fix(credentials): refine managed oauth flow

Author: TheodoreSpeaks

apps/sim/app/api/credential-groups/enroll/[token]/oauth/[optionId]/route.test.ts

@@ -82,14 +82,31 @@ describe('credential group OAuth start route', () => {
     expect(mocks.startOAuth).not.toHaveBeenCalled()
   })
 
-  it('stops before token lookup when the public IP budget is exhausted', async () => {
+  it('returns a rate-limited OAuth start to its enrollment page before token lookup', async () => {
     mocks.ipRateLimit.mockResolvedValue(
       NextResponse.json({ error: 'Too many requests' }, { status: 429 })
     )
 
     const response = await GET(request(), context)
 
-    expect(response.status).toBe(429)
+    expect(response.status).toBe(307)
+    expect(response.headers.get('location')).toBe(
+      '/credential-groups/enroll/invitation-token?oauth=rate_limited'
+    )
     expect(mocks.authenticate).not.toHaveBeenCalled()
   })
+
+  it('returns an exhausted enrollment OAuth budget to the enrollment page', async () => {
+    mocks.enrollmentRateLimit.mockResolvedValue(
+      NextResponse.json({ error: 'Too many requests' }, { status: 429 })
+    )
+
+    const response = await GET(request(), context)
+
+    expect(response.status).toBe(307)
+    expect(response.headers.get('location')).toBe(
+      '/credential-groups/enroll/invitation-token?oauth=rate_limited'
+    )
+    expect(mocks.startOAuth).not.toHaveBeenCalled()
+  })
 })

apps/sim/app/api/credential-groups/enroll/[token]/oauth/[optionId]/route.ts

@@ -25,11 +25,13 @@ export const GET = withRouteHandler(
     context: { params: Promise<{ token: string; optionId: string }> }
   ) => {
     const limited = await enforcePublicCredentialGroupIpRateLimit(request, 'oauth-start')
-    if (limited) return limited
 
     const parsed = await parseRequest(startCredentialGroupOAuthContract, request, context)
-    if (!parsed.success) return parsed.response
+    if (!parsed.success) return limited ?? parsed.response
     const { token, optionId } = parsed.data.params
+    if (limited) {
+      return createCredentialGroupEnrollmentRedirect(token, { oauth: 'rate_limited' })
+    }
     const principal = await authenticateCredentialGroupEnrollment(token)
     if (!principal) {
       return createCredentialGroupEnrollmentRedirect(token, { oauth: 'unavailable' })
@@ -38,7 +40,9 @@ export const GET = withRouteHandler(
     const enrollmentLimited = await enforceCredentialGroupEnrollmentOAuthRateLimit(
       principal.enrollmentId
     )
-    if (enrollmentLimited) return enrollmentLimited
+    if (enrollmentLimited) {
+      return createCredentialGroupEnrollmentRedirect(token, { oauth: 'rate_limited' })
+    }
 
     try {
       const { authorizationUrl } = await startPublicCredentialGroupOAuth.execute({

apps/sim/app/api/credential-groups/oauth/[provider]/callback/route.test.ts

@@ -1,7 +1,7 @@
 /**
  * @vitest-environment node
  */
-import { NextRequest } from 'next/server'
+import { NextRequest, NextResponse } from 'next/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const mocks = vi.hoisted(() => ({
@@ -109,4 +109,20 @@ describe('credential group OAuth callback', () => {
     )
     expect(mocks.completeOAuth).not.toHaveBeenCalled()
   })
+
+  it('returns a valid rate-limited callback to the enrollment page without exchanging', async () => {
+    mocks.rateLimit.mockResolvedValue(
+      NextResponse.json({ error: 'Too many requests' }, { status: 429 })
+    )
+
+    const response = await GET(request('state=state-1&code=code-1'), context)
+
+    expect(mocks.consumeAttempt).toHaveBeenCalledWith('state-1')
+    expect(response.status).toBe(307)
+    expect(response.headers.get('location')).toBe(
+      '/credential-groups/enroll/invitation-token?oauth=rate_limited'
+    )
+    expect(mocks.authenticate).not.toHaveBeenCalled()
+    expect(mocks.completeOAuth).not.toHaveBeenCalled()
+  })
 })

apps/sim/app/api/credential-groups/oauth/[provider]/callback/route.ts

@@ -20,10 +20,9 @@ const logger = createLogger('CredentialGroupOAuthCallbackAPI')
 export const GET = withRouteHandler(
   async (request: NextRequest, context: { params: Promise<{ provider: string }> }) => {
     const limited = await enforcePublicCredentialGroupIpRateLimit(request, 'oauth-callback')
-    if (limited) return limited
 
     const parsed = await parseRequest(credentialGroupOAuthCallbackContract, request, context)
-    if (!parsed.success) return parsed.response
+    if (!parsed.success) return limited ?? parsed.response
     const { provider } = parsed.data.params
     const { state, code, error: providerError } = parsed.data.query
 
