chore(oauth): drop provider refresh-error surfacing to keep this PR slack-only

Author: TheodoreSpeaks

apps/sim/app/api/auth/oauth/token/route.test.ts

@@ -27,7 +27,6 @@ vi.mock('@/lib/auth/credential-access', () => ({
 }))
 
 import { TokenServiceAccountValidationError } from '@/lib/credentials/token-service-accounts/errors'
-import { OAuthRefreshError } from '@/lib/oauth/errors'
 import { GET, POST } from '@/app/api/auth/oauth/token/route'
 
 describe('OAuth Token API Routes', () => {
@@ -302,38 +301,6 @@ describe('OAuth Token API Routes', () => {
       )
     })
 
-    it('should surface the provider error detail on typed refresh failures', async () => {
-      mockAuthorizeCredentialUse.mockResolvedValueOnce({
-        ok: true,
-        authType: 'session',
-        requesterUserId: 'test-user-id',
-        credentialOwnerUserId: 'owner-user-id',
-      })
-      authOAuthUtilsMockFns.mockGetCredential.mockResolvedValueOnce({
-        id: 'credential-id',
-        accessToken: 'test-token',
-        refreshToken: 'refresh-token',
-        accessTokenExpiresAt: new Date(Date.now() - 3600 * 1000),
-        providerId: 'google',
-      })
-      authOAuthUtilsMockFns.mockRefreshTokenIfNeeded.mockRejectedValueOnce(
-        new OAuthRefreshError('google', 'invalid_grant', 'Token has been expired or revoked.')
-      )
-
-      const req = createMockRequest('POST', {
-        credentialId: 'credential-id',
-      })
-
-      const response = await POST(req)
-      const data = await response.json()
-
-      expect(response.status).toBe(401)
-      expect(data).toHaveProperty(
-        'error',
-        'Failed to refresh access token: invalid_grant (google: Token has been expired or revoked.)'
-      )
-    })
-
     describe('credentialAccountUserId + providerId path', () => {
       it('should reject unauthenticated requests', async () => {
         hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValueOnce({

apps/sim/app/api/auth/oauth/token/route.ts

@@ -12,7 +12,6 @@ import { AuthType, checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { TokenServiceAccountValidationError } from '@/lib/credentials/token-service-accounts/errors'
-import { OAuthRefreshError } from '@/lib/oauth/errors'
 import { captureServerEvent } from '@/lib/posthog/server'
 import {
   getCredential,
@@ -301,11 +300,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       )
     } catch (error) {
       logger.error(`[${requestId}] Failed to refresh access token:`, error)
-      const detail = error instanceof OAuthRefreshError ? `: ${error.message}` : ''
-      return NextResponse.json(
-        { error: `Failed to refresh access token${detail}` },
-        { status: 401 }
-      )
+      return NextResponse.json({ error: 'Failed to refresh access token' }, { status: 401 })
     }
   } catch (error) {
     logger.error(`[${requestId}] Error getting access token`, error)
@@ -417,11 +412,7 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
       )
     } catch (error) {
       logger.error(`[${requestId}] Failed to refresh access token:`, error)
-      const detail = error instanceof OAuthRefreshError ? `: ${error.message}` : ''
-      return NextResponse.json(
-        { error: `Failed to refresh access token${detail}` },
-        { status: 401 }
-      )
+      return NextResponse.json({ error: 'Failed to refresh access token' }, { status: 401 })
     }
   } catch (error) {
     logger.error(`[${requestId}] Error fetching access token`, error)

apps/sim/app/api/auth/oauth/utils.test.ts

@@ -164,46 +164,6 @@ describe('OAuth Utils', () => {
         message: 'Failed',
       })
 
-      await expect(
-        refreshTokenIfNeeded('request-id', mockCredential, 'credential-id')
-      ).rejects.toThrow('invalid_grant (google)')
-    })
-
-    it('should preserve the provider error description in the thrown error', async () => {
-      const mockCredential = {
-        id: 'credential-id',
-        accessToken: 'expired-token',
-        refreshToken: 'refresh-token',
-        accessTokenExpiresAt: new Date(Date.now() - 3600 * 1000),
-        providerId: 'google',
-      }
-
-      mockRefreshOAuthToken.mockResolvedValueOnce({
-        ok: false,
-        errorCode: 'invalid_grant',
-        errorDescription: 'Token has been expired or revoked.',
-        message: 'Failed',
-      })
-
-      await expect(
-        refreshTokenIfNeeded('request-id', mockCredential, 'credential-id')
-      ).rejects.toThrow('invalid_grant (google: Token has been expired or revoked.)')
-    })
-
-    it('should throw the generic error on transient failures without a provider code', async () => {
-      const mockCredential = {
-        id: 'credential-id',
-        accessToken: 'expired-token',
-        refreshToken: 'refresh-token',
-        accessTokenExpiresAt: new Date(Date.now() - 3600 * 1000),
-        providerId: 'google',
-      }
-
-      mockRefreshOAuthToken.mockResolvedValueOnce({
-        ok: false,
-        message: 'fetch failed',
-      })
-
       await expect(
         refreshTokenIfNeeded('request-id', mockCredential, 'credential-id')
       ).rejects.toThrow('Failed to refresh token')
@@ -426,7 +386,7 @@ describe('OAuth Utils', () => {
       })
 
