fix(integrations): bound recorded sites and keep them when a reconnect cannot list them

Author: waleedlatif1

apps/sim/lib/api/contracts/organization-accounts.ts

@@ -18,6 +18,9 @@ import { organizationIdSchema, workspaceIdSchema } from '@/lib/api/contracts/pri
 import { defineRouteContract } from '@/lib/api/contracts/types'
 import { ORGANIZATION_CREDENTIAL_TYPES } from '@/lib/credential-groups/credential-types'
 import {
+  ACCOUNT_SITE_LIMIT,
+  ACCOUNT_SITE_NAME_MAX_LENGTH,
+  ACCOUNT_SITE_URL_MAX_LENGTH,
   ORGANIZATION_ACCOUNT_WORKSPACE_LIMIT,
   ORGANIZATION_VIEWER_ACCOUNT_LIMIT,
 } from '@/lib/credential-groups/limits'
@@ -80,8 +83,13 @@ export const getOrganizationAccountsContract = defineRouteContract({
             optionId: z.string().min(1).max(128),
             status: z.enum(['active', 'needs_reauth']),
             sites: z
-              .array(z.object({ name: z.string().max(512), url: z.string().max(2048) }))
-              .max(50),
+              .array(
+                z.object({
+                  name: z.string().max(ACCOUNT_SITE_NAME_MAX_LENGTH),
+                  url: z.string().max(ACCOUNT_SITE_URL_MAX_LENGTH),
+                })
+              )
+              .max(ACCOUNT_SITE_LIMIT),
           })
         )
         .max(ORGANIZATION_VIEWER_ACCOUNT_LIMIT)

apps/sim/lib/auth/connectors/managed-oauth.ts

@@ -7,6 +7,7 @@ import { OAuth2Client, type TokenPayload } from 'google-auth-library'
 import { createRemoteJWKSet, type JWTPayload, jwtVerify } from 'jose'
 import { buildConnectorProviders } from '@/lib/auth/connectors/providers'
 import { readResponseJsonWithLimit } from '@/lib/core/utils/stream-limits'
+import { boundedAccountSites } from '@/lib/credential-groups/account-sites'
 import { getDocusignOAuthUrl } from '@/lib/oauth/docusign'
 import { verifyGitHubRepositoriesIdentity } from '@/lib/oauth/github-repositories'
 import { deriveMicrosoftEmailVerified, mapMicrosoftProfileToUser } from '@/lib/oauth/microsoft'
@@ -26,7 +27,6 @@ const ATLASSIAN_USER_INFO_URL = 'https://api.atlassian.com/me'
 const ATLASSIAN_USER_INFO_MAX_BYTES = 256 * 1024
 const ATLASSIAN_USER_INFO_TIMEOUT_MS = 10_000
 const ATLASSIAN_SITES_URL = 'https://api.atlassian.com/oauth/token/accessible-resources'
-const ATLASSIAN_SITE_LIMIT = 50
 const MICROSOFT_JWKS_URL = 'https://login.microsoftonline.com/common/discovery/v2.0/keys'
 const MICROSOFT_OIDC_USER_INFO_URL = 'https://graph.microsoft.com/oidc/userinfo'
 const MICROSOFT_OIDC_USER_INFO_MAX_BYTES = 256 * 1024
@@ -216,14 +216,12 @@ async function listAtlassianSites(accessToken: string): Promise<ManagedOAuthSite
       label: 'Atlassian accessible resources response',
     })
     if (!response.ok || !Array.isArray(body)) return undefined
-    return body
-      .flatMap((entry) => {
+    return boundedAccountSites(
+      body.map((entry) => {
         const site = toRecord(entry)
-        const name = typeof site.name === 'string' ? site.name.trim() : ''
-        const url = typeof site.url === 'string' ? httpsOrigin(site.url) : null
-        return name && url ? [{ name, url }] : []
+        return { name: site.name, url: typeof site.url === 'string' ? httpsOrigin(site.url) : null }
       })
-      .slice(0, ATLASSIAN_SITE_LIMIT)
+    )
   } catch {
     return undefined
   }

apps/sim/lib/credential-groups/__integration__/multiple-provider-accounts.integration.ts

