fix(connected-accounts): align organization settings and invitation flows

Author: TheodoreSpeaks

apps/docs/content/docs/platform/connected-accounts.mdx

@@ -15,9 +15,11 @@ Connected accounts must be enabled for your organization. Sim Cloud also require
 
 For self-hosted deployments using environment-based feature flags, set `CREDENTIAL_GROUPS=true`. Availability is organization-scoped; personal workspaces cannot use an organization pool.
 
+The setup instructions below describe **Settings → Connected accounts**, shown when Knowledge Member Access is disabled. When `KNOWLEDGE_MEMBER_ACCESS=true` and connected accounts is available, organization settings shows the Search **Integrations** page instead. Only the selected page is available, including through direct links. Switching pages does not remove existing connections or workspace access.
+
 ## Set up connected accounts
 
-Open **Settings → Organization → Connected accounts**. You can also open **Connected accounts** from organization settings. Select **Set up connected accounts** if this is your first time.
+Open your organization’s **Settings → Connected accounts**. Select **Set up connected accounts** if this is your first time.
 
 The page has three tabs:
 
@@ -42,11 +44,13 @@ For Databricks, **Add** validates and saves the configuration before the provide
 
 When editing Databricks, leaving the client secret blank preserves the saved secret. Changing the MCP URL or OAuth client requires people to reconnect.
 
-Adding a provider makes account connections available. Indexable providers also show **Indexing on/off**, with the switch inside **Configure**. Indexing is a separate, optional Search capability; workflows can use connected accounts with indexing off. Managed MCP providers currently support live tool calls only and have no indexing switch.
+Adding a provider makes account connections available without enabling indexing. Search source setup is managed on **Settings → Integrations** when Search is enabled. Connected accounts has no indexing controls or status indicators. Managed MCP providers currently support live tool calls only.
 
 ### 2. Invite people
 
-1. Open **People** and select **Invite people**.
+For Search-enabled organizations, open **Settings → Integrations → People**. Otherwise, use **Settings → Connected accounts → People**. Set up a provider for personal account connections before inviting people; approving a Search integration alone is not enough.
+
+1. Select **Request connections**.
 2. Enter their email addresses and select **Send requests**.
 3. Each person opens the invitation, signs in to Sim with the verified invitation email, and authorizes the providers they want to connect.
 4. They select **Submit** to finish the connection form.
@@ -61,11 +65,11 @@ On first use, the invitation email must match the signed-in user's verified Sim
 
 OAuth account providers also verify that the provider email matches the invitation email. Managed MCP connections are associated with the verified Sim user who completes authorization; they do not independently verify the MCP provider's account email. Keep using the invitation email when looking up those connections.
 
-In **People**, use **Resend** or **Copy new link** when someone needs another invitation link. **Revoke** stops the organization from using that person's contributions. The person cannot undo an administrator's revocation by reconnecting on their own.
+In **People**, open a person's actions menu and select **Resend** when they need another invitation. **Revoke** stops the organization from using that person's contributions. The person cannot undo an administrator's revocation by reconnecting on their own.
 
 ### 3. Allow workspaces
 
-Open **Workspace access**, select the workspaces that should use the pool, and select **Save access**. Only workspaces in this organization can be allowed.
+Open **Workspace access** and select **Add workspaces** to choose one or more workspaces. The list shows workspaces that have access; use a row's **Remove** action to withdraw it. Adding or removing a workspace applies immediately. Only workspaces in this organization can be allowed.
 
