fix(dataverse): request the per-environment OAuth scope

Dataverse's API resource is the customer's own environment host. The provider
declared a static `https://dynamics.microsoft.com/user_impersonation`, which is
not an Entra Application ID URI — the Dataverse first-party app
(00000007-0000-0000-c000-000000000000) publishes `admin.services.crm.dynamics.com`,
its regional siblings, and `*.crm.dynamics.com` wildcards, and nothing matching
what we sent. Entra rejects it at /authorize, so this integration has never been
able to complete consent.

There is no tenant-agnostic alternative: the data-API resource *is* the org URL,
which is why the scope has to be built per connection rather than declared.

A service can now declare `resourceUrl`, and the connect modal collects that host,
validates it against the service's allowed domains, and sends
`origin + scopeSuffix` in the link request — Better Auth's link route replaces the
registered scopes with the body's, which is what makes this possible without a
second provider registration. Only Microsoft Dataverse declares it; the other 60
services take an unchanged path.

The three initiation surfaces that cannot collect a tenant host fail closed rather
than minting a token with no API audience: the desktop hand-off (its scope is
id-shaped, validated against ID_PATTERN in a separately released Electron binary,
so an installed shell would drop a new field), the Copilot auth-link tool (its
schema is generated from the Mothership catalog), and the authorize route the
desktop path redirects through.

`getDataverseBaseUrl` now shares one host list with the scope builder. Those had
drifted into separate copies, and the failure mode is quiet: a new Microsoft
sovereign cloud added on one side only produces a token whose audience the tools
then refuse to send to.

Not fixed here, and the integration stays non-functional until it is: the shared
Entra app registration needs the Dynamics CRM delegated permission before any of
these scopes can be consented to.

Author: waleedlatif1

apps/sim/app/api/auth/oauth2/authorize/route.test.ts

@@ -37,6 +37,9 @@ vi.mock('@/lib/credentials/access', () => ({
 
 vi.mock('@/lib/oauth/utils', () => ({
   getAllOAuthServices: vi.fn(() => [{ providerId: 'google-email', name: 'Gmail' }]),
+  // Ordinary providers declare no `resourceUrl`, so the resource-scoped guard
+  // never fires for them and the authorize flow proceeds as before.
+  getServiceConfigByProviderId: vi.fn(() => ({ providerId: 'google-email', name: 'Gmail' })),
   // Real implementation: a credential id matches its service's OAuth id, an
   // alternate authorization server, or the family's service-account id.
   credentialProviderMatchesService: (

apps/sim/app/api/auth/oauth2/authorize/route.ts

@@ -8,6 +8,7 @@ import { getBaseUrl } from '@/lib/core/utils/urls'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { getCredentialActorContext } from '@/lib/credentials/access'
 import { createConnectDraft } from '@/lib/credentials/connect-draft'
+import { getServiceConfigByProviderId } from '@/lib/oauth/utils'
 import { checkWorkspaceAccess } from '@/lib/workspaces/permissions/utils'
 
 const logger = createLogger('OAuth2Authorize')
@@ -103,6 +104,21 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
 
     requireConfiguredOAuthClient(providerId)
 
+    /**
+     * A service whose OAuth resource is the customer's own tenant host has no
+     * static resource scope, and this endpoint has no way to collect one — the
+     * desktop hand-off carries only id-shaped values. Linking anyway would mint
+     * a token with no Dataverse audience, which surfaces much later as an opaque
+     * 401 from the API rather than a problem with the connection.
+     */
+    if (getServiceConfigByProviderId(providerId)?.resourceUrl) {
+      logger.warn('Blocked OAuth2 authorize for a resource-scoped provider', {
+        providerId,
+        userId,
+      })
+      return NextResponse.redirect(`${baseUrl}/workspace?error=oauth_resource_url_required`)
+    }
+
     // Create the draft before initiating the link so it is guaranteed to exist
     // (and freshly clocked) when the OAuth callback's `account.create.after`
     // hook runs. If this throws, we never start the OAuth flow.

