with gated service-account blocks.
• Loads viewer-specific block visibility only when gated providers are present.
• Filters gated service accounts through the shared integration-visibility policy.
• Adds focused route coverage for hidden service accounts and unchanged lookup/ungated behavior.

Confidence Score: 5/5

The PR appears safe to merge, with no actionable correctness or security defects identified.

The connected-list path filters only mapped service-account providers, preserves ungated credentials and direct lookups, and avoids unnecessary visibility resolution when no gated provider is present.

Important Files Changed

Filename	Overview
apps/sim/lib/credentials/application/credential-crud.ts	Adds a targeted, viewer-aware visibility filter for gated service-account credentials without changing direct lookup behavior.
apps/sim/app/api/credentials/route.test.ts	Adds coverage confirming gated service accounts are hidden and visibility resolution is skipped for unaffected list and lookup paths.

_{Reviews (1): Last reviewed commit: "fix(credentials): hide gated service acc..." | Re-trigger Greptile}