fix(credentials): bind OAuth links to connection intent

Author: TheodoreSpeaks

apps/sim/app/api/auth/oauth2/authorize/route.test.ts

@@ -214,9 +214,7 @@ describe('OAuth2 authorize route', () => {
         })
       )
       expect(dbChainMockFns.onConflictDoUpdate).toHaveBeenCalledWith(
-        expect.objectContaining({
-          set: expect.objectContaining({ credentialId: null }),
-        })
+        expect.objectContaining({ setWhere: expect.anything() })
       )
     })
 
@@ -232,11 +230,12 @@ describe('OAuth2 authorize route', () => {
       )
     })
 
-    it('nulls out credentialId in the upsert set so a stale reconnect draft cannot leak into a plain connect', async () => {
+    it('does not overwrite a reconnect intent when refreshing a plain connect', async () => {
       await GET(authorizeRequest({ providerId: 'google-email', workspaceId: WORKSPACE_ID }))
 
-      const [{ set }] = dbChainMockFns.onConflictDoUpdate.mock.calls[0]
-      expect(set).toHaveProperty('credentialId', null)
+      const [{ set, setWhere }] = dbChainMockFns.onConflictDoUpdate.mock.calls[0]
+      expect(set).not.toHaveProperty('credentialId')
+      expect(setWhere).toBeDefined()
     })
 
     it('rejects an OAuth client that is not configured for the deployment', async () => {
@@ -283,7 +282,7 @@ describe('OAuth2 authorize route', () => {
   })
 
   describe('reconnect (credentialId present)', () => {
-    it('creates a reconnect draft carrying credentialId in values and upsert set', async () => {
+    it('creates a reconnect draft and guards conflict refreshes by intent', async () => {
       mockGetCredentialActorContext.mockResolvedValue(oauthCredentialActor())
 
       const response = await GET(
@@ -304,9 +303,7 @@ describe('OAuth2 authorize route', () => {
         expect.objectContaining({ credentialId: CREDENTIAL_ID })
       )
       expect(dbChainMockFns.onConflictDoUpdate).toHaveBeenCalledWith(
-        expect.objectContaining({
-          set: expect.objectContaining({ credentialId: CREDENTIAL_ID }),
-        })
+        expect.objectContaining({ setWhere: expect.anything() })
       )
     })
 

apps/sim/app/api/v2/credential-connections/route.test.ts

@@ -12,6 +12,7 @@ import {
 import { NextRequest } from 'next/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { WorkspaceApiKeyScopeAuthorizationError } from '@/lib/core/application'
+import { OrchestrationError } from '@/lib/core/orchestration/types'
 
 const mocks = vi.hoisted(() => ({ execute: vi.fn() }))
 
@@ -147,4 +148,33 @@ describe('POST /api/v2/credential-connections', () => {
       error: { code: 'NOT_FOUND', message: 'Workspace not found' },
     })
   })
+
+  it('returns a conflict when another intent already owns the active provider draft', async () => {
+    mocks.execute.mockRejectedValueOnce(
+      new OrchestrationError(
+        'conflict',
+        'A different OAuth connection flow is already active for this provider'
+      )
+    )
+
+    const response = await POST(
+      new NextRequest('http://localhost:3000/api/v2/credential-connections', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          workspaceId: WORKSPACE_ID,
+          providerId: 'google-email',
+          displayName: 'Work Gmail',
+        }),
+      })
+    )
+
+    expect(response.status).toBe(409)
+    expect(await response.json()).toEqual({
+      error: {
+        code: 'CONFLICT',
+        message: 'A different OAuth connection flow is already active for this provider',
+      },
+    })
+  })
 })

apps/sim/lib/credentials/connect-draft.test.ts

@@ -19,7 +19,7 @@ describe('createConnectDraft', () => {
     mockGenerateId.mockReturnValue('new-draft-id')
   })
 
-  it('preserves the active draft ID when refreshing the same connection intent', async () => {
+  it('refreshes the expiry without changing an active connection intent', async () => {
     const expiresAt = new Date('2026-08-13T20:15:00.000Z')
     dbChainMockFns.returning.mockResolvedValueOnce([{ id: 'active-draft-id', expiresAt }])
 
@@ -34,13 +34,29 @@ describe('createConnectDraft', () => {
       expect.objectContaining({ id: 'new-draft-id' })
     )
     const conflict = dbChainMockFns.onConflictDoUpdate.mock.calls[0]?.[0] as
-      | { set?: Record<string, unknown> }
+      | { set?: Record<string, unknown>; setWhere?: unknown }
       | undefined
     expect(conflict?.set).not.toHaveProperty('id')
-    expect(conflict?.set).toMatchObject({
-      displayName: 'Work Gmail',
-      credentialId: null,
-    })
+    expect(conflict?.set).not.toHaveProperty('displayName')
+    expect(conflict?.set).not.toHaveProperty('credentialId')
+    expect(conflict?.setWhere).toBeDefined()
     expect(result).toEqual({ id: 'active-draft-id', expiresAt })
   })
+
+  it('fails fast when an active draft has a different connection intent', async () => {
+    dbChainMockFns.returning.mockResolvedValueOnce([])
+
+    await expect(
+      createConnectDraft({
+        userId: 'user-1',
+        workspaceId: 'workspace-1',
+        providerId: 'google-email',
+        credentialId: 'credential-1',
+        displayName: 'Existing Gmail',
+      })
+    ).rejects.toMatchObject({
+      code: 'conflict',
+      message: 'A different OAuth connection flow is already active for this provider',
+    })
+  })
 })

apps/sim/lib/credentials/connect-draft.ts

@@ -2,7 +2,8 @@ import { db } from '@sim/db'
 import { credential, pendingCredentialDraft, user } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { generateId } from '@sim/utils/id'
-import { and, eq, gt, lt } from 'drizzle-orm'
+import { and, eq, gt, isNull, lt } from 'drizzle-orm'
+import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { defaultCredentialDisplayName } from '@/lib/credentials/display-name'
 import { credentialProviderMatchesService, getAllOAuthServices } from '@/lib/oauth/utils'
 
@@ -84,14 +85,22 @@ export async function createConnectDraft(params: {
         pendingCredentialDraft.providerId,
         pendingCredentialDraft.workspaceId,
       ],
-      // credentialId must be written on BOTH paths: a plain connect that reuses a
-      // stale reconnect draft row would otherwise silently rebind the old
-      // credential instead of creating a new one.
-      set: { displayName, credentialId: credentialId ?? null, expiresAt, createdAt: now },
+      set: { expiresAt, createdAt: now },
+      setWhere: and(
+        eq(pendingCredentialDraft.displayName, displayName),
+        credentialId
+          ? eq(pendingCredentialDraft.credentialId, credentialId)
+          : isNull(pendingCredentialDraft.credentialId)
+      ),
     })
     .returning({ id: pendingCredentialDraft.id, expiresAt: pendingCredentialDraft.expiresAt })
 
-  if (!draft) throw new Error('OAuth connect draft insert returned no row')
+  if (!draft) {
+    throw new OrchestrationError(
+      'conflict',
+      'A different OAuth connection flow is already active for this provider'
+    )
+  }
 
   logger.info('Created OAuth connect credential draft', {
     userId,