apps/sim/app/desktop/connect/page.tsx

@@ -3,6 +3,7 @@ import { headers } from 'next/headers'
 import { redirect } from 'next/navigation'
 import { auth } from '@/lib/auth'
 import { getBaseUrl } from '@/lib/core/utils/urls'
+import { getServiceConfigByProviderId } from '@/lib/oauth/utils'
 import { isValidHandoffState, parseLoopbackPort } from '@/app/desktop/auth/validation'
 import { DesktopHandoffShell } from '@/app/desktop/components/desktop-handoff-shell'
 import { ConnectLauncher } from '@/app/desktop/connect/connect-launcher'
@@ -34,6 +35,21 @@ function InvalidRequest() {
   )
 }
 
+/**
+ * Shown for a service whose OAuth resource is the customer's own tenant host.
+ * The desktop hand-off carries only id-shaped values, so that host cannot reach
+ * this page, and linking without it mints a token with no API audience — an
+ * opaque 401 later rather than a visible failure now.
+ */
+function ResourceUrlUnsupported() {
+  return (
+    <DesktopHandoffShell
+      title='Connect this account from your browser'
+      description='This integration needs its environment URL, which the desktop app cannot pass along. Open Sim in your browser and connect it from Settings → Integrations.'
+    />
+  )
+}
+
 /**
  * Desktop OAuth-connect landing. The desktop app opens this page in the
  * system browser with the provider to connect, a one-time state, and the port
@@ -98,6 +114,10 @@ export default async function DesktopConnectPage({ searchParams }: DesktopConnec
   // draft — including reconnect rebinding when a credentialId rides along.
   // Modal-initiated connects have no workspaceId here (the desktop app already
   // created the draft) and use the plain link flow below.
+  if (getServiceConfigByProviderId(providerId)?.resourceUrl) {
+    return <ResourceUrlUnsupported />
+  }
+
   if (workspaceId) {
     const authorize = new URL('/api/auth/oauth2/authorize', getBaseUrl())
     authorize.searchParams.set('providerId', providerId)

apps/sim/app/workspace/[workspaceId]/components/connect-oauth-modal/connect-oauth-modal.tsx

@@ -25,6 +25,7 @@ import {
   type OAuthProvider,
   parseProvider,
 } from '@/lib/oauth'
+import { resolveResourceOrigin } from '@/lib/oauth/resource-url'
 import { getScopeDescription, getServiceConfigByProviderId } from '@/lib/oauth/utils'
 import { useCreateCredentialDraft, useWorkspaceCredentials } from '@/hooks/queries/credentials'
 import { useConnectOAuthService } from '@/hooks/queries/oauth/oauth-connections'
@@ -157,6 +158,23 @@ export function ConnectOAuthModal(props: ConnectOAuthModalProps) {
   const [selectedProviderId, setSelectedProviderId] = useState<string | null>(null)
   const providerId = selectedProviderId ?? declaredProviderId
 
+  const resourceConfig = getServiceConfigByProviderId(providerId)?.resourceUrl
+  const [resourceUrl, setResourceUrl] = useState('')
+  const resolvedResource = resourceConfig
+    ? resolveResourceOrigin(resourceUrl, resourceConfig)
+    : undefined
+  /**
+   * Blocks submit outright: a draft credential is written before the provider
+   * hand-off, so letting a bad host through would orphan one. The message is
+   * withheld until the field has content, so an untouched required field is not
+   * pre-marked as an error.
+   */
+  const resourceIncomplete = Boolean(resolvedResource && !resolvedResource.ok)
+  const resourceError =
+    resourceUrl.trim() && resolvedResource && !resolvedResource.ok
+      ? resolvedResource.error
+      : undefined
+
   const [displayName, setDisplayName] = useState('')
   const [description, setDescription] = useState('')
   const [validationError, setValidationError] = useState<string | null>(null)
@@ -226,6 +244,7 @@ export function ConnectOAuthModal(props: ConnectOAuthModalProps) {
     if (!open) {
       prefilled.current = false
       setSelectedProviderId(null)
+      setResourceUrl('')
       return
     }
     if (!isConnect || prefilled.current || credentialsLoading) return
@@ -319,6 +338,7 @@ export function ConnectOAuthModal(props: ConnectOAuthModalProps) {
       await connectOAuthService.mutateAsync({
         providerId,
         callbackURL: callbackURL.toString(),
+        resourceUrl,
       })
       handleClose()
     } catch (err: unknown) {
@@ -330,8 +350,8 @@ export function ConnectOAuthModal(props: ConnectOAuthModalProps) {
 
