Function performDeleteCredential

apps/sim/lib/credentials/orchestration/index.ts:153–324

(
  params: CredentialActorParams
)

}

export async function performDeleteCredential(
  params: CredentialActorParams
): Promise<PerformCredentialResult> {
  try {
    const access = await getCredentialActorContext(params.credentialId, params.userId)
    if (!access.credential) {
      return { success: false, error: 'Credential not found', errorCode: 'not_found' }
    }
    if (!access.hasWorkspaceAccess || !access.isAdmin) {
      return {
        success: false,
        error: 'Credential admin permission required',
        errorCode: 'forbidden',
      }
    }
    if (params.allowedTypes && !params.allowedTypes.includes(access.credential.type)) {
      return {
        success: false,
        error: `Only ${params.allowedTypes.join(', ')} credentials can be managed with this tool.`,
        errorCode: 'validation',
      }
    }

    if (access.credential.type === 'env_personal' && access.credential.envKey) {
      const ownerUserId = access.credential.envOwnerUserId
      if (!ownerUserId) {
        return { success: false, error: 'Invalid personal secret owner', errorCode: 'validation' }
      }

      const [personalRow] = await db
        .select({ variables: environment.variables })
        .from(environment)
        .where(eq(environment.userId, ownerUserId))
        .limit(1)

      const current = ((personalRow?.variables as Record<string, string> | null) ?? {}) as Record<
        string,
        string
      >
      if (access.credential.envKey in current) delete current[access.credential.envKey]

      await db
        .insert(environment)
        .values({ id: ownerUserId, userId: ownerUserId, variables: current, updatedAt: new Date() })
        .onConflictDoUpdate({
          target: [environment.userId],
          set: { variables: current, updatedAt: new Date() },
        })

      await syncPersonalEnvCredentialsForUser({
        userId: ownerUserId,
        envKeys: Object.keys(current),
      })

      captureServerEvent(
        params.userId,
        'credential_deleted',
        {