fix(credentials): isolate managed delegation

Author: TheodoreSpeaks

apps/sim/app/api/auth/oauth/token/route.test.ts

@@ -128,6 +128,38 @@ describe('OAuth Token API Routes', () => {
       expect(authOAuthUtilsMockFns.mockGetCredential).toHaveBeenCalled()
     })
 
+    it('does not authenticate managed delegation for an ordinary OAuth credential', async () => {
+      mockAuthorizeCredentialUse.mockResolvedValueOnce({
+        ok: true,
+        authType: 'internal_jwt',
+        requesterUserId: 'workflow-owner-id',
+        credentialOwnerUserId: 'workflow-owner-id',
+      })
+      authOAuthUtilsMockFns.mockGetCredential.mockResolvedValueOnce({
+        id: 'credential-id',
+        accessToken: 'test-token',
+        refreshToken: 'refresh-token',
+        accessTokenExpiresAt: new Date(Date.now() + 3600 * 1000),
+        providerId: 'google',
+      })
+      authOAuthUtilsMockFns.mockRefreshTokenIfNeeded.mockResolvedValueOnce({
+        accessToken: 'fresh-token',
+        refreshed: false,
+      })
+
+      const response = await POST(
+        createMockRequest(
+          'POST',
+          { credentialId: 'credential-id', workflowId: 'workflow-id' },
+          { 'x-sim-managed-oauth-delegation': 'Bearer stale-delegation' }
+        )
+      )
+
+      expect(response.status).toBe(200)
+      await expect(response.json()).resolves.toMatchObject({ accessToken: 'fresh-token' })
+      expect(mockAuthenticateManagedOAuthDelegation).not.toHaveBeenCalled()
+    })
+
     it('should handle missing credentialId', async () => {
       const req = createMockRequest('POST', {})
 

apps/sim/app/api/auth/oauth/token/route.ts

@@ -127,13 +127,24 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       }
     }
 
-    let managedOAuthPrincipal: WorkflowExecutionDelegatedPrincipal | null = null
-    const managedOAuthDelegation = parsed.data.headers?.[MANAGED_OAUTH_DELEGATION_HEADER]
-    if (managedOAuthDelegation && credentialId) {
+    const resolved = credentialId ? await resolveOAuthAccountId(credentialId) : null
+    if (resolved?.credentialType === 'managed_oauth' && resolved.credentialId) {
+      const managedOAuthDelegation = parsed.data.headers?.[MANAGED_OAUTH_DELEGATION_HEADER]
+      if (!managedOAuthDelegation) {
+        return NextResponse.json(
+          {
+            code: 'MANAGED_CREDENTIAL_DELEGATION_REQUIRED',
+            error: 'Managed credentials can only be used by an authenticated workflow execution',
+          },
+          { status: 403 }
+        )
+      }
+
+      let managedOAuthPrincipal: WorkflowExecutionDelegatedPrincipal
       try {
         managedOAuthPrincipal = await authenticateManagedOAuthDelegation(
           managedOAuthDelegation,
-          credentialId
+          resolved.credentialId
         )
       } catch (error) {
         if (!(error instanceof InvalidManagedOAuthDelegationError)) throw error
@@ -145,10 +156,6 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
           { status: 401 }
         )
       }
-    }
-
-    const resolved = credentialId ? await resolveOAuthAccountId(credentialId) : null
-    if (resolved?.credentialType === 'managed_oauth' && resolved.credentialId) {
       if (!toolId) {
         return NextResponse.json(
           {
@@ -187,16 +194,6 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
         )
       }
 
-      if (!managedOAuthPrincipal) {
-        return NextResponse.json(
-          {
-            code: 'MANAGED_CREDENTIAL_DELEGATION_REQUIRED',
-            error: 'Managed credentials can only be used by an authenticated workflow execution',
-          },
-          { status: 403 }
-        )
-      }
-
       try {
         const result = await resolveManagedOAuthCredentialToken.execute({
           principal: managedOAuthPrincipal,