fix(monday): address OAuth review feedback

Author: Bill Leoutsakos

apps/sim/app/api/auth/oauth/utils.test.ts

@@ -142,42 +142,19 @@ describe('OAuth Utils', () => {
         refreshToken: 'new-refresh-token',
       })
 
-      mockUpdateChain()
+      const { mockSet } = mockUpdateChain()
 
       const result = await refreshTokenIfNeeded('request-id', mockCredential, 'credential-id')
 
       expect(mockRefreshOAuthToken).toHaveBeenCalledWith('google', 'refresh-token')
-      expect(mockDb.update).toHaveBeenCalled()
-      expect(result).toEqual({ accessToken: 'new-token', refreshed: true })
-    })
-
-    it('persists a rotated Monday refresh token with the refreshed access token', async () => {
-      const credential = {
-        id: 'monday-credential-id',
-        accessToken: 'expired-monday-token',
-        refreshToken: 'old-monday-refresh-token',
-        accessTokenExpiresAt: new Date(Date.now() - 60_000),
-        providerId: 'monday',
-      }
-      mockRefreshOAuthToken.mockResolvedValueOnce({
-        ok: true,
-        accessToken: 'new-monday-token',
-        expiresIn: 3600,
-        refreshToken: 'rotated-monday-refresh-token',
-      })
-      const { mockSet } = mockUpdateChain()
-
-      const result = await refreshTokenIfNeeded('request-id', credential, credential.id)
-
-      expect(mockRefreshOAuthToken).toHaveBeenCalledWith('monday', 'old-monday-refresh-token')
       expect(mockSet).toHaveBeenCalledWith(
         expect.objectContaining({
-          accessToken: 'new-monday-token',
-          refreshToken: 'rotated-monday-refresh-token',
+          accessToken: 'new-token',
+          refreshToken: 'new-refresh-token',
           accessTokenExpiresAt: expect.any(Date),
         })
       )
-      expect(result).toEqual({ accessToken: 'new-monday-token', refreshed: true })
+      expect(result).toEqual({ accessToken: 'new-token', refreshed: true })
     })
 
     it('should handle refresh token error', async () => {

apps/sim/lib/credential-groups/standard-oauth-provider.test.ts

@@ -44,32 +44,6 @@ vi.mock('@/lib/auth/connectors/managed-oauth', () => ({
         },
       }
     }
-    if (providerId === 'monday') {
-      return {
-        providerId,
-        clientId: 'monday-client-1',
-        clientSecret: 'monday-secret-1',
-        authorizationUrl: 'https://auth.monday.com/oauth2/authorize',
-        tokenUrl: 'https://auth.monday.com/oauth_ms/oauth/token',
-        redirectURI: 'https://sim.example.com/api/auth/oauth2/callback/monday',
-        scopes: ['boards:read', 'me:read'],
-        responseType: 'code',
-        authentication: 'post',
-        getToken: mockGetToken,
-        managedOAuth: {
-          additionalScopes: [],
-          requiresRefreshToken: true,
-          pkce: true,
-          nonceVerification: 'state_only',
-          includeLoginHint: false,
-          getAuthorizationAppId: (clientId: string) => `monday:${clientId}`,
-          verifyIdentity: mockVerifyIdentity,
-          hasRequiredScopes: (granted: string[], required: string[]) =>
-            required.every((scope) => granted.includes(scope)),
-          isTerminalRefreshError: (errorCode: string | undefined) => errorCode === 'invalid_grant',
-        },
-      }
-    }
     if (providerId === 'jira') {
       return {
         providerId,
@@ -108,7 +82,6 @@ import { createStandardOAuthCredentialGroupProviderAdapter } from '@/lib/credent
 
 const adapter = createStandardOAuthCredentialGroupProviderAdapter('google-calendar')
 const jiraAdapter = createStandardOAuthCredentialGroupProviderAdapter('jira')
-const mondayAdapter = createStandardOAuthCredentialGroupProviderAdapter('monday')
 
 function buildContext(): CredentialGroupOAuthContext {
   return {
@@ -237,82 +210,6 @@ describe('standard OAuth Credential Group provider', () => {
     })
   })
 
