refactor(oauth): apply simplify-pass cleanups to the inlined token resolution

Author: waleedlatif1

apps/sim/app/api/auth/oauth/token/route.ts

@@ -132,12 +132,10 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       callerUserId,
       auditRequest: request,
       authenticate: () => checkSessionOrInternalAuth(request, { requireWorkflowId: false }),
-      ...(managedOAuthDelegation
-        ? {
-            resolveManagedPrincipal: (managedCredentialId: string) =>
-              authenticateManagedOAuthDelegation(managedOAuthDelegation, managedCredentialId),
-          }
-        : {}),
+      resolveManagedPrincipal: managedOAuthDelegation
+        ? (managedCredentialId: string) =>
+            authenticateManagedOAuthDelegation(managedOAuthDelegation, managedCredentialId)
+        : undefined,
     })
 
     if (!result.ok) {

apps/sim/executor/utils/credential-token.ts

@@ -53,22 +53,20 @@ export async function resolveExecutorCredentialToken(
     callerUserId: userId && params.enforceCredentialAccess ? userId : undefined,
     authenticate: () => ({
       success: true,
-      ...(userId ? { userId } : {}),
+      userId,
       authType: AuthType.INTERNAL_JWT,
     }),
-    ...(executorDelegationOrigin
-      ? {
-          resolveManagedPrincipal: (managedCredentialId: string) =>
-            bindExecutorManagedOAuthDelegation(executorDelegationOrigin, managedCredentialId),
-        }
-      : {}),
+    resolveManagedPrincipal: executorDelegationOrigin
+      ? (managedCredentialId: string) =>
+          bindExecutorManagedOAuthDelegation(executorDelegationOrigin, managedCredentialId)
+      : undefined,
   })
 
   if (!result.ok) {
     logger.error(`[${requestId}] Credential token resolution failed`, {
       status: result.status,
       credentialId,
-      ...(result.code ? { code: result.code } : {}),
+      code: result.code,
     })
     throw new Error(
       `Failed to obtain credential for ${params.toolLabel ?? credentialId}: ${result.error}`

apps/sim/executor/utils/http.test.ts

@@ -4,66 +4,30 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const mocks = vi.hoisted(() => ({
-  generateInternalDelegationToken: vi.fn(),
   generateInternalToken: vi.fn(),
 }))
 
 vi.mock('@/lib/auth/internal', () => ({
-  generateInternalDelegationToken: mocks.generateInternalDelegationToken,
   generateInternalToken: mocks.generateInternalToken,
 }))
 
-import { buildAuthHeaders, buildExecutorDelegationHeaders } from '@/executor/utils/http'
+import { buildAuthHeaders } from '@/executor/utils/http'
 
 describe('executor HTTP authentication headers', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    mocks.generateInternalDelegationToken.mockResolvedValue('delegation-token')
     mocks.generateInternalToken.mockResolvedValue('legacy-token')
   })
 
   afterEach(() => {
     vi.unstubAllGlobals()
   })
 
-  it('issues a workflow-scoped executor delegation', async () => {
-    await expect(
-      buildExecutorDelegationHeaders({
-        subjectUserId: 'user-1',
-        workflowId: 'workflow-1',
-        executionId: 'execution-1',
-      })
-    ).resolves.toEqual({
-      'Content-Type': 'application/json',
-      Authorization: 'Bearer delegation-token',
-    })
-
-    expect(mocks.generateInternalDelegationToken).toHaveBeenCalledWith({
-      subjectUserId: 'user-1',
-      workflowId: 'workflow-1',
-      executionId: 'execution-1',
-    })
-    expect(mocks.generateInternalToken).not.toHaveBeenCalled()
-  })
-
-  it('fails instead of issuing trusted delegation headers in a browser', async () => {
-    vi.stubGlobal('window', {})
-
-    await expect(
-      buildExecutorDelegationHeaders({
-        subjectUserId: 'user-1',
-        workflowId: 'workflow-1',
-      })
-    ).rejects.toThrow('Executor delegation headers can only be created on the server')
-    expect(mocks.generateInternalDelegationToken).not.toHaveBeenCalled()
-  })
-
-  it('keeps the legacy helper separate during endpoint migration', async () => {
+  it('mints an internal token for server-side calls', async () => {
     await expect(buildAuthHeaders('user-1')).resolves.toEqual({
       'Content-Type': 'application/json',
       Authorization: 'Bearer legacy-token',
     })
     expect(mocks.generateInternalToken).toHaveBeenCalledWith('user-1')
-    expect(mocks.generateInternalDelegationToken).not.toHaveBeenCalled()
   })
 })

