fix(monday): support OAuth 2.1

Author: Bill Leoutsakos

apps/sim/app/api/auth/oauth/utils.test.ts

@@ -151,6 +151,35 @@ describe('OAuth Utils', () => {
       expect(result).toEqual({ accessToken: 'new-token', refreshed: true })
     })
 
+    it('persists a rotated Monday refresh token with the refreshed access token', async () => {
+      const credential = {
+        id: 'monday-credential-id',
+        accessToken: 'expired-monday-token',
+        refreshToken: 'old-monday-refresh-token',
+        accessTokenExpiresAt: new Date(Date.now() - 60_000),
+        providerId: 'monday',
+      }
+      mockRefreshOAuthToken.mockResolvedValueOnce({
+        ok: true,
+        accessToken: 'new-monday-token',
+        expiresIn: 3600,
+        refreshToken: 'rotated-monday-refresh-token',
+      })
+      const { mockSet } = mockUpdateChain()
+
+      const result = await refreshTokenIfNeeded('request-id', credential, credential.id)
+
+      expect(mockRefreshOAuthToken).toHaveBeenCalledWith('monday', 'old-monday-refresh-token')
+      expect(mockSet).toHaveBeenCalledWith(
+        expect.objectContaining({
+          accessToken: 'new-monday-token',
+          refreshToken: 'rotated-monday-refresh-token',
+          accessTokenExpiresAt: expect.any(Date),
+        })
+      )
+      expect(result).toEqual({ accessToken: 'new-monday-token', refreshed: true })
+    })
+
     it('should handle refresh token error', async () => {
       const mockCredential = {
         id: 'credential-id',
@@ -185,6 +214,21 @@ describe('OAuth Utils', () => {
       expect(mockRefreshOAuthToken).not.toHaveBeenCalled()
       expect(result).toEqual({ accessToken: 'token', refreshed: false })
     })
+
+    it('keeps a legacy non-expiring Monday credential usable without refreshing it', async () => {
+      const legacyCredential = {
+        id: 'legacy-monday-credential-id',
+        accessToken: 'legacy-monday-access-token',
+        refreshToken: null,
+        accessTokenExpiresAt: null,
+        providerId: 'monday',
+      }
+
+      const result = await refreshTokenIfNeeded('request-id', legacyCredential, legacyCredential.id)
+
+      expect(mockRefreshOAuthToken).not.toHaveBeenCalled()
+      expect(result).toEqual({ accessToken: 'legacy-monday-access-token', refreshed: false })
+    })
   })
 
   describe('refreshAccessTokenIfNeeded', () => {

apps/sim/lib/auth/connectors/managed-oauth.test.ts

@@ -296,6 +296,14 @@ describe('userinfo-backed managed OAuth connectors', () => {
     }
   )
 
+  it('requires PKCE and refresh-token persistence for Monday OAuth 2.1', () => {
+    expect(policyFor('monday')).toMatchObject({
+      pkce: true,
+      requiresRefreshToken: true,
+      nonceVerification: 'state_only',
+    })
+  })
+
   it.each(['linear', 'monday'])(
     'treats a partial %s GraphQL response as no identity at all',
     async (providerId) => {

apps/sim/lib/auth/connectors/managed-oauth.ts

@@ -798,8 +798,8 @@ const USER_INFO_MANAGED_OAUTH_CONNECTORS = new Map<string, () => ManagedOAuthCon
     () =>
       createUserInfoManagedOAuthConnector({
         providerId: 'monday',
-        /** monday.com access tokens do not expire and no refresh token is issued. */
-        requiresRefreshToken: false,
+        requiresRefreshToken: true,
+        pkce: true,
         scopes: { from: 'token_response' },
         userInfo: {
           url: MONDAY_API_URL,

apps/sim/lib/auth/connectors/providers.ts

@@ -10,6 +10,7 @@ import { syntheticConnectorEmail } from '@/lib/auth/connector-email'
 import { env } from '@/lib/core/config/env'
 import { inspectConfiguredOAuthClient } from '@/lib/core/config/env-capabilities.server'
 import {
+  DEFAULT_MAX_ERROR_BODY_BYTES,
   readResponseJsonWithLimit,
   readResponseTextWithLimit,
 } from '@/lib/core/utils/stream-limits'
@@ -22,6 +23,11 @@ import {
   getBoundMicrosoftDataverseEnvironment,
   resolveMicrosoftDataverseOAuthCallbackScopes,
 } from '@/lib/oauth/microsoft-dataverse'
+import {
+  exchangeMondayAuthorizationCode,
+  MONDAY_OAUTH_AUTHORIZATION_URL,
+  MONDAY_OAUTH_TOKEN_URL,
+} from '@/lib/oauth/monday'
 import { SALESFORCE_LOGIN_HOSTS } from '@/lib/oauth/salesforce'
 import { getCanonicalScopesForProvider } from '@/lib/oauth/utils'
 import { MONDAY_API_URL, MONDAY_API_VERSION } from '@/tools/monday/utils'
@@ -86,6 +92,17 @@ interface AttioWorkspaceMemberResponse {
   }
 }
 
