Fix org OAuth connection token partitioning in encrypted-secrets (#1462)

* Add failing e2e repro for org OAuth token partitioning (#1453)

* Partition encrypted-secrets rows by the owner embedded in the item id

* Share the item-id owner grammar and harden the repartition migration

Author: RhysSullivan

.changeset/encrypted-secrets-org-partition.md

@@ -0,0 +1,7 @@
+---
+"executor": patch
+---
+
+**Fix: org OAuth connections on self-host worked only for whoever ran the consent**
+
+The encrypted-secrets credential provider (the writable provider on the self-hosted and Cloudflare hosts) filed token rows under the _acting user's_ private partition instead of the credential's own owner. An org-owned OAuth connection whose consent completed in one member's browser session therefore resolved only for that member — every other principal failed with `oauth_connection_missing`, while the UI showed the connection healthy. The provider now partitions by the owner embedded in the item id (`oauth:org:…` → org-shared), matching the WorkOS Vault provider, and a boot-time data migration re-files rows already written wrong. The encrypted value itself was never affected.

apps/host-cloudflare/src/db/data-migrations.test.ts

@@ -241,6 +241,7 @@ describe("runCloudflareDataMigrations", () => {
         "2026-06-20-google-openapi-ownership",
         "2026-07-08-provider-service-split",
         "2026-07-09-openapi-ndjson-output-arrays",
+        "2026-07-27-encrypted-secrets-owner-repartition",
       ]);
       expect(yield* Effect.promise(() => runCloudflareDataMigrations(d1, bucket))).toEqual([]);
 
@@ -285,6 +286,7 @@ describe("runCloudflareDataMigrations", () => {
         "2026-06-20-google-openapi-ownership",
         "2026-07-08-provider-service-split",
         "2026-07-09-openapi-ndjson-output-arrays",
+        "2026-07-27-encrypted-secrets-owner-repartition",
       ]);
       expect(yield* Effect.promise(() => runCloudflareDataMigrations(d1, bucket))).toEqual([]);
 
@@ -336,6 +338,7 @@ describe("runCloudflareDataMigrations", () => {
         "2026-06-20-google-openapi-ownership",
         "2026-07-08-provider-service-split",
         "2026-07-09-openapi-ndjson-output-arrays",
+        "2026-07-27-encrypted-secrets-owner-repartition",
       ]);
       expect(yield* Effect.promise(() => runCloudflareDataMigrations(d1, bucket))).toEqual([]);
 

apps/host-cloudflare/src/db/data-migrations.ts

@@ -9,6 +9,7 @@ import {
 } from "@executor-js/sdk";
 import { openApiNdjsonOutputDataMigration } from "@executor-js/plugin-openapi";
 import { googleOpenApiOwnershipDataMigration } from "@executor-js/plugin-openapi/providers/google";
+import { encryptedSecretsRepartitionDataMigration } from "@executor-js/plugin-encrypted-secrets";
 
 import {
   providerServiceSplitDataMigration,
@@ -246,6 +247,9 @@ const cloudflareDataMigrations = (bucket: R2Bucket | undefined): readonly Sqlite
   // Stale-mark connections whose operations return NDJSON so their tool rows
   // rebuild with array-wrapped output schemas (mirrors cloud's drizzle 0010).
   openApiNdjsonOutputDataMigration,
+  // Re-file credential rows the pre-fix provider stored under the acting
+  // caller's partition instead of the owner embedded in the item id (#1453).
+  encryptedSecretsRepartitionDataMigration,
 ];
 
 export const runCloudflareDataMigrations = (

apps/host-selfhost/src/db/data-migrations.ts

@@ -16,6 +16,7 @@ import { graphqlIntrospectionBlobDataMigration } from "@executor-js/plugin-graph
 import { googleOpenApiOwnershipDataMigration } from "@executor-js/plugin-openapi/providers/google";
 
 import { providerServiceSplitDataMigration } from "@executor-js/plugin-provider-service-split";
+import { encryptedSecretsRepartitionDataMigration } from "@executor-js/plugin-encrypted-secrets";
 import { authConfigTransforms } from "./auth-config-migration";
 