apps/sim/executor/utils/http.ts

@@ -1,12 +1,7 @@
-import {
-  type GenerateInternalDelegationTokenInput,
-  generateInternalDelegationToken,
-  generateInternalToken,
-} from '@/lib/auth/internal'
+import { generateInternalToken } from '@/lib/auth/internal'
 import { getBaseUrl, getInternalApiBaseUrl } from '@/lib/core/utils/urls'
 import { HTTP } from '@/executor/constants'
 
-/** @deprecated Use `buildExecutorDelegationHeaders` for protected application routes. */
 export async function buildAuthHeaders(userId?: string): Promise<Record<string, string>> {
   const headers: Record<string, string> = {
     'Content-Type': HTTP.CONTENT_TYPE.JSON,
@@ -20,21 +15,6 @@ export async function buildAuthHeaders(userId?: string): Promise<Record<string,
   return headers
 }
 
-/** Builds server-only headers for an executor call bound to its workflow execution origin. */
-export async function buildExecutorDelegationHeaders(
-  input: GenerateInternalDelegationTokenInput
-): Promise<Record<string, string>> {
-  if (typeof window !== 'undefined') {
-    throw new Error('Executor delegation headers can only be created on the server')
-  }
-
-  const token = await generateInternalDelegationToken(input)
-  return {
-    'Content-Type': HTTP.CONTENT_TYPE.JSON,
-    Authorization: `Bearer ${token}`,
-  }
-}
-
 export function buildAPIUrl(path: string, params?: Record<string, string>): URL {
   const baseUrl = path.startsWith('/api/') ? getInternalApiBaseUrl() : getBaseUrl()
   const url = new URL(path, baseUrl)

apps/sim/lib/credentials/application/managed-oauth-delegation.ts

@@ -45,9 +45,8 @@ export async function authenticateManagedOAuthDelegation(
 /**
  * In-process sibling of {@link authenticateManagedOAuthDelegation}: binds the
  * executor's own delegation origin to one managed credential without minting and
- * re-verifying a delegation JWT. The binding still re-validates the workflow and
- * deployment context, so trust matches the wire path minus the signature check,
- * which proves nothing when the executor is the caller.
+ * re-verifying a delegation JWT — see {@link createExecutorPrincipalFromDelegationOrigin}
+ * for why that loses nothing.
  */
 export async function bindExecutorManagedOAuthDelegation(
   origin: ExecutorDelegationOrigin,

apps/sim/lib/oauth/credential-service.test.ts

@@ -64,7 +64,7 @@ vi.mock('@/lib/oauth/terminal-errors', () => ({
   markCredentialDead: vi.fn(),
 }))
 
-import { resolveCredentialAccessToken } from '@/lib/oauth/credential-service'
+import { resolveCredentialTokenBundle } from '@/lib/oauth/credential-service'
 
 const RAW_CREDENTIAL_ID = 'credential-raw-secret-id'
 const RAW_ACCOUNT_ID = 'account-raw-secret-id'
@@ -127,7 +127,7 @@ async function observeRefresh(
   ])
 
   await expect(
-    resolveCredentialAccessToken(
+    resolveCredentialTokenBundle(
       RAW_CREDENTIAL_ID,
       RAW_USER_ID,
       'selector-execution',
@@ -149,7 +149,7 @@ async function observeRefresh(
   }
 }
 