 <Callout>
 An allowed workspace gives every authorized manual and deployed workflow in that workspace access to **every active account in the pool**. This includes scheduled, webhook, and public deployments that pass their normal workflow authorization. There is no separate workflow allowlist or restriction to the running user's own contributions.

apps/sim/app/api/organizations/[id]/connected-accounts/invitation-link/route.ts

@@ -2,7 +2,7 @@ import type { Metadata } from 'next'
 import { notFound, redirect } from 'next/navigation'
 import { getSession } from '@/lib/auth'
 import { getAccessibleCopilotChatAuth } from '@/lib/copilot/chat/lifecycle'
-import { organizationRoutes } from '@/lib/navigation/paths'
+import { WORKSPACE_SETTINGS_PATH } from '@/lib/navigation/paths'
 import { getOrganizationSurfaceContext } from '@/lib/organizations/surface'
 import { OrganizationHome } from '@/app/o/[organizationId]/home/organization-home'
 
@@ -18,8 +18,7 @@ export default async function OrganizationChatPage({
   if (!session?.user?.id) notFound()
   const context = await getOrganizationSurfaceContext(organizationId, session.user.id)
   if (!context) notFound()
-  if (!context.searchAccess.memberScoped)
-    redirect(organizationRoutes(organizationId).settingsSection('general'))
+  if (!context.searchAccess.memberScoped) redirect(WORKSPACE_SETTINGS_PATH)
   const chat = await getAccessibleCopilotChatAuth(chatId, session.user.id, {
     principal: { kind: 'session', userId: session.user.id, sessionId: session.session.id },
   })

apps/sim/app/o/[organizationId]/chat/[chatId]/page.tsx

@@ -47,9 +47,9 @@ describe('organization Search page gates', () => {
     ['Search', () => OrganizationSearchPage({ params })],
     ['chat', () => OrganizationChatPage({ params })],
     ['organization entry', () => OrganizationPage({ params })],
-  ] as const)('redirects %s to General settings when Search is disabled', async (_name, open) => {
+  ] as const)('redirects %s to workspace settings when Search is disabled', async (_name, open) => {
     mocks.context.mockResolvedValue({ searchAccess: { memberScoped: false, sourceMirrored: true } })
-    await expect(open()).rejects.toThrow('redirect:/o/org-1/settings/general')
+    await expect(open()).rejects.toThrow('redirect:/workspace?redirect=settings')
     expect(mocks.context).toHaveBeenCalledWith('org-1', 'viewer')
     expect(mocks.chat).not.toHaveBeenCalled()
   })

apps/sim/app/o/[organizationId]/home/page.test.tsx

@@ -1,7 +1,7 @@
 import type { Metadata } from 'next'
 import { notFound, redirect } from 'next/navigation'
 import { getSession } from '@/lib/auth'
-import { organizationRoutes } from '@/lib/navigation/paths'
+import { WORKSPACE_SETTINGS_PATH } from '@/lib/navigation/paths'
 import { getOrganizationSurfaceContext } from '@/lib/organizations/surface'
 import { OrganizationHome } from '@/app/o/[organizationId]/home/organization-home'
 
@@ -19,8 +19,7 @@ export default async function OrganizationHomePage({
   if (!session?.user?.id) notFound()
   const context = await getOrganizationSurfaceContext(organizationId, session.user.id)
   if (!context) notFound()
-  if (!context.searchAccess.memberScoped)
-    redirect(organizationRoutes(organizationId).settingsSection('general'))
+  if (!context.searchAccess.memberScoped) redirect(WORKSPACE_SETTINGS_PATH)
 
   return <OrganizationHome userName={session.user.name} />
 }

apps/sim/app/o/[organizationId]/home/page.tsx

@@ -1,6 +1,6 @@
 import { notFound, redirect } from 'next/navigation'
 import { getSession } from '@/lib/auth'
-import { organizationRoutes } from '@/lib/navigation/paths'
+import { organizationRoutes, WORKSPACE_SETTINGS_PATH } from '@/lib/navigation/paths'
 import { getOrganizationSurfaceContext } from '@/lib/organizations/surface'
 
