chore(auth): drop comments the 1.7 upgrade made stale and pass the delegated token body directly

Author: waleedlatif1

apps/sim/app/api/auth/oauth2/token/route.ts

@@ -88,12 +88,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       delegatedForm.delete('resource')
       const response = await withOAuthResourceIssuance(resource, () =>
         withOAuthProviderIssuanceCompensation(() =>
-          betterAuthPOST(
-            buildDelegatedOAuthRequest(request, {
-              ...parsed.value,
-              rawBody: delegatedForm.toString(),
-            })
-          )
+          betterAuthPOST(buildDelegatedOAuthRequest(request, delegatedForm.toString()))
         )
       )
       return normalizeDelegatedOAuthTokenResponse(response, parsed.value.credentials.method)

apps/sim/lib/auth/oauth-protocol-request.ts

@@ -231,24 +231,21 @@ async function readBoundedOAuthBody(request: Request): Promise<OAuthBodyReadResu
 }
 
 /**
- * Rebuilds the consumed request for Better Auth.
+ * Rebuilds the consumed request for Better Auth with `body` as its form.
  * Client credentials keep the transport the client authenticated with: Better
  * Auth form-decodes Basic credentials itself and refuses a client that
  * presents them by any method other than the one it registered. A DPoP proof
  * is dropped: Sim's resource servers accept only bearer tokens, so a
  * DPoP-bound token would be unusable.
  */
-export function buildDelegatedOAuthRequest(
-  request: NextRequest,
-  parsed: ParsedOAuthForm
-): NextRequest {
+export function buildDelegatedOAuthRequest(request: NextRequest, body: string): NextRequest {
   const headers = new Headers(request.headers)
   headers.delete('content-length')
   headers.delete('dpop')
   return new NextRequest(request.url, {
     method: request.method,
     headers,
-    body: parsed.rawBody,
+    body,
     signal: request.signal,
   })
 }

apps/sim/lib/auth/oauth-token-family.ts

@@ -151,7 +151,7 @@ async function authenticateClient(
     return { success: true, value: client }
   }
 
-  /** Better Auth 1.6 marked public clients with `public`; 1.7 only registers them with `none`. */
+  /** A client flagged `public` never authenticates with a secret, whatever method it carries. */
   if (client.public || !client.clientSecret || !credentials.clientSecret) {
     return protocolError('invalid_client', 'Client authentication failed.')
   }

apps/sim/lib/auth/sso/application/provider-registration.ts

@@ -54,10 +54,9 @@ function failSsoProvider(status: number, message: string, reason?: string): neve
 type TokenEndpointAuthMethod = 'client_secret_basic' | 'client_secret_post'
 
 /**
- * Prefers client_secret_post over client_secret_basic when an IdP supports both:
- * better-auth sends client_secret_basic credentials without URL-encoding per
- * RFC 6749 §2.3.1, so a '+' in the client secret is decoded as a space, causing
- * invalid_client errors. Matches the same default in register-sso-provider.ts.
+ * Prefers client_secret_post over client_secret_basic when an IdP supports both, so new
+ * providers authenticate the way existing ones do. Matches the same default in
+ * register-sso-provider.ts.
  */
 function selectTokenEndpointAuthMethod(
   supportedMethods: unknown,

packages/db/scripts/register-sso-provider.ts

@@ -597,9 +597,7 @@ async function registerSSOProvider(): Promise<boolean> {
         clientSecret: ssoConfig.oidcConfig.clientSecret,
         authorizationEndpoint: ssoConfig.oidcConfig.authorizationEndpoint,
         tokenEndpoint: ssoConfig.oidcConfig.tokenEndpoint,
-        // Default to client_secret_post: better-auth sends client_secret_basic
-        // credentials without URL-encoding per RFC 6749 §2.3.1, so '+' in secrets
-        // is decoded as space by OIDC providers, causing invalid_client errors.
+        // Matches the default of providers saved in the app.
         tokenEndpointAuthentication:
           ssoConfig.oidcConfig.tokenEndpointAuthentication ?? 'client_secret_post',
         jwksEndpoint: ssoConfig.oidcConfig.jwksEndpoint,