refactor(knowledge): tighten the per-member access surface

- The credential-group policy canonicaliser carries knowledge-connector
  statements through instead of rejecting a third statement
- Google Docs and Box report an unreachable scope so a member's access is
  withdrawn rather than retried forever; Notion leaves members mode because
  its page access is granted to the shared integration bot
- Provisioning reuses a Credential Group only when other members-mode
  connectors already sync through it, never a group curated for something
  else; the fast dispatch on connect accepts the same statuses as the sweep
- Enrollment opens its tab inside the click so popup blockers cannot swallow
  it, and the membership poll stops after ten minutes
- Session-only routes use session auth; members mode stores the cap-stripped
  config; one liveness rule for members and managed bindings
- Drop dead code: the access barrel, system.ts and rank.ts folded into their
  siblings, unused ACL helpers, the unread change_cursor_at column, stale
  documentation, and the engine/provisioning/queue import cycle

Author: waleedlatif1

apps/sim/app/api/knowledge/[id]/connectors/[connectorId]/access/route.ts

@@ -1,19 +1,20 @@
 import { updateKnowledgeConnectorAccessContract } from '@/lib/api/contracts/knowledge'
-import { defineInternalJsonRoute, internalRateLimits } from '@/lib/api/server/routes'
+import {
+  defineInternalJsonRoute,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
 import {
   resolveInternalKnowledgeBillingAttribution,
   toInternalKnowledgeConnector,
 } from '@/lib/knowledge/api/internal-route'
-import {
-  internalKnowledgeErrorPolicies,
-  internalKnowledgeSessionOrExecutorAuth,
-} from '@/lib/knowledge/api/route-policies'
+import { internalKnowledgeErrorPolicies } from '@/lib/knowledge/api/route-policies'
 import { updateKnowledgeConnectorAccess } from '@/lib/knowledge/application/connector-access'
 import { knowledgeOperations } from '@/lib/knowledge/application/operations'
 
 export const PATCH = defineInternalJsonRoute({
   contract: updateKnowledgeConnectorAccessContract,
-  auth: internalKnowledgeSessionOrExecutorAuth,
+  auth: internalSessionAuth,
   operation: knowledgeOperations.updateConnectorAccess,
   rateLimit: internalRateLimits.none({
     reason: 'A settings action an admin performs by hand; the switch itself is bounded',

apps/sim/app/api/knowledge/[id]/connectors/[connectorId]/enroll/route.ts

@@ -1,15 +1,16 @@
 import { startKnowledgeConnectorMemberEnrollmentContract } from '@/lib/api/contracts/knowledge'
-import { defineInternalJsonRoute, internalRateLimits } from '@/lib/api/server/routes'
 import {
-  internalKnowledgeErrorPolicies,
-  internalKnowledgeSessionOrExecutorAuth,
-} from '@/lib/knowledge/api/route-policies'
+  defineInternalJsonRoute,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { internalKnowledgeErrorPolicies } from '@/lib/knowledge/api/route-policies'
 import { startKnowledgeConnectorMemberEnrollment } from '@/lib/knowledge/application/connector-access'
 import { knowledgeOperations } from '@/lib/knowledge/application/operations'
 
 export const POST = defineInternalJsonRoute({
   contract: startKnowledgeConnectorMemberEnrollmentContract,
-  auth: internalKnowledgeSessionOrExecutorAuth,
+  auth: internalSessionAuth,
   operation: knowledgeOperations.enrollConnectorMember,
   rateLimit: internalRateLimits.none({
     reason:

apps/sim/app/api/knowledge/search/utils.test.ts

@@ -48,18 +48,18 @@ afterEach(() => {
 })
 
 import { WORKSPACE_ACCESS_SCOPE } from '@/lib/knowledge/access/scope'
+import { generateSearchEmbedding } from '@/lib/knowledge/embeddings'
 import {
   executeKeywordSearch,
   executeKnowledgeSearch,
   fuseByReciprocalRank,
-  generateSearchEmbedding,
   getQueryStrategy,
   handleTagAndVectorSearch,
   handleTagOnlySearch,
   handleVectorOnlySearch,
   type SearchResult,
 } from '@/lib/knowledge/search/queries'
-import { RRF_K } from '@/lib/knowledge/search/rank'
+import { RRF_K } from '@/lib/knowledge/search/recency'
 