   const isPending = (isConnect && createDraft.isPending) || connectOAuthService.isPending
   const isDisabled = isConnect
-    ? !displayName.trim() || isPending || Boolean(existingCredential)
-    : isPending
+    ? !displayName.trim() || isPending || Boolean(existingCredential) || resourceIncomplete
+    : isPending || resourceIncomplete
 
   const displayNameError =
     validationError ??
@@ -358,13 +378,30 @@ export function ConnectOAuthModal(props: ConnectOAuthModalProps) {
             type='dropdown'
             title='Environment'
             value={providerId}
-            onChange={setSelectedProviderId}
+            onChange={(value) => {
+              setSelectedProviderId(value)
+              setResourceUrl('')
+            }}
             options={authServerOptions}
             align='start'
             hint={authServerHint}
           />
         )}
 
+        {resourceConfig && (
+          <ChipModalField
+            type='input'
+            title={resourceConfig.title}
+            value={resourceUrl}
+            onChange={setResourceUrl}
+            placeholder={resourceConfig.placeholder}
+            autoComplete='off'
+            required
+            hint={resourceConfig.hint}
+            error={resourceError}
+          />
+        )}
+
         {isConnect && (
           <ChipModalField
             type='input'

apps/sim/hooks/queries/oauth/oauth-connections.ts

@@ -12,6 +12,9 @@ import {
 import { client } from '@/lib/auth/auth-client'
 import { getDesktopBridge } from '@/lib/desktop'
 import { OAUTH_PROVIDERS, type OAuthServiceConfig } from '@/lib/oauth'
+import { resolveResourceOrigin } from '@/lib/oauth/resource-url'
+import type { OAuthResourceUrlConfig } from '@/lib/oauth/types'
+import { getServiceConfigByProviderId } from '@/lib/oauth/utils'
 
 const logger = createLogger('OAuthConnectionsQuery')
 
@@ -140,6 +143,34 @@ export function useOAuthConnections() {
 interface ConnectServiceParams {
   providerId: string
   callbackURL: string
+  /**
+   * Tenant host for a service whose OAuth resource is per-customer, as declared
+   * by {@link OAuthServiceConfig.resourceUrl}. Ignored by every other provider.
+   */
+  resourceUrl?: string
+}
+
+/**
+ * Builds the scope list for a service whose OAuth resource is per-tenant.
+ *
+ * Better Auth's link route *replaces* the provider's registered scopes with the
+ * ones in the request body, so this returns the full list — the static scopes
+ * plus the resource scope naming the validated origin.
+ *
+ * @throws {Error} when the URL is missing or is not one of the service's hosts.
+ *   Reaching here with a bad value means the modal's own check was bypassed, so
+ *   failing is right; the alternative is an opaque error from the provider.
+ */
+function resolveConnectScopes(
+  service: OAuthServiceConfig,
+  resourceConfig: OAuthResourceUrlConfig,
+  resourceUrl: string | undefined
+): string[] {
+  const resolved = resolveResourceOrigin(resourceUrl, resourceConfig)
+  if (!resolved.ok) {
+    throw new Error(resolved.error)
+  }
+  return [...service.scopes, `${resolved.origin}${resourceConfig.scopeSuffix}`]
 }
 
