fix(oauth): bind update access to selected credential - #6999
fix(oauth): bind update access to selected credential#6999BillLeoutsakosvl346 wants to merge 4 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
PR SummaryMedium Risk Overview
Workflow credential selectors, tool-input selectors, and knowledge connectors pass the resolved credential’s id, name, and actual Reviewed by Cursor Bugbot for commit e0dc30f. Bugbot is set up for automated code reviews on this repo. Configure here. |
Greptile SummaryThis PR binds OAuth reauthorization to the exact selected credential through the existing draft reconnect path.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains.
|
| Filename | Overview |
|---|---|
| apps/sim/app/workspace/[workspaceId]/components/connect-oauth-modal/connect-oauth-modal.tsx | Reauthorization now creates and forwards an exact-credential draft before launching OAuth. |
| apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connectors-section.tsx | Knowledge-connector reconnect resolves the stored credential, uses its provider and identity, and fails closed when resolution fails. |
| apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/credential-selector/credential-selector.tsx | Workflow credential reauthorization now supplies the selected credential as the reconnect target. |
| apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/tool-input/components/tools/credential-selector.tsx | Tool-input credential reauthorization now supplies the selected credential as the reconnect target. |
| apps/sim/app/workspace/[workspaceId]/components/connect-oauth-modal/connect-oauth-modal.test.tsx | Adds focused tests for exact draft binding, launch suppression on draft failure, and provider-only behavior. |
| apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connectors-section.test.tsx | Adds coverage for unresolved credentials, custom-provider identity, and credential disappearance while the modal is open. |
| apps/sim/lib/credentials/draft-processor.test.ts | Verifies that an exact Slack reconnect draft updates its bound credential regardless of changed account identity. |
Sequence Diagram
sequenceDiagram
participant UI as Credential UI
participant Draft as Credential Draft API
participant OAuth as OAuth Launch/Callback
participant Processor as Draft Processor
participant Credential as Selected Credential
UI->>Draft: Create draft with provider and credential ID
Draft-->>UI: Return draft ID
UI->>OAuth: Launch reauthorization with draft ID
OAuth->>Processor: Callback with draft and new account ID
Processor->>Credential: Rebind exact selected credential
Reviews (4): Last reviewed commit: "fix(oauth): clear stale connector return..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
|
bugbot run |
Screen.Recording.2026-08-22.at.6.38.59.PM.mov |
|
@cursor review |
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit e0dc30f. Configure here.
| consumeOAuthReturnContext() | ||
| setShowOAuthModal(false) | ||
| } | ||
| }, [showOAuthModal, selectedId, selectedCredential]) |
There was a problem hiding this comment.
Premature OAuth reauth cleanup
Medium Severity
The new cleanup effect treats a temporarily unresolved credential as deleted. selectedCredential is derived from a credentials list that defaults to [] whenever the query has no cached data, and the effect never checks credentialsLoading. In the tool selector, workflowId enters the query key only after workflowMap loads, so an open reauth modal can briefly lose selectedCredential, consume the OAuth return context, and close mid-flow.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit e0dc30f. Configure here.
2 participants
Summary
Bind existing-credential reauthorization to the exact selected OAuth credential before redirecting. This makes the callback use the established draft reconnect path instead of relying on provider account-ID matching, which can leave a legacy Slack credential pointing at its old account after Update access.
The change is provider-agnostic and applies to workflow credential selectors, tool-input credential selectors, and knowledge connectors. Provider-only Copilot reauthorization remains unchanged.
Type of Change
Testing
bun run --cwd apps/sim test 'app/workspace/[workspaceId]/components/connect-oauth-modal/connect-oauth-modal.test.tsx' lib/credentials/draft-processor.test.ts lib/credentials/draft-hooks.test.ts(18 tests passed)bun run --cwd apps/sim type-checkchat:write:Additional permissions requiredandUpdate access.Connect Slackpermission modal rendered without visual regressions.POST /api/credentials/draftcreated draft7e70aa5f-afc3-42df-95b4-5ed144dd5748for workspace6762b941-0cb8-4787-918d-c8ac76d501b4, providerslack, selected credentialea789bd4-17c9-4a8f-80fd-123456789004, and display nameLocal incomplete Slack.POST /api/auth/oauth2/linkwas attempted. The local run used port 3001 because port 3000 was occupied by another worktree, so Better Auth rejected the local origin before any Slack redirect. The focused modal test separately verifies that the returned draft ID is forwarded into this link call.No live Slack OAuth flow was completed, no real grant or credential was modified, and no provider configuration was changed.
Checklist
Screenshots/Videos
Not applicable: no visual changes are intended. Chrome verification confirmed the existing warning and modal presentation.