 /** Minimal SearchResult builder — only the fields fusion and ordering read. */
 function makeResult(id: string, distance = 0.1): SearchResult {

apps/sim/app/api/knowledge/utils.ts

@@ -18,89 +18,6 @@ interface KnowledgeBaseData {
   updatedAt: Date
 }
 
-interface DocumentData {
-  id: string
-  knowledgeBaseId: string
-  filename: string
-  fileUrl: string
-  fileSize: number
-  mimeType: string
-  chunkCount: number
-  tokenCount: number
-  characterCount: number
-  processingStatus: string
-  processingStartedAt?: Date | null
-  processingCompletedAt?: Date | null
-  processingError?: string | null
-  enabled: boolean
-  deletedAt?: Date | null
-  uploadedAt: Date
-  // Text tags
-  tag1?: string | null
-  tag2?: string | null
-  tag3?: string | null
-  tag4?: string | null
-  tag5?: string | null
-  tag6?: string | null
-  tag7?: string | null
-  // Number tags (5 slots)
-  number1?: number | null
-  number2?: number | null
-  number3?: number | null
-  number4?: number | null
-  number5?: number | null
-  // Date tags (2 slots)
-  date1?: Date | null
-  date2?: Date | null
-  // Boolean tags (3 slots)
-  boolean1?: boolean | null
-  boolean2?: boolean | null
-  boolean3?: boolean | null
-  // Connector fields
-  connectorId?: string | null
-  sourceUrl?: string | null
-  externalId?: string | null
-}
-
-interface EmbeddingData {
-  id: string
-  knowledgeBaseId: string
-  documentId: string
-  chunkIndex: number
-  chunkHash: string
-  content: string
-  contentLength: number
-  tokenCount: number
-  embedding?: number[] | null
-  embeddingModel: string
-  startOffset: number
-  endOffset: number
-  // Text tags
-  tag1?: string | null
-  tag2?: string | null
-  tag3?: string | null
-  tag4?: string | null
-  tag5?: string | null
-  tag6?: string | null
-  tag7?: string | null
-  // Number tags (5 slots)
-  number1?: number | null
-  number2?: number | null
-  number3?: number | null
-  number4?: number | null
-  number5?: number | null
-  // Date tags (2 slots)
-  date1?: Date | null
-  date2?: Date | null
-  // Boolean tags (3 slots)
-  boolean1?: boolean | null
-  boolean2?: boolean | null
-  boolean3?: boolean | null
-  enabled: boolean
-  createdAt: Date
-  updatedAt: Date
-}
-
 export interface KnowledgeBaseAccessResult {
   hasAccess: true
   knowledgeBase: Pick<

apps/sim/app/api/v1/knowledge/search/route.test.ts

@@ -46,7 +46,6 @@ const SYSTEM_BILLING_ATTRIBUTION = {
 
 vi.mock('@/lib/knowledge/search/queries', () => ({
   executeKnowledgeSearch: mockExecuteKnowledgeSearch,
-  generateSearchEmbedding: mockGenerateSearchEmbedding,
   getDocumentMetadataByIds: mockGetDocumentMetadataByIds,
 }))
 
@@ -63,6 +62,7 @@ vi.mock('@/lib/billing/core/billing-attribution', () => ({
 }))
 
 vi.mock('@/lib/knowledge/embeddings', () => ({
+  generateSearchEmbedding: mockGenerateSearchEmbedding,
   recordSearchEmbeddingUsage: mockRecordSearchEmbeddingUsage,
 }))
 

apps/sim/app/api/v1/knowledge/search/route.ts

@@ -8,11 +8,10 @@ import {
 } from '@/lib/billing/core/billing-attribution'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { ALL_TAG_SLOTS } from '@/lib/knowledge/constants'
-import { recordSearchEmbeddingUsage } from '@/lib/knowledge/embeddings'
+import { generateSearchEmbedding, recordSearchEmbeddingUsage } from '@/lib/knowledge/embeddings'
 import { resolveKnowledgeSearchDefaults } from '@/lib/knowledge/search/defaults'
 import {
   executeKnowledgeSearch,
-  generateSearchEmbedding,
   getDocumentMetadataByIds,
   type SearchResult,
 } from '@/lib/knowledge/search/queries'

apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connector-access-field/connector-access-field.tsx

@@ -62,7 +62,7 @@ export function ConnectorAccessField({
     if (value.accessMode !== 'members') return null
     return (
       <ChipModalField type='custom' title='Access'>
-        <ButtonGroup value='members' onValueChange={() => undefined}>
+        <ButtonGroup value='members'>
           <ButtonGroupItem value='workspace' disabled>
             Workspace
           </ButtonGroupItem>

apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connectors-section.tsx

@@ -35,6 +35,7 @@ import {
   CONNECTOR_SYNC_STALE_LOCK_TTL_MS,
   MEMBER_SYNC_STALE_LOCK_TTL_MS,
 } from '@/lib/knowledge/connectors/sync-limits'
+import type { MemberSyncStatus } from '@/lib/knowledge/types'
 import { getCanonicalScopesForProvider, getProviderIdFromServiceId } from '@/lib/oauth'
 import { getMissingRequiredScopes } from '@/lib/oauth/utils'
 import { ConnectOAuthModal } from '@/app/workspace/[workspaceId]/components/connect-oauth-modal'
@@ -99,7 +100,7 @@ const MEMBER_SYNC_STATUS_AS_CONNECTOR_STATUS = {
   running: 'syncing',
   error: 'error',
   disabled: 'disabled',
-} as const satisfies Record<string, keyof typeof STATUS_CONFIG>
+} as const satisfies Record<MemberSyncStatus, keyof typeof STATUS_CONFIG>
 
