The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		May 21, 2026 11:56pm

PR Summary

Medium Risk
Touches OAuth token refresh behavior and introduces Redis-backed coordination/caching; failures could impact access-token availability or refresh frequency under concurrency.

Overview
OAuth refreshes are now coordinated and de-duplicated per account. Token refresh logic in app/api/auth/oauth/utils.ts is refactored to a shared performCoalescedRefresh that uses local singleflight plus a Redis-based withLeaderLock so only one concurrent request hits the provider while others poll the DB for the updated token.

Refresh failure handling is hardened. refreshOAuthToken now returns a structured { ok: true|false } result (including Slack-style HTTP 200 { ok: false } bodies and extracted errorCode), and terminal refresh errors are cached in Redis for 1 hour via new lib/oauth/terminal-errors.ts to short-circuit repeated failing refresh attempts; the dead flag is cleared on credential create/reconnect.

New concurrency utilities and tests added. Introduces lib/concurrency/singleflight.ts and lib/concurrency/leader-lock.ts with corresponding unit tests, and updates existing OAuth util tests to mock Redis and the new result shape.

^{Reviewed by Cursor Bugbot for commit b424129. Configure here.}

Greptile Summary

This PR eliminates the OAuth token-refresh race condition by introducing a two-layer coalescing strategy: coalesceLocally deduplicates concurrent refreshes within a single process, while withLeaderLock coordinates across processes via a Redis distributed lock. It also changes refreshOAuthToken to return a discriminated union (RefreshTokenResult) instead of null, detects Slack-style HTTP 200 + {ok:false} body errors, and caches terminal failures in Redis for 1 hour to stop retry storms.

• singleflight.ts + leader-lock.ts: New concurrency primitives; in-process deduplication plus Redis leader election with correct fallback when Redis is unavailable.
• terminal-errors.ts: Redis-backed dead-flag cache with graceful no-op on Redis absence; flag cleared on reconnect via draft-hooks.ts.
• utils.ts: All four refresh call sites consolidated into performCoalescedRefresh; prior behaviour (proactive-refresh fallback to still-valid token, resolvedCredentialId for DB writes) is preserved.

Confidence Score: 5/5

Safe to merge; the coalescing logic is well-tested and all Redis operations degrade gracefully to pre-PR behaviour when unavailable.

The concurrency primitives are correct, the fallback paths (Redis down → uncoordinated leader, lock release failure → TTL expiry) are exercised by tests, and all four refresh call sites now go through the coalesced path. The one non-blocking concern is that a handful of OAuth app-level error codes in the terminal set could cause user-visible reconnect requirements after a server misconfiguration.

apps/sim/lib/oauth/terminal-errors.ts — the TERMINAL_ERRORS set includes app-level OAuth config errors alongside user-level credential errors.

Important Files Changed

_{Reviews (4): Last reviewed commit: "improvement(oauth): coalesce token refre..." | Re-trigger Greptile}

@greptile

@cursor review

@greptile

@cursor review

@greptile

@cursor review