 export default async function OrganizationPage({
@@ -14,5 +14,5 @@ export default async function OrganizationPage({
   const context = await getOrganizationSurfaceContext(organizationId, session.user.id)
   if (!context) notFound()
   const routes = organizationRoutes(organizationId)
-  redirect(context.searchAccess.memberScoped ? routes.home : routes.settingsSection('general'))
+  redirect(context.searchAccess.memberScoped ? routes.home : WORKSPACE_SETTINGS_PATH)
 }

apps/sim/app/o/[organizationId]/page.tsx

@@ -1,7 +1,7 @@
 import type { Metadata } from 'next'
 import { notFound, redirect } from 'next/navigation'
 import { getSession } from '@/lib/auth'
-import { organizationRoutes } from '@/lib/navigation/paths'
+import { WORKSPACE_SETTINGS_PATH } from '@/lib/navigation/paths'
 import { getOrganizationSurfaceContext } from '@/lib/organizations/surface'
 import { OrganizationSearch } from '@/app/o/[organizationId]/search/search'
 
@@ -17,7 +17,6 @@ export default async function OrganizationSearchPage({
   if (!session?.user?.id) notFound()
   const context = await getOrganizationSurfaceContext(organizationId, session.user.id)
   if (!context) notFound()
-  if (!context.searchAccess.memberScoped)
-    redirect(organizationRoutes(organizationId).settingsSection('general'))
+  if (!context.searchAccess.memberScoped) redirect(WORKSPACE_SETTINGS_PATH)
   return <OrganizationSearch />
 }

apps/sim/app/o/[organizationId]/search/page.tsx

@@ -8,7 +8,7 @@ import {
 } from '@/components/settings/navigation'
 import { SettingsSectionProvider } from '@/components/settings/settings-panel'
 import { useOrganizationContext } from '@/app/o/[organizationId]/providers/organization-provider'
-import { OrganizationIntegrationsSetup } from '@/app/o/[organizationId]/settings/components/integrations/organization-integrations-setup'
+import { OrganizationIntegrationsSettings } from '@/app/o/[organizationId]/settings/components/integrations/organization-integrations-settings'
 import { OrganizationSearchMcp } from '@/app/o/[organizationId]/settings/components/organization-search-mcp'
 import { OrganizationConnectedAccounts } from '@/ee/credential-groups/components/organization-connected-accounts'
 
@@ -60,7 +60,7 @@ export function OrganizationSettings({ section }: OrganizationSettingsProps) {
 
   return (
     <SettingsSectionProvider section={section} meta={meta}>
-      {section === 'integrations' && <OrganizationIntegrationsSetup />}
+      {section === 'integrations' && <OrganizationIntegrationsSettings />}
       {section === 'connected-accounts' && (
         <OrganizationConnectedAccounts organizationId={organizationId} />
       )}

