fix(credentials): restore reliable OAuth connections - #6753

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 16, 2026 12:34am

PR Summary

High Risk
Changes touch OAuth callback handling, credential creation, and desktop handoff paths; mis-binding or stricter after-hook failures could block or mis-attach workspace credentials.

Overview
This PR tightens OAuth credential linking so each launch binds to an exact draft id, survives Better Auth’s deferred account hooks, and reports verified outcomes instead of optimistic success toasts.

Draft lifecycle: createConnectDraft now rotates the draft primary key on conflict instead of only refreshing TTL, so a newer connect invalidates stale callbacks. The draft API returns draftId, and web/desktop flows pass draftId / credentialDraftId through connect URLs, OAuth callbackURL, and desktop handoff IPC (with validation).

Better Auth: Draft binding is captured in account.create.before on OAuth callbacks and consumed in the after-hook via request-scoped storage, fixing lost state when processing is deferred. OAuth callbacks without a captured binding fail rather than silently skipping draft processing.

Idempotency & UX: Duplicate workspace+account inserts are handled as reconnect (bump updatedAt, audit) instead of being ignored. Post-OAuth messaging compares baseline credentials (accountId / updatedAt) and can show errors when verification fails; explicit reconnect: true paths keep reconnect success without a baseline. displayNameDefinesIntent and active-draft conflict errors are removed.

^{Reviewed by Cursor Bugbot for commit 25f6ba9. Bugbot is set up for automated code reviews on this repo. Configure here.}

@greptile

Greptile Summary

This PR carries exact credential-draft state through browser and desktop OAuth flows, lets newer launches supersede stale drafts, and verifies idempotent account connections. The new timestamp-based verification can still attribute an unrelated credential update to the current OAuth attempt.

• Propagates draft IDs through desktop IPC, handoff URLs, and OAuth callback state.
• Captures credential-draft state across Better Auth account hooks.
• Handles workspace/account conflicts idempotently and adds return-result verification.

Confidence Score: 4/5

The PR should not merge until OAuth return verification can distinguish the current authorization from unrelated credential timestamp updates.

The return path currently treats any post-launch updatedAt change on a same-provider credential as proof of this OAuth attempt, so concurrent edits or authorizations can produce a verified success for a failed or abandoned flow.

Files Needing Attention: apps/sim/hooks/use-oauth-return.ts

sequenceDiagram
  participant UI as Workspace UI
  participant OAuth as OAuth Provider
  participant Auth as Better Auth Callback
  participant DB as Credential Store
  UI->>UI: Snapshot credential IDs/account IDs/updatedAt
  UI->>OAuth: Launch OAuth with exact draft ID
  OAuth->>Auth: Provider callback
  Auth->>DB: Create, reconnect, or bump existing credential
  Auth-->>UI: Return to application
  UI->>DB: Reload workspace credentials
  UI->>UI: Infer outcome from count/accountId/updatedAt delta

_{Reviews (4): Last reviewed commit: "fix(credentials): preserve reauthorizati..." | Re-trigger Greptile}

@cursor review

@greptile

@cursor review

@greptile