 const CONNECTOR_ACTION_BUTTON_CLASSES =
   'size-7 rounded-lg p-0 text-[var(--text-muted)] hover-hover:bg-[var(--surface-active)] hover-hover:text-[var(--text-primary)]'
@@ -316,9 +317,7 @@ function ConnectorCard({
    */
   const effectiveStatus =
     connector.accessMode === 'members' && connector.status === 'active'
-      ? (MEMBER_SYNC_STATUS_AS_CONNECTOR_STATUS[
-          connector.memberSyncStatus as keyof typeof MEMBER_SYNC_STATUS_AS_CONNECTOR_STATUS
-        ] ?? 'active')
+      ? MEMBER_SYNC_STATUS_AS_CONNECTOR_STATUS[connector.memberSyncStatus]
       : connector.status
   const statusConfig =
     STATUS_CONFIG[effectiveStatus as keyof typeof STATUS_CONFIG] || STATUS_CONFIG.active

apps/sim/app/workspace/[workspaceId]/search/components/member-connectors-section/member-connectors-section.tsx

@@ -78,42 +78,44 @@ export function MemberConnectorsSection({ workspaceId, search }: MemberConnector
   if (visible.length === 0) return null
 
   return (
-    <IntegrationSection label={SHARED_WITH_YOU_LABEL}>
-      {visible.map((connector) => {
-        const meta = CONNECTOR_META_REGISTRY[connector.connectorType]
-        const waiting = isAwaiting(connector.connectorId)
-        const connectable = CONNECTABLE.has(connector.viewerMembership)
-        return (
-          <SettingsResourceRow
-            key={connector.connectorId}
-            iconVariant='custom'
-            icon={
-              meta ? (
-                <IntegrationTile blockType={connector.connectorType} icon={meta.icon} />
-              ) : undefined
-            }
-            title={meta?.name ?? connector.connectorType}
-            description={describe(connector, waiting)}
-            trailing={
-              connectable ? (
-                <Button
-                  variant='primary'
-                  size='sm'
-                  onClick={() => connect(connector.knowledgeBaseId, connector.connectorId)}
-                  disabled={isPending}
-                >
-                  {waiting
-                    ? 'Open again'
-                    : connector.viewerMembership === 'needs_reauth'
-                      ? 'Reconnect'
-                      : 'Connect'}
-                </Button>
-              ) : undefined
-            }
-          />
-        )
-      })}
+    <>
+      <IntegrationSection label={SHARED_WITH_YOU_LABEL}>
+        {visible.map((connector) => {
+          const meta = CONNECTOR_META_REGISTRY[connector.connectorType]
+          const waiting = isAwaiting(connector.connectorId)
+          const connectable = CONNECTABLE.has(connector.viewerMembership)
+          return (
+            <SettingsResourceRow
+              key={connector.connectorId}
+              iconVariant='custom'
+              icon={
+                meta ? (
+                  <IntegrationTile blockType={connector.connectorType} icon={meta.icon} />
+                ) : undefined
+              }
+              title={meta?.name ?? connector.connectorType}
+              description={describe(connector, waiting)}
+              trailing={
+                connectable ? (
+                  <Button
+                    variant='primary'
+                    size='sm'
+                    onClick={() => connect(connector.knowledgeBaseId, connector.connectorId)}
+                    disabled={isPending}
+                  >
+                    {waiting
+                      ? 'Open again'
+                      : connector.viewerMembership === 'needs_reauth'
+                        ? 'Reconnect'
+                        : 'Connect'}
+                  </Button>
+                ) : undefined
+              }
+            />
+          )
+        })}
+      </IntegrationSection>
       {error && <p className='text-[var(--text-error)] text-caption'>{error}</p>}
-    </IntegrationSection>
+    </>
   )
 }

apps/sim/app/workspace/[workspaceId]/search/search.test.tsx

@@ -107,6 +107,19 @@ vi.mock('@/hooks/queries/credentials', () => ({
   }),
 }))
 
+vi.mock('@/hooks/queries/kb/connectors', () => ({
+  memberConnectorKeys: { list: (workspaceId?: string) => ['member-connectors', workspaceId] },
+  useWorkspaceMemberConnectors: () => ({ data: [] }),
+}))
+vi.mock('@/hooks/use-member-enrollment', () => ({
+  useMemberEnrollment: () => ({
+    connect: vi.fn(),
+    isAwaiting: () => false,
+    isPending: false,
+    error: null,
+  }),
+}))
+
 import { Search } from '@/app/workspace/[workspaceId]/search/search'
 
 let root: Root | null = null