[waleedlatif1]

Summary

• A workspace connect link (/api/auth/oauth2/authorize?providerId=&workspaceId=[&credentialId=], and the Instagram equivalent) used to create the connection draft on the GET itself. Anyone can craft that link, and a same-origin hop launders it past the cross-site check from fix(oauth): reject cross-site workspace OAuth launches #9772: email sign-in navigating to callbackUrl, or client-side redirects such as /oauth/chat-complete?returnTo=
• The link now only redirects to a new /oauth/connect confirmation page, which shows the provider and the signed-in account. Continue POSTs to the new internal POST /api/credentials/connections route (session auth, existing createCredentialConnection use case), which creates the user-bound draft. The page then launches authorize?draftId= with the original callbackURL. This follows the gesture-gate pattern /desktop/auth uses
• The authorize route now only launches drafts. This removes the GET-time mutation, its error-code redirects (nothing reads them), the fix(oauth): reject cross-site workspace OAuth launches #9772/fix(oauth): reject cross-site Instagram workspace launches #9788 header checks, and a dead QuickBooks draft re-fetch
• A draft launch sends provider failures to the status page only when the caller didn't name its own return page. Chat chips keep landing on the provider error page they watch for
• Existing producers keep working unchanged: desktop chips, agent-generated links and chat chips. Signed-out links still continue after sign-in, now including social and SSO sign-in, which fix(oauth): reject cross-site workspace OAuth launches #9772 rejected

Type of Change

• Bug fix

Testing

• Authorize and Instagram route tests: a connect link redirects to the confirmation page without launching anything, even when same-origin. The error callback applies only without a caller return page. All three new tests are red on the pre-fix routes
• oauth2/authorize, instagram/authorize and proxy tests (92 passing), check:api-validation:strict, biome; the full audit suite and type-check run in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Nov 7, 2026 10:15pm UTC

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The reviewed changes appear safe to merge.

Summary

Workspace connect links now open a confirmation page instead of creating a draft immediately.

• Workspace OAuth links wait for a user to confirm before starting a connection.
• OAuth draft launches use the caller’s return page or the connection status page.

Diagram

sequenceDiagram
  participant User
  participant Confirm as Confirmation page
  participant API as Connections API
  participant Authorize as Authorize route
  participant Provider
  User->>Authorize: Open workspace connect link
  Authorize-->>Confirm: Redirect without creating draft
  User->>Confirm: Click Continue
  Confirm->>API: POST workspace and provider
  alt Session expired
    API-->>Confirm: 401
    Confirm-->>User: Sign in, then return to confirmation
  else Session valid
    API-->>Confirm: Draft authorization URL
    Confirm->>Authorize: Launch draft
    Authorize-->>Provider: Request approval
  end

Loading

_{Reviews (2) · Last reviewed commit: "fix(oauth): send an expired session back..." · Reviewed by Greptile}

[cubic-dev-ai]

All reported issues were addressed across 9 files

_{Turn on auto-fix | Re-trigger cubic}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 11 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}