 export const selfHostDataMigrations: readonly SqliteDataMigration[] = [
@@ -37,4 +38,7 @@ export const selfHostDataMigrations: readonly SqliteDataMigration[] = [
   // Stale-mark connections whose operations return NDJSON so their tool rows
   // rebuild with array-wrapped output schemas (mirrors cloud's drizzle 0010).
   openApiNdjsonOutputDataMigration,
+  // Re-file credential rows the pre-fix provider stored under the acting
+  // caller's partition instead of the owner embedded in the item id (#1453).
+  encryptedSecretsRepartitionDataMigration,
 ];

e2e/selfhost/mcp-browser-approval-ownership.test.ts

@@ -1,17 +1,14 @@
 // Selfhost-only: the browser-approval HTTP endpoints are session-scoped. A
 // signed-in user who does not own the MCP session must not be able to read the
 // paused execution or record the human decision for it.
-import { randomBytes } from "node:crypto";
-
 import { expect } from "@effect/vitest";
 import { Effect } from "effect";
 import { composePluginApi } from "@executor-js/api/server";
 
 import { scenario } from "../src/scenario";
 import { Api, Mcp, Target } from "../src/services";
 import { parseBrowserApproval } from "../src/surfaces/mcp";
-import type { Identity } from "../src/target";
-import { signInSession } from "../targets/selfhost";
+import { createInvitedIdentity } from "../targets/selfhost";
 
 const coreApi = composePluginApi([] as const);
 
@@ -21,46 +18,6 @@ const result = await tools.executor.coreTools.policies.list({});
 return JSON.stringify(result);
 `;
 
-const createInvitedIdentity = async (baseUrl: string, admin: Identity): Promise<Identity> => {
-  const cookie = admin.headers?.cookie;
-  expect(typeof cookie, "bootstrap admin has a Better Auth session cookie").toBe("string");
-
-  const invite = await fetch(new URL("/api/admin/invites", baseUrl), {
-    method: "POST",
-    headers: {
-      "content-type": "application/json",
-      cookie: cookie!,
-      origin: new URL(baseUrl).origin,
-    },
-    body: JSON.stringify({ role: "member" }),
-  });
-  expect(invite.status, `admin invite create response: ${await invite.clone().text()}`).toBe(200);
-  const inviteBody = (await invite.json()) as { readonly code?: string };
-  expect(typeof inviteBody.code, "invite response includes a redeemable code").toBe("string");
-
-  const email = `approval-cross-user-${randomBytes(5).toString("hex")}@e2e.test`;
-  const password = "approval-cross-user-password-123";
-  const signup = await fetch(new URL("/api/auth/sign-up/email", baseUrl), {
-    method: "POST",
-    headers: { "content-type": "application/json", origin: new URL(baseUrl).origin },
-    body: JSON.stringify({
-      email,
-      password,
-      name: email,
-      inviteCode: inviteBody.code,
-    }),
-  });
-  expect(signup.status, `invited signup response: ${await signup.clone().text()}`).toBe(200);
-
-  const session = await signInSession(baseUrl, { email, password });
-  return {
-    label: email,
-    credentials: { email, password },
-    headers: { cookie: session.cookieHeader },
-    cookies: session.cookies,
-  };
-};
-
 const approvalEndpoint = (baseUrl: string, sessionId: string, executionId: string): URL =>
   new URL(
     `/api/mcp-sessions/${encodeURIComponent(sessionId)}/executions/${encodeURIComponent(
@@ -77,7 +34,9 @@ scenario(
     const api = yield* Api;
     const mcp = yield* Mcp;
     const owner = yield* target.newIdentity();
-    const other = yield* Effect.promise(() => createInvitedIdentity(target.baseUrl, owner));
+    const other = yield* Effect.promise(() =>
+      createInvitedIdentity(target.baseUrl, owner, { emailPrefix: "approval-cross-user" }),
+    );
     const client = yield* api.client(coreApi, owner);
 
     const policy = yield* client.policies.create({