fix(integrations): harden Dynamics OAuth binding

Author: waleedlatif1

apps/sim/app/desktop/connect/connect-launcher.tsx

@@ -4,6 +4,7 @@ import { useCallback, useEffect, useRef, useState } from 'react'
 import { Chip } from '@sim/emcn'
 import { getErrorMessage } from '@sim/utils/errors'
 import { client } from '@/lib/auth/auth-client'
+import { getPerRequestOAuthLinkScopes } from '@/lib/oauth/utils'
 import { DesktopHandoffShell } from '@/app/desktop/components/desktop-handoff-shell'
 
 interface ConnectLauncherProps {
@@ -31,9 +32,11 @@ export function ConnectLauncher({ providerId, completeUrl }: ConnectLauncherProp
   const start = useCallback(async () => {
     setError(null)
     try {
+      const scopes = getPerRequestOAuthLinkScopes(providerId)
       await client.oauth2.link({
         providerId,
         callbackURL: completeUrl,
+        ...(scopes && { scopes }),
         // Failed flows bounce to the same complete page (which forwards the
         // failure to the loopback) instead of waiting out the handoff TTL.
         // Do NOT bake in a query param here: better-auth appends its own

apps/sim/app/workspace/[workspaceId]/components/connect-oauth-modal/microsoft-dataverse-environment.test.ts

@@ -4,13 +4,12 @@ import { useState } from 'react'
 import { ChipModalField } from '@sim/emcn'
 import { getErrorMessage } from '@sim/utils/errors'
 import {
+  getMicrosoftDataverseIdentityScopes,
   getMicrosoftDataverseOAuthScopes,
   MICROSOFT_DATAVERSE_PROVIDER_ID,
   normalizeMicrosoftDataverseEnvironmentUrl,
 } from '@/lib/oauth/microsoft-dataverse'
 
-const DYNAMICS_IDENTITY_SCOPES = ['openid', 'profile', 'email', 'offline_access'] as const
-
 interface UseMicrosoftDataverseEnvironmentFormProps {
   fallbackScopes: readonly string[]
   lockedEnvironmentUrl?: string
@@ -71,7 +70,7 @@ export function useMicrosoftDataverseEnvironmentForm({
 
   const effectiveScopes = (() => {
     if (!enabled) return fallbackScopes
-    if (!value.trim()) return DYNAMICS_IDENTITY_SCOPES
+    if (!value.trim()) return getMicrosoftDataverseIdentityScopes(fallbackScopes)
     try {
       return getMicrosoftDataverseOAuthScopes(value)
     } catch {

apps/sim/app/workspace/[workspaceId]/components/connect-oauth-modal/microsoft-dataverse-environment.tsx

@@ -14,7 +14,8 @@ const { beginOAuthConnect, oauthLink } = vi.hoisted(() => ({
 vi.mock('@/lib/api/client/request', () => ({ requestJson: vi.fn() }))
 vi.mock('@/lib/auth/auth-client', () => ({ client: { oauth2: { link: oauthLink } } }))
 vi.mock('@/lib/desktop', () => ({
-  getDesktopBridge: () => ({ beginOAuthConnect }),
+  getDesktopBridge: () =>
+    beginOAuthConnect.getMockName() === 'desktop' ? { beginOAuthConnect } : null,
 }))
 vi.mock('@/lib/oauth', () => ({ OAUTH_PROVIDERS: {} }))
 
@@ -25,6 +26,7 @@ describe('useConnectOAuthService', () => {
 
   beforeEach(() => {
     vi.clearAllMocks()
+    beginOAuthConnect.mockName('desktop')
     beginOAuthConnect.mockResolvedValue(true)
     ;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
   })
@@ -68,4 +70,50 @@ describe('useConnectOAuthService', () => {
       expect(oauthLink).not.toHaveBeenCalled()
     }
   )
+
+  it('supplies the canonical legacy scopes explicitly for web Dataverse links', async () => {
+    beginOAuthConnect.mockName('web')
+    oauthLink.mockResolvedValue({ data: {}, error: null })
+    const queryClient = new QueryClient({
+      defaultOptions: { mutations: { retry: false }, queries: { retry: false } },
+    })
+    const container = document.createElement('div')
+    const root = createRoot(container)
+    let connect: ReturnType<typeof useConnectOAuthService> | undefined
+    function Probe() {
+      connect = useConnectOAuthService()
+      return null
+    }
+    function Wrapper({ children }: { children: ReactNode }) {
+      return <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
+    }
+    act(() =>
+      root.render(
+        <Wrapper>
+          <Probe />
+        </Wrapper>
+      )
+    )
+    unmount = () => act(() => root.unmount())
+
+    await act(async () => {
+      await connect?.mutateAsync({
+        providerId: 'microsoft-dataverse',
+        callbackURL: 'https://sim.test/oauth/credential-connected',
+        draftId: 'draft-1',
+      })
+    })
+
+    expect(oauthLink).toHaveBeenCalledWith({
+      providerId: 'microsoft-dataverse',
+      callbackURL: 'https://sim.test/oauth/credential-connected?credentialDraftId=draft-1',
+      scopes: [
+        'openid',
+        'profile',
+        'email',
+        'https://dynamics.microsoft.com/user_impersonation',
+        'offline_access',
+      ],
+    })
+  })
 })

