fix(credentials): serialize enrollment readiness

Author: TheodoreSpeaks

apps/sim/app/api/credential-groups/oauth/[provider]/callback/route.test.ts

@@ -97,4 +97,16 @@ describe('credential group OAuth callback', () => {
     expect(mismatchedResponse.status).toBe(400)
     expect(mocks.completeOAuth).not.toHaveBeenCalled()
   })
+
+  it('returns an unavailable enrollment redirect when the invitation was revoked in flight', async () => {
+    mocks.authenticate.mockResolvedValue(null)
+
+    const response = await GET(request('state=state-1&code=code-1'), context)
+
+    expect(response.status).toBe(307)
+    expect(response.headers.get('location')).toBe(
+      '/credential-groups/enroll/invitation-token?oauth=unavailable'
+    )
+    expect(mocks.completeOAuth).not.toHaveBeenCalled()
+  })
 })

apps/sim/app/api/credential-groups/oauth/[provider]/callback/route.ts

@@ -54,10 +54,9 @@ export const GET = withRouteHandler(
 
     const principal = await authenticateCredentialGroupEnrollment(attempt.invitationToken)
     if (!principal) {
-      return NextResponse.json(
-        { error: 'Invitation is invalid or expired.' },
-        { status: 404, headers: { 'Cache-Control': 'no-store' } }
-      )
+      return createCredentialGroupEnrollmentRedirect(attempt.invitationToken, {
+        oauth: 'unavailable',
+      })
     }
 
     try {

apps/sim/ee/credential-groups/components/credential-group-detail.tsx

@@ -57,7 +57,6 @@ function getEnrollmentStatus(
   const needsReauthorization = enrollment.connections.some(
     (connection) => connection.status === 'needs_reauth'
   )
-  if (enrollment.expired) return { label: 'Expired', invalid: true }
   if (needsReauthorization) return { label: 'Reconnect needed', invalid: false }
   const connectedProviders = new Set(
     enrollment.connections
@@ -71,6 +70,7 @@ function getEnrollmentStatus(
     return { label: 'Connected', invalid: false }
   }
   if (enrollment.status === 'completed') return { label: 'In progress', invalid: false }
+  if (enrollment.expired) return { label: 'Expired', invalid: true }
   if (enrollment.status === 'in_progress') return { label: 'In progress', invalid: false }
   return { label: 'Invited', invalid: false }
 }

apps/sim/lib/credential-groups/enrollments.test.ts

@@ -263,4 +263,64 @@ describe('completeCredentialGroupEnrollment', () => {
     expect(dbChainMockFns.execute).toHaveBeenCalledTimes(1)
     expect(dbChainMockFns.update).not.toHaveBeenCalled()
   })
+
+  it('refuses completion when a connection needs reauthorization under the row locks', async () => {
+    queueTableRows(schemaMock.credentialGroupEnrollment, [
+      {
+        enrollment: { ...ENROLLMENT, status: 'in_progress' },
+        groupId: 'group-1',
+        groupName: 'Group',
+        groupStatus: 'active',
+        options: [
+          {
+            id: 'option-1',
+            provider: 'gmail',
+            label: 'Gmail',
+            required: true,
+            status: 'active',
+          },
+        ],
+        workspaceId: 'workspace-1',
+        workspaceName: 'Workspace',
+        workspaceOwnerId: 'owner-1',
+        inviterName: 'Inviter',
+      },
+    ])
+    queueTableRows(schemaMock.credentialGroupEnrollment, [
+      {
+        status: 'in_progress',
+        invitationTokenHash: ENROLLMENT.invitationTokenHash,
+        invitationExpiresAt: ENROLLMENT.invitationExpiresAt,
+      },
+    ])
+    queueTableRows(schemaMock.credentialGroup, [
+      {
+        status: 'active',
+        options: [
+          {
+            id: 'option-1',
+            provider: 'gmail',
+            label: 'Gmail',
+            required: true,
+            status: 'active',
+          },
+        ],
+      },
+    ])
+    queueTableRows(schemaMock.credential, [
+      {
+        optionId: 'option-1',
+        status: 'needs_reauth',
+        scopeVersion: 1,
+        authorizationAppId: 'google:client',
+        grantedScopes: ['scope'],
+        grantedAt: new Date('2026-08-11T12:05:00.000Z'),
+      },
+    ])
+
+    await expect(completeCredentialGroupEnrollment('invitation-token')).resolves.toBe(false)
+
+    expect(dbChainMockFns.update).not.toHaveBeenCalled()
+    expect(adapter.getPolicy).not.toHaveBeenCalled()
+  })
 })

