fix(apps): preserve grant and approval defaults

Co-authored-by: Codex <codex@openai.com>

server/src/__tests__/generic-mcp-connection.test.ts

@@ -366,6 +366,9 @@ describeEmbeddedPostgres("generic remote MCP connections", () => {
     // this connection cannot be depending on gallery metadata for anything.
     expect(connection!.config).not.toHaveProperty("sourceTemplateKey");
     expect(connection!.config).not.toHaveProperty("connectionMethodKey");
+    await expect(service.listConnectionGrants(result.connectionId, company.id)).resolves.toMatchObject({
+      grants: [expect.objectContaining({ kind: "organization", isDefault: true, credentialSecretRefs: [] })],
+    });
     const [profile] = await db.select().from(toolProfiles).where(eq(
       toolProfiles.profileKey,
       `app:${result.connectionId}`,

server/src/services/tool-access.ts

@@ -4585,6 +4585,7 @@ export function toolAccessService(db: Db, options: ToolAccessServiceOptions = {}
         })
         .where(eq(toolConnections.id, existing.id))
         .returning();
+      await ensureDefaultOrganizationGrant(updated);
       await syncCredentialBindings(updated);
       await ensureRuntimeSlot(updated);
       return { row: updated, created: false };
@@ -4605,6 +4606,7 @@ export function toolAccessService(db: Db, options: ToolAccessServiceOptions = {}
       credentialRefs: [],
       credentialSecretRefs: [],
     }).returning();
+    await ensureDefaultOrganizationGrant(created);
     await syncCredentialBindings(created);
     await ensureRuntimeSlot(created);
     return { row: created, created: true };
@@ -6568,6 +6570,7 @@ export function toolAccessService(db: Db, options: ToolAccessServiceOptions = {}
           createdByUserId: actor?.actorType === "user" ? actor.actorId ?? null : null,
         }).returning();
       }
+      await ensureDefaultOrganizationGrant(connectionRow);
       await syncCredentialBindings(connectionRow);
       await ensureRuntimeSlot(connectionRow);