fix(credentials): serialize enrollment revocation

Author: TheodoreSpeaks

apps/sim/lib/credential-groups/enrollments.ts

@@ -11,7 +11,7 @@ import {
 import { getErrorMessage } from '@sim/utils/errors'
 import { generateId } from '@sim/utils/id'
 import { normalizeEmail, truncate } from '@sim/utils/string'
-import { and, count, desc, eq, inArray, lt, or } from 'drizzle-orm'
+import { and, count, desc, eq, inArray, lt, or, sql } from 'drizzle-orm'
 import { renderCredentialGroupInvitationEmail } from '@/components/emails/render'
 import type {
   CredentialGroupEnrollment,
@@ -29,6 +29,7 @@ import {
   getCredentialGroupProviderFromProviderId,
   isCredentialGroupProvider,
 } from '@/lib/credential-groups/providers'
+import type { DbOrTx } from '@/lib/db/types'
 import { sendEmail } from '@/lib/messaging/email/mailer'
 import { getFromEmailAddress } from '@/lib/messaging/email/utils'
 import { getBrandConfig } from '@/ee/whitelabeling'
@@ -85,6 +86,17 @@ export interface CredentialGroupOAuthContext {
   options: CredentialGroupOptionConfig[]
 }
 
+/** Serializes OAuth grant persistence and administrative revocation for one enrollment. */
+export async function lockCredentialGroupEnrollmentLifecycle(
+  executor: DbOrTx,
+  enrollmentId: string
+): Promise<void> {
+  if (!enrollmentId.trim()) throw new Error('Credential group enrollment ID is required')
+  await executor.execute(
+    sql`SELECT pg_advisory_xact_lock(hashtextextended(${`credential-group-enrollment:${enrollmentId}`}, 0))`
+  )
+}
+
 export class CredentialGroupEnrollmentError extends Error {
   constructor(
     message: string,
@@ -524,6 +536,7 @@ export async function revokeCredentialGroupEnrollment(
   if (!existing) throw new CredentialGroupEnrollmentError('Enrollment not found', 404)
 
   return db.transaction(async (tx) => {
+    await lockCredentialGroupEnrollmentLifecycle(tx, enrollmentId)
     const now = new Date()
     const [revoked] = await tx
       .update(credentialGroupEnrollment)

