feat(assistant): connect personal accounts in chat and reuse desktop tools

Author: Vikhyath Mondreti

apps/sim/app/api/credential-groups/enrollment-redirect.ts

@@ -20,11 +20,22 @@ export function createCredentialGroupEnrollmentRedirect(
   })
 }
 
-export function createCredentialGroupCompletionRedirect(): NextResponse {
+export type CredentialGroupOAuthFailure =
+  | 'denied'
+  | 'account_mismatch'
+  | 'permissions_required'
+  | 'configuration_changed'
+  | 'rate_limited'
+  | 'unavailable'
+  | 'failed'
+
+export function createCredentialGroupCompletionRedirect(
+  oauth?: CredentialGroupOAuthFailure
+): NextResponse {
   return new NextResponse(null, {
     status: 303,
     headers: {
-      Location: '/credential-groups/complete',
+      Location: `/credential-groups/complete${oauth ? `?oauth=${oauth}` : ''}`,
       ...NO_STORE_REDIRECT_HEADERS,
     },
   })

apps/sim/app/api/credential-groups/oauth-callback.ts

@@ -3,15 +3,19 @@ import { getErrorMessage } from '@sim/utils/errors'
 import type { NextRequest } from 'next/server'
 import { NextResponse } from 'next/server'
 import type { CredentialGroupOAuthCallbackQuery } from '@/lib/api/contracts/credential-groups'
-import { authenticateCredentialGroupEnrollment } from '@/lib/credential-groups/application/enrollment-auth'
+import { credentialGroupOAuthAttemptPrincipal } from '@/lib/credential-groups/application/enrollment-auth'
 import { completePublicCredentialGroupOAuth } from '@/lib/credential-groups/application/public-enrollment'
 import { consumeCredentialGroupOAuthAttempt } from '@/lib/credential-groups/oauth-state'
 import {
   CredentialGroupInvitationUnavailableError,
   CredentialGroupOAuthError,
 } from '@/lib/credential-groups/provider-adapter'
 import type { CredentialGroupProvider } from '@/lib/credential-groups/providers'
-import { createCredentialGroupEnrollmentRedirect } from '@/app/api/credential-groups/enrollment-redirect'
+import {
+  type CredentialGroupOAuthFailure,
+  createCredentialGroupCompletionRedirect,
+  createCredentialGroupEnrollmentRedirect,
+} from '@/app/api/credential-groups/enrollment-redirect'
 
 const logger = createLogger('CredentialGroupOAuthCallbackAPI')
 
@@ -49,34 +53,33 @@ export async function handleCredentialGroupOAuthCallback({
       { status: 400, headers: { 'Cache-Control': 'no-store' } }
     )
   }
+  const failureRedirect = (oauth: CredentialGroupOAuthFailure) =>
+    attempt.completionRedirect
+      ? createCredentialGroupCompletionRedirect(oauth)
+      : createCredentialGroupEnrollmentRedirect(attempt.invitationToken, { oauth })
   if (limited) {
-    return createCredentialGroupEnrollmentRedirect(attempt.invitationToken, {
-      oauth: 'rate_limited',
-    })
+    return failureRedirect('rate_limited')
   }
   if (providerError) {
-    return createCredentialGroupEnrollmentRedirect(attempt.invitationToken, { oauth: 'denied' })
+    return failureRedirect('denied')
   }
   if (!code) {
-    return createCredentialGroupEnrollmentRedirect(attempt.invitationToken, { oauth: 'failed' })
+    return failureRedirect('failed')
   }
 
-  const principal = await authenticateCredentialGroupEnrollment(attempt.invitationToken)
-  if (!principal) {
-    return createCredentialGroupEnrollmentRedirect(attempt.invitationToken, {
-      oauth: 'unavailable',
-    })
-  }
+  const principal = credentialGroupOAuthAttemptPrincipal(attempt)
 
   try {
     await completePublicCredentialGroupOAuth.execute({
       principal,
       input: { attempt, code },
       request,
     })
-    return createCredentialGroupEnrollmentRedirect(attempt.invitationToken, {
-      connected: attempt.optionId,
-    })
+    return attempt.completionRedirect
+      ? createCredentialGroupCompletionRedirect()
+      : createCredentialGroupEnrollmentRedirect(attempt.invitationToken, {
+          connected: attempt.optionId,
+        })
   } catch (error) {
     logger.error('Managed OAuth authorization failed', {
       provider,
@@ -92,6 +95,6 @@ export async function handleCredentialGroupOAuthCallback({
           : error instanceof CredentialGroupOAuthError && error.statusCode === 409
             ? 'configuration_changed'
             : 'failed'
-    return createCredentialGroupEnrollmentRedirect(attempt.invitationToken, { oauth: status })
+    return failureRedirect(status)
   }
 }

