fix(auth): revoke sessions and OAuth grants on password reset

Author: waleedlatif1

apps/sim/lib/auth/auth.ts

@@ -67,6 +67,7 @@ import {
   SIM_CLI_CLIENT_ID,
 } from '@/lib/auth/oauth-provider'
 import { bindOAuthIssuedResource, oauthResourcePlugin } from '@/lib/auth/oauth-resource'
+import { revokeUserOAuthGrants } from '@/lib/auth/oauth-token-family'
 import { getSessionCookieCacheVersion } from '@/lib/auth/security-policy'
 import { prepareSessionForCreation } from '@/lib/auth/session-hooks'
 import { clampExpiryForSession } from '@/lib/auth/session-policy'
@@ -988,7 +989,18 @@ export const auth = betterAuth({
         throw new Error(`Failed to send reset password email: ${result.message}`)
       }
     },
+    /** Runs after `onPasswordReset`; cookie-cached sessions survive until `cookieCache.maxAge`. */
+    revokeSessionsOnPasswordReset: true,
     onPasswordReset: async ({ user: resetUser }, request) => {
+      try {
+        await revokeUserOAuthGrants(resetUser.id)
+      } catch (error) {
+        // Throwing would skip the session revocation Better Auth runs after this hook.
+        logger.error('[onPasswordReset] Failed to revoke OAuth grants', {
+          userId: resetUser.id,
+          error,
+        })
+      }
       await recordPasswordResetAudit({ kind: 'completed', userId: resetUser.id, request })
     },
   },

apps/sim/lib/auth/lifecycle-audit.integration.ts

@@ -3,6 +3,10 @@ import {
   account,
   auditLog,
   member,
+  oauthAccessToken,
+  oauthClient,
+  oauthConsent,
+  oauthTokenFamily,
   organization,
   session,
   ssoProvider,
@@ -309,6 +313,84 @@ describe('authentication audit history in PostgreSQL', () => {
     ).toHaveLength(0)
   })
 
+  it('ends every pre-reset session and OAuth token when a password reset completes', async () => {
+    await login()
+    const [current] = await db
+      .select({ id: session.id })
+      .from(session)
+      .where(eq(session.userId, userId))
+    const clientId = generateId()
+    const familyId = generateId()
+    const now = new Date()
+    const expiresAt = new Date(now.getTime() + 86_400_000)
+    await db.insert(oauthClient).values({
+      id: clientId,
+      clientId,
+      name: 'Password reset OAuth fixture',
+      public: true,
+      tokenEndpointAuthMethod: 'none',
+      grantTypes: ['authorization_code', 'refresh_token'],
+      redirectUris: ['http://127.0.0.1/callback'],
+    })
+    try {
+      await db.insert(oauthConsent).values({
+        id: generateId(),
+        clientId,
+        userId,
+        scopes: ['api:read'],
+        createdAt: now,
+        updatedAt: now,
+      })
+      await db.insert(oauthTokenFamily).values({
+        id: familyId,
+        clientId,
+        userId,
+        sessionId: current.id,
+        createdAt: now,
+        expiresAt,
+      })
+      await db.insert(oauthAccessToken).values({
+        id: generateId(),
+        token: generateId(),
+        clientId,
+        userId,
+        scopes: ['api:read'],
+        createdAt: now,
+        expiresAt,
+      })
+
+      const requested = await auth.handler(
+        request('/request-password-reset', {
+          email,
+          redirectTo: 'http://localhost:3000/reset-password',
+        })
+      )
+      expect(requested.status).toBe(200)
+      const [resetToken] = await db
+        .select({ identifier: verification.identifier })
+        .from(verification)
+        .where(eq(verification.value, userId))
+      const completed = await auth.handler(
+        request('/reset-password', {
+          token: resetToken.identifier.replace('reset-password:', ''),
+          newPassword: 'Audit-fixture-new-password-37!',
+        })
+      )
+      expect(completed.status).toBe(200)
+
+      expect(await sessionCount()).toBe(0)
+      expect(
+        await db.select().from(oauthTokenFamily).where(eq(oauthTokenFamily.clientId, clientId))
+      ).toHaveLength(0)
+      expect(
+        await db.select().from(oauthAccessToken).where(eq(oauthAccessToken.clientId, clientId))
+      ).toHaveLength(0)
+      await expectEvent('password.reset', userId)
+    } finally {
+      await db.delete(oauthClient).where(eq(oauthClient.clientId, clientId))
+    }
+  })
+
   it('scopes an SSO admission refusal to the configured provider organization when the account belongs elsewhere', async () => {
     const providerOrganizationId = generateId()
     const providerId = generateId()

apps/sim/lib/auth/oauth-token-family.ts

@@ -493,6 +493,19 @@ export async function rotateOAuthRefreshToken(
   })
 }
 
+/**
+ * Revokes every refresh family and access token a user holds. Families outlive the session that
+ * minted them (`session_id` is set null on delete), so deleting sessions alone leaves them
+ * rotatable. Consents are kept, so a legitimate client re-authorizes without a new consent prompt.
+ */
+export async function revokeUserOAuthGrants(
+  userId: string,
+  database: OAuthDatabase = db
+): Promise<void> {
+  await database.delete(oauthTokenFamily).where(eq(oauthTokenFamily.userId, userId))
+  await database.delete(oauthAccessToken).where(eq(oauthAccessToken.userId, userId))
+}
+
 /** Revokes one refresh family or one opaque access token. Unknown tokens are a successful no-op. */
 export async function revokeOAuthToken(
   input: { credentials: OAuthClientCredentials; token: string },