fix(credentials): fail closed without breaking auth

Author: TheodoreSpeaks

apps/sim/app/api/auth/shopify/authorize/route.test.ts

@@ -0,0 +1,60 @@
+/**
+ * @vitest-environment node
+ */
+import { createMockRequest } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  getSession: vi.fn(),
+  requireConfiguredOAuthClient: vi.fn(),
+}))
+
+vi.mock('@/lib/auth', () => ({
+  getSession: mocks.getSession,
+}))
+
+vi.mock('@/lib/core/config/env-capabilities.server', () => ({
+  requireConfiguredOAuthClient: mocks.requireConfiguredOAuthClient,
+}))
+
+vi.mock('@/lib/core/utils/urls', () => ({
+  getBaseUrl: () => 'https://sim.test',
+}))
+
+vi.mock('@/lib/oauth/shopify-state', () => ({
+  createShopifyOAuthState: () => 'signed-state',
+}))
+
+vi.mock('@/lib/oauth/utils', () => ({
+  getScopesForService: () => ['read_products'],
+}))
+
+import { GET } from '@/app/api/auth/shopify/authorize/route'
+
+describe('Shopify authorize route', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.getSession.mockResolvedValue({ user: { id: 'user-1' } })
+    mocks.requireConfiguredOAuthClient.mockReturnValue({
+      values: {
+        SHOPIFY_CLIENT_ID: 'shopify-client',
+        SHOPIFY_CLIENT_SECRET: 'shopify-secret',
+      },
+    })
+  })
+
+  it('keeps the post-connect return URL for the full credential draft lifetime', async () => {
+    const request = createMockRequest(
+      'GET',
+      undefined,
+      {},
+      'https://sim.test/api/auth/shopify/authorize?shop=test-store.myshopify.com&returnUrl=https%3A%2F%2Fsim.test%2Foauth%2Fcredential-connected&draftId=draft-1'
+    )
+
+    const response = await GET(request)
+
+    expect(response.status).toBe(307)
+    expect(response.headers.get('set-cookie')).toContain('shopify_return_url=')
+    expect(response.headers.get('set-cookie')).toContain('Max-Age=900')
+  })
+})

apps/sim/app/api/auth/shopify/authorize/route.ts

@@ -9,6 +9,7 @@ import { requireConfiguredOAuthClient } from '@/lib/core/config/env-capabilities
 import { getBaseUrl } from '@/lib/core/utils/urls'
 import { isSameOrigin } from '@/lib/core/utils/validation'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { CREDENTIAL_DRAFT_TTL_SECONDS } from '@/lib/credentials/draft-constants'
 import { createShopifyOAuthState } from '@/lib/oauth/shopify-state'
 import { getScopesForService } from '@/lib/oauth/utils'
 
@@ -209,7 +210,7 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
         httpOnly: true,
         secure: process.env.NODE_ENV === 'production',
         sameSite: 'lax',
-        maxAge: 60 * 10,
+        maxAge: CREDENTIAL_DRAFT_TTL_SECONDS,
         path: '/',
       })
     } else {

apps/sim/lib/auth/auth.ts

@@ -97,7 +97,7 @@ import {
 import { PlatformEvents } from '@/lib/core/telemetry'
 import { getBaseUrl, isLocalhostUrl, parseOriginList } from '@/lib/core/utils/urls'
 import {
-  parseCredentialDraftIdFromCallbackUrl,
+  loadOAuthCredentialDraftBinding,
   processCredentialDraft,
 } from '@/lib/credentials/draft-processor'
 import { sendEmail } from '@/lib/messaging/email/mailer'
@@ -526,33 +526,33 @@ export const auth = betterAuth({
             }
           }
 
-          let credentialDraftId: string | undefined
-          try {
-            const oauthState = await getOAuthState()
-            credentialDraftId = parseCredentialDraftIdFromCallbackUrl(oauthState?.callbackURL)
-          } catch (error) {
+          const credentialDraftBinding = await loadOAuthCredentialDraftBinding(() =>
+            getOAuthState()
+          )
+          if (credentialDraftBinding.status === 'unavailable') {
             logger.error('[account.create.after] Failed to read OAuth credential draft state', {
               userId: account.userId,
               providerId: account.providerId,
-              error,
+              error: credentialDraftBinding.error,
             })
-            throw error
           }
 