apps/sim/lib/credential-groups/enrollments.ts

@@ -801,18 +801,9 @@ async function completeResolvedCredentialGroupEnrollment(
   row: NonNullable<Awaited<ReturnType<typeof resolvePublicEnrollmentRowByIdentity>>>,
   identity: PublicCredentialGroupEnrollmentIdentity
 ): Promise<boolean | null> {
-  const enrollment = await buildPublicCredentialGroupEnrollment(row)
-  const activeOptions = enrollment.options.filter((option) => option.status === 'active')
-  const allConnected =
-    activeOptions.length > 0 &&
-    activeOptions.every(
-      (option) => option.connections.length === 1 && option.connections[0]?.status === 'connected'
-    )
-  if (!allConnected) return false
-
-  const now = new Date()
   return db.transaction(async (tx) => {
     await lockCredentialGroupEnrollmentLifecycle(tx, row.enrollment.id)
+    const now = new Date()
     const [current] = await tx
       .select({
         status: credentialGroupEnrollment.status,
@@ -832,6 +823,68 @@ async function completeResolvedCredentialGroupEnrollment(
       return null
     }
 
+    const [group] = await tx
+      .select({
+        status: credentialGroup.status,
+        options: credentialGroup.options,
+      })
+      .from(credentialGroup)
+      .where(
+        and(
+          eq(credentialGroup.id, identity.credentialGroupId),
+          eq(credentialGroup.workspaceId, identity.workspaceId)
+        )
+      )
+      .limit(1)
+      .for('update')
+    if (!group || group.status !== 'active') return null
+
+    const activeOptions = group.options.filter((option) => option.status === 'active')
+    if (activeOptions.length === 0) return false
+    const connections = await tx
+      .select({
+        optionId: credential.credentialGroupOptionId,
+        status: credential.managedOauthStatus,
+        scopeVersion: credential.managedOauthScopeVersion,
+        authorizationAppId: credential.authorizationAppId,
+        grantedScopes: credential.grantedScopes,
+        grantedAt: credential.grantedAt,
+      })
+      .from(credential)
+      .where(
+        and(
+          eq(credential.type, 'managed_oauth'),
+          eq(credential.credentialGroupEnrollmentId, row.enrollment.id)
+        )
+      )
+      .for('update')
+
+    for (const option of activeOptions) {
+      if (!isCredentialGroupProvider(option.provider)) {
+        throw new Error(`Unsupported Credential Group provider: ${option.provider}`)
+      }
+      const matchingConnections = connections.filter(
+        (connection) => connection.optionId === option.id
+      )
+      if (matchingConnections.length !== 1) return false
+      const [connection] = matchingConnections
+      if (!connection || connection.status !== 'active' || !connection.grantedAt) return false
+
+      const adapter = getCredentialGroupProviderAdapter(option.provider)
+      const policy = await adapter.getPolicy(option, {
+        workspaceId: identity.workspaceId,
+        credentialGroupId: identity.credentialGroupId,
+        executor: tx,
+      })
+      if (
+        connection.authorizationAppId !== policy.authorizationAppId ||
+        connection.scopeVersion !== policy.scopeVersion ||
+        !adapter.hasRequiredScopes(connection.grantedScopes ?? [], policy.requiredScopes)
+      ) {
+        return false
+      }
+    }
+
     const [completed] = await tx
       .update(credentialGroupEnrollment)
       .set({ status: 'completed', completedAt: now, updatedAt: now })