GeezerVison

Summary

• Disconnecting an OAuth credential routed through POST /api/auth/oauth/disconnect, a credential user operation scoped to the acting user's own account rows. A workspace or org admin acting on a credential another user created matched no accounts, so it returned { credentials: [] } and the route still answered 200 — the UI navigated away and the credential was still there. Not a denial, a silent no-op.
• Route every credential type through the workspace-scoped credential delete, which authorizes against credential admin and already resolves workspace/org admins as derived credential admins for shared credential types.
• That path only deleted the credential row, so send oauth through deleteCredentialRecord — the manager that also tears down a credential's secret source — and have it delete the backing account grant once no credential references it. Scoped by account id, not owner: the caller is already authorized against the credential. A grant still used by a credential in another workspace survives.
• Collapse the delete use case's remaining service_account carve-out. Both arms reached the same tail, but the carve-out skipped the Slack custom-bot credential-group guard — and custom bots are exactly the type it guards, so the single-delete surface could orphan a credential group that the batch path refuses to.
• deleteOrphanedOAuthAccount is one conditional statement rather than a read then a write. credential.accountId is ON DELETE CASCADE, so a credential racing the gap would be reaped by Postgres without clearCredentialRefs running, stranding its id in workflow state.
• Point the reconnect hook at that shared helper; it carried its own copy of the same orphan-grant rule.
• Invalidate the OAuth connections query on credential delete — the removed disconnect hook owned that invalidation and the detail page reads it. Retires the hand-dispatched oauth-credentials-updated event from the delete path; connect/reconnect still dispatches it. Deletes the now-callerless useDisconnectOAuthService.
• Make RoleLockTooltip layout-transparent. It wrapped locked controls in an inline-flex div, letting the chip shrink to its label while unwrapped controls stretched to the member row's fixed role track — so one members list rendered the same role at two widths. A grid wrapper takes the width its parent offers and passes it through, aligning the credential, secrets, and skills member lists that share the row.

Type of Change

• Bug fix

Testing

• bun run type-check clean; bun run check:api-validation passes
• 193 test files / 1800 tests pass across lib/credentials, hooks, app/api/credentials, app/api/auth/oauth
• Added regression tests for the grant teardown and the delete routing, and verified both fail against the pre-fix source
• Width change is code-verified across all three member-list surfaces, not browser-verified

Follow-ups (not in this PR)

• POST /api/auth/oauth/disconnect and its use case now have no caller. Left in place rather than removing an authenticated endpoint in a bugfix PR.
• performDeleteCredential in credential orchestration also appears to have no remaining callers.
• MemberRow's role track is 120px when the viewer can manage and 200px when not — a width difference across viewers, never within one list.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)