       await expect(refreshTokenIfNeeded('request-id', slackCredential(), 'row-1')).rejects.toThrow(
-        'token_revoked (slack)'
+        'Failed to refresh token'
       )
 
       expect(fakeRedis.set).toHaveBeenCalledWith(

apps/sim/app/api/auth/oauth/utils.ts

@@ -21,7 +21,6 @@ import {
   type TokenServiceAccountSecretBlob,
 } from '@/lib/credentials/token-service-accounts/server'
 import { refreshOAuthToken } from '@/lib/oauth'
-import { OAuthRefreshError } from '@/lib/oauth/errors'
 import { isInstagramProvider, shouldProactivelyRefreshInstagramToken } from '@/lib/oauth/instagram'
 import {
   getMicrosoftRefreshTokenExpiry,
@@ -671,12 +670,6 @@ interface CoalescedRefreshOptions {
   userId?: string
 }
 
-interface CoalescedRefreshOutcome {
-  accessToken: string | null
-  /** Present when the refresh failed with a known provider error; absent on follower timeout / transient failure. */
-  error?: OAuthRefreshError
-}
-
 /**
  * Slack lock budgets sized past `TOKEN_REFRESH_TIMEOUT_MS` (15s) in
  * lib/oauth/oauth.ts: installation-keyed locks make every sibling row's request
@@ -695,7 +688,7 @@ async function performCoalescedRefresh({
   providerAccountId,
   requestId,
   userId,
-}: CoalescedRefreshOptions): Promise<CoalescedRefreshOutcome> {
+}: CoalescedRefreshOptions): Promise<string | null> {
   /**
    * Slack bot tokens are per-installation (team × app): every account row for
    * one team holds a copy of the same rotating chain, so refreshes are locked,
@@ -718,13 +711,13 @@ async function performCoalescedRefresh({
       ...logContext,
       errorCode: deadCode,
     })
-    return { accessToken: null, error: new OAuthRefreshError(providerId, deadCode) }
+    return null
   }
 
   const lockKey = `oauth:refresh:${scopeKey}`
 
   const refreshPromise = coalesceLocally(lockKey, () =>
-    withLeaderLock<CoalescedRefreshOutcome>({
+    withLeaderLock<string>({
       key: lockKey,
       // Installation-keyed Slack locks gather followers from every sibling row,
       // so their wait and the lock TTL must outlast the 15s provider timeout —
@@ -752,7 +745,7 @@ async function performCoalescedRefresh({
                 accessTokenExpiresAt: freshest.accessTokenExpiresAt,
               })
               logger.info('Reused freshest Slack installation token', logContext)
-              return { accessToken: freshest.accessToken }
+              return freshest.accessToken
             }
             refreshTokenToUse = freshest.refreshToken
           }
@@ -767,20 +760,7 @@ async function performCoalescedRefresh({
             if (result.errorCode && isTerminalRefreshError(result.errorCode)) {
               await markCredentialDead(scopeKey, result.errorCode)
             }
-            return {
-              accessToken: null,
-              // No errorCode = transient (timeout/network), not a provider rejection —
-              // stay errorless so callers keep their null-fallback behavior.
-              ...(result.errorCode
-                ? {
-                    error: new OAuthRefreshError(
-                      providerId,
-                      result.errorCode,
-                      result.errorDescription
-                    ),
-                  }
-                : {}),
-            }
+            return null
           }
 
           const accessTokenExpiresAt = new Date(Date.now() + result.expiresIn * 1000)
@@ -808,13 +788,13 @@ async function performCoalescedRefresh({
           }
 
           logger.info('Successfully refreshed access token', logContext)
-          return { accessToken: result.accessToken }
+          return result.accessToken
         } catch (error) {
           logger.error('Refresh failed inside leader path', {
             ...logContext,
             error: toError(error).message,
           })
-          return { accessToken: null }
+          return null
         }
       },
       onFollower: async () => {
@@ -833,7 +813,7 @@ async function performCoalescedRefresh({
             row.accessTokenExpiresAt > new Date()
           ) {
             logger.info('Got fresh access token from coalesced refresh', logContext)
-            return { accessToken: row.accessToken }
+            return row.accessToken
           }
           return null
         } catch (error) {
@@ -848,13 +828,13 @@ async function performCoalescedRefresh({
   )
 
   try {
-    return (await refreshPromise) ?? { accessToken: null }
+    return await refreshPromise
   } catch (error) {
     logger.error('Coalesced refresh did not settle', {
       ...logContext,
       error: toError(error).message,
     })
-    return { accessToken: null }
+    return null
   }
 }
 
