improvement(credentials): allow connecting accounts with different emails

[TheodoreSpeaks]

Summary

• Allow credential-group connections, including Sim Search, to authorize provider accounts with a different email from the signed-in Sim user.
• Remove email hints and mismatch errors while preserving provider verification, required permissions, and enrollment ownership.

Type of Change

• Improvement

Testing

358 focused tests passed across OAuth providers, enrollment, persistence, Search access, and connection UI. App type-check, repository lint, strict API validation, and repository audits passed.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 16, 2026 6:36pm UTC

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge with the existing enrollment ownership and provider-verification boundaries intact.

Summary

This PR allows credential-group members to authorize provider accounts whose email differs from their verified Sim enrollment email while retaining the existing identity, authorization, and persistence boundaries.

• Removes provider login hints and provider-to-Sim email equality checks.
• Continues verifying provider identities, token subjects, OAuth state/nonces, required scopes, provider configuration, and enrollment ownership.
• Persists the provider-attested email and subject for display and subsequent credential use.
• Updates Slack, standard OAuth, GitHub repositories, callback messaging, enrollment UI, documentation, and focused tests.

Diagram

sequenceDiagram
  participant Member
  participant Sim as Sim enrollment
  participant Provider as OAuth provider
  participant Store as Credential store
  Member->>Sim: Start connection for bound enrollment
  Sim->>Provider: Authorization request without email hint
  Provider-->>Sim: Authorization code
  Sim->>Provider: Exchange code and verify identity
  Provider-->>Sim: Subject, provider email, tokens, and scopes
  Sim->>Sim: Check state/nonce, provider policy, scopes, and enrollment owner
  Sim->>Store: Persist grant under bound Sim enrollment
  Store-->>Member: Connection completed

Loading

_{Reviews (1) · Last reviewed commit: "improvement(credentials): allow connecti..."}

[cubic-dev-ai]

No issues found across 20 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}