fix(connected-accounts): handle state upgrades and align regression coverage

Author: TheodoreSpeaks

apps/sim/app/(auth)/oauth/sign-in/route.test.ts

@@ -151,7 +151,7 @@ describe('OAuth login bridge', () => {
         })
       )
       expect(response.status).toBe(307)
-      expect(response.headers.get('location')).toBe('https://sim.test/workspace')
+      expect(response.headers.get('location')).toBe('https://sim.test/home')
     }
   })
 

apps/sim/app/api/credential-groups/oauth-callback.ts

@@ -5,6 +5,7 @@ import { NextResponse } from 'next/server'
 import type { CredentialGroupOAuthCallbackQuery } from '@/lib/api/contracts/credential-groups'
 import { credentialGroupOAuthAttemptPrincipal } from '@/lib/credential-groups/application/enrollment-auth'
 import { completePublicCredentialGroupOAuth } from '@/lib/credential-groups/application/public-enrollment'
+import { CredentialGroupOAuthStateVersionError } from '@/lib/credential-groups/oauth-attempt-version'
 import { consumeCredentialGroupOAuthAttempt } from '@/lib/credential-groups/oauth-state'
 import {
   CredentialGroupInvitationUnavailableError,
@@ -38,6 +39,12 @@ export async function handleCredentialGroupOAuthCallback({
   try {
     attempt = await consumeCredentialGroupOAuthAttempt(state)
   } catch (error) {
+    if (error instanceof CredentialGroupOAuthStateVersionError) {
+      return NextResponse.json(
+        { error: error.message },
+        { status: 400, headers: { 'Cache-Control': 'no-store' } }
+      )
+    }
     logger.error('Failed to consume credential group OAuth state', {
       error: getErrorMessage(error),
     })

apps/sim/app/api/credential-groups/oauth/[provider]/callback/route.test.ts

@@ -3,6 +3,7 @@
  */
 import { NextRequest, NextResponse } from 'next/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { CredentialGroupOAuthStateVersionError } from '@/lib/credential-groups/oauth-attempt-version'
 
 const mocks = vi.hoisted(() => ({
   authenticate: vi.fn(),
@@ -249,4 +250,14 @@ describe('credential group OAuth callback', () => {
     expect(response.headers.get('location')).toBe('/credential-groups/complete?oauth=rate_limited')
     expect(mocks.completeOAuth).not.toHaveBeenCalled()
   })
+  it('reports a state protocol change as an explicit restart without exchanging a code', async () => {
+    mocks.consumeAttempt.mockRejectedValue(new CredentialGroupOAuthStateVersionError())
+    const response = await GET(request('state=state-1&code=code-1'), context)
+    expect(response.status).toBe(400)
+    expect(await response.json()).toEqual({
+      error: expect.stringContaining('Reopen your invitation and connect again'),
+    })
+    expect(mocks.authenticate).not.toHaveBeenCalled()
+    expect(mocks.completeOAuth).not.toHaveBeenCalled()
+  })
 })

apps/sim/app/api/mcp/oauth/callback/route.test.ts

@@ -10,6 +10,7 @@ import {
 } from '@sim/testing'
 import { NextRequest } from 'next/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { CredentialGroupOAuthStateVersionError } from '@/lib/credential-groups/oauth-attempt-version'
 
 const {
   mockAuthenticateEnrollment,
@@ -195,4 +196,13 @@ describe('MCP OAuth callback route', () => {
     expect(mockConsumeManagedAttempt).not.toHaveBeenCalled()
     expect(mockCompleteManagedMcpOAuth).not.toHaveBeenCalled()
   })
+  it('reports a state protocol change without exchanging a code or loading an enrollment', async () => {
+    mockConsumeManagedAttempt.mockRejectedValue(new CredentialGroupOAuthStateVersionError())
+    const response = await GET(
+      new NextRequest('http://localhost:3000/api/mcp/oauth/callback?state=mcp_cg_old&code=code')
+    )
+    expect(await response.text()).toContain('Reopen your invitation and connect again')
+    expect(mockAuthenticateEnrollment).not.toHaveBeenCalled()
+    expect(mockCompleteManagedMcpOAuth).not.toHaveBeenCalled()
+  })
 })

apps/sim/app/api/mcp/oauth/callback/route.ts

@@ -15,6 +15,7 @@ import {
   consumeCredentialGroupMcpOAuthAttempt,
   isCredentialGroupMcpOAuthState,
 } from '@/lib/credential-groups/mcp-oauth-state'
+import { CredentialGroupOAuthStateVersionError } from '@/lib/credential-groups/oauth-attempt-version'
 import { enforcePublicCredentialGroupIpRateLimit } from '@/lib/credential-groups/rate-limit'
 import {
   assertSafeOauthServerUrl,
@@ -84,7 +85,15 @@ async function completeManagedMcpCallback(params: {
   code?: string
   error?: string
 }): Promise<NextResponse> {
-  const attempt = await consumeCredentialGroupMcpOAuthAttempt(params.state)
+  let attempt
+  try {
+    attempt = await consumeCredentialGroupMcpOAuthAttempt(params.state)
+  } catch (error) {
+    if (error instanceof CredentialGroupOAuthStateVersionError) {
+      return htmlClose(error.message, false, 'invalid_state', undefined, params.state)
+    }
+    throw error
+  }
   if (!attempt) {
     return htmlClose('Invalid or expired authorization state.', false, 'invalid_state')
   }

apps/sim/app/api/organizations/[id]/connected-accounts/[groupId]/slack-managed-users/route.test.ts

