fix(oauth): prove the new Atlassian grant is saved and note the site limit

Author: waleedlatif1

apps/docs/content/docs/search/connect-your-account.mdx

@@ -25,7 +25,7 @@ After your admin adds a source in **Settings → Sources**, connect your own acc
 To connect another account of the same app, such as Google Drive for two different work accounts, open the app and choose **Add account**, then pick the other account when the provider asks. You can connect up to five accounts per app, and Search looks across all of them. Open an account to see its tool permissions when the app supports them; each account's menu has **Reconnect** and **Disconnect**.
 
 - Slack accounts must belong to your organization's connected workspace.
-- For another Confluence or Jira site on the same Atlassian login, choose **Add account** or **Reconnect** and pick the site. The site joins your existing account, and Search covers every site that login can reach.
+- For another Confluence or Jira site on the same Atlassian login, choose **Add account** or **Reconnect** and pick the site. The site joins your existing account. Search reads up to four sites per Atlassian account in one search and notes when it leaves sites out.
 - Each Notion workspace is its own account, so add one per workspace. If Sim asks you to reconnect first, reconnect your existing Notion account once, then add the other workspace.
 - Zoom, Lucid, and Databricks allow one account, because Sim cannot yet tell their accounts apart.
 - If the provider signs you straight back into a connected account, sign in to the other account with the provider first, then choose **Add account** again.

apps/sim/lib/credential-groups/__integration__/multiple-provider-accounts.integration.ts

@@ -39,6 +39,9 @@ vi.mock('@/lib/credential-groups/scoped-availability', () => ({
   isScopedCredentialGroupsAvailable: async () => true,
 }))
 
+/** Each grant carries its own token, as a real exchange does, so a saved grant is identifiable. */
+let grants = 0
+
 vi.mock('@/lib/credential-groups/provider-registry', async (importOriginal) => {
   const { getCredentialGroupProviderId } = await import('@/lib/credential-groups/providers')
   return {
@@ -61,7 +64,7 @@ vi.mock('@/lib/credential-groups/provider-registry', async (importOriginal) => {
             providerTenantId: tenant || null,
             displayName: code,
             metadata: { email: code },
-            accessToken: `token-for-${code}`,
+            accessToken: `token-for-${code}-${(grants += 1)}`,
             grantedScopes: POLICY.requiredScopes,
             accessTokenExpiresAt: null,
             refreshTokenExpiresAt: null,
@@ -253,7 +256,7 @@ describe('connecting several accounts of one provider', () => {
       status: 'active',
     })
     expect(await decryptManagedOAuthTokenSet(stored?.tokens ?? '')).toMatchObject({
-      accessToken: 'token-for-work@second-tenant.test',
+      accessToken: expect.stringMatching(/^token-for-work@second-tenant\.test-/),
     })
   })
 
@@ -342,14 +345,16 @@ describe('reconnecting one of several accounts', () => {
 describe('adding another site to an Atlassian login', () => {
   it('keeps the new grant on the existing account instead of refusing it', async () => {
     const first = await connect('person@atlassian', { kind: 'create' }, CONFLUENCE)
-    const [before] = await rows()
+    const saved = async () =>
+      (await decryptManagedOAuthTokenSet((await rows())[0]?.tokens ?? '')).accessToken
+    const firstToken = await saved()
 
     const added = await connect('person@atlassian', { kind: 'create' }, CONFLUENCE)
 
     expect(added).toMatchObject({ created: false, credentialId: first.credentialId })
-    const after = await rows()
-    expect(after).toHaveLength(1)
-    expect(after[0]?.tokens).not.toBe(before?.tokens)
+    expect(await rows()).toHaveLength(1)
+    expect(await saved()).toMatch(/^token-for-person@atlassian-/)
+    expect(await saved()).not.toBe(firstToken)
   })
 
   it('still adds a different Atlassian login as its own account', async () => {

apps/sim/lib/credential-groups/providers.ts

@@ -272,10 +272,12 @@ export function getCredentialGroupProviderService(
   return service
 }
 
+/** Whether connecting the same login again refreshes its existing account, adding sites to it. */
 export function credentialGroupGrantSpansSites(provider: CredentialGroupProvider): boolean {
   return CREDENTIAL_GROUP_PROVIDER_SUPPORT[provider].grantSpansSites === true
 }
 
+/** Whether an account saved without a tenant may take one on when the same person reconnects. */
 export function credentialGroupTenantRecordedLater(provider: CredentialGroupProvider): boolean {
   return CREDENTIAL_GROUP_PROVIDER_SUPPORT[provider].tenantRecordedLater === true
 }