fix(auth): keep OAuth grant revocation out of the auth module graph

Author: waleedlatif1

apps/sim/lib/auth/auth.ts

@@ -55,6 +55,7 @@ import {
   recordPasswordResetAudit,
 } from '@/lib/auth/lifecycle-audit'
 import { hashOAuthToken } from '@/lib/auth/oauth-access-token'
+import { revokeUserOAuthGrants } from '@/lib/auth/oauth-grants'
 import {
   consentRequestNamesClient,
   OAUTH_ACCESS_TOKEN_PREFIX,
@@ -67,7 +68,6 @@ import {
   SIM_CLI_CLIENT_ID,
 } from '@/lib/auth/oauth-provider'
 import { bindOAuthIssuedResource, oauthResourcePlugin } from '@/lib/auth/oauth-resource'
-import { revokeUserOAuthGrants } from '@/lib/auth/oauth-token-family'
 import { getSessionCookieCacheVersion } from '@/lib/auth/security-policy'
 import { prepareSessionForCreation } from '@/lib/auth/session-hooks'
 import { clampExpiryForSession } from '@/lib/auth/session-policy'

apps/sim/lib/auth/oauth-grants.ts

@@ -0,0 +1,14 @@
+import { db } from '@sim/db'
+import { oauthAccessToken, oauthTokenFamily } from '@sim/db/schema'
+import { eq } from 'drizzle-orm'
+import type { DbOrTx } from '@/lib/db/types'
+
+/**
+ * Revokes every refresh family and access token a user holds. Families outlive the session that
+ * minted them (`session_id` is set null on delete), so deleting sessions alone leaves them
+ * rotatable. Consents are kept, so a legitimate client re-authorizes without a new consent prompt.
+ */
+export async function revokeUserOAuthGrants(userId: string, database: DbOrTx = db): Promise<void> {
+  await database.delete(oauthTokenFamily).where(eq(oauthTokenFamily.userId, userId))
+  await database.delete(oauthAccessToken).where(eq(oauthAccessToken.userId, userId))
+}

apps/sim/lib/auth/oauth-token-family.ts

@@ -493,19 +493,6 @@ export async function rotateOAuthRefreshToken(
   })
 }
 
-/**
- * Revokes every refresh family and access token a user holds. Families outlive the session that
- * minted them (`session_id` is set null on delete), so deleting sessions alone leaves them
- * rotatable. Consents are kept, so a legitimate client re-authorizes without a new consent prompt.
- */
-export async function revokeUserOAuthGrants(
-  userId: string,
-  database: OAuthDatabase = db
-): Promise<void> {
-  await database.delete(oauthTokenFamily).where(eq(oauthTokenFamily.userId, userId))
-  await database.delete(oauthAccessToken).where(eq(oauthAccessToken.userId, userId))
-}
-
 /** Revokes one refresh family or one opaque access token. Unknown tokens are a successful no-op. */
 export async function revokeOAuthToken(
   input: { credentials: OAuthClientCredentials; token: string },