apps/sim/app/o/[organizationId]/settings/[section]/settings.tsx

@@ -0,0 +1,152 @@
+/** @vitest-environment jsdom */
+import { act } from 'react'
+import { toast } from '@sim/emcn'
+import { NuqsTestingAdapter } from 'nuqs/adapters/testing'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  context: vi.fn(),
+  accounts: vi.fn(),
+  people: vi.fn(),
+  invite: vi.fn(),
+  refetch: vi.fn(),
+}))
+vi.mock('@/app/o/[organizationId]/providers/organization-provider', () => ({
+  useOrganizationContext: mocks.context,
+}))
+vi.mock(
+  '@/app/o/[organizationId]/settings/components/integrations/organization-integrations-setup',
+  () => ({ OrganizationIntegrationsSetup: () => <div>Provider setup</div> })
+)
+vi.mock('@/hooks/queries/organization-accounts', () => ({
+  useOrganizationAccounts: mocks.accounts,
+  useOrganizationAccountPeople: mocks.people,
+  useInviteOrganizationAccountPeople: () => ({ mutateAsync: mocks.invite, reset: vi.fn() }),
+  useResendOrganizationAccountInvitation: () => ({}),
+  useRevokeOrganizationAccountEnrollment: () => ({}),
+}))
+
+import { OrganizationIntegrationsSettings } from '@/app/o/[organizationId]/settings/components/integrations/organization-integrations-settings'
+
+describe('organization integration invitations', () => {
+  let root: Root
+  let container: HTMLDivElement
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.spyOn(toast, 'success').mockReturnValue('toast-id')
+    vi.stubGlobal('IS_REACT_ACT_ENVIRONMENT', true)
+    mocks.context.mockReturnValue({ organization: { id: 'org-a' }, viewer: { isAdmin: true } })
+    mocks.accounts.mockReturnValue({
+      data: { credentialGroup: { id: 'group-a' } },
+      error: null,
+      refetch: mocks.refetch,
+    })
+    mocks.people.mockReturnValue({ data: { pages: [{ enrollments: [] }] } })
+    mocks.invite.mockResolvedValue({
+      sentCount: 2,
+      results: [
+        { email: 'one@example.com', success: true },
+        { email: 'two@example.com', success: true },
+      ],
+    })
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+  })
+
+  afterEach(async () => {
+    await act(async () => root.unmount())
+    container.remove()
+    vi.restoreAllMocks()
+    vi.unstubAllGlobals()
+  })
+
+  async function render(searchParams = '') {
+    await act(async () =>
+      root.render(
+        <NuqsTestingAdapter hasMemory searchParams={searchParams}>
+          <OrganizationIntegrationsSettings />
+        </NuqsTestingAdapter>
+      )
+    )
+  }
+
+  async function click(label: string) {
+    const button = Array.from(document.querySelectorAll('button')).find(
+      (element) => element.textContent === label
+    )
+    if (!button) throw new Error(`Missing ${label} button`)
+    await act(async () => button.click())
+  }
+
+  it('keeps provider setup as the default and sends manual invitations from People to this org', async () => {
+    await render()
+    expect(container.textContent).toContain('Provider setup')
+    expect(mocks.accounts).toHaveBeenLastCalledWith(undefined)
+    expect(mocks.people).not.toHaveBeenCalled()
+
+    await click('People')
+    expect(container.textContent).not.toContain('Provider setup')
+    expect(mocks.accounts).toHaveBeenLastCalledWith('org-a')
+    expect(mocks.people).toHaveBeenLastCalledWith('org-a')
+    expect(container.querySelector('[aria-label="Search people"]')).not.toBeNull()
+    expect(mocks.invite).not.toHaveBeenCalled()
+
+    await click('Request connections')
+    const input = document.querySelector<HTMLInputElement>('input[placeholder="Enter emails"]')
+    if (!input) throw new Error('Missing invitation email input')
+    const paste = new Event('paste', { bubbles: true, cancelable: true })
+    Object.defineProperty(paste, 'clipboardData', {
+      value: { getData: () => 'one@example.com two@example.com' },
+    })
+    await act(async () => input.dispatchEvent(paste))
+    await click('Send requests')
+    expect(mocks.invite).toHaveBeenCalledExactlyOnceWith({
+      organizationId: 'org-a',
+      emails: ['one@example.com', 'two@example.com'],
+    })
+    expect(document.querySelector('[role="dialog"]')).toBeNull()
+  })
+
+  it('opens People directly from the saved URL', async () => {
+    await render('?tab=people')
+    expect(container.textContent).toContain('Request connections')
+    expect(container.textContent).not.toContain('Provider setup')
+    expect(mocks.people).toHaveBeenLastCalledWith('org-a')
+  })
+
+  it('sends an org without a credential group back to provider setup before invitations', async () => {
+    mocks.accounts.mockReturnValue({ data: { credentialGroup: null }, error: null })
+    await render('?tab=people')
+    expect(container.textContent).toContain('before inviting people')
+    expect(mocks.people).not.toHaveBeenCalled()
+    expect(container.textContent).not.toContain('Request connections')
+    await click('Set up providers')
+    expect(container.textContent).toContain('Provider setup')
+    expect(mocks.invite).not.toHaveBeenCalled()
+  })
+
+  it('surfaces account lookup errors instead of treating them as missing setup', async () => {
+    mocks.accounts.mockReturnValue({
+      error: new Error('Account access denied'),
+      refetch: mocks.refetch,
+    })
+    await render('?tab=people')
+    expect(container.textContent).toContain('Account access denied')
+    expect(container.textContent).not.toContain('Set up providers')
+    expect(mocks.people).not.toHaveBeenCalled()
+    await click('Try again')
+    expect(mocks.refetch).toHaveBeenCalledOnce()
+  })
+
+  it('does not load admin account data or expose invitations to an ordinary member', async () => {
+    mocks.context.mockReturnValue({ organization: { id: 'org-a' }, viewer: { isAdmin: false } })
+    await render('?tab=people')
+    expect(container.textContent).toBe('')
+    expect(mocks.accounts).toHaveBeenLastCalledWith(undefined)
+    expect(mocks.people).not.toHaveBeenCalled()
+    expect(mocks.invite).not.toHaveBeenCalled()
+  })
+})

