fix(credentials): match the last-admin guard to the server

Author: waleedlatif1

apps/sim/app/api/credentials/[id]/members/route.test.ts

@@ -75,6 +75,7 @@ describe('/api/credentials/[id]/members compatibility', () => {
         joinedAt: new Date('2026-08-02T00:00:00.000Z'),
         userName: 'Member',
         userEmail: 'member@example.com',
+        explicitAdmin: false,
       },
     ])
   })

apps/sim/app/api/v2/credentials/[credentialId]/members/route.ts

@@ -39,7 +39,7 @@ export const GET = defineV2JsonRoute({
   }),
   useCase: listCredentialMembersUseCase,
   present: ({ members, nextCursorKeys }, { params, query }) => ({
-    data: members.map((member) => ({
+    data: members.map(({ explicitAdmin, ...member }) => ({
       ...member,
       joinedAt: member.joinedAt?.toISOString() ?? null,
     })),

apps/sim/app/workspace/[workspaceId]/components/credential-detail/components/credential-members-section.tsx

@@ -55,9 +55,7 @@ export function CredentialMembersSection({
 
   const viewerId = session?.user?.id
   const activeMembers = members.filter((member) => member.status === 'active')
-  const explicitAdminCount = activeMembers.filter(
-    (member) => member.role === 'admin' && member.roleSource !== 'workspace-admin'
-  ).length
+  const explicitAdminCount = activeMembers.filter((member) => member.explicitAdmin).length
   const showActions = isAdmin || activeMembers.some((member) => member.userId === viewerId)
 
   const handleChangeMemberRole = async (userId: string, role: MemberRole) => {

apps/sim/lib/api/contracts/credentials.ts

@@ -365,6 +365,8 @@ export const workspaceCredentialMemberSchema = z.object({
   userImage: z.string().nullable().optional(),
   /** `workspace-admin` roles are derived from workspace admin and cannot be changed. */
   roleSource: z.enum(['explicit', 'workspace-admin']).optional(),
+  /** Holds an active explicit admin grant; the last-admin guards count these, not `role`. */
+  explicitAdmin: z.boolean(),
 })
 
 export type WorkspaceCredentialMember = z.output<typeof workspaceCredentialMemberSchema>

apps/sim/lib/credentials/members.ts

@@ -30,6 +30,11 @@ export interface CredentialMemberView {
   userEmail: string | null
   userImage: string | null
   roleSource: 'explicit' | 'workspace-admin'
+  /**
+   * Whether the user holds an active explicit admin grant, independent of any
+   * inherited workspace-admin role. This is what the last-admin guards count.
+   */
+  explicitAdmin: boolean
 }
 
 export async function listCredentialMembers(
@@ -52,7 +57,14 @@ export async function listCredentialMembers(
     .where(eq(credentialMember.credentialId, credential.id))
 
   const byUser = new Map<string, CredentialMemberView>(
-    explicitMembers.map((member) => [member.userId, { ...member, roleSource: 'explicit' as const }])
+    explicitMembers.map((member) => [
+      member.userId,
+      {
+        ...member,
+        roleSource: 'explicit' as const,
+        explicitAdmin: member.role === 'admin' && member.status === 'active',
+      },
+    ])
   )
 
   if (isSharedCredentialType(credential.type)) {
@@ -75,6 +87,7 @@ export async function listCredentialMembers(
           userEmail: workspaceMember.email,
           userImage: workspaceMember.image ?? null,
           roleSource: 'workspace-admin',
+          explicitAdmin: false,
         })
       }
     }
@@ -148,6 +161,7 @@ export async function listCredentialMembersPage(
       roleSource: sql<
         'explicit' | 'workspace-admin'
       >`case when ${inheritedAdmin} then 'workspace-admin' else 'explicit' end`,
+      explicitAdmin: sql<boolean>`coalesce(${credentialMember.role} = 'admin' and ${credentialMember.status} = 'active', false)`,
     })
     .from(user)
     .leftJoin(