@@ -18,7 +18,8 @@ import { credentialGroupOperations } from '@/lib/credential-groups/application/o
 import { POST } from '@/app/api/organizations/[id]/connected-accounts/[groupId]/slack-managed-users/route'
 
 const body = {
-  slackBotCredentialId: '11111111-1111-4111-8111-111111111111',
+  appId: 'A123',
+  teamId: 'T123',
   clientId: 'fixture-client-id',
   clientSecret: 'fixture-client-secret',
 }

apps/sim/app/api/workspaces/invitations/route.test.ts

@@ -119,7 +119,9 @@ describe('POST /api/workspaces/invitations/batch', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     resetDbChainMock()
+    queueTableRows(schemaMock.user, [{ id: 'user-1', name: 'Owner User', email: 'owner@test.com' }])
     mockGetSession.mockResolvedValue({
+      session: { id: 'session-1' },
       user: { id: 'user-1', email: 'owner@test.com', name: 'Owner User' },
     })
     mockGetWorkspaceWithOwner.mockResolvedValue({
@@ -171,6 +173,7 @@ describe('POST /api/workspaces/invitations/batch', () => {
 
   afterAll(() => {
     resetDbChainMock()
+    queueTableRows(schemaMock.user, [{ id: 'user-1', name: 'Owner User', email: 'owner@test.com' }])
   })
 
   it('blocks invites for personal workspaces with an upgrade prompt', async () => {

apps/sim/app/credential-groups/enroll/[token]/page.test.tsx

@@ -1,5 +1,6 @@
 /** @vitest-environment jsdom */
 import type { ReactNode } from 'react'
+import { authMockFns } from '@sim/testing'
 import { renderToStaticMarkup } from 'react-dom/server'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { PublicCredentialGroupEnrollment } from '@/lib/credential-groups/enrollments'
@@ -21,6 +22,8 @@ vi.mock('@/lib/credential-groups/rate-limit', () => ({
   enforcePublicCredentialGroupIpRateLimit: mocks.rateLimit,
 }))
 vi.mock('@/lib/credential-groups/providers', () => ({
+  CREDENTIAL_GROUP_PROVIDER_IDS: ['confluence', 'slack'],
+  CREDENTIAL_GROUP_STANDARD_OAUTH_PROVIDER_IDS: ['confluence'],
   getCredentialGroupProviderService: (provider: string) => ({
     providerId: provider,
     name: provider === 'confluence' ? 'Confluence' : 'Slack',
@@ -77,6 +80,10 @@ function oauthLinks() {
 
 beforeEach(() => {
   vi.clearAllMocks()
+  authMockFns.mockGetSession.mockResolvedValue({
+    user: { id: 'member', email: 'member@example.test', emailVerified: true },
+    session: { id: 'session-1' },
+  })
   mocks.authenticate.mockResolvedValue(principal)
   mocks.rateLimit.mockResolvedValue(null)
   enrollment = {

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/dropdown/dropdown.test.tsx

@@ -76,6 +76,9 @@ vi.mock(
   '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/workflow-search-highlight',
   () => ({ getWorkflowSearchLabelHighlight: () => undefined })
 )
+vi.mock('@/hooks/queries/organization-accounts', () => ({
+  useWorkspaceOrganizationAccounts: () => ({ data: { allowed: false } }),
+}))
 vi.mock('@/hooks/use-operation-access', () => ({
   useOperationAccess: () => ({
     getDeniedOperations: () => new Set<string>(),
@@ -89,7 +92,7 @@ vi.mock('@/stores/workflows/workflow/store', () => ({
 }))
 vi.mock('@/stores/workflows/registry/store', () => ({
   useWorkflowRegistry: (selector: (state: unknown) => unknown) =>
-    selector({ activeWorkflowId: 'wf-1' }),
+    selector({ activeWorkflowId: 'wf-1', hydration: { workspaceId: 'workspace-1' } }),
 }))
 vi.mock('@/stores/workflows/subblock/store', () => ({
   useSubBlockStore: (selector: (state: unknown) => unknown) => selector({ workflowValues: {} }),

apps/sim/blocks/blocks/credential-group.test.ts

@@ -9,7 +9,8 @@ import { CredentialGroupBlock } from '@/blocks/blocks/credential-group'
 
 describe('Connected Accounts block', () => {
   it('uses the workspace container without selectable or manual group inputs', () => {
-    expect(CredentialGroupBlock.name).toBe('Connected Accounts')
+    expect(CredentialGroupBlock.name).toBe('Connected Accounts (Legacy)')
+    expect(CredentialGroupBlock.hideFromToolbar).toBe(true)
     const operation = CredentialGroupBlock.subBlocks.find((field) => field.id === 'operation')
     expect(operation?.options).toEqual([
       { label: 'List Credentials', id: 'list_credentials' },