Skip to content

Commit 10f1085

Browse files
icecrasher321icecrasher321
committed
fix draft timing issue
1 parent 733656c commit 10f1085

3 files changed

Lines changed: 95 additions & 51 deletions

File tree

‎apps/sim/app/api/auth/oauth2/authorize/route.ts‎

Lines changed: 83 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,81 @@
1+
import { db } from '@sim/db'
2+
import { pendingCredentialDraft, user } from '@sim/db/schema'
13
import { createLogger } from '@sim/logger'
4+
import { generateId } from '@sim/utils/id'
5+
import { and, eq, lt } from 'drizzle-orm'
26
import { type NextRequest, NextResponse } from 'next/server'
37
import { authorizeOAuth2Contract } from '@/lib/api/contracts/oauth-connections'
48
import { parseRequest } from '@/lib/api/server'
59
import { auth, getSession } from '@/lib/auth/auth'
610
import { getBaseUrl } from '@/lib/core/utils/urls'
711
import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
12+
import { getAllOAuthServices } from '@/lib/oauth/utils'
13+
import { checkWorkspaceAccess } from '@/lib/workspaces/permissions/utils'
814

915
const logger = createLogger('OAuth2Authorize')
1016

1117
export const dynamic = 'force-dynamic'
1218

19+
const DRAFT_TTL_MS = 15 * 60 * 1000
20+
21+
/**
22+
* Creates the pending credential draft at click time so its TTL starts when the
23+
* user actually initiates the connect. Better Auth's `account.create.after` hook
24+
* consumes this draft to materialize the real credential after the OAuth
25+
* callback; starting the clock here guarantees the draft outlives the (≤5 min)
26+
* OAuth round-trip rather than expiring mid-flow and silently producing no
27+
* credential.
28+
*/
29+
async function createConnectDraft(params: {
30+
userId: string
31+
workspaceId: string
32+
providerId: string
33+
}): Promise<void> {
34+
const { userId, workspaceId, providerId } = params
35+
36+
const service = getAllOAuthServices().find((s) => s.providerId === providerId)
37+
const serviceName = service?.name ?? providerId
38+
39+
let displayName = serviceName
40+
try {
41+
const [row] = await db.select({ name: user.name }).from(user).where(eq(user.id, userId))
42+
if (row?.name) {
43+
displayName = `${row.name}'s ${serviceName}`
44+
}
45+
} catch {
46+
// Fall back to service name only
47+
}
48+
49+
const now = new Date()
50+
const expiresAt = new Date(now.getTime() + DRAFT_TTL_MS)
51+
await db
52+
.delete(pendingCredentialDraft)
53+
.where(
54+
and(eq(pendingCredentialDraft.userId, userId), lt(pendingCredentialDraft.expiresAt, now))
55+
)
56+
await db
57+
.insert(pendingCredentialDraft)
58+
.values({
59+
id: generateId(),
60+
userId,
61+
workspaceId,
62+
providerId,
63+
displayName,
64+
expiresAt,
65+
createdAt: now,
66+
})
67+
.onConflictDoUpdate({
68+
target: [
69+
pendingCredentialDraft.userId,
70+
pendingCredentialDraft.providerId,
71+
pendingCredentialDraft.workspaceId,
72+
],
73+
set: { displayName, expiresAt, createdAt: now },
74+
})
75+
76+
logger.info('Created OAuth connect credential draft', { userId, workspaceId, providerId })
77+
}
78+
1379
/**
1480
* Browser-initiated entrypoint for linking a generic OAuth2 account.
1581
*/
@@ -22,16 +88,32 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
2288
loginUrl.searchParams.set('callbackUrl', request.nextUrl.pathname + request.nextUrl.search)
2389
return NextResponse.redirect(loginUrl.toString())
2490
}
91+
const userId = session.user.id
2592

2693
const parsed = await parseRequest(authorizeOAuth2Contract, request, {})
2794
if (!parsed.success) return parsed.response
28-
const { providerId, callbackURL: requestedCallback } = parsed.data.query
95+
const { providerId, workspaceId, callbackURL: requestedCallback } = parsed.data.query
2996

3097
const callbackURL = requestedCallback?.startsWith(`${baseUrl}/`)
3198
? requestedCallback
3299
: `${baseUrl}/workspace`
33100

34101
try {
102+
const access = await checkWorkspaceAccess(workspaceId, userId)
103+
if (!access.canWrite) {
104+
logger.warn('Workspace write access denied for OAuth2 authorize', {
105+
userId,
106+
workspaceId,
107+
providerId,
108+
})
109+
return NextResponse.redirect(`${baseUrl}/workspace?error=workspace_access_denied`)
110+
}
111+
112+
// Create the draft before initiating the link so it is guaranteed to exist
113+
// (and freshly clocked) when the OAuth callback's `account.create.after`
114+
// hook runs. If this throws, we never start the OAuth flow.
115+
await createConnectDraft({ userId, workspaceId, providerId })
116+
35117
const linkResponse = await auth.api.oAuth2LinkAccount({
36118
body: { providerId, callbackURL },
37119
headers: request.headers,

