fix(credentials): expire a coordinated token an internal operation's provider refuses

Author: waleedlatif1

apps/sim/tools/index.test.ts

@@ -3894,6 +3894,8 @@ describe('Internal Route Trust', () => {
     const toolId = 'test_internal_minted_token_refusal'
     beforeEach(() => {
       mockForgetRejectedClientCredentialToken.mockReset()
+      mockInvalidateCoordinatedClientToken.mockReset()
+      mockInvalidateCoordinatedClientToken.mockResolvedValue(undefined)
       ;(tools as Record<string, unknown>)[toolId] = {
         id: toolId,
         name: 'Internal Minted Token Refusal Test',
@@ -3937,6 +3939,9 @@ describe('Internal Route Trust', () => {
 
       expect(result.success).toBe(false)
       expect(mockForgetRejectedClientCredentialToken).toHaveBeenCalledWith('minted-token')
+      expect(mockInvalidateCoordinatedClientToken).toHaveBeenCalledWith('minted-token', {
+        minimumAgeMs: 60_000,
+      })
     })
 
     it('drops the cached token after a 403 only once it is old enough to blame', async () => {
@@ -3946,19 +3951,24 @@ describe('Internal Route Trust', () => {
       expect(mockForgetRejectedClientCredentialToken).toHaveBeenCalledWith('minted-token', {
         minimumAgeMs: 60_000,
       })
+      expect(mockInvalidateCoordinatedClientToken).toHaveBeenCalledWith('minted-token', {
+        minimumAgeMs: 60_000,
+      })
     })
 
     it('keeps the token after a call the provider accepts', async () => {
       const result = await runWith('service_account', 200)
 
       expect(result.success).toBe(true)
       expect(mockForgetRejectedClientCredentialToken).not.toHaveBeenCalled()
+      expect(mockInvalidateCoordinatedClientToken).not.toHaveBeenCalled()
     })
 
     it("never drops a signed-in account's token", async () => {
       await runWith('oauth', 401)
 
       expect(mockForgetRejectedClientCredentialToken).not.toHaveBeenCalled()
+      expect(mockInvalidateCoordinatedClientToken).not.toHaveBeenCalled()
     })
 
     it('reports an expired saved token instead of the bare refusal', async () => {

apps/sim/tools/index.ts

@@ -2981,6 +2981,7 @@ async function executeDeclaredInternalOperation({
           requestId,
           result.status === 403 ? REJECTED_TOKEN_MINIMUM_AGE_MS : undefined
         )
+        await expireRefusedCoordinatedToken(params.accessToken, requestId)
       }
       if (result instanceof Response && result.status === 401 && refreshCredential) {
         await result.body?.cancel()
@@ -3098,6 +3099,18 @@ async function expireRejectedServiceAccountToken(
   if (!(error instanceof Error) || !('status' in error) || error.status !== 401) return
   if (typeof accessToken !== 'string' || !accessToken || reportsScopeRefusal(error)) return
   await forgetRefusedServiceAccountToken(accessToken, requestId)
+  await expireRefusedCoordinatedToken(accessToken, requestId)
+}
+
+/**
+ * Expires a refused token coordinated across workers (a client-credentials grant's shared token),
+ * so the next call on any worker mints a replacement. A token minted within
+ * {@link REJECTED_TOKEN_MINIMUM_AGE_MS} is kept, since the refusal may come from the endpoint.
+ */
+async function expireRefusedCoordinatedToken(
+  accessToken: string,
+  requestId: string
+): Promise<void> {
   try {
     const { invalidateCoordinatedClientToken } = await import(
       '@/lib/credentials/coordinated-client-token'