apps/sim/lib/credential-groups/oauth.test.ts

@@ -0,0 +1,100 @@
+/**
+ * @vitest-environment node
+ */
+import { dbChainMockFns, resetDbChainMock } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { adapter } = vi.hoisted(() => ({
+  adapter: {
+    provider: 'gmail' as const,
+    requiresRefreshToken: true,
+    getPolicy: vi.fn(),
+    prepareAuthorization: vi.fn(),
+    exchangeAndVerify: vi.fn(),
+    hasRequiredScopes: vi.fn(),
+    refreshToken: vi.fn(),
+    isTerminalRefreshError: vi.fn(),
+  },
+}))
+
+vi.mock('@/lib/credential-groups/provider-registry', () => ({
+  getCredentialGroupProviderAdapter: () => adapter,
+}))
+
+import { completeCredentialGroupOAuth } from '@/lib/credential-groups/oauth'
+
+const POLICY = {
+  provider: 'gmail' as const,
+  providerId: 'google-email',
+  authorizationAppId: 'google:client',
+  requiredScopes: ['openid', 'https://www.googleapis.com/auth/gmail.modify'],
+  scopeVersion: 1,
+}
+
+const CONTEXT = {
+  enrollmentId: 'enrollment-1',
+  credentialGroupId: 'group-1',
+  workspaceId: 'workspace-1',
+  workspaceName: 'Workspace',
+  workspaceOwnerId: 'owner-1',
+  email: 'person@example.com',
+  enrollmentStatus: 'in_progress' as const,
+  option: {
+    id: 'option-1',
+    provider: 'gmail' as const,
+    label: 'Gmail',
+    required: true,
+    status: 'active' as const,
+  },
+  options: [],
+}
+
+describe('credential group OAuth persistence', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    resetDbChainMock()
+    adapter.getPolicy.mockResolvedValue(POLICY)
+    adapter.exchangeAndVerify.mockResolvedValue({
+      providerId: POLICY.providerId,
+      providerSubjectId: 'google-subject-1',
+      providerTenantId: null,
+      displayName: 'person@example.com',
+      metadata: { email: 'person@example.com' },
+      accessToken: 'access-token',
+      refreshToken: 'refresh-token',
+      grantedScopes: POLICY.requiredScopes,
+      accessTokenExpiresAt: new Date('2026-08-14T00:00:00Z'),
+      refreshTokenExpiresAt: null,
+    })
+  })
+
+  it('does not reactivate a credential after its enrollment is revoked', async () => {
+    dbChainMockFns.limit.mockResolvedValueOnce([{ status: 'revoked' }])
+
+    await expect(
+      completeCredentialGroupOAuth(
+        CONTEXT,
+        {
+          state: 'state-1',
+          provider: 'gmail',
+          nonceHash: 'nonce-hash',
+          enrollmentId: CONTEXT.enrollmentId,
+          credentialGroupId: CONTEXT.credentialGroupId,
+          optionId: CONTEXT.option.id,
+          authorizationAppId: POLICY.authorizationAppId,
+          scopeVersion: POLICY.scopeVersion,
+          requiredScopes: POLICY.requiredScopes,
+          redirectUri: 'https://sim.ai/api/credential-groups/oauth/gmail/callback',
+          codeVerifier: 'verifier',
+          invitationToken: 'invitation-token',
+          createdAt: Date.now(),
+        },
+        'authorization-code'
+      )
+    ).rejects.toThrow('This account invitation was revoked.')
+
+    expect(dbChainMockFns.execute).toHaveBeenCalledTimes(2)
+    expect(dbChainMockFns.update).not.toHaveBeenCalled()
+    expect(dbChainMockFns.insert).not.toHaveBeenCalled()
+  })
+})

apps/sim/lib/credential-groups/oauth.ts

@@ -1,8 +1,11 @@
 import { db } from '@sim/db'
 import { credential, credentialGroupEnrollment } from '@sim/db/schema'
 import { generateId } from '@sim/utils/id'
-import { and, eq, sql } from 'drizzle-orm'
-import type { CredentialGroupOAuthContext } from '@/lib/credential-groups/enrollments'
+import { and, eq, ne, sql } from 'drizzle-orm'
+import {
+  type CredentialGroupOAuthContext,
+  lockCredentialGroupEnrollmentLifecycle,
+} from '@/lib/credential-groups/enrollments'
 import {
   type CredentialGroupOAuthAttempt,
   createCredentialGroupOAuthAttempt,
@@ -98,9 +101,19 @@ async function persistGrant(
   }
 
   await db.transaction(async (tx) => {
+    await lockCredentialGroupEnrollmentLifecycle(tx, context.enrollmentId)
     await tx.execute(
       sql`SELECT pg_advisory_xact_lock(hashtextextended(${`credential-group-oauth:${context.enrollmentId}:${context.option.id}`}, 0))`
     )
+    const [enrollment] = await tx
+      .select({ status: credentialGroupEnrollment.status })
+      .from(credentialGroupEnrollment)
+      .where(eq(credentialGroupEnrollment.id, context.enrollmentId))
+      .limit(1)
+    if (!enrollment || enrollment.status === 'revoked') {
+      throw new CredentialGroupOAuthError('This account invitation was revoked.', 409)
+    }
+
     const [existing] = await tx
       .select({
         id: credential.id,
@@ -193,9 +206,16 @@ async function persistGrant(
         completedAt: null,
         updatedAt: now,
       })
-      .where(eq(credentialGroupEnrollment.id, context.enrollmentId))
+      .where(
+        and(
+          eq(credentialGroupEnrollment.id, context.enrollmentId),
+          ne(credentialGroupEnrollment.status, 'revoked')
+        )
+      )
       .returning({ id: credentialGroupEnrollment.id })
-    if (!updatedEnrollment) throw new Error('Credential group enrollment update returned no row')
+    if (!updatedEnrollment) {
+      throw new CredentialGroupOAuthError('This account invitation was revoked.', 409)
+    }
   })
 }