fix(credentials): revalidate policy before grant persistence

Author: TheodoreSpeaks

apps/sim/lib/credential-groups/oauth.test.ts

@@ -1,7 +1,13 @@
 /**
  * @vitest-environment node
  */
-import { dbChainMockFns, resetDbChainMock } from '@sim/testing'
+import {
+  dbChainMock,
+  dbChainMockFns,
+  queueTableRows,
+  resetDbChainMock,
+  schemaMock,
+} from '@sim/testing'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { adapter } = vi.hoisted(() => ({
@@ -54,6 +60,18 @@ const CONTEXT = {
   options: [],
 }
 
+const GROUP = {
+  status: 'active' as const,
+  options: [
+    {
+      ...CONTEXT.option,
+      authorizationAppId: POLICY.authorizationAppId,
+      requiredScopes: POLICY.requiredScopes,
+      scopeVersion: POLICY.scopeVersion,
+    },
+  ],
+}
+
 describe('credential group OAuth persistence', () => {
   beforeEach(() => {
     vi.clearAllMocks()
@@ -104,7 +122,9 @@ describe('credential group OAuth persistence', () => {
   })
 
   it('preserves completed enrollment state when an account reconnects', async () => {
-    dbChainMockFns.limit.mockResolvedValueOnce([{ status: 'completed' }]).mockResolvedValueOnce([
+    dbChainMockFns.limit.mockResolvedValueOnce([{ status: 'completed' }])
+    queueTableRows(schemaMock.credentialGroup, [GROUP])
+    queueTableRows(schemaMock.credential, [
       {
         id: 'credential-1',
         providerSubjectId: 'google-subject-1',
@@ -142,4 +162,59 @@ describe('credential group OAuth persistence', () => {
     )
     expect(enrollmentUpdate).not.toHaveProperty('completedAt')
   })
+
+  it('rejects an exchanged grant when the group policy changed before persistence', async () => {
+    const nextPolicy = {
+      ...POLICY,
+      requiredScopes: [...POLICY.requiredScopes, 'https://www.googleapis.com/auth/gmail.readonly'],
+      scopeVersion: 2,
+    }
+    adapter.getPolicy.mockResolvedValueOnce(POLICY).mockResolvedValueOnce(nextPolicy)
+    dbChainMockFns.limit.mockResolvedValueOnce([{ status: 'completed' }])
+    queueTableRows(schemaMock.credentialGroup, [
+      {
+        ...GROUP,
+        options: [
+          {
+            ...GROUP.options[0],
+            requiredScopes: nextPolicy.requiredScopes,
+            scopeVersion: nextPolicy.scopeVersion,
+          },
+        ],
+      },
+    ])
+
+    await expect(
+      completeCredentialGroupOAuth(
+        { ...CONTEXT, enrollmentStatus: 'completed' },
+        {
+          state: 'state-1',
+          provider: 'gmail',
+          nonceHash: 'nonce-hash',
+          enrollmentId: CONTEXT.enrollmentId,
+          credentialGroupId: CONTEXT.credentialGroupId,
+          optionId: CONTEXT.option.id,
+          authorizationAppId: POLICY.authorizationAppId,
+          scopeVersion: POLICY.scopeVersion,
+          requiredScopes: POLICY.requiredScopes,
+          redirectUri: 'https://sim.ai/api/credential-groups/oauth/gmail/callback',
+          codeVerifier: 'verifier',
+          invitationToken: 'invitation-token',
+          createdAt: Date.now(),
+        },
+        'authorization-code'
+      )
+    ).rejects.toThrow('This credential option changed.')
+
+    expect(adapter.getPolicy).toHaveBeenLastCalledWith(
+      expect.objectContaining({ id: 'option-1' }),
+      {
+        workspaceId: CONTEXT.workspaceId,
+        credentialGroupId: CONTEXT.credentialGroupId,
+        executor: dbChainMock.db,
+      }
+    )
+    expect(dbChainMockFns.update).not.toHaveBeenCalled()
+    expect(dbChainMockFns.insert).not.toHaveBeenCalled()
+  })
 })

apps/sim/lib/credential-groups/oauth.ts

@@ -1,5 +1,5 @@
 import { db } from '@sim/db'
-import { credential, credentialGroupEnrollment } from '@sim/db/schema'
+import { credential, credentialGroup, credentialGroupEnrollment } from '@sim/db/schema'
 import { generateId } from '@sim/utils/id'
 import { and, eq, ne, sql } from 'drizzle-orm'
 import {
@@ -35,6 +35,19 @@ function scopesEqual(left: string[], right: string[]): boolean {
   )
 }
 
+function policiesEqual(
+  left: CredentialGroupProviderPolicy,
+  right: CredentialGroupProviderPolicy
+): boolean {
+  return (
+    left.provider === right.provider &&
+    left.providerId === right.providerId &&
+    left.authorizationAppId === right.authorizationAppId &&
+    left.scopeVersion === right.scopeVersion &&
+    scopesEqual(left.requiredScopes, right.requiredScopes)
+  )
+}
+
 function getOptionAdapter(context: CredentialGroupOAuthContext): CredentialGroupProviderAdapter {
   if (!isCredentialGroupProvider(context.option.provider)) {
     throw new Error(`Unsupported Credential Group provider: ${context.option.provider}`)
@@ -114,6 +127,42 @@ async function persistGrant(
       throw new CredentialGroupOAuthError('This account invitation was revoked.', 409)
     }
 
+    const [group] = await tx
+      .select({ status: credentialGroup.status, options: credentialGroup.options })
+      .from(credentialGroup)
+      .where(
+        and(
+          eq(credentialGroup.id, context.credentialGroupId),
+          eq(credentialGroup.workspaceId, context.workspaceId)
+        )
+      )
+      .limit(1)
+      .for('update')
+    const currentOption = group?.options.find((option) => option.id === context.option.id)
+    if (
+      !group ||
+      group.status !== 'active' ||
+      !currentOption ||
+      currentOption.status !== 'active' ||
+      currentOption.provider !== adapter.provider
+    ) {
+      throw new CredentialGroupOAuthError(
+        'This credential option changed. Reload the invitation and try again.',
+        409
+      )
+    }
+    const currentPolicy = await adapter.getPolicy(currentOption, {
+      workspaceId: context.workspaceId,
+      credentialGroupId: context.credentialGroupId,
+      executor: tx,
+    })
+    if (!policiesEqual(currentPolicy, policy)) {
+      throw new CredentialGroupOAuthError(
+        'This credential option changed. Reload the invitation and try again.',
+        409
+      )
+    }
+
     const [existing] = await tx
       .select({
         id: credential.id,