fix(auth): colocate OAuth grant revocation with access tokens

Author: waleedlatif1

apps/sim/lib/auth/auth.ts

@@ -54,8 +54,7 @@ import {
   recordAuthenticationSecurityAudit,
   recordPasswordResetAudit,
 } from '@/lib/auth/lifecycle-audit'
-import { hashOAuthToken } from '@/lib/auth/oauth-access-token'
-import { revokeUserOAuthGrants } from '@/lib/auth/oauth-grants'
+import { hashOAuthToken, revokeUserOAuthGrants } from '@/lib/auth/oauth-access-token'
 import {
   consentRequestNamesClient,
   OAUTH_ACCESS_TOKEN_PREFIX,

apps/sim/lib/auth/oauth-access-token.ts

@@ -1,7 +1,7 @@
 import { AsyncLocalStorage } from 'node:async_hooks'
 import type { OAuthAccessTokenPrincipal } from '@sim/auth/principal'
 import { db } from '@sim/db'
-import { oauthAccessToken, oauthClient, user } from '@sim/db/schema'
+import { oauthAccessToken, oauthClient, oauthTokenFamily, user } from '@sim/db/schema'
 import { createLogger, setRequestAuth } from '@sim/logger'
 import { sha256Hex } from '@sim/security/hash'
 import { eq, sql } from 'drizzle-orm'
@@ -11,6 +11,7 @@ import {
   OAUTH_API_READ_SCOPE,
   oauthScopeSatisfies,
 } from '@/lib/auth/oauth-provider'
+import type { DbOrTx } from '@/lib/db/types'
 
 const logger = createLogger('OAuthAccessToken')
 
@@ -174,3 +175,13 @@ export async function verifyOAuthAccessToken(
     expiresAt: row.expiresAt,
   }
 }
+
+/**
+ * Revokes every refresh family and access token a user holds. Families outlive the session that
+ * minted them (`session_id` is set null on delete), so deleting sessions alone leaves them
+ * rotatable. Consents are kept, so a legitimate client re-authorizes without a new consent prompt.
+ */
+export async function revokeUserOAuthGrants(userId: string, database: DbOrTx = db): Promise<void> {
+  await database.delete(oauthTokenFamily).where(eq(oauthTokenFamily.userId, userId))
+  await database.delete(oauthAccessToken).where(eq(oauthAccessToken.userId, userId))
+}