apps/sim/hooks/queries/oauth/oauth-connections.test.tsx

@@ -11,6 +11,7 @@ import { client } from '@/lib/auth/auth-client'
 import { OAUTH_CREDENTIAL_DRAFT_CALLBACK_PARAM } from '@/lib/credentials/draft-constants'
 import { getDesktopBridge } from '@/lib/desktop'
 import { OAUTH_PROVIDERS, type OAuthServiceConfig } from '@/lib/oauth'
+import { getPerRequestOAuthLinkScopes } from '@/lib/oauth/utils'
 
 const logger = createLogger('OAuthConnectionsQuery')
 
@@ -193,9 +194,11 @@ export function useConnectOAuthService() {
         stateCallbackUrl.searchParams.set(OAUTH_CREDENTIAL_DRAFT_CALLBACK_PARAM, draftId)
       }
 
+      const scopes = getPerRequestOAuthLinkScopes(providerId)
       await client.oauth2.link({
         providerId,
         callbackURL: stateCallbackUrl.toString(),
+        ...(scopes && { scopes }),
       })
 
       return { success: true }

apps/sim/hooks/queries/oauth/oauth-connections.ts

@@ -798,7 +798,11 @@ export function buildConnectorProviders(): GenericOAuthConfig[] {
       authorizationUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',
       tokenUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',
       userInfoUrl: 'https://graph.microsoft.com/v1.0/me',
-      scopes: getCanonicalScopesForProvider('microsoft-dataverse'),
+      /**
+       * Better Auth appends connector scopes to link-request scopes. Dataverse audiences are
+       * request-specific, so every allowed link supplies its exact grant and this base stays empty.
+       */
+      scopes: [],
       responseType: 'code',
       accessType: 'offline',
       authentication: 'basic',

apps/sim/lib/auth/connectors/providers.ts

@@ -10,6 +10,7 @@ import {
   classifyMicrosoftDataverseCredentialEnvironment,
   extractMicrosoftDataverseEnvironmentUrl,
   getBoundMicrosoftDataverseEnvironment,
+  getMicrosoftDataverseIdentityScopes,
   getMicrosoftDataverseOAuthScopes,
   getMicrosoftDataverseRequiredScope,
   normalizeMicrosoftDataverseEnvironmentUrl,
@@ -69,6 +70,15 @@ describe('Microsoft Dataverse OAuth environment binding', () => {
     ])
   })
 
+  it('derives identity permissions from the canonical service grant', () => {
+    expect(getMicrosoftDataverseIdentityScopes(LEGACY_DATAVERSE_SCOPES)).toEqual([
+      'openid',
+      'profile',
+      'email',
+      'offline_access',
+    ])
+  })
+
   it('round-trips the flow-bound environment through absolute and relative callback URLs', () => {
     const absolute = bindMicrosoftDataverseEnvironmentToOAuthCallback(
       'https://sim.test/workspace?existing=1',
@@ -126,7 +136,7 @@ describe('Microsoft Dataverse OAuth environment binding', () => {
         undefined,
         LEGACY_DATAVERSE_SCOPES
       )
-    ).not.toThrow()
+    ).toThrow('exact legacy scopes')
     expect(() =>
       assertMicrosoftDataverseOAuthLinkRequest(
         'https://sim.test/workspace',
@@ -283,6 +293,19 @@ describe('Microsoft Dataverse OAuth environment binding', () => {
     ).toThrow('multiple environment scopes')
   })
 
+  it('rejects a malformed internal environment marker instead of treating it as legacy', () => {
+    const malformedMarker = '__sim_dataverse_instance__:https://evil.example'
+    expect(() => extractMicrosoftDataverseEnvironmentUrl([malformedMarker])).toThrow(
+      'invalid environment scope'
+    )
+    expect(
+      classifyMicrosoftDataverseCredentialEnvironment(
+        [malformedMarker],
+        'https://dev.crm.dynamics.com'
+      )
+    ).toBe('invalid')
+  })
+
   it('classifies matching, legacy, different, and ambiguous stored grants', () => {
     const requested = 'https://dev.crm.dynamics.com'
     expect(
@@ -331,6 +354,14 @@ describe('Microsoft Dataverse OAuth environment binding', () => {
     expect(prod.id).toContain(':prod.api.crm.dynamics.com-')
   })
 