apps/sim/app/api/credential-groups/oauth/[provider]/callback/route.test.ts

@@ -12,7 +12,7 @@ const mocks = vi.hoisted(() => ({
 }))
 
 vi.mock('@/lib/credential-groups/application/enrollment-auth', () => ({
-  authenticateCredentialGroupEnrollment: mocks.authenticate,
+  credentialGroupOAuthAttemptPrincipal: mocks.authenticate,
 }))
 
 vi.mock('@/lib/credential-groups/application/public-enrollment', () => ({
@@ -27,7 +27,10 @@ vi.mock('@/lib/credential-groups/rate-limit', () => ({
   enforcePublicCredentialGroupIpRateLimit: mocks.rateLimit,
 }))
 
-import { CredentialGroupInvitationUnavailableError } from '@/lib/credential-groups/provider-adapter'
+import {
+  CredentialGroupInvitationUnavailableError,
+  CredentialGroupOAuthError,
+} from '@/lib/credential-groups/provider-adapter'
 import { GET } from '@/app/api/credential-groups/oauth/[provider]/callback/route'
 
 const principal = {
@@ -56,7 +59,7 @@ describe('credential group OAuth callback', () => {
     vi.clearAllMocks()
     mocks.rateLimit.mockResolvedValue(null)
     mocks.consumeAttempt.mockResolvedValue(attempt)
-    mocks.authenticate.mockResolvedValue(principal)
+    mocks.authenticate.mockReturnValue(principal)
     mocks.completeOAuth.mockResolvedValue({ connectedOptionId: 'option-1' })
   })
 
@@ -65,6 +68,7 @@ describe('credential group OAuth callback', () => {
     const response = await GET(callbackRequest, context)
 
     expect(mocks.consumeAttempt).toHaveBeenCalledWith('state-1')
+    expect(mocks.authenticate).toHaveBeenCalledWith(attempt)
     expect(mocks.completeOAuth).toHaveBeenCalledWith({
       principal,
       input: { attempt, code: 'code-1' },
@@ -113,15 +117,15 @@ describe('credential group OAuth callback', () => {
   })
 
   it('returns an unavailable enrollment redirect when the invitation was revoked in flight', async () => {
-    mocks.authenticate.mockResolvedValue(null)
+    mocks.completeOAuth.mockRejectedValueOnce(new CredentialGroupInvitationUnavailableError())
 
     const response = await GET(request('state=state-1&code=code-1'), context)
 
     expect(response.status).toBe(307)
     expect(response.headers.get('location')).toBe(
       '/credential-groups/enroll/invitation-token?oauth=unavailable'
     )
-    expect(mocks.completeOAuth).not.toHaveBeenCalled()
+    expect(mocks.completeOAuth).toHaveBeenCalledOnce()
   })
 
   it('returns an unavailable enrollment redirect when the invitation is revoked during exchange', async () => {
@@ -150,4 +154,49 @@ describe('credential group OAuth callback', () => {
     expect(mocks.authenticate).not.toHaveBeenCalled()
     expect(mocks.completeOAuth).not.toHaveBeenCalled()
   })
+
+  it('returns personal connections to the fixed completion page after invitation rotation', async () => {
+    mocks.consumeAttempt.mockResolvedValue({ ...attempt, completionRedirect: true })
+    const response = await GET(request('state=state-1&code=code-1'), context)
+    expect(response.status).toBe(303)
+    expect(response.headers.get('location')).toBe('/credential-groups/complete')
+    expect(response.headers.get('cache-control')).toBe('no-store')
+    expect(response.headers.get('referrer-policy')).toBe('no-referrer')
+  })
+
+  it.each([['error=access_denied', 'denied']])(
+    'shows personal callback failure without reopening a stale invitation: %s',
+    async (query, status) => {
+      mocks.consumeAttempt.mockResolvedValue({ ...attempt, completionRedirect: true })
+      const response = await GET(request(`state=state-1&${query}`), context)
+      expect(response.status).toBe(303)
+      expect(response.headers.get('location')).toBe(`/credential-groups/complete?oauth=${status}`)
+      expect(mocks.completeOAuth).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each([
+    [new CredentialGroupInvitationUnavailableError(), 'unavailable'],
+    [new CredentialGroupOAuthError('Sign in with your own account', 403), 'account_mismatch'],
+    [new CredentialGroupOAuthError('Missing scopes', 403), 'permissions_required'],
+    [new CredentialGroupOAuthError('Changed settings', 409), 'configuration_changed'],
+    [new Error('Provider failed'), 'failed'],
+  ])('shows failed personal authorization on the completion page', async (error, status) => {
+    mocks.consumeAttempt.mockResolvedValue({ ...attempt, completionRedirect: true })
+    mocks.completeOAuth.mockRejectedValueOnce(error)
+    const response = await GET(request('state=state-1&code=code-1'), context)
+    expect(response.status).toBe(303)
+    expect(response.headers.get('location')).toBe(`/credential-groups/complete?oauth=${status}`)
+  })
+
+  it('shows rate limits on the personal completion page without exchanging', async () => {
+    mocks.consumeAttempt.mockResolvedValue({ ...attempt, completionRedirect: true })
+    mocks.rateLimit.mockResolvedValue(
+      NextResponse.json({ error: 'Too many requests' }, { status: 429 })
+    )
+    const response = await GET(request('state=state-1&code=code-1'), context)
+    expect(response.status).toBe(303)
+    expect(response.headers.get('location')).toBe('/credential-groups/complete?oauth=rate_limited')
+    expect(mocks.completeOAuth).not.toHaveBeenCalled()
+  })
 })