‎apps/sim/lib/api/contracts/oauth-connections.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
import { z } from 'zod'
2+
import { workspaceIdSchema } from '@/lib/api/contracts/primitives'
23
import type {
34
ContractBody,
45
ContractBodyInput,
@@ -192,6 +193,7 @@ export const trelloCallbackContract = defineRouteContract({
192193

193194
export const authorizeOAuth2QuerySchema = z.object({
194195
providerId: z.string().min(1, 'providerId is required'),
196+
workspaceId: workspaceIdSchema,
195197
callbackURL: z.string().min(1).optional(),
196198
})
197199

‎apps/sim/lib/copilot/tools/handlers/oauth.ts‎

Lines changed: 10 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,4 @@
1-
import { db } from '@sim/db'
2-
import { pendingCredentialDraft, user } from '@sim/db/schema'
31
import { toError } from '@sim/utils/errors'
4-
import { generateId } from '@sim/utils/id'
5-
import { and, eq, lt } from 'drizzle-orm'
62
import type { ExecutionContext, ToolCallResult } from '@/lib/copilot/request/types'
73
import { ensureWorkspaceAccess } from '@/lib/copilot/tools/handlers/access'
84
import { getBaseUrl } from '@/lib/core/utils/urls'
@@ -20,7 +16,6 @@ export async function executeOAuthGetAuthLink(
2016
}
2117
await ensureWorkspaceAccess(context.workspaceId, context.userId, 'write')
2218
const result = await generateOAuthLink(
23-
context.userId,
2419
context.workspaceId,
2520
context.workflowId,
2621
context.chatId,
@@ -72,13 +67,13 @@ export async function executeOAuthRequestAccess(
7267
* Resolves a human-friendly provider name to a providerId and returns a
7368
* browser-initiated authorize URL the user opens to connect the service.
7469
*
75-
* Steps: resolve provider → create credential draft → return the Sim
76-
* `/api/auth/oauth2/authorize` URL. That endpoint (not this server-side handler)
77-
* calls Better Auth, so the signed `state` cookie is planted in the user's
78-
* browser and the OAuth callback's state check passes.
70+
* Steps: resolve provider → return the Sim `/api/auth/oauth2/authorize` URL.
71+
* That endpoint (not this server-side handler) creates the credential draft and
72+
* calls Better Auth, so the draft's TTL starts at click and the signed `state`
73+
* cookie is planted in the user's browser and the OAuth callback's state check
74+
* passes.
7975
*/
8076
async function generateOAuthLink(
81-
userId: string,
8277
workspaceId: string | undefined,
8378
workflowId: string | undefined,
8479
chatId: string | undefined,
@@ -129,54 +124,19 @@ async function generateOAuthLink(
129124
}
130125
}
131126

132-
let displayName = serviceName
133-
try {
134-
const [row] = await db.select({ name: user.name }).from(user).where(eq(user.id, userId))
135-
if (row?.name) {
136-
displayName = `${row.name}'s ${serviceName}`
137-
}
138-
} catch {
139-
// Fall back to service name only
140-
}
141-
142-
const now = new Date()
143-
await db
144-
.delete(pendingCredentialDraft)
145-
.where(
146-
and(eq(pendingCredentialDraft.userId, userId), lt(pendingCredentialDraft.expiresAt, now))
147-
)
148-
await db
149-
.insert(pendingCredentialDraft)
150-
.values({
151-
id: generateId(),
152-
userId,
153-
workspaceId,
154-
providerId,
155-
displayName,
156-
expiresAt: new Date(now.getTime() + 15 * 60 * 1000),
157-
createdAt: now,
158-
})
159-
.onConflictDoUpdate({
160-
target: [
161-
pendingCredentialDraft.userId,
162-
pendingCredentialDraft.providerId,
163-
pendingCredentialDraft.workspaceId,
164-
],
165-
set: {
166-
displayName,
167-
expiresAt: new Date(now.getTime() + 15 * 60 * 1000),
168-
createdAt: now,
169-
},
170-
})
171-
172127
// Hand back a browser-initiated authorize URL rather than calling
173128
// oAuth2LinkAccount here. Generating the link server-side would set Better
174129
// Auth's signed `state` cookie on this server-to-server response instead of the
175130
// user's browser, so the OAuth callback would fail with `state_mismatch`. The
176131
// authorize endpoint runs the link inside the user's browser, planting the
177132
// cookie correctly while keeping the callback's state check enabled.
133+
//
134+
// The pending credential draft is created by that authorize endpoint at click
135+
// time (not here), so the draft's TTL starts when the user actually initiates
136+
// the connect and reliably outlives the OAuth round-trip.
178137
const authorizeUrl = new URL(`${baseUrl}/api/auth/oauth2/authorize`)
179138
authorizeUrl.searchParams.set('providerId', providerId)
139+
authorizeUrl.searchParams.set('workspaceId', workspaceId)
180140
authorizeUrl.searchParams.set('callbackURL', callbackURL)
181141

182142
return { url: authorizeUrl.toString(), providerId, serviceName }

0 commit comments

Comments
 (0)