+interface MondayUserInfoResponse {
+  data?: {
+    me?: {
+      id?: string | number
+      name?: string | null
+      email?: string | null
+    } | null
+  }
+  errors?: unknown[]
+}
+
 /**
  * Shape of `GET https://api.bitbucket.org/2.0/user` for the authenticated user.
  * @see https://developer.atlassian.com/cloud/bitbucket/rest/api-group-users/#api-user-get
@@ -1729,15 +1746,29 @@ export function buildConnectorProviders(): GenericOAuthConfig[] {
       providerId: 'monday',
       clientId: env.MONDAY_CLIENT_ID as string,
       clientSecret: env.MONDAY_CLIENT_SECRET as string,
-      authorizationUrl: 'https://auth.monday.com/oauth2/authorize',
-      tokenUrl: 'https://auth.monday.com/oauth2/token',
+      authorizationUrl: MONDAY_OAUTH_AUTHORIZATION_URL,
+      tokenUrl: MONDAY_OAUTH_TOKEN_URL,
       userInfoUrl: 'https://api.monday.com/v2',
       scopes: getCanonicalScopesForProvider('monday'),
       responseType: 'code',
-      pkce: false,
+      pkce: true,
+      authentication: 'post',
       redirectURI: `${getBaseUrl()}/api/auth/oauth2/callback/monday`,
+      getToken: async ({ code, codeVerifier, redirectURI }) => {
+        if (!codeVerifier) {
+          throw new Error('Monday OAuth token exchange requires a PKCE verifier')
+        }
+        return exchangeMondayAuthorizationCode({
+          clientId: env.MONDAY_CLIENT_ID as string,
+          clientSecret: env.MONDAY_CLIENT_SECRET as string,
+          code,
+          codeVerifier,
+          redirectUri: redirectURI,
+        })
+      },
       getUserInfo: async (tokens) => {
         try {
+          const signal = AbortSignal.timeout(15_000)
           const response = await fetch(MONDAY_API_URL, {
             method: 'POST',
             headers: {
@@ -1746,27 +1777,49 @@ export function buildConnectorProviders(): GenericOAuthConfig[] {
               Authorization: tokens.accessToken ?? '',
             },
             body: JSON.stringify({ query: '{ me { id name email } }' }),
+            signal,
           })
 
           if (!response.ok) {
-            await response.text().catch(() => {})
+            await readResponseTextWithLimit(response, {
+              maxBytes: DEFAULT_MAX_ERROR_BODY_BYTES,
+              label: 'Monday OAuth user info error response',
+              signal,
+            }).catch(() => {})
             logger.error('Error fetching Monday.com user info:', {
               status: response.status,
               statusText: response.statusText,
             })
             return null
           }
 
-          const data = await response.json()
+          const data = await readResponseJsonWithLimit<MondayUserInfoResponse>(response, {
+            maxBytes: DEFAULT_MAX_ERROR_BODY_BYTES,
+            label: 'Monday OAuth user info response',
+            signal,
+          })
+          if (data.errors?.length) {
+            logger.error('Monday.com user info returned GraphQL errors', {
+              errorCount: data.errors.length,
+            })
+            return null
+          }
           const user = data.data?.me
-          if (!user) return null
+          const userId =
+            typeof user?.id === 'string' || typeof user?.id === 'number'
+              ? String(user.id)
+              : undefined
+          if (!user || !userId) return null
+
+          const email = typeof user.email === 'string' ? user.email : undefined
+          const name = typeof user.name === 'string' ? user.name : undefined
 
           const now = new Date()
           return {
-            id: `${user.id.toString()}-${generateId()}`,
-            name: user.name || 'Monday.com User',
-            email: user.email || syntheticConnectorEmail('monday', user.id),
-            emailVerified: !!user.email,
+            id: `${userId}-${generateId()}`,
+            name: name || 'Monday.com User',
+            email: email || syntheticConnectorEmail('monday', userId),
+            emailVerified: !!email,
             createdAt: now,
             updatedAt: now,
           }

