fix(dataverse): reject port-qualified origins, refuse reconnect without a host

- resolve: an explicit port survived into the origin, which becomes both the
  OAuth audience and the API base. Providers publish their resource on the
  default port, so a port-qualified origin names a resource nobody serves.
  `URL` drops the port only when it is the scheme default, so anything left is
  explicit and now rejected.

- reconnect: the credential-detail Reconnect action calls the connect mutation
  directly with no environment URL, so a resource-scoped service failed with a
  validator error about a field that surface never shows. It now refuses up
  front with the route that works. The check runs before the draft is written,
  so a refusal leaves nothing behind.

`WorkspaceCredential` carries no granted scopes, so the origin cannot be read
back off the credential here — that is the follow-up already noted on the PR.

Author: waleedlatif1

apps/sim/app/workspace/[workspaceId]/integrations/connected/[credentialId]/connected-credential-detail.tsx

@@ -19,6 +19,7 @@ import { useRouter } from 'next/navigation'
 import { SaveDiscardChips } from '@/components/settings/save-discard-actions'
 import { writeOAuthReturnContext } from '@/lib/credentials/client-state'
 import { resolveCredentialDisplay } from '@/lib/integrations'
+import { getServiceConfigByProviderId } from '@/lib/oauth/utils'
 import {
   AddPeopleModal,
   CredentialDetailHeading,
@@ -113,6 +114,19 @@ export function ConnectedCredentialDetail({
   const handleReconnectOAuth = async () => {
     if (!credential || credential.type !== 'oauth' || !credential.providerId || !workspaceId) return
     try {
+      /**
+       * A reconnect must return to the environment the credential belongs to,
+       * and this surface has no way to supply it — `WorkspaceCredential` carries
+       * no granted scopes to read the origin back from. Checked before the draft
+       * is written so a refusal leaves nothing behind.
+       */
+      const resourceConfig = getServiceConfigByProviderId(credential.providerId)?.resourceUrl
+      if (resourceConfig) {
+        throw new Error(
+          `Reconnecting ${credential.displayName} needs its ${resourceConfig.title}. Disconnect it here, then connect the account again to enter one.`
+        )
+      }
+
       await createDraft.mutateAsync({
         workspaceId,
         providerId: credential.providerId,

apps/sim/lib/oauth/resource-url.test.ts

@@ -41,6 +41,15 @@ describe('resolveResourceOrigin', () => {
     expect(resolveResourceOrigin('http://myorg.crm.dynamics.com', config).ok).toBe(false)
   })
 
+  it('rejects an explicit port, which no provider serves its resource on', () => {
+    expect(resolveResourceOrigin('https://myorg.crm.dynamics.com:8443', config).ok).toBe(false)
+  })
+
+  it('accepts the default https port, which URL drops from the origin', () => {
+    const result = resolveResourceOrigin('https://myorg.crm.dynamics.com:443', config)
+    expect(result).toEqual({ ok: true, origin: 'https://myorg.crm.dynamics.com' })
+  })
+
   it('rejects embedded credentials', () => {
     expect(resolveResourceOrigin('https://u:p@myorg.crm.dynamics.com', config).ok).toBe(false)
   })

apps/sim/lib/oauth/resource-url.ts

@@ -40,6 +40,15 @@ export function resolveResourceOrigin(
   if (parsed.username || parsed.password) {
     return { ok: false, error: `${config.title} must not contain credentials` }
   }
+  /**
+   * `URL` drops the port only when it is the scheme default, so anything left
+   * here is explicit. The origin becomes an OAuth audience and the base for
+   * every API request, and providers publish their resource on the default
+   * port — a port-qualified origin would be a resource nobody serves.
+   */
+  if (parsed.port) {
+    return { ok: false, error: `${config.title} must not include a port` }
+  }
 
   /**
    * The allowlist is the whole security control here: no private address,