-  it('uses PKCE and persists expiring rotating credentials for managed Monday OAuth', async () => {
-    const requiredScopes = ['boards:read', 'me:read']
-    const context: CredentialGroupOAuthContext = {
-      ...buildContext(),
-      option: {
-        ...buildContext().option,
-        provider: 'monday',
-        label: 'Monday.com',
-        authorizationAppId: 'monday:monday-client-1',
-        requiredScopes,
-      },
-    }
-    const policy = await mondayAdapter.getPolicy(context.option, {
-      workspaceId: context.workspaceId,
-      credentialGroupId: context.credentialGroupId,
-    })
-    const prepared = await mondayAdapter.prepareAuthorization(context, policy)
-    const authorizationUrl = new URL(
-      await prepared.buildAuthorizationUrl({ state: 'monday-state-1', nonce: 'nonce-ignored' })
-    )
-
-    expect(mondayAdapter.requiresRefreshToken).toBe(true)
-    expect(prepared.codeVerifier).toHaveLength(86)
-    expect(authorizationUrl.searchParams.get('code_challenge_method')).toBe('S256')
-    expect(authorizationUrl.searchParams.get('code_challenge')).toBeTruthy()
-
-    const accessTokenExpiresAt = new Date('2026-08-14T01:00:00Z')
-    mockGetToken.mockResolvedValueOnce({
-      tokenType: 'Bearer',
-      accessToken: 'monday-access-1',
-      refreshToken: 'monday-refresh-1',
-      accessTokenExpiresAt,
-      scopes: requiredScopes,
-    })
-    mockVerifyIdentity.mockResolvedValueOnce({
-      providerSubjectId: 'monday-user-1',
-      providerTenantId: null,
-      email: 'person@example.com',
-      emailVerified: true,
-      grantedScopes: requiredScopes,
-    })
-
-    const grant = await mondayAdapter.exchangeAndVerify({
-      context,
-      attempt: {
-        state: 'monday-state-1',
-        provider: 'monday',
-        nonceHash: 'unused-for-state-bound-provider',
-        enrollmentId: context.enrollmentId,
-        credentialGroupId: context.credentialGroupId,
-        optionId: context.option.id,
-        authorizationAppId: policy.authorizationAppId,
-        scopeVersion: policy.scopeVersion,
-        requiredScopes,
-        redirectUri: prepared.redirectUri,
-        codeVerifier: prepared.codeVerifier,
-        invitationToken: 'invitation-1',
-        createdAt: Date.now(),
-      },
-      code: 'monday-code-1',
-      policy,
-    })
-
-    expect(mockGetToken).toHaveBeenLastCalledWith({
-      code: 'monday-code-1',
-      redirectURI: 'https://sim.example.com/api/auth/oauth2/callback/monday',
-      codeVerifier: prepared.codeVerifier,
-    })
-    expect(grant).toMatchObject({
-      accessToken: 'monday-access-1',
-      refreshToken: 'monday-refresh-1',
-      accessTokenExpiresAt,
-      grantedScopes: requiredScopes,
-    })
-  })
-
   it('rejects a different invited email', async () => {
     mockVerifyIdentity.mockResolvedValueOnce({
       providerSubjectId: 'google-sub-2',

apps/sim/lib/credentials/managed-oauth.test.ts

@@ -2,13 +2,14 @@
  * @vitest-environment node
  */
 import { dbChainMockFns, resetDbChainMock } from '@sim/testing'
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const mocks = vi.hoisted(() => ({
   getBilling: vi.fn(),
   isAvailable: vi.fn(),
   getAdapter: vi.fn(),
   decryptSecret: vi.fn(),
+  encryptSecret: vi.fn(),
 }))
 
 vi.mock('@/lib/billing/core/workspace-access', () => ({
@@ -25,15 +26,44 @@ vi.mock('@/lib/credential-groups/provider-registry', () => ({
 
 vi.mock('@/lib/core/security/encryption', () => ({
   decryptSecret: mocks.decryptSecret,
-  encryptSecret: vi.fn(),
+  encryptSecret: mocks.encryptSecret,
 }))
 
 import { resolveManagedOAuthToken } from '@/lib/credentials/managed-oauth'
 
