fix(credentials): close OAuth draft edge cases

Author: TheodoreSpeaks

apps/sim/app/api/auth/instagram/authorize/route.test.ts

@@ -77,6 +77,7 @@ describe('Instagram authorize route', () => {
     expect(response.headers.get('set-cookie')).toContain(
       'instagram_credential_draft_id=draft-created'
     )
+    expect(response.headers.get('set-cookie')).toContain('Max-Age=900')
     expect(mocks.createCredentialConnection).toHaveBeenCalledWith({
       principal: { kind: 'session', userId: 'user-1', sessionId: 'session-1' },
       input: { workspaceId: 'workspace-1', providerId: 'instagram' },

apps/sim/app/api/auth/instagram/authorize/route.ts

@@ -10,6 +10,7 @@ import { getBaseUrl } from '@/lib/core/utils/urls'
 import { isSameOrigin } from '@/lib/core/utils/validation'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { createCredentialConnection } from '@/lib/credentials/application/create-credential-connection'
+import { CREDENTIAL_DRAFT_TTL_SECONDS } from '@/lib/credentials/draft-constants'
 import { getCanonicalScopesForProvider } from '@/lib/oauth/utils'
 
 const logger = createLogger('InstagramAuthorize')
@@ -20,7 +21,6 @@ const INSTAGRAM_STATE_COOKIE = 'instagram_oauth_state'
 const INSTAGRAM_RETURN_URL_COOKIE = 'instagram_return_url'
 const INSTAGRAM_CREDENTIAL_DRAFT_COOKIE = 'instagram_credential_draft_id'
 const INSTAGRAM_STATE_COOKIE_PATH = '/api/auth'
-const INSTAGRAM_STATE_COOKIE_MAX_AGE_SECONDS = 60 * 10
 
 export const GET = withRouteHandler(async (request: NextRequest) => {
   try {
@@ -81,15 +81,15 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
       httpOnly: true,
       secure: process.env.NODE_ENV === 'production',
       sameSite: 'lax',
-      maxAge: INSTAGRAM_STATE_COOKIE_MAX_AGE_SECONDS,
+      maxAge: CREDENTIAL_DRAFT_TTL_SECONDS,
       path: INSTAGRAM_STATE_COOKIE_PATH,
     })
     if (credentialDraftId) {
       response.cookies.set(INSTAGRAM_CREDENTIAL_DRAFT_COOKIE, credentialDraftId, {
         httpOnly: true,
         secure: process.env.NODE_ENV === 'production',
         sameSite: 'lax',
-        maxAge: INSTAGRAM_STATE_COOKIE_MAX_AGE_SECONDS,
+        maxAge: CREDENTIAL_DRAFT_TTL_SECONDS,
         path: INSTAGRAM_STATE_COOKIE_PATH,
       })
     } else {
@@ -104,7 +104,7 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
         httpOnly: true,
         secure: process.env.NODE_ENV === 'production',
         sameSite: 'lax',
-        maxAge: INSTAGRAM_STATE_COOKIE_MAX_AGE_SECONDS,
+        maxAge: CREDENTIAL_DRAFT_TTL_SECONDS,
         path: INSTAGRAM_STATE_COOKIE_PATH,
       })
     }

apps/sim/app/api/auth/trello/authorize/route.ts

@@ -8,6 +8,7 @@ import { env } from '@/lib/core/config/env'
 import { getBaseUrl } from '@/lib/core/utils/urls'
 import { isSameOrigin } from '@/lib/core/utils/validation'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { CREDENTIAL_DRAFT_TTL_SECONDS } from '@/lib/credentials/draft-constants'
 import { getCanonicalScopesForProvider } from '@/lib/oauth/utils'
 
 const logger = createLogger('TrelloAuthorize')
@@ -18,7 +19,6 @@ const TRELLO_STATE_COOKIE = 'trello_oauth_state'
 const TRELLO_RETURN_URL_COOKIE = 'trello_return_url'
 const TRELLO_CREDENTIAL_DRAFT_COOKIE = 'trello_credential_draft_id'
 const TRELLO_STATE_COOKIE_PATH = '/api/auth/trello'
-const TRELLO_STATE_COOKIE_MAX_AGE_SECONDS = 60 * 10
 