-describe('resolveCredentialAccessToken selector privacy', () => {
+describe('resolveCredentialTokenBundle selector privacy', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     resetDbChainMock()

apps/sim/lib/oauth/credential-service.ts

@@ -1028,7 +1028,7 @@ export async function getOAuthToken(userId: string, providerId: string): Promise
  * Pipedrive's `x-api-token`. OAuth credentials resolve with `accessToken`
  * only.
  */
-export async function resolveCredentialAccessToken(
+export async function resolveCredentialTokenBundle(
   credentialId: string,
   userId: string,
   requestId: string,
@@ -1131,7 +1131,7 @@ export async function resolveCredentialAccessToken(
 /**
  * Refreshes an OAuth token if needed based on credential information.
  * Also handles service account credentials by generating a JWT-based token.
- * Thin string wrapper over {@link resolveCredentialAccessToken}.
+ * Thin string wrapper over {@link resolveCredentialTokenBundle}.
  * @param credentialId The ID of the credential to check and potentially refresh
  * @param userId The user ID who owns the credential (for security verification)
  * @param requestId Request ID for log correlation
@@ -1146,7 +1146,7 @@ export async function refreshAccessTokenIfNeeded(
   impersonateEmail?: string,
   options?: CredentialTokenResolutionOptions
 ): Promise<string | null> {
-  const result = await resolveCredentialAccessToken(
+  const result = await resolveCredentialTokenBundle(
     credentialId,
     userId,
     requestId,

apps/sim/lib/oauth/token-resolution.test.ts

@@ -92,7 +92,6 @@ const INTERNAL_AUTH = { success: true, userId: 'user-1', authType: 'internal_jwt
 describe('resolveCredentialToken', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    mockResolveOAuthAccountId.mockResolvedValue(null)
   })
 
   it('fails closed when the credential is not authorized', async () => {
@@ -103,6 +102,7 @@ describe('resolveCredentialToken', () => {
 
     const result = await resolveCredentialToken(INTERNAL_AUTH, {
       requestId: 'req-1',
+      resolvedCredential: null,
       credentialId: 'cred-1',
     })
 
@@ -124,7 +124,7 @@ describe('resolveCredentialToken', () => {
 
     const result = await resolveCredentialToken(
       { success: true, authType: 'internal_jwt' },
-      { requestId: 'req-1', credentialId: 'cred-1' }
+      { requestId: 'req-1', credentialId: 'cred-1', resolvedCredential: null }
     )
 
     expect(result).toEqual({ ok: false, status: 403, error: 'Authentication required' })
@@ -147,6 +147,7 @@ describe('resolveCredentialToken', () => {
 
     const result = await resolveCredentialToken(INTERNAL_AUTH, {
       requestId: 'req-1',
+      resolvedCredential: null,
       credentialId: 'cred-1',
       workflowId: 'wf-1',
     })
@@ -177,6 +178,7 @@ describe('resolveCredentialToken', () => {
 
     const result = await resolveCredentialToken(INTERNAL_AUTH, {
       requestId: 'req-1',
+      resolvedCredential: null,
       credentialId: 'cred-1',
     })
 
@@ -201,6 +203,7 @@ describe('resolveCredentialToken', () => {
     await expect(
       resolveCredentialToken(INTERNAL_AUTH, {
         requestId: 'req-1',
+        resolvedCredential: null,
         credentialId: 'cred-1',
       })
     ).resolves.toEqual({
@@ -231,6 +234,7 @@ describe('resolveCredentialToken', () => {
     await expect(
       resolveCredentialToken(INTERNAL_AUTH, {
         requestId: 'req-1',
+        resolvedCredential: null,
         credentialId: 'cred-1',
       })
     ).resolves.toEqual({
@@ -251,6 +255,7 @@ describe('resolveCredentialToken', () => {
 
     const result = await resolveCredentialToken(INTERNAL_AUTH, {
       requestId: 'req-1',
+      resolvedCredential: null,
       credentialId: 'cred-1',
     })
 
