[waleedlatif1]

Summary

• Atlassian keeps one grant per login and adds each site the person consents to into that grant, and Search already reads every site the token reaches through accessible-resources
• Connecting the same Atlassian login again to add a Confluence or Jira site was refused with "This account is already connected", which discarded the fresh tokens even though the site was granted
• Confluence and Jira now mark grantSpansSites, and resolveAccountWrite treats that same-login connect as a refresh of the existing account. Every other provider still refuses a duplicate, and a different Atlassian login is still its own account
• Notion is the opposite case: a Notion token reaches one workspace, but accounts were keyed on the person alone, so a second workspace on the same login was refused too. Notion now records bot.workspace_id from /v1/users/me as the tenant
• A Notion connection saved before this has no workspace. It takes on its workspace when the person reconnects or follows an invitation link, as before, and an Add account is refused until then, so a second workspace can never overwrite it. This is scoped to providers that declare tenantRecordedLater; everywhere else a missing tenant still never matches another
• Docs say how to add another site or workspace

Type of Change

• Bug fix

Testing

• multiple-provider-accounts.integration.ts on real Postgres: adding a site to the same Atlassian login refreshes that account's tokens instead of failing; a different login is still a second account. The first case failed before the fix with the reported error. Ran on both the push and the SQL migration provisioning paths, together with tool-permissions.integration.ts
• Existing duplicate-refusal cases for other providers unchanged and passing
• Notion workspace tenant and older tenantless connections: reconnect and invitation link fill the workspace, Add account waits for that, and a provider that always recorded its tenant still refuses a tenantless match. Existing tool-permissions.integration.ts case for Salesforce null tenants unchanged and passing
• lib/credential-groups and personal search integration unit suites, biome on changed files, check:comment-hygiene, check:utils, check:test-patterns, check:source-conventions, check:file-names, check:explicit-any, check:boundaries, check:api-validation:strict; type-check on pre-push
• check:audits and the full suite run in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Nov 7, 2026 1:19am UTC

[cubic-dev-ai]

No issues found across 5 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no blocking issue remains.

Summary

This PR refreshes an existing Atlassian account when the same login grants another site. It also records Notion workspaces separately and lets older connections gain their missing workspace on reconnect.

• Adding a Confluence or Jira site refreshes the same Atlassian account.
• Notion accounts now stay separate for each workspace.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  Grant[Provider verifies account] --> Match{Saved account matches?}
  Match -->|Same Atlassian login| Refresh[Refresh existing account]
  Match -->|Same Notion person and workspace| Intent{Connection request}
  Intent -->|Reconnect| Refresh
  Intent -->|Add active duplicate| Refuse[Refuse duplicate]
  Match -->|Legacy Notion account without workspace| Legacy{Connection request}
  Legacy -->|Reconnect or invitation| Adopt[Save workspace on existing account]
  Legacy -->|Add account| Wait[Require reconnect first]
  Match -->|Different account| Add[Add within account limit]

Loading

_{Reviews (2) · Last reviewed commit: "fix(oauth): prove the new Atlassian gran..." · Reviewed by Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 7 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}