apps/sim/lib/credential-groups/standard-oauth-provider.test.ts

@@ -44,6 +44,32 @@ vi.mock('@/lib/auth/connectors/managed-oauth', () => ({
         },
       }
     }
+    if (providerId === 'monday') {
+      return {
+        providerId,
+        clientId: 'monday-client-1',
+        clientSecret: 'monday-secret-1',
+        authorizationUrl: 'https://auth.monday.com/oauth2/authorize',
+        tokenUrl: 'https://auth.monday.com/oauth_ms/oauth/token',
+        redirectURI: 'https://sim.example.com/api/auth/oauth2/callback/monday',
+        scopes: ['boards:read', 'me:read'],
+        responseType: 'code',
+        authentication: 'post',
+        getToken: mockGetToken,
+        managedOAuth: {
+          additionalScopes: [],
+          requiresRefreshToken: true,
+          pkce: true,
+          nonceVerification: 'state_only',
+          includeLoginHint: false,
+          getAuthorizationAppId: (clientId: string) => `monday:${clientId}`,
+          verifyIdentity: mockVerifyIdentity,
+          hasRequiredScopes: (granted: string[], required: string[]) =>
+            required.every((scope) => granted.includes(scope)),
+          isTerminalRefreshError: (errorCode: string | undefined) => errorCode === 'invalid_grant',
+        },
+      }
+    }
     if (providerId === 'jira') {
       return {
         providerId,
@@ -82,6 +108,7 @@ import { createStandardOAuthCredentialGroupProviderAdapter } from '@/lib/credent
 
 const adapter = createStandardOAuthCredentialGroupProviderAdapter('google-calendar')
 const jiraAdapter = createStandardOAuthCredentialGroupProviderAdapter('jira')
+const mondayAdapter = createStandardOAuthCredentialGroupProviderAdapter('monday')
 
 function buildContext(): CredentialGroupOAuthContext {
   return {
@@ -210,6 +237,82 @@ describe('standard OAuth Credential Group provider', () => {
     })
   })
 
+  it('uses PKCE and persists expiring rotating credentials for managed Monday OAuth', async () => {
+    const requiredScopes = ['boards:read', 'me:read']
+    const context: CredentialGroupOAuthContext = {
+      ...buildContext(),
+      option: {
+        ...buildContext().option,
+        provider: 'monday',
+        label: 'Monday.com',
+        authorizationAppId: 'monday:monday-client-1',
+        requiredScopes,
+      },
+    }
+    const policy = await mondayAdapter.getPolicy(context.option, {
+      workspaceId: context.workspaceId,
+      credentialGroupId: context.credentialGroupId,
+    })
+    const prepared = await mondayAdapter.prepareAuthorization(context, policy)
+    const authorizationUrl = new URL(
+      await prepared.buildAuthorizationUrl({ state: 'monday-state-1', nonce: 'nonce-ignored' })
+    )
+
+    expect(mondayAdapter.requiresRefreshToken).toBe(true)
+    expect(prepared.codeVerifier).toHaveLength(86)
+    expect(authorizationUrl.searchParams.get('code_challenge_method')).toBe('S256')
+    expect(authorizationUrl.searchParams.get('code_challenge')).toBeTruthy()
+
+    const accessTokenExpiresAt = new Date('2026-08-14T01:00:00Z')
+    mockGetToken.mockResolvedValueOnce({
+      tokenType: 'Bearer',
+      accessToken: 'monday-access-1',
+      refreshToken: 'monday-refresh-1',
+      accessTokenExpiresAt,
+      scopes: requiredScopes,
+    })
+    mockVerifyIdentity.mockResolvedValueOnce({
+      providerSubjectId: 'monday-user-1',
+      providerTenantId: null,
+      email: 'person@example.com',
+      emailVerified: true,
+      grantedScopes: requiredScopes,
+    })
+
+    const grant = await mondayAdapter.exchangeAndVerify({
+      context,
+      attempt: {
+        state: 'monday-state-1',
+        provider: 'monday',
+        nonceHash: 'unused-for-state-bound-provider',
+        enrollmentId: context.enrollmentId,
+        credentialGroupId: context.credentialGroupId,
+        optionId: context.option.id,
+        authorizationAppId: policy.authorizationAppId,
+        scopeVersion: policy.scopeVersion,
+        requiredScopes,
+        redirectUri: prepared.redirectUri,
+        codeVerifier: prepared.codeVerifier,
+        invitationToken: 'invitation-1',
+        createdAt: Date.now(),
+      },
+      code: 'monday-code-1',
+      policy,
+    })
+
+    expect(mockGetToken).toHaveBeenLastCalledWith({
+      code: 'monday-code-1',
+      redirectURI: 'https://sim.example.com/api/auth/oauth2/callback/monday',
+      codeVerifier: prepared.codeVerifier,
+    })
+    expect(grant).toMatchObject({
+      accessToken: 'monday-access-1',
+      refreshToken: 'monday-refresh-1',
+      accessTokenExpiresAt,
+      grantedScopes: requiredScopes,
+    })
+  })
+
   it('rejects a different invited email', async () => {
     mockVerifyIdentity.mockResolvedValueOnce({
       providerSubjectId: 'google-sub-2',