@@ -898,18 +878,17 @@ export async function getOAuthToken(userId: string, providerId: string): Promise
     })
 
   if (accessTokenNeedsRefresh || instagramNeedsProactiveRefresh) {
-    const outcome = await performCoalescedRefresh({
+    const fresh = await performCoalescedRefresh({
       accountId: credential.id,
       providerId,
       refreshToken: credential.refreshToken!,
       providerAccountId: credential.providerAccountId,
       userId,
     })
-    if (outcome.accessToken) return outcome.accessToken
+    if (fresh) return fresh
     if (!accessTokenNeedsRefresh && credential.accessToken) {
       return credential.accessToken
     }
-    if (outcome.error) throw outcome.error
     return null
   }
 
@@ -1002,15 +981,15 @@ export async function resolveCredentialAccessToken(
     const resolvedCredentialId =
       (credential as { resolvedCredentialId?: string }).resolvedCredentialId ?? credentialId
 
-    const outcome = await performCoalescedRefresh({
+    const fresh = await performCoalescedRefresh({
       accountId: resolvedCredentialId,
       providerId: credential.providerId,
       refreshToken: credential.refreshToken!,
       providerAccountId: credential.accountId,
       requestId,
       userId: credential.userId,
     })
-    if (outcome.accessToken) return { accessToken: outcome.accessToken }
+    if (fresh) return { accessToken: fresh }
 
     // If refresh was only triggered proactively (Microsoft refresh-token aging /
     // Instagram long-lived nearing expiry), the still-valid access token is fine.
@@ -1107,19 +1086,19 @@ export async function refreshTokenIfNeeded(
     return { accessToken: credential.accessToken, refreshed: false }
   }
 
-  const outcome = await performCoalescedRefresh({
+  const fresh = await performCoalescedRefresh({
     accountId: resolvedCredentialId,
     providerId: credential.providerId,
     refreshToken: credential.refreshToken!,
     providerAccountId: credential.accountId,
     requestId,
     userId: credential.userId,
   })
-  if (outcome.accessToken) return { accessToken: outcome.accessToken, refreshed: true }
+  if (fresh) return { accessToken: fresh, refreshed: true }
 
   if (!accessTokenNeedsRefresh && credential.accessToken) {
     logger.info(`[${requestId}] Refresh unavailable; reusing still-valid access token`)
     return { accessToken: credential.accessToken, refreshed: false }
   }
-  throw outcome.error ?? new Error('Failed to refresh token')
+  throw new Error('Failed to refresh token')
 }

apps/sim/lib/oauth/errors.ts

@@ -1634,7 +1634,6 @@ export interface RefreshTokenSuccess {
 export interface RefreshTokenFailure {
   ok: false
   errorCode?: string
-  errorDescription?: string
   message?: string
 }
 
@@ -1652,14 +1651,6 @@ function extractErrorCode(value: unknown): string | undefined {
   return undefined
 }
 
-function extractErrorDescription(value: unknown): string | undefined {
-  if (value && typeof value === 'object' && 'error_description' in value) {
-    const description = (value as { error_description: unknown }).error_description
-    if (typeof description === 'string' && description.trim()) return description
-  }
-  return undefined
-}
-
 /**
  * Hard deadline on the token-endpoint exchange. This function does not coalesce
  * on its own; its sole production caller (`performCoalescedRefresh` in the OAuth
@@ -1707,7 +1698,6 @@ async function refreshInstagramLongLivedToken(
     return {
       ok: false,
       errorCode: extractErrorCode(responseData),
-      errorDescription: extractErrorDescription(responseData),
       message: `Failed to refresh token: ${response.status} ${errorSummary}`,
     }
   }
@@ -1779,7 +1769,6 @@ export async function refreshOAuthToken(
       return {
         ok: false,
         errorCode: extractErrorCode(errorData),
-        errorDescription: extractErrorDescription(errorData),
         message: `Failed to refresh token: ${response.status} ${errorText}`,
       }
     }
@@ -1801,7 +1790,6 @@ export async function refreshOAuthToken(
       return {
         ok: false,
         errorCode: typeof data.error === 'string' ? data.error : undefined,
-        errorDescription: extractErrorDescription(data),
         message: `Failed to refresh token: ${data.error ?? 'unknown'}`,
       }
     }