 /**
@@ -150,7 +181,9 @@ export function useConnectOAuthService() {
   const queryClient = useQueryClient()
 
   return useMutation({
-    mutationFn: async ({ providerId, callbackURL }: ConnectServiceParams) => {
+    mutationFn: async ({ providerId, callbackURL, resourceUrl }: ConnectServiceParams) => {
+      const service = getServiceConfigByProviderId(providerId)
+      const resourceConfig = service?.resourceUrl
       if (providerId === 'trello') {
         const returnUrl = encodeURIComponent(callbackURL)
         window.location.href = `/api/auth/trello/authorize?returnUrl=${returnUrl}`
@@ -177,6 +210,19 @@ export function useConnectOAuthService() {
       // which refreshes caches and shows the connected toast.
       const desktopBridge = getDesktopBridge()
       if (desktopBridge?.beginOAuthConnect) {
+        /**
+         * The desktop hand-off carries only an id-shaped scope
+         * (`DesktopOAuthConnectScope`), validated against `ID_PATTERN` in the
+         * Electron main process, and ships as a separately released binary — so
+         * an installed shell would silently drop a tenant URL even after the
+         * bridge contract gained one. Fail with a route the user can actually
+         * take rather than starting a flow that cannot request the right scope.
+         */
+        if (resourceConfig) {
+          throw new Error(
+            `Connecting ${service?.name ?? providerId} is not supported in the desktop app yet — connect it from Sim in your browser.`
+          )
+        }
         const opened = await desktopBridge.beginOAuthConnect(providerId)
         if (!opened) {
           throw new Error('Could not open your browser to connect this account.')
@@ -187,6 +233,9 @@ export function useConnectOAuthService() {
       await client.oauth2.link({
         providerId,
         callbackURL,
+        ...(resourceConfig && service
+          ? { scopes: resolveConnectScopes(service, resourceConfig, resourceUrl) }
+          : {}),
       })
 
       return { success: true }

apps/sim/lib/copilot/tools/handlers/oauth.ts

@@ -206,6 +206,19 @@ async function generateOAuthLink(
         ? `${baseUrl}/workspace/${workspaceId}/chat/${chatId}`
         : `${baseUrl}/workspace/${workspaceId}`
 
+  /**
+   * A service whose OAuth resource is the customer's own tenant host needs that
+   * URL before the authorization request is built, and this tool has nowhere to
+   * take one from — its schema is generated from the Mothership catalog. An
+   * authorize link without it would request the wrong resource and fail at the
+   * provider.
+   */
+  if (matched.resourceUrl) {
+    throw new Error(
+      `${serviceName} needs its environment URL to connect, which this tool cannot supply. Ask the user to connect ${serviceName} from Settings → Integrations.`
+    )
+  }
+
   if (providerId === 'trello') {
     const authorizeUrl = new URL(`${baseUrl}/api/auth/trello/authorize`)
     authorizeUrl.searchParams.set('returnUrl', callbackURL)

apps/sim/lib/oauth/dataverse.ts

@@ -0,0 +1,29 @@
+import type { OAuthResourceUrlConfig } from '@/lib/oauth/types'
+
+/**
+ * The one description of a Dataverse environment host.
+ *
+ * Two places depend on it and must not drift: the OAuth scope names this origin
+ * as the token's audience, and every Web API request is pinned to it. If
+ * Microsoft adds a sovereign cloud and only one side learns about it, the result
+ * is a token whose audience the tool then refuses to send to.
+ *
+ * Suffixes are the registrable domains Microsoft serves environments from —
+ * commercial and regional clouds (`*.crm[N].dynamics.com`), China (21Vianet),
+ * US Government and DoD, and the legacy German cloud. Matching the registrable
+ * domain rather than each regional `crmN` prefix keeps new Microsoft regions
+ * working without a code change.
+ */
+export const DATAVERSE_RESOURCE_URL: OAuthResourceUrlConfig = {
+  title: 'Environment URL',
+  placeholder: 'https://myorg.crm.dynamics.com',
+  hint: 'Find this in Power Platform admin center under your environment.',
+  allowedHostSuffixes: [
+    '.dynamics.com',
+    '.dynamics.cn',
+    '.dynamics.de',
+    '.microsoftdynamics.us',
+    '.appsplatform.us',
+  ],
+  scopeSuffix: '/user_impersonation',
+}