@@ -42,6 +42,8 @@ vi.mock('@/lib/credential-groups/scoped-availability', () => ({
 
 /** Each grant carries its own token, as a real exchange does, so a saved grant is identifiable. */
 let grants = 0
+/** Sites the next grant reports, or `undefined` when its site listing failed. */
+let grantSites: Array<{ name: string; url: string }> | undefined
 
 vi.mock('@/lib/credential-groups/provider-registry', async (importOriginal) => {
   const { getCredentialGroupProviderId } = await import('@/lib/credential-groups/providers')
@@ -64,7 +66,7 @@ vi.mock('@/lib/credential-groups/provider-registry', async (importOriginal) => {
             providerSubjectId: subject,
             providerTenantId: tenant || null,
             displayName: code,
-            metadata: { email: code },
+            metadata: { email: code, ...(grantSites ? { sites: grantSites } : {}) },
             accessToken: `token-for-${code}-${(grants += 1)}`,
             grantedScopes: POLICY.requiredScopes,
             accessTokenExpiresAt: null,
@@ -230,6 +232,7 @@ beforeAll(async () => {
 })
 
 beforeEach(async () => {
+  grantSites = undefined
   await db.delete(credential).where(eq(credential.organizationId, organizationId))
 })
 
@@ -383,6 +386,52 @@ describe('adding another site to an Atlassian login', () => {
     expect((await viewer())?.sites).toEqual([{ name: 'Acme', url: 'https://acme.example.net' }])
   })
 
+  it('never lets oversized stored sites break the account list', async () => {
+    const account = await connect('person@atlassian', { kind: 'create' }, CONFLUENCE)
+    const site = (index: number) => ({
+      name: `Site ${index}`,
+      url: `https://s${index}.example.net`,
+    })
+    await db
+      .update(credential)
+      .set({
+        providerMetadata: sql`${JSON.stringify({
+          email: 'person@atlassian',
+          sites: [
+            { name: 'x'.repeat(600), url: 'https://long-name.example.net' },
+            { name: 'Long URL', url: `https://example.net/${'x'.repeat(2100)}` },
+            ...Array.from({ length: 60 }, (_, index) => site(index)),
+          ],
+        })}::jsonb`,
+      })
+      .where(eq(credential.id, account.credentialId))
+
+    const [viewer] = await listViewerOrganizationAccounts({ organizationId, userId })
+    expect(viewer?.sites).toHaveLength(50)
+    expect(viewer?.sites[0]).toEqual(site(0))
+  })
+
+  it('keeps the recorded sites when a reconnect cannot list them', async () => {
+    grantSites = [{ name: 'Acme', url: 'https://acme.example.net' }]
+    const account = await connect('person@atlassian', { kind: 'create' }, CONFLUENCE)
+    const reconnect = () =>
+      connect(
+        'person@atlassian',
+        { kind: 'reconnect', credentialId: account.credentialId },
+        CONFLUENCE
+      )
+    const sites = async () =>
+      (await listViewerOrganizationAccounts({ organizationId, userId }))[0]?.sites
+
+    grantSites = undefined
+    await reconnect()
+    expect(await sites()).toEqual([{ name: 'Acme', url: 'https://acme.example.net' }])
+
+    grantSites = []
+    await reconnect()
+    expect(await sites()).toEqual([])
+  })
+
   it('still adds a different Atlassian login as its own account', async () => {
     await connect('person@atlassian', { kind: 'create' }, CONFLUENCE)
     await connect('other@atlassian', { kind: 'create' }, CONFLUENCE)

apps/sim/lib/credential-groups/account-sites.ts

@@ -0,0 +1,27 @@
+import type { ManagedOAuthSite } from '@sim/db/schema'
+import { toArray, toRecord } from '@sim/utils/object'
+import {
+  ACCOUNT_SITE_LIMIT,
+  ACCOUNT_SITE_NAME_MAX_LENGTH,
+  ACCOUNT_SITE_URL_MAX_LENGTH,
+} from '@/lib/credential-groups/limits'
+
+/**
+ * Keeps the well-formed sites within the recorded bounds. Site lists are display data from a
+ * provider, so a bad entry is dropped rather than allowed to fail the account it belongs to.
+ */
+export function boundedAccountSites(value: unknown): ManagedOAuthSite[] {
+  return toArray(value)
+    .flatMap((entry) => {
+      const site = toRecord(entry)
+      const name = typeof site.name === 'string' ? site.name.trim() : ''
+      const url = typeof site.url === 'string' ? site.url : ''
+      return name &&
+        url &&
+        name.length <= ACCOUNT_SITE_NAME_MAX_LENGTH &&
+        url.length <= ACCOUNT_SITE_URL_MAX_LENGTH
+        ? [{ name, url }]
+        : []
+    })
+    .slice(0, ACCOUNT_SITE_LIMIT)
+}

