fix(oauth): bind update access to selected credential - #6999

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 24, 2026 7:21pm

PR Summary

Medium Risk
Changes OAuth reauthorization and credential draft binding across multiple entry points; incorrect wiring could update the wrong credential, but behavior is guarded with fail-closed UI and new tests.

Overview
Update access and Reconnect now tie OAuth reauthorization to the exact credential the user selected, instead of starting a provider-only flow that could match the wrong account on callback (e.g. legacy Slack credentials keeping an old account after scope updates).

ConnectOAuthModal in reauthorize mode accepts optional reconnectTarget (workspace, credential id, display name). When set—and when onConnect is not overriding—it creates a credential draft bound to that credential, then passes the returned draftId into the OAuth link so the callback uses the existing draft reconnect path. Provider-only reauthorization (no target) is unchanged.

Workflow credential selectors, tool-input selectors, and knowledge connector cards pass reconnectTarget, use the stored credential’s provider for the redirect, disable reconnect when the credential cannot be resolved, and close the modal plus clear OAuth return context if the credential vanishes while loading.

Tests cover modal draft ordering/errors, connector UI behavior, and draft processing for Slack reconnect via an exact draft.

^{Reviewed by Cursor Bugbot for commit fe47b61. Configure here.}

Greptile Summary

The PR binds OAuth reauthorization to the exact selected credential through a pending credential draft and fails closed when a knowledge connector’s stored credential cannot be resolved.

• Adds credential-bound draft creation before OAuth reauthorization.
• Passes the selected credential’s provider, identity, workspace, and display name from workflow and knowledge credential selectors.
• Keeps reconnect state stable during credential loading and closes it when the credential is definitively unavailable.
• Adds focused tests for draft forwarding, provider-specific reconnects, loading transitions, and draft processing.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

sequenceDiagram
    participant User
    participant Selector as Credential selector
    participant Modal as OAuth modal
    participant Draft as Credential draft API
    participant OAuth as OAuth provider
    participant Callback as OAuth callback
    User->>Selector: Update access
    Selector->>Modal: Reauthorize exact credential
    Modal->>Draft: Create draft with provider and credential ID
    Draft-->>Modal: Return draft ID
    Modal->>OAuth: Launch OAuth with draft ID
    OAuth-->>Callback: Return updated provider account
    Callback->>Draft: Process exact credential draft
    Draft-->>User: Reconnect selected credential

_{Reviews (7): Last reviewed commit: "fix(oauth): refresh resolved connector c..." | Re-trigger Greptile}

Addressed both provider-binding findings in 36fe7d0, added focused regression coverage, and reran the focused suite, Biome, and type-check.

@greptile
@cursor review

Addressed the stale OAuth return-context finding in 1014ba6 with focused lifecycle coverage; all 27 focused tests, Biome, and type-check pass.

@greptile
@cursor review

bugbot run

@greptile

@cursor review

Addressed the latest Bugbot credential-loading race in 4f1ee9f.

@cursor review
@greptile

@cursor review

@greptile

bugbot run

@greptile