fix(credentials): fail closed on oauth completion

Author: TheodoreSpeaks

apps/sim/app/api/auth/oauth2/callback/instagram/route.ts

@@ -299,18 +299,15 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
         ),
       }))
 
-    if (persisted) {
-      try {
-        await processCredentialDraft({
-          draftId,
-          userId: session.user.id,
-          providerId: 'instagram',
-          accountId: persisted.id,
-        })
-      } catch (draftError) {
-        logger.error('Failed to process credential draft for Instagram', { error: draftError })
-      }
+    if (!persisted) {
+      throw new Error(`Instagram OAuth account ${igUserId} was not persisted`)
     }
+    await processCredentialDraft({
+      draftId,
+      userId: session.user.id,
+      providerId: 'instagram',
+      accountId: persisted.id,
+    })
 
     const returnUrlCookie = request.cookies.get(INSTAGRAM_RETURN_URL_COOKIE)?.value
     const redirectUrl =

apps/sim/app/api/auth/oauth2/shopify/store/route.ts

@@ -119,18 +119,15 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
         ),
       }))
 
-    if (persisted) {
-      try {
-        await processCredentialDraft({
-          draftId,
-          userId: session.user.id,
-          providerId: 'shopify',
-          accountId: persisted.id,
-        })
-      } catch (error) {
-        logger.error('Failed to process credential draft for Shopify', { error })
-      }
+    if (!persisted) {
+      throw new Error(`Shopify OAuth account ${stableAccountId} was not persisted`)
     }
+    await processCredentialDraft({
+      draftId,
+      userId: session.user.id,
+      providerId: 'shopify',
+      accountId: persisted.id,
+    })
 
     const redirectUrl = returnUrl && isSameOrigin(returnUrl) ? returnUrl : `${baseUrl}/workspace`
     const finalUrl = new URL(redirectUrl)

apps/sim/app/api/auth/trello/store/route.ts

@@ -138,18 +138,15 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
         ),
       }))
 
-    if (persisted) {
-      try {
-        await processCredentialDraft({
-          draftId,
-          userId: session.user.id,
-          providerId: 'trello',
-          accountId: persisted.id,
-        })
-      } catch (error) {
-        logger.error('Failed to process credential draft for Trello', { error })
-      }
+    if (!persisted) {
+      throw new Error(`Trello OAuth account ${trelloUser.id} was not persisted`)
     }
+    await processCredentialDraft({
+      draftId,
+      userId: session.user.id,
+      providerId: 'trello',
+      accountId: persisted.id,
+    })
 
     return clearStateCookie(NextResponse.json({ success: true }))
   } catch (error) {

apps/sim/lib/auth/auth.ts

@@ -524,18 +524,19 @@ export const auth = betterAuth({
             }
           }
 
+          let credentialDraftId: string | undefined
           try {
             const oauthState = await getOAuthState()
             const rawCallbackUrl = oauthState?.callbackURL
             if (rawCallbackUrl !== undefined && typeof rawCallbackUrl !== 'string') {
               throw new Error('OAuth state callback URL must be a string')
             }
-            const draftId = rawCallbackUrl
+            credentialDraftId = rawCallbackUrl
               ? (new URL(rawCallbackUrl).searchParams.get(OAUTH_CREDENTIAL_DRAFT_CALLBACK_PARAM) ??
                 undefined)
               : undefined
             await processCredentialDraft({
-              draftId,
+              draftId: credentialDraftId,
               userId: account.userId,
               providerId: account.providerId,
               accountId: account.id,
@@ -546,6 +547,7 @@ export const auth = betterAuth({
               providerId: account.providerId,
               error,
             })
+            if (credentialDraftId) throw error
           }
 
           try {

apps/sim/lib/credentials/draft-hooks.ts

@@ -121,10 +121,7 @@ export async function handleReconnectCredential(params: {
     .limit(1)
 
   if (!existingCredential) {
-    logger.warn('Credential not found for reconnect, skipping', {
-      credentialId: draft.credentialId,
-    })
-    return
+    throw new Error(`Cannot reconnect missing credential ${draft.credentialId}`)
   }
 
   const oldAccountId = existingCredential.accountId
@@ -144,12 +141,9 @@ export async function handleReconnectCredential(params: {
       .limit(1)
 
     if (conflicting) {
-      logger.warn('New account already used by another credential, skipping reconnect', {
-        credentialId: draft.credentialId,
-        newAccountId,
-        conflictingCredentialId: conflicting.id,
-      })
-      return
+      throw new Error(
+        `Cannot reconnect credential ${draft.credentialId}: account ${newAccountId} is already used by credential ${conflicting.id}`
+      )
     }
   }
 

apps/sim/lib/credentials/draft-processor.test.ts

@@ -83,4 +83,23 @@ describe('processCredentialDraft', () => {
     expect(mockHandleCreateCredentialFromDraft).not.toHaveBeenCalled()
     expect(mockHandleReconnectCredential).not.toHaveBeenCalled()
   })
+
+  it('fails when an exact draft is missing or expired', async () => {
+    queueTableRows(schemaMock.pendingCredentialDraft, [])
+
+    await expect(
+      processCredentialDraft({
+        draftId: 'draft-missing',
+        userId: 'user-1',
+        providerId: 'google-email',
+        accountId: 'account-1',
+      })
+    ).rejects.toThrow(
+      'Cannot process missing or expired OAuth credential draft draft-missing for user user-1'
+    )
+
+    expect(mockHandleCreateCredentialFromDraft).not.toHaveBeenCalled()
+    expect(mockHandleReconnectCredential).not.toHaveBeenCalled()
+    expect(dbChainMockFns.delete).not.toHaveBeenCalled()
+  })
 })

apps/sim/lib/credentials/draft-processor.ts

@@ -50,7 +50,14 @@ export async function processCredentialDraft(params: ProcessCredentialDraftParam
 
   const [draft] = drafts
 
-  if (!draft) return
+  if (!draft) {
+    if (draftId) {
+      throw new Error(
+        `Cannot process missing or expired OAuth credential draft ${draftId} for user ${userId}`
+      )
+    }
+    return
+  }
 
   const now = new Date()