 export const GET = withRouteHandler(async (request: NextRequest) => {
   try {
@@ -58,15 +58,15 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
       httpOnly: true,
       secure: process.env.NODE_ENV === 'production',
       sameSite: 'lax',
-      maxAge: TRELLO_STATE_COOKIE_MAX_AGE_SECONDS,
+      maxAge: CREDENTIAL_DRAFT_TTL_SECONDS,
       path: TRELLO_STATE_COOKIE_PATH,
     })
     if (draftId) {
       response.cookies.set(TRELLO_CREDENTIAL_DRAFT_COOKIE, draftId, {
         httpOnly: true,
         secure: process.env.NODE_ENV === 'production',
         sameSite: 'lax',
-        maxAge: TRELLO_STATE_COOKIE_MAX_AGE_SECONDS,
+        maxAge: CREDENTIAL_DRAFT_TTL_SECONDS,
         path: TRELLO_STATE_COOKIE_PATH,
       })
     } else {
@@ -80,7 +80,7 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
         httpOnly: true,
         secure: process.env.NODE_ENV === 'production',
         sameSite: 'lax',
-        maxAge: TRELLO_STATE_COOKIE_MAX_AGE_SECONDS,
+        maxAge: CREDENTIAL_DRAFT_TTL_SECONDS,
         path: TRELLO_STATE_COOKIE_PATH,
       })
     } else {

apps/sim/lib/auth/auth.ts

@@ -97,7 +97,7 @@ import {
 import { PlatformEvents } from '@/lib/core/telemetry'
 import { getBaseUrl, isLocalhostUrl, parseOriginList } from '@/lib/core/utils/urls'
 import {
-  OAUTH_CREDENTIAL_DRAFT_CALLBACK_PARAM,
+  parseCredentialDraftIdFromCallbackUrl,
   processCredentialDraft,
 } from '@/lib/credentials/draft-processor'
 import { sendEmail } from '@/lib/messaging/email/mailer'
@@ -529,14 +529,17 @@ export const auth = betterAuth({
           let credentialDraftId: string | undefined
           try {
             const oauthState = await getOAuthState()
-            const rawCallbackUrl = oauthState?.callbackURL
-            if (rawCallbackUrl !== undefined && typeof rawCallbackUrl !== 'string') {
-              throw new Error('OAuth state callback URL must be a string')
-            }
-            credentialDraftId = rawCallbackUrl
-              ? (new URL(rawCallbackUrl).searchParams.get(OAUTH_CREDENTIAL_DRAFT_CALLBACK_PARAM) ??
-                undefined)
-              : undefined
+            credentialDraftId = parseCredentialDraftIdFromCallbackUrl(oauthState?.callbackURL)
+          } catch (error) {
+            logger.error('[account.create.after] Failed to read OAuth credential draft state', {
+              userId: account.userId,
+              providerId: account.providerId,
+              error,
+            })
+            throw error
+          }
+
+          try {
             await processCredentialDraft({
               draftId: credentialDraftId,
               userId: account.userId,

apps/sim/lib/credentials/connect-draft.ts

@@ -5,10 +5,10 @@ import { generateId } from '@sim/utils/id'
 import { and, eq, gt, isNull, lt } from 'drizzle-orm'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { defaultCredentialDisplayName } from '@/lib/credentials/display-name'
+import { CREDENTIAL_DRAFT_TTL_MS } from '@/lib/credentials/draft-constants'
 import { credentialProviderMatchesService, getAllOAuthServices } from '@/lib/oauth/utils'
 
 const logger = createLogger('OAuthConnectDraft')
-const DRAFT_TTL_MS = 15 * 60 * 1000
 
 export type ConnectDraft = typeof pendingCredentialDraft.$inferSelect
 
@@ -63,7 +63,7 @@ export async function createConnectDraft(params: {
   }
 
   const now = new Date()
-  const expiresAt = new Date(now.getTime() + DRAFT_TTL_MS)
+  const expiresAt = new Date(now.getTime() + CREDENTIAL_DRAFT_TTL_MS)
   await db
     .delete(pendingCredentialDraft)
     .where(

apps/sim/lib/credentials/draft-constants.ts

@@ -0,0 +1,2 @@
+export const CREDENTIAL_DRAFT_TTL_MS = 15 * 60 * 1000
+export const CREDENTIAL_DRAFT_TTL_SECONDS = CREDENTIAL_DRAFT_TTL_MS / 1000

apps/sim/lib/credentials/draft-hooks.test.ts

@@ -0,0 +1,45 @@
+/**
+ * @vitest-environment node
+ */
+import { auditMock, auditMockFns, queueTableRows, resetDbChainMock, schemaMock } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  clearDeadFlag: vi.fn(),
+}))
+
+vi.mock('@sim/audit', () => auditMock)
+vi.mock('@/lib/oauth/terminal-errors', () => ({ clearDeadFlag: mocks.clearDeadFlag }))
+vi.mock('@/lib/posthog/server', () => ({ captureServerEvent: vi.fn() }))
+
+import { handleReconnectCredential } from '@/lib/credentials/draft-hooks'
+
+describe('handleReconnectCredential', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    resetDbChainMock()
+  })
+
+  it('audits a reconnect with the credential current name instead of draft presentation', async () => {
+    queueTableRows(schemaMock.credential, [
+      { id: 'credential-1', accountId: null, displayName: 'Renamed Gmail' },
+    ])
+    queueTableRows(schemaMock.credential, [])
+
+    await handleReconnectCredential({
+      draft: { credentialId: 'credential-1' },
+      newAccountId: 'account-new',
+      workspaceId: 'workspace-1',
+      userId: 'user-1',
+      now: new Date('2026-08-14T18:00:00.000Z'),
+    })
+
+    expect(auditMockFns.mockRecordAudit).toHaveBeenCalledWith(
+      expect.objectContaining({
+        resourceId: 'credential-1',
+        resourceName: 'Renamed Gmail',
+        description: 'Reconnected OAuth credential "Renamed Gmail" to a new account',
+      })
+    )
+  })
+})

