Summary
OAuth reconnect drafts are selected by broad ambient context rather than one exact protected flow. Tighten the shared credential-draft lifecycle so concurrent and cross-provider OAuth flows cannot consume or mutate the wrong draft.
Required changes
- validate reconnect target credential type, provider, workspace, and provider-specific environment at draft creation
- return the draft ID and bind it into protected OAuth state
- process the exact draft row identified by that protected state during callback
- repeat type, provider, workspace, and environment checks before the final credential mutation
- preserve ordinary new-credential and legacy OAuth behavior where the same invariants hold
Tests
- concurrent OAuth tabs in one workspace
- concurrent OAuth flows across workspaces
- cross-provider reconnect attempts
- wrong credential type and wrong target credential
- provider-specific environment mismatch
- exact-flow success and replay/expired-draft rejection
Context
This is a platform-wide credential integrity change affecting generic OAuth and custom OAuth flows. It is intentionally separate from Dynamics 365 CRM PR #6714, which adds UI-level environment binding but must not absorb shared draft infrastructure changes.
Summary
OAuth reconnect drafts are selected by broad ambient context rather than one exact protected flow. Tighten the shared credential-draft lifecycle so concurrent and cross-provider OAuth flows cannot consume or mutate the wrong draft.
Required changes
Tests
Context
This is a platform-wide credential integrity change affecting generic OAuth and custom OAuth flows. It is intentionally separate from Dynamics 365 CRM PR #6714, which adds UI-level environment binding but must not absorb shared draft infrastructure changes.