apps/sim/app/api/credentials/personal/connect/route.ts

@@ -0,0 +1,20 @@
+import { startPersonalCredentialConnectionContract } from '@/lib/api/contracts/credentials'
+import {
+  defineInternalJsonRoute,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { internalPersonalCredentialConnectionErrorPolicy } from '@/lib/credentials/api/route-policies'
+import { credentialOperations } from '@/lib/credentials/application/operations'
+import { startPersonalCredentialConnection } from '@/lib/credentials/application/personal-connection'
+
+export const POST = defineInternalJsonRoute({
+  contract: startPersonalCredentialConnectionContract,
+  auth: internalSessionAuth,
+  operation: credentialOperations.startPersonalConnection,
+  rateLimit: internalRateLimits.user({ bucketName: 'credentials.personal.connect' }),
+  errorPolicy: internalPersonalCredentialConnectionErrorPolicy,
+  mapInput: ({ body }) => body,
+  useCase: startPersonalCredentialConnection,
+  present: (result) => result,
+})

apps/sim/app/api/credentials/personal/route.ts

@@ -0,0 +1,26 @@
+import { listPersonalCredentialsContract } from '@/lib/api/contracts/credentials'
+import {
+  defineInternalJsonRoute,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { internalCredentialErrorPolicy } from '@/lib/credentials/api/route-policies'
+import { credentialOperations } from '@/lib/credentials/application/operations'
+import { listPersonalCredentials } from '@/lib/credentials/application/personal-credentials'
+
+export const GET = defineInternalJsonRoute({
+  contract: listPersonalCredentialsContract,
+  auth: internalSessionAuth,
+  operation: credentialOperations.listPersonal,
+  rateLimit: internalRateLimits.user({ bucketName: 'credentials.personal.list' }),
+  errorPolicy: internalCredentialErrorPolicy,
+  mapInput: ({ query }) => query,
+  useCase: listPersonalCredentials,
+  present: ({ credentials }) => ({
+    credentials: credentials.map((entry) => ({
+      ...entry,
+      updatedAt: entry.updatedAt.toISOString(),
+      connectedAt: entry.connectedAt.toISOString(),
+    })),
+  }),
+})

apps/sim/app/api/mcp/oauth/callback/route.test.ts

@@ -30,7 +30,7 @@ vi.mock('@/lib/mcp/service', () => ({
   mcpService: { discoverServerTools: mockDiscoverServerTools },
 }))
 vi.mock('@/lib/credential-groups/application/enrollment-auth', () => ({
-  authenticateCredentialGroupEnrollment: mockAuthenticateEnrollment,
+  credentialGroupOAuthAttemptPrincipal: mockAuthenticateEnrollment,
 }))
 vi.mock('@/lib/credential-groups/application/public-enrollment', () => ({
   completePublicCredentialGroupMcpOAuth: { execute: mockCompleteManagedMcpOAuth },
@@ -68,14 +68,16 @@ describe('MCP OAuth callback route', () => {
     mockDiscoverServerTools.mockResolvedValue(undefined)
     mockConsumeManagedAttempt.mockResolvedValue({
       state: 'mcp_cg_state-1',
+      workspaceId: 'workspace-1',
+      email: 'invitee@example.com',
       enrollmentId: 'enrollment-1',
       credentialGroupId: 'group-1',
       mcpServerId: 'server-1',
       codeVerifier: 'code-verifier',
       invitationToken: 'invitation-token',
       createdAt: Date.now(),
     })
-    mockAuthenticateEnrollment.mockResolvedValue({
+    mockAuthenticateEnrollment.mockReturnValue({
       kind: 'credential_group_enrollment',
       workspaceId: 'workspace-1',
       credentialGroupId: 'group-1',
@@ -159,7 +161,13 @@ describe('MCP OAuth callback route', () => {
 