@@ -40,11 +39,17 @@ export const GET = withRouteHandler(
       )
     }
     if (!attempt || attempt.provider !== provider) {
+      if (limited) return limited
       return NextResponse.json(
         { error: 'Authorization state is invalid or expired.' },
         { status: 400, headers: { 'Cache-Control': 'no-store' } }
       )
     }
+    if (limited) {
+      return createCredentialGroupEnrollmentRedirect(attempt.invitationToken, {
+        oauth: 'rate_limited',
+      })
+    }
     if (providerError) {
       return createCredentialGroupEnrollmentRedirect(attempt.invitationToken, { oauth: 'denied' })
     }

apps/sim/app/credential-groups/enroll/[token]/page.tsx

@@ -67,6 +67,7 @@ const OAUTH_MESSAGES = {
   account_mismatch: 'Choose the account matching the email address on this invitation.',
   permissions_required: 'All requested permissions are required to connect this account.',
   configuration_changed: 'This credential option changed. Reload the page and try again.',
+  rate_limited: 'Too many authorization attempts. Wait a few minutes and try again.',
   incomplete: 'Connect every account before submitting.',
   unavailable: 'Account authorization is temporarily unavailable. Please try again.',
   failed: 'Account authorization did not complete. Please try again.',

apps/sim/ee/credential-groups/components/slack-managed-users-modal.test.ts

@@ -0,0 +1,21 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import { getSlackManagedUsersFailureNotification } from '@/ee/credential-groups/components/slack-managed-users-modal'
+
+describe('Slack managed-user authorization notifications', () => {
+  it('treats provider cancellation as a non-error outcome', () => {
+    expect(getSlackManagedUsersFailureNotification('provider_error')).toEqual({
+      message: 'Slack authorization canceled',
+      variant: 'warning',
+    })
+  })
+
+  it('keeps verification failures in the error state', () => {
+    expect(getSlackManagedUsersFailureNotification('invalid_response')).toEqual({
+      message: 'Slack app verification failed. Please try again.',
+      variant: 'error',
+    })
+  })
+})

apps/sim/ee/credential-groups/components/slack-managed-users-modal.tsx

@@ -35,17 +35,28 @@ interface SlackManagedUsersModalProps {
 interface SlackManagedUsersMessage {
   type: typeof CHANNEL_NAME
   ok: boolean
+  reason?: string
   state?: string
   credentialGroupId?: string
   slackBotCredentialId?: string
 }
 
+export function getSlackManagedUsersFailureNotification(reason?: string): {
+  message: string
+  variant: 'error' | 'warning'
+} {
+  return reason === 'provider_error'
+    ? { message: 'Slack authorization canceled', variant: 'warning' }
+    : { message: 'Slack app verification failed. Please try again.', variant: 'error' }
+}
+
 function isSlackManagedUsersMessage(value: unknown): value is SlackManagedUsersMessage {
   if (!value || typeof value !== 'object') return false
   const message = value as Record<string, unknown>
   return (
     message.type === CHANNEL_NAME &&
     typeof message.ok === 'boolean' &&
+    (message.reason === undefined || typeof message.reason === 'string') &&
     (message.state === undefined || typeof message.state === 'string') &&
     (message.credentialGroupId === undefined || typeof message.credentialGroupId === 'string') &&
     (message.slackBotCredentialId === undefined || typeof message.slackBotCredentialId === 'string')
@@ -97,8 +108,13 @@ export function SlackManagedUsersModal({
       popup.current?.close()
       popup.current = null
       setPending(false)
+      if (!event.data.ok) {
+        const notification = getSlackManagedUsersFailureNotification(event.data.reason)
+        if (notification.variant === 'warning') toast.warning(notification.message)
+        else toast.error(notification.message)
+        return
+      }
       if (
-        !event.data.ok ||
         event.data.credentialGroupId !== credentialGroupId ||
         !verifiedCredentialId ||
         event.data.slackBotCredentialId !== verifiedCredentialId

apps/sim/tools/generated/tool-metadata.ts

@@ -10,7 +10,6 @@ export const gmailAddLabelTool: ToolConfig<GmailLabelParams, GmailToolResponse>
   oauth: {
     required: true,
     provider: 'google-email',
-    requiredScopes: ['https://www.googleapis.com/auth/gmail.modify'],
   },
 
   params: {

apps/sim/tools/gmail/add_label.ts

@@ -10,7 +10,6 @@ export const gmailArchiveTool: ToolConfig<GmailMarkReadParams, GmailToolResponse
   oauth: {
     required: true,
     provider: 'google-email',
-    requiredScopes: ['https://www.googleapis.com/auth/gmail.modify'],
   },
 
   params: {