fix(search): authorize organization source credentials

[icecrasher321]

Summary

• Authorize organization Search source credentials through the existing organization credential policy instead of the workspace-only credential check.
• Preserve the acting principal through creation, settings validation, and access-mode changes. Reject revoked organization credentials before provider access.

Type of Change

• Bug fix

Testing

• 152 focused tests passed, including repository binding through real organization authorization and rejection of non-admins, revoked credentials, wrong scope, workspace keys, and another user's OAuth account.
• App and auth type-checks, lint, all 46 repository audits, and docs manifest checks passed.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 10, 2026 2:06am UTC

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; no actionable correctness, security, or repository-rule violations were identified.

Summary

• Rejects revoked organization credentials before provider access.
• Introduces a scope-aware connector credential resolver that retains existing workspace behavior.
• Propagates principal and request context through GitHub installation preparation and source validation.
• Adds focused coverage for organization roles, scope isolation, revocation, provider policy, and OAuth ownership.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Connector create, update, or access-mode change] --> B[Canonical knowledge owner scope]
    B --> C{Owner scope}
    C -->|Organization| D[authorizeOrganizationCredentialUse]
    D --> E[Verify principal, admin role, and integrations capability]
    E --> F[Reject revoked, wrong-scope, unavailable, or unauthorized credential]
    C -->|Workspace| G[getCredentialActorContext and canUseCredential]
    D --> H[Resolve provider identity or token]
    G --> H
    H --> I[Validate source configuration]
    I --> J[Persist connector change]

Loading

_{Reviews (1) · Last reviewed commit: "fix(search): authorize organization sour..."}