apps/sim/lib/oauth/oauth.ts

@@ -71,6 +71,7 @@ import {
   DEFAULT_MAX_ERROR_BODY_BYTES,
   readResponseTextWithLimit,
 } from '@/lib/core/utils/stream-limits'
+import { DATAVERSE_RESOURCE_URL } from '@/lib/oauth/dataverse'
 import { parseInstagramLongLivedToken } from '@/lib/oauth/instagram'
 import {
   SALESFORCE_ADDITIONAL_PROVIDER_IDS,
@@ -348,13 +349,15 @@ export const OAUTH_PROVIDERS: Record<string, OAuthProviderConfig> = {
         providerId: 'microsoft-dataverse',
         icon: MicrosoftDataverseIcon,
         baseProviderIcon: MicrosoftIcon,
-        scopes: [
-          'openid',
-          'profile',
-          'email',
-          'https://dynamics.microsoft.com/user_impersonation',
-          'offline_access',
-        ],
+        /**
+         * Only the OIDC scopes are static. Dataverse's API resource is the
+         * customer's own environment host — the Dataverse first-party app
+         * publishes `*.crm.dynamics.com` and its regional siblings, never a
+         * tenant-agnostic URI — so the resource scope is built per connection
+         * from {@link resourceUrl} instead of being declared here.
+         */
+        scopes: ['openid', 'profile', 'email', 'offline_access'],
+        resourceUrl: DATAVERSE_RESOURCE_URL,
       },
       'microsoft-excel': {
         name: 'Microsoft Excel',

apps/sim/lib/oauth/resource-url.test.ts

@@ -0,0 +1,52 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import { resolveResourceOrigin } from '@/lib/oauth/resource-url'
+import type { OAuthResourceUrlConfig } from '@/lib/oauth/types'
+
+const config: OAuthResourceUrlConfig = {
+  title: 'Environment URL',
+  placeholder: 'https://myorg.crm.dynamics.com',
+  allowedHostSuffixes: ['.dynamics.com', '.microsoftdynamics.us'],
+  scopeSuffix: '/user_impersonation',
+}
+
+describe('resolveResourceOrigin', () => {
+  it('accepts an allowed host and reduces it to a bare origin', () => {
+    const result = resolveResourceOrigin('https://myorg.crm.dynamics.com/api/data/v9.2/', config)
+    expect(result).toEqual({ ok: true, origin: 'https://myorg.crm.dynamics.com' })
+  })
+
+  it('assumes https when the scheme is omitted, which is how users paste a host', () => {
+    const result = resolveResourceOrigin('myorg.crm4.dynamics.com', config)
+    expect(result).toEqual({ ok: true, origin: 'https://myorg.crm4.dynamics.com' })
+  })
+
+  it('matches on the registrable domain so new provider regions keep working', () => {
+    expect(resolveResourceOrigin('https://org.crm17.dynamics.com', config).ok).toBe(true)
+    expect(resolveResourceOrigin('https://org.crm.microsoftdynamics.us', config).ok).toBe(true)
+  })
+
+  it('rejects a host outside the allow list, which would set the token audience', () => {
+    const result = resolveResourceOrigin('https://attacker.example', config)
+    expect(result.ok).toBe(false)
+  })
+
+  it('rejects a lookalike host that only contains an allowed suffix mid-string', () => {
+    expect(resolveResourceOrigin('https://dynamics.com.attacker.example', config).ok).toBe(false)
+  })
+
+  it('rejects plaintext http so the resource cannot be downgraded', () => {
+    expect(resolveResourceOrigin('http://myorg.crm.dynamics.com', config).ok).toBe(false)
+  })
+
+  it('rejects embedded credentials', () => {
+    expect(resolveResourceOrigin('https://u:p@myorg.crm.dynamics.com', config).ok).toBe(false)
+  })
+
+  it('rejects an empty value rather than building a scope from nothing', () => {
+    expect(resolveResourceOrigin('   ', config).ok).toBe(false)
+    expect(resolveResourceOrigin(undefined, config).ok).toBe(false)
+  })
+})