apps/sim/lib/credential-groups/limits.ts

@@ -9,3 +9,7 @@ export const CREDENTIAL_GROUP_KNOWLEDGE_CONNECTOR_ACCESS_LIMIT = 32
 export const ORGANIZATION_ACCOUNT_INDEXING_SOURCE_LIMIT = 100
 /** Live accounts one member may connect per provider; bounds a search's per-account fan-out. */
 export const CREDENTIAL_GROUP_ACCOUNTS_PER_PROVIDER_LIMIT = 5
+/** Bounds on the sites recorded for one account, enforced wherever they are written or read. */
+export const ACCOUNT_SITE_LIMIT = 50
+export const ACCOUNT_SITE_NAME_MAX_LENGTH = 512
+export const ACCOUNT_SITE_URL_MAX_LENGTH = 2048

apps/sim/lib/credential-groups/oauth.ts

@@ -231,6 +231,7 @@ async function persistGrant(
         id: credential.id,
         revokedAt: credential.revokedAt,
         managedOauthStatus: credential.managedOauthStatus,
+        providerMetadata: credential.providerMetadata,
         providerSubjectId: credential.providerSubjectId,
         providerTenantId: credential.providerTenantId,
         encryptedOauthTokenSet: credential.encryptedOauthTokenSet,
@@ -287,7 +288,11 @@ async function persistGrant(
       providerTenantId: grant.providerTenantId,
       managedOauthStatus: 'active' as const,
       grantedScopes: grant.grantedScopes,
-      providerMetadata: grant.metadata,
+      // A site listing that failed reports no sites; keep the account's last known list.
+      providerMetadata:
+        grant.metadata.sites === undefined && existing?.providerMetadata?.sites
+          ? { ...grant.metadata, sites: existing.providerMetadata.sites }
+          : grant.metadata,
       encryptedOauthTokenSet,
       grantedAt: now,
       revokedAt: null,

apps/sim/lib/credential-groups/viewer-accounts.ts

@@ -1,25 +1,11 @@
 import { db } from '@sim/db'
-import {
-  credential,
-  credentialGroup,
-  credentialGroupEnrollment,
-  type ManagedOAuthSite,
-} from '@sim/db/schema'
-import { toArray, toRecord } from '@sim/utils/object'
+import { credential, credentialGroup, credentialGroupEnrollment } from '@sim/db/schema'
+import { toRecord } from '@sim/utils/object'
 import { and, eq, inArray, isNull, type SQL } from 'drizzle-orm'
 import { resourceScopeCondition } from '@/lib/core/resource-scope.server'
+import { boundedAccountSites } from '@/lib/credential-groups/account-sites'
 import { ORGANIZATION_VIEWER_ACCOUNT_LIMIT } from '@/lib/credential-groups/limits'
 
-/** Stored metadata is provider-shaped JSON, so only well-formed entries are shown. */
-function recordedSites(metadata: unknown): ManagedOAuthSite[] {
-  return toArray(toRecord(metadata).sites).flatMap((entry) => {
-    const site = toRecord(entry)
-    return typeof site.name === 'string' && typeof site.url === 'string'
-      ? [{ name: site.name, url: site.url }]
-      : []
-  })
-}
-
 /** Own grant metadata remains manageable even while provider setup or enrollment is disabled. */
 export async function listViewerOrganizationAccounts(input: {
   organizationId: string
@@ -70,7 +56,7 @@ export async function listViewerOrganizationAccounts(input: {
       optionId: account.optionId,
       providerId: account.providerId,
       status: account.status,
-      sites: recordedSites(metadata),
+      sites: boundedAccountSites(toRecord(metadata).sites),
     }
   })
 }