+function mondayCredentialRow() {
+  return {
+    id: 'credential-1',
+    workspaceId: 'workspace-1',
+    type: 'managed_oauth',
+    providerId: 'monday',
+    authorizationAppId: 'monday:monday-client-1',
+    managedOauthScopeVersion: 1,
+    managedOauthStatus: 'active',
+    grantedScopes: ['boards:read', 'me:read'],
+    encryptedOauthTokenSet: 'encrypted-token-set',
+    accessTokenExpiresAt: new Date('2026-09-01T11:00:00.000Z'),
+    refreshTokenExpiresAt: null,
+    credentialGroupId: 'group-1',
+    credentialGroupEnrollmentId: 'enrollment-1',
+  }
+}
+
+function mondayTokenResolutionParams() {
+  return {
+    credentialId: 'credential-1',
+    workspaceId: 'workspace-1',
+    expectedProviderId: 'monday',
+    requiredScopes: ['boards:read', 'me:read'],
+  }
+}
+
 describe('managed OAuth token resolution', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     resetDbChainMock()
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date('2026-09-01T12:00:00.000Z'))
     mocks.getBilling.mockResolvedValue({ plan: 'enterprise' })
     mocks.isAvailable.mockResolvedValue(true)
     mocks.decryptSecret.mockResolvedValue({
@@ -53,6 +83,10 @@ describe('managed OAuth token resolution', () => {
     })
   })
 
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
   it('uses a non-expiring Slack access token without entering refresh', async () => {
     dbChainMockFns.limit.mockResolvedValueOnce([
       {
@@ -80,4 +114,98 @@ describe('managed OAuth token resolution', () => {
     ).resolves.toEqual({ accessToken: 'xoxp-slack-token', refreshed: false })
     expect(dbChainMockFns.transaction).not.toHaveBeenCalled()
   })
+
+  it('refreshes an expired Monday credential and persists its rotated token set', async () => {
+    const row = mondayCredentialRow()
+    dbChainMockFns.limit.mockResolvedValueOnce([row]).mockResolvedValueOnce([row])
+    dbChainMockFns.returning.mockResolvedValueOnce([{ id: row.id }])
+    mocks.decryptSecret.mockResolvedValue({
+      decrypted: JSON.stringify({
+        type: 'managed-oauth-token-set',
+        version: 1,
+        tokenType: 'Bearer',
+        accessToken: 'expired-access-token',
+        refreshToken: 'old-refresh-token',
+      }),
+    })
+    mocks.encryptSecret.mockResolvedValue({ encrypted: 'encrypted-rotated-token-set' })
+    const refreshToken = vi.fn().mockResolvedValue({
+      ok: true,
+      accessToken: 'new-access-token',
+      refreshToken: 'rotated-refresh-token',
+      expiresIn: 3600,
+    })
+    mocks.getAdapter.mockReturnValue({
+      getPolicy: vi.fn().mockResolvedValue({
+        authorizationAppId: row.authorizationAppId,
+        scopeVersion: 1,
+      }),
+      hasRequiredScopes: vi.fn().mockReturnValue(true),
+      refreshToken,
+      isTerminalRefreshError: vi.fn().mockReturnValue(false),
+    })
+
+    await expect(resolveManagedOAuthToken(mondayTokenResolutionParams())).resolves.toEqual({
+      accessToken: 'new-access-token',
+      refreshed: true,
+    })
+
+    expect(refreshToken).toHaveBeenCalledWith('old-refresh-token')
+    const [serializedTokenSet] = mocks.encryptSecret.mock.calls[0] as [string]
+    expect(JSON.parse(serializedTokenSet)).toEqual({
+      type: 'managed-oauth-token-set',
+      version: 1,
+      tokenType: 'Bearer',
+      accessToken: 'new-access-token',
+      refreshToken: 'rotated-refresh-token',
+    })
+    expect(dbChainMockFns.set).toHaveBeenCalledWith(
+      expect.objectContaining({
+        encryptedOauthTokenSet: 'encrypted-rotated-token-set',
+        accessTokenExpiresAt: new Date('2026-09-01T13:00:00.000Z'),
+        lastRefreshedAt: new Date('2026-09-01T12:00:00.000Z'),
+      })
+    )
+  })
+
+  it('marks an expired Monday credential for reauthorization after a terminal refresh error', async () => {
+    const row = mondayCredentialRow()
+    dbChainMockFns.limit.mockResolvedValueOnce([row]).mockResolvedValueOnce([row])
+    mocks.decryptSecret.mockResolvedValue({
+      decrypted: JSON.stringify({
+        type: 'managed-oauth-token-set',
+        version: 1,
+        tokenType: 'Bearer',
+        accessToken: 'expired-access-token',
+        refreshToken: 'old-refresh-token',
+      }),
+    })
+    const refreshToken = vi.fn().mockResolvedValue({
+      ok: false,
+      errorCode: 'invalid_grant',
+      message: 'Refresh token rejected',
+    })
+    const isTerminalRefreshError = vi.fn().mockReturnValue(true)
+    mocks.getAdapter.mockReturnValue({
+      getPolicy: vi.fn().mockResolvedValue({
+        authorizationAppId: row.authorizationAppId,
+        scopeVersion: 1,
+      }),
+      hasRequiredScopes: vi.fn().mockReturnValue(true),
+      refreshToken,
+      isTerminalRefreshError,
+    })
+
+    await expect(resolveManagedOAuthToken(mondayTokenResolutionParams())).rejects.toMatchObject({
+      code: 'MANAGED_CREDENTIAL_NEEDS_REAUTH',
+      statusCode: 401,
+    })
+
+    expect(refreshToken).toHaveBeenCalledWith('old-refresh-token')
+    expect(isTerminalRefreshError).toHaveBeenCalledWith('invalid_grant')
+    expect(dbChainMockFns.set).toHaveBeenCalledWith(
+      expect.objectContaining({ managedOauthStatus: 'needs_reauth' })
+    )
+    expect(mocks.encryptSecret).not.toHaveBeenCalled()
+  })
 })