+  it('fails closed when the generated account ID invariant is missing', () => {
+    expect(() =>
+      bindMicrosoftDataverseEnvironmentToUserInfo({ id: 'entra-user-id' }, [
+        getMicrosoftDataverseRequiredScope('https://dev.crm.dynamics.com'),
+      ])
+    ).toThrow('user ID is missing its generated suffix')
+  })
+
   it('rejects callback tokens without an environment audience', () => {
     expect(() =>
       bindMicrosoftDataverseEnvironmentToUserInfo(userInfoFor('entra-user-id'), [

apps/sim/lib/oauth/microsoft-dataverse.test.ts

@@ -67,6 +67,13 @@ export function getMicrosoftDataverseOAuthScopes(environmentUrl: unknown): strin
   ]
 }
 
+/** Keeps only non-resource permissions from the canonical Dataverse service grant for UI display. */
+export function getMicrosoftDataverseIdentityScopes(scopes: readonly string[]): string[] {
+  return scopes.filter(
+    (scope) => !/^https:\/\//i.test(scope) && !scope.startsWith(DATAVERSE_INSTANCE_MARKER_PREFIX)
+  )
+}
+
 /** Returns the trusted internal marker used to match a Dynamics credential in block UIs. */
 export function getMicrosoftDataverseRequiredScope(environmentUrl: unknown): string {
   const origin = normalizeMicrosoftDataverseEnvironmentUrl(environmentUrl)
@@ -130,7 +137,6 @@ export function assertMicrosoftDataverseOAuthLinkRequest(
 ): void {
   const environment = getBoundMicrosoftDataverseEnvironment(callbackURL)
   if (!environment) {
-    if (requestedScopes === undefined || requestedScopes === null) return
     if (
       !Array.isArray(requestedScopes) ||
       !requestedScopes.every((scope) => typeof scope === 'string')
@@ -258,7 +264,9 @@ export function extractMicrosoftDataverseEnvironmentUrl(
     const candidate = value.slice(DATAVERSE_INSTANCE_MARKER_PREFIX.length)
     try {
       origins.add(normalizeMicrosoftDataverseEnvironmentUrl(candidate))
-    } catch {}
+    } catch {
+      throw new Error('Microsoft Dataverse credential contains an invalid environment scope')
+    }
   }
 
   if (origins.size > 1) {
@@ -308,6 +316,9 @@ export function bindMicrosoftDataverseEnvironmentToUserInfo<T extends { id: stri
   }
 
   const environmentHost = new URL(environmentUrl).hostname
+  if (!UUID_SUFFIX_RE.test(userInfo.id)) {
+    throw new Error('Microsoft Dynamics 365 OAuth user ID is missing its generated suffix')
+  }
   return {
     ...userInfo,
     id: userInfo.id.replace(UUID_SUFFIX_RE, `:${environmentHost}$&`),

apps/sim/lib/oauth/microsoft-dataverse.ts

@@ -70,7 +70,12 @@ afterAll(resetEnvMock)
 import { GoogleIcon, GoogleVaultIcon } from '@/components/icons'
 import { buildConnectorProviders } from '@/lib/auth/connectors/providers'
 import { DEFAULT_MAX_ERROR_BODY_BYTES } from '@/lib/core/utils/stream-limits'
-import { getSlackApprovalGatedScopes, OAUTH_PROVIDERS, refreshOAuthToken } from '@/lib/oauth'
+import {
+  getPerRequestOAuthLinkScopes,
+  getSlackApprovalGatedScopes,
+  OAUTH_PROVIDERS,
+  refreshOAuthToken,
+} from '@/lib/oauth'
 import { REDDIT_USER_AGENT } from '@/tools/reddit/constants'
 
 /**
@@ -138,6 +143,21 @@ describe('Atlassian OAuth connectors', () => {
   )
 })
 
+describe('Microsoft Dataverse OAuth connector', () => {
+  it('keeps static connector scopes empty and supplies the canonical legacy grant per request', () => {
+    const connector = buildConnectorProviders().find(
+      (candidate) => candidate.providerId === 'microsoft-dataverse'
+    )
+    if (!connector) throw new Error('Microsoft Dataverse OAuth connector is not configured')
+
+    expect(connector.scopes).toEqual([])
+    expect(getPerRequestOAuthLinkScopes('microsoft-dataverse')).toEqual(
+      OAUTH_PROVIDERS.microsoft.services['microsoft-dataverse'].scopes
+    )
+    expect(getPerRequestOAuthLinkScopes('microsoft-excel')).toBeUndefined()
+  })
+})
+
 function getBitbucketConnector() {
   const connector = buildConnectorProviders().find(
     (candidate) => candidate.providerId === 'bitbucket'