@@ -259,34 +264,26 @@ describe('resolveCredentialToken', () => {
   })
 
   it('authorizes service-account credentials before minting a token', async () => {
-    mockResolveOAuthAccountId.mockResolvedValue({
-      credentialType: 'service_account',
-      credentialId: 'sa-1',
-      providerId: 'google',
-      workspaceId: 'ws-1',
-      accountId: '',
-      usedCredentialTable: true,
-    })
     mockAuthorizeCredentialUseForAuth.mockResolvedValue({ ok: false, error: 'Unauthorized' })
 
     const result = await resolveCredentialToken(INTERNAL_AUTH, {
       requestId: 'req-1',
       credentialId: 'cred-1',
+      resolvedCredential: {
+        credentialType: 'service_account',
+        credentialId: 'sa-1',
+        providerId: 'google',
+        workspaceId: 'ws-1',
+        accountId: '',
+        usedCredentialTable: true,
+      },
     })
 
     expect(result).toEqual({ ok: false, status: 403, error: 'Unauthorized' })
     expect(mockResolveServiceAccountToken).not.toHaveBeenCalled()
   })
 
   it('surfaces the classified service-account failure code', async () => {
-    mockResolveOAuthAccountId.mockResolvedValue({
-      credentialType: 'service_account',
-      credentialId: 'sa-1',
-      providerId: 'atlassian',
-      workspaceId: 'ws-1',
-      accountId: '',
-      usedCredentialTable: true,
-    })
     mockAuthorizeCredentialUseForAuth.mockResolvedValue({ ok: true, requesterUserId: 'user-1' })
     mockResolveServiceAccountToken.mockRejectedValue(
       new TokenServiceAccountValidationError('invalid_credentials', 401)
@@ -295,6 +292,14 @@ describe('resolveCredentialToken', () => {
     const result = await resolveCredentialToken(INTERNAL_AUTH, {
       requestId: 'req-1',
       credentialId: 'cred-1',
+      resolvedCredential: {
+        credentialType: 'service_account',
+        credentialId: 'sa-1',
+        providerId: 'atlassian',
+        workspaceId: 'ws-1',
+        accountId: '',
+        usedCredentialTable: true,
+      },
     })
 
     expect(result).toEqual({
@@ -308,6 +313,7 @@ describe('resolveCredentialToken', () => {
   it('rejects a malformed impersonation subject before touching the credential', async () => {
     const result = await resolveCredentialToken(INTERNAL_AUTH, {
       requestId: 'req-1',
+      resolvedCredential: null,
       credentialId: 'cred-1',
       impersonateEmail: 'not-an-email',
     })
@@ -378,6 +384,27 @@ describe('resolveCredentialAccessToken', () => {
     })
   })
 
+  it('treats an empty impersonation subject as absent', async () => {
+    mockAuthorizeCredentialUseForAuth.mockResolvedValue({
+      ok: true,
+      requesterUserId: 'user-1',
+      credentialOwnerUserId: 'owner-1',
+      workspaceId: 'ws-1',
+      resolvedCredentialId: 'account-1',
+    })
+    mockGetCredential.mockResolvedValue({ providerId: 'google' })
+    mockRefreshTokenIfNeeded.mockResolvedValue({ accessToken: 'fresh', refreshed: false })
+
+    const result = await resolveCredentialAccessToken({
+      requestId: 'req-1',
+      credentialId: 'cred-1',
+      impersonateEmail: '',
+      authenticate,
+    })
+
+    expect(result).toEqual({ ok: true, token: { accessToken: 'fresh', idToken: undefined } })
+  })
+
   it('rejects a managed credential when no delegation resolver is wired', async () => {
     mockResolveOAuthAccountId.mockResolvedValue(MANAGED_RESOLVED)