apps/sim/lib/oauth/monday.test.ts

@@ -2,7 +2,6 @@
  * @vitest-environment node
  */
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import { DEFAULT_MAX_ERROR_BODY_BYTES } from '@/lib/core/utils/stream-limits'
 import {
   exchangeMondayAuthorizationCode,
   MONDAY_OAUTH_TOKEN_URL,
@@ -94,6 +93,15 @@ describe('Monday OAuth 2.1', () => {
     expect(expiresAt).toEqual(new Date(jwtExpirySeconds * 1000))
   })
 
+  it('preserves an expired JWT expiration so the credential refreshes immediately', () => {
+    const now = new Date('2026-09-01T12:00:00.000Z')
+    const jwtExpirySeconds = Math.floor(now.getTime() / 1000) - 60
+
+    expect(
+      resolveMondayAccessTokenExpiresAt(unsignedJwt({ exp: jwtExpirySeconds }), 3600, now)
+    ).toEqual(new Date(jwtExpirySeconds * 1000))
+  })
+
   it('falls back to expires_in and then one hour for an opaque access token', () => {
     const now = new Date('2026-09-01T12:00:00.000Z')
 
@@ -147,21 +155,4 @@ describe('Monday OAuth 2.1', () => {
     expect((error as Error).message).toBe('Monday OAuth token exchange failed with HTTP 400')
     expect((error as Error).message).not.toContain(providerSecret)
   })
-
-  it('bounds the token endpoint response', async () => {
-    vi.stubGlobal(
-      'fetch',
-      vi.fn().mockResolvedValue(new Response('x'.repeat(DEFAULT_MAX_ERROR_BODY_BYTES + 1)))
-    )
-
-    await expect(
-      exchangeMondayAuthorizationCode({
-        clientId: 'client-id',
-        clientSecret: 'client-secret',
-        code: 'authorization-code',
-        codeVerifier: 'pkce-verifier',
-        redirectUri: 'https://www.sim.ai/api/auth/oauth2/callback/monday',
-      })
-    ).rejects.toThrow('exceeds maximum size')
-  })
 })

apps/sim/lib/oauth/monday.ts

@@ -53,7 +53,7 @@ export function resolveMondayAccessTokenExpiresAt(
 ): Date {
   try {
     const { exp } = decodeJwt(accessToken)
-    if (typeof exp === 'number' && Number.isFinite(exp) && exp * 1000 > now.getTime()) {
+    if (typeof exp === 'number' && Number.isFinite(exp)) {
       const expiresAt = new Date(exp * 1000)
       if (!Number.isNaN(expiresAt.getTime())) return expiresAt
     }