apps/sim/lib/credentials/draft-hooks.ts

@@ -105,7 +105,7 @@ export async function handleCreateCredentialFromDraft(params: {
  * the dead flag. Callers treat that timestamp as proof the reconnect landed.
  */
 export async function handleReconnectCredential(params: {
-  draft: { credentialId: string | null; workspaceId: string; displayName: string }
+  draft: { credentialId: string | null }
   newAccountId: string
   workspaceId: string
   userId: string
@@ -115,7 +115,11 @@ export async function handleReconnectCredential(params: {
   if (!draft.credentialId) return
 
   const [existingCredential] = await db
-    .select({ id: schema.credential.id, accountId: schema.credential.accountId })
+    .select({
+      id: schema.credential.id,
+      accountId: schema.credential.accountId,
+      displayName: schema.credential.displayName,
+    })
     .from(schema.credential)
     .where(eq(schema.credential.id, draft.credentialId))
     .limit(1)
@@ -125,6 +129,7 @@ export async function handleReconnectCredential(params: {
   }
 
   const oldAccountId = existingCredential.accountId
+  const displayName = existingCredential.displayName
   const accountChanged = oldAccountId !== newAccountId
 
   if (accountChanged) {
@@ -171,10 +176,10 @@ export async function handleReconnectCredential(params: {
     action: AuditAction.CREDENTIAL_RECONNECTED,
     resourceType: AuditResourceType.CREDENTIAL,
     resourceId: draft.credentialId,
-    resourceName: draft.displayName,
+    resourceName: displayName,
     description: accountChanged
-      ? `Reconnected OAuth credential "${draft.displayName}" to a new account`
-      : `Reconnected OAuth credential "${draft.displayName}"`,
+      ? `Reconnected OAuth credential "${displayName}" to a new account`
+      : `Reconnected OAuth credential "${displayName}"`,
     metadata: { oldAccountId, newAccountId },
   })
 

apps/sim/lib/credentials/draft-processor.test.ts

@@ -20,7 +20,10 @@ vi.mock('@/lib/credentials/draft-hooks', () => ({
   handleReconnectCredential: mockHandleReconnectCredential,
 }))
 
-import { processCredentialDraft } from '@/lib/credentials/draft-processor'
+import {
+  parseCredentialDraftIdFromCallbackUrl,
+  processCredentialDraft,
+} from '@/lib/credentials/draft-processor'
 
 function credentialDraft(id: string, workspaceId: string) {
   return {
@@ -103,3 +106,20 @@ describe('processCredentialDraft', () => {
     expect(dbChainMockFns.delete).not.toHaveBeenCalled()
   })
 })
+
+describe('parseCredentialDraftIdFromCallbackUrl', () => {
+  it('extracts the exact draft id from a valid callback URL', () => {
+    expect(
+      parseCredentialDraftIdFromCallbackUrl(
+        'https://sim.test/oauth/credential-connected?credentialDraftId=draft-1'
+      )
+    ).toBe('draft-1')
+  })
+
+  it('fails closed for malformed or non-string callback state', () => {
+    expect(() => parseCredentialDraftIdFromCallbackUrl({})).toThrow(
+      'OAuth state callback URL must be a string'
+    )
+    expect(() => parseCredentialDraftIdFromCallbackUrl('not a URL')).toThrow()
+  })
+})

apps/sim/lib/credentials/draft-processor.ts

@@ -11,6 +11,15 @@ const logger = createLogger('CredentialDraftProcessor')
 
 export const OAUTH_CREDENTIAL_DRAFT_CALLBACK_PARAM = 'credentialDraftId'
 
+/** Extracts a draft binding from Better Auth state and rejects malformed callback state. */
+export function parseCredentialDraftIdFromCallbackUrl(callbackUrl: unknown): string | undefined {
+  if (callbackUrl === undefined) return undefined
+  if (typeof callbackUrl !== 'string') {
+    throw new Error('OAuth state callback URL must be a string')
+  }
+  return new URL(callbackUrl).searchParams.get(OAUTH_CREDENTIAL_DRAFT_CALLBACK_PARAM) ?? undefined
+}
+
 interface ProcessCredentialDraftParams {
   draftId?: string
   userId: string