apps/sim/app/o/[organizationId]/settings/components/integrations/organization-integrations-settings.test.tsx

@@ -0,0 +1,63 @@
+'use client'
+
+import { Chip, ChipSwitch } from '@sim/emcn'
+import { useQueryState } from 'nuqs'
+import { useOrganizationContext } from '@/app/o/[organizationId]/providers/organization-provider'
+import { OrganizationIntegrationsSetup } from '@/app/o/[organizationId]/settings/components/integrations/organization-integrations-setup'
+import { organizationIntegrationsTabParam } from '@/app/o/[organizationId]/settings/components/integrations/search-params'
+import {
+  SettingsEmptyState,
+  SettingsQueryErrorState,
+} from '@/app/workspace/[workspaceId]/settings/components/settings-empty-state'
+import { OrganizationAccountPeople } from '@/ee/credential-groups/components/organization-account-people'
+import { useOrganizationAccounts } from '@/hooks/queries/organization-accounts'
+
+export function OrganizationIntegrationsSettings() {
+  const { organization, viewer } = useOrganizationContext()
+  const [tab, setTab] = useQueryState(
+    organizationIntegrationsTabParam.key,
+    organizationIntegrationsTabParam.parser
+  )
+  const accounts = useOrganizationAccounts(
+    viewer.isAdmin && tab === 'people' ? organization.id : undefined
+  )
+  if (!viewer.isAdmin) return null
+
+  return (
+    <div className='flex flex-col gap-6'>
+      <div>
+        <ChipSwitch
+          aria-label='Integration settings'
+          value={tab}
+          onChange={(value) => void setTab(value)}
+          options={[
+            { value: 'providers', label: 'Providers' },
+            { value: 'people', label: 'People' },
+          ]}
+        />
+      </div>
+      {tab === 'providers' && <OrganizationIntegrationsSetup />}
+      {tab === 'people' &&
+        (accounts.error ? (
+          <SettingsQueryErrorState
+            error={accounts.error}
+            fallback='Could not load connected accounts'
+            isRetrying={accounts.isFetching}
+            onRetry={() => void accounts.refetch()}
+            variant='inline'
+          />
+        ) : !accounts.data ? (
+          <SettingsEmptyState variant='inline'>Loading connected accounts…</SettingsEmptyState>
+        ) : !accounts.data.credentialGroup ? (
+          <div className='flex flex-col items-start gap-4'>
+            <SettingsEmptyState variant='inline'>
+              Set up a provider for personal account connections before inviting people.
+            </SettingsEmptyState>
+            <Chip onClick={() => void setTab('providers')}>Set up providers</Chip>
+          </div>
+        ) : (
+          <OrganizationAccountPeople key={organization.id} organizationId={organization.id} />
+        ))}
+    </div>
+  )
+}