-          try {
-            await processCredentialDraft({
-              draftId: credentialDraftId,
-              userId: account.userId,
-              providerId: account.providerId,
-              accountId: account.id,
-            })
-          } catch (error) {
-            logger.error('[account.create.after] Failed to process credential draft', {
-              userId: account.userId,
-              providerId: account.providerId,
-              error,
-            })
-            if (credentialDraftId) throw error
+          if (credentialDraftBinding.status === 'available') {
+            try {
+              await processCredentialDraft({
+                draftId: credentialDraftBinding.draftId,
+                userId: account.userId,
+                providerId: account.providerId,
+                accountId: account.id,
+              })
+            } catch (error) {
+              logger.error('[account.create.after] Failed to process credential draft', {
+                userId: account.userId,
+                providerId: account.providerId,
+                error,
+              })
+              if (credentialDraftBinding.draftId) throw error
+            }
           }
 
           try {

apps/sim/lib/credentials/draft-processor.test.ts

@@ -21,6 +21,7 @@ vi.mock('@/lib/credentials/draft-hooks', () => ({
 }))
 
 import {
+  loadOAuthCredentialDraftBinding,
   parseCredentialDraftIdFromCallbackUrl,
   processCredentialDraft,
 } from '@/lib/credentials/draft-processor'
@@ -123,3 +124,29 @@ describe('parseCredentialDraftIdFromCallbackUrl', () => {
     expect(() => parseCredentialDraftIdFromCallbackUrl('not a URL')).toThrow()
   })
 })
+
+describe('loadOAuthCredentialDraftBinding', () => {
+  it('returns the exact draft id when OAuth state is readable', async () => {
+    await expect(
+      loadOAuthCredentialDraftBinding(async () => ({
+        callbackURL: 'https://sim.test/oauth/credential-connected?credentialDraftId=draft-exact',
+      }))
+    ).resolves.toEqual({ status: 'available', draftId: 'draft-exact' })
+  })
+
+  it('marks unreadable OAuth state unavailable instead of permitting legacy draft fallback', async () => {
+    const stateError = new Error('OAuth state is unavailable')
+
+    await expect(
+      loadOAuthCredentialDraftBinding(async () => {
+        throw stateError
+      })
+    ).resolves.toEqual({ status: 'unavailable', error: stateError })
+  })
+
+  it('marks malformed callback state unavailable without throwing from the account hook', async () => {
+    const binding = await loadOAuthCredentialDraftBinding(async () => ({ callbackURL: null }))
+
+    expect(binding.status).toBe('unavailable')
+  })
+})

apps/sim/lib/credentials/draft-processor.ts

@@ -11,6 +11,14 @@ const logger = createLogger('CredentialDraftProcessor')
 
 export const OAUTH_CREDENTIAL_DRAFT_CALLBACK_PARAM = 'credentialDraftId'
 
+interface OAuthStateWithCallbackUrl {
+  callbackURL?: unknown
+}
+
+type OAuthCredentialDraftBinding =
+  | { status: 'available'; draftId?: string }
+  | { status: 'unavailable'; error: unknown }
+
 /** Extracts a draft binding from Better Auth state and rejects malformed callback state. */
 export function parseCredentialDraftIdFromCallbackUrl(callbackUrl: unknown): string | undefined {
   if (callbackUrl === undefined) return undefined
@@ -20,6 +28,21 @@ export function parseCredentialDraftIdFromCallbackUrl(callbackUrl: unknown): str
   return new URL(callbackUrl).searchParams.get(OAUTH_CREDENTIAL_DRAFT_CALLBACK_PARAM) ?? undefined
 }
 
+/** Reads an exact draft binding without falling back when OAuth state is unavailable. */
+export async function loadOAuthCredentialDraftBinding(
+  loadOAuthState: () => Promise<OAuthStateWithCallbackUrl | null | undefined>
+): Promise<OAuthCredentialDraftBinding> {
+  try {
+    const oauthState = await loadOAuthState()
+    return {
+      status: 'available',
+      draftId: parseCredentialDraftIdFromCallbackUrl(oauthState?.callbackURL),
+    }
+  } catch (error) {
+    return { status: 'unavailable', error }
+  }
+}
+
 interface ProcessCredentialDraftParams {
   draftId?: string
   userId: string