     expect(mockEnforceCallbackRateLimit).toHaveBeenCalledWith(request, 'oauth-callback')
     expect(mockConsumeManagedAttempt).toHaveBeenCalledWith('mcp_cg_state-1')
-    expect(mockAuthenticateEnrollment).toHaveBeenCalledWith('invitation-token')
+    expect(mockAuthenticateEnrollment).toHaveBeenCalledWith(
+      expect.objectContaining({
+        workspaceId: 'workspace-1',
+        email: 'invitee@example.com',
+        invitationToken: 'invitation-token',
+      })
+    )
     expect(mockCompleteManagedMcpOAuth).toHaveBeenCalledWith(
       expect.objectContaining({
         input: expect.objectContaining({

apps/sim/app/api/mcp/oauth/callback/route.ts

@@ -9,7 +9,7 @@ import { mcpOauthCallbackContract } from '@/lib/api/contracts/mcp'
 import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { authenticateCredentialGroupEnrollment } from '@/lib/credential-groups/application/enrollment-auth'
+import { credentialGroupOAuthAttemptPrincipal } from '@/lib/credential-groups/application/enrollment-auth'
 import { completePublicCredentialGroupMcpOAuth } from '@/lib/credential-groups/application/public-enrollment'
 import {
   consumeCredentialGroupMcpOAuthAttempt,
@@ -97,12 +97,7 @@ async function completeManagedMcpCallback(params: {
     })
   }
   try {
-    const principal = await authenticateCredentialGroupEnrollment(attempt.invitationToken)
-    if (!principal) {
-      return createCredentialGroupEnrollmentRedirect(attempt.invitationToken, {
-        oauth: 'unavailable',
-      })
-    }
+    const principal = credentialGroupOAuthAttemptPrincipal(attempt)
     const result = await completePublicCredentialGroupMcpOAuth.execute({
       principal,
       input: { attempt, code: params.code },

apps/sim/app/credential-groups/complete/page.tsx

@@ -6,12 +6,31 @@ export const metadata: Metadata = {
   robots: { index: false, follow: false },
 }
 
-export default function CredentialGroupCompletePage() {
+const OAUTH_FAILURE_MESSAGES = {
+  denied: 'Authorization was canceled. Return to the chat to try again.',
+  account_mismatch: 'Choose the account matching your Sim email address.',
+  permissions_required: 'All requested permissions are required to connect this account.',
+  configuration_changed: 'The connection settings changed. Return to the chat to try again.',
+  rate_limited: 'Too many authorization attempts. Wait a few minutes and try again.',
+  unavailable: 'This connection is unavailable. Return to the chat to try again.',
+  failed: 'Account authorization did not complete. Return to the chat to try again.',
+} as const
+
+export default async function CredentialGroupCompletePage({
+  searchParams,
+}: {
+  searchParams: Promise<{ oauth?: string | string[] }>
+}) {
+  const { oauth } = await searchParams
+  const error =
+    typeof oauth === 'string' && Object.hasOwn(OAUTH_FAILURE_MESSAGES, oauth)
+      ? OAUTH_FAILURE_MESSAGES[oauth as keyof typeof OAUTH_FAILURE_MESSAGES]
+      : undefined
   return (
     <AuthShell>
       <AuthHeader
-        title='Accounts connected'
-        description='Your accounts are ready to use — you can close this tab.'
+        title={error ? 'Account not connected' : 'Accounts connected'}
+        description={error ?? 'Your accounts are ready to use — you can close this tab.'}
       />
     </AuthShell>
   )

apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/chat-content/chat-content.tsx

@@ -455,6 +455,7 @@ const MARKDOWN_COMPONENTS = {
 interface ChatContentProps {
   content: string
   messageId?: string
+  requestMode?: 'agent' | 'assistant'
   isStreaming?: boolean
   /** Transcript-derived answers for this message's question card (renders the recap). */
   questionAnswers?: string[]
@@ -478,6 +479,7 @@ interface ChatContentProps {
 function ChatContentInner({
   content,
   messageId,
+  requestMode,
   isStreaming = false,
   questionAnswers,
   credentialSubmission,
@@ -725,6 +727,7 @@ function ChatContentInner({
               questionAnswers={questionAnswers}
               credentialSubmission={credentialSubmission}
               credentialAbandoned={credentialAbandoned}
+              requestMode={requestMode}
               onOptionSelect={onOptionSelect}
               onQuestionDismiss={onQuestionDismiss}
             />