chore: import upstream snapshot with attribution

apps/sim/app/api/auth/oauth/connections/route.test.ts

@@ -0,0 +1,180 @@
+/**
+ * Tests for OAuth connections API route
+ *
+ * @vitest-environment node
+ */
+import {
+  authMockFns,
+  createMockRequest,
+  dbChainMock,
+  dbChainMockFns,
+  resetDbChainMock,
+} from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockParseProvider, mockDecodeJwt, mockEq } = vi.hoisted(() => ({
+  mockParseProvider: vi.fn(),
+  mockDecodeJwt: vi.fn(),
+  mockEq: vi.fn((field: unknown, value: unknown) => ({ field, value, type: 'eq' })),
+}))
+
+vi.mock('@sim/db', () => ({
+  ...dbChainMock,
+  account: { userId: 'userId', providerId: 'providerId' },
+  user: { email: 'email', id: 'id' },
+  eq: mockEq,
+}))
+
+vi.mock('drizzle-orm', () => ({
+  eq: mockEq,
+}))
+
+vi.mock('jose', () => ({
+  decodeJwt: mockDecodeJwt,
+}))
+
+vi.mock('@/lib/oauth/utils', () => ({
+  parseProvider: mockParseProvider,
+}))
+
+import { GET } from '@/app/api/auth/oauth/connections/route'
+
+describe('OAuth Connections API Route', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    resetDbChainMock()
+
+    mockParseProvider.mockImplementation((providerId: string) => ({
+      baseProvider: providerId.split('-')[0] || providerId,
+      featureType: providerId.split('-')[1] || 'default',
+    }))
+  })
+
+  it('should return connections successfully', async () => {
+    authMockFns.mockGetSession.mockResolvedValueOnce({
+      user: { id: 'user-123' },
+    })
+
+    const mockAccounts = [
+      {
+        id: 'account-1',
+        providerId: 'google-email',
+        accountId: 'test@example.com',
+        scope: 'email profile',
+        updatedAt: new Date('2024-01-01'),
+        idToken: null,
+      },
+      {
+        id: 'account-2',
+        providerId: 'github',
+        accountId: 'testuser',
+        scope: 'repo',
+        updatedAt: new Date('2024-01-02'),
+        idToken: null,
+      },
+    ]
+
+    const mockUserRecord = [{ email: 'user@example.com' }]
+
+    dbChainMockFns.where.mockResolvedValueOnce(mockAccounts)
+    dbChainMockFns.limit.mockResolvedValueOnce(mockUserRecord)
+
+    const req = createMockRequest('GET')
+
+    const response = await GET(req)
+    const data = await response.json()
+
+    expect(response.status).toBe(200)
+    expect(data.connections).toHaveLength(2)
+    expect(data.connections[0]).toMatchObject({
+      provider: 'google-email',
+      baseProvider: 'google',
+      featureType: 'email',
+      isConnected: true,
+    })
+    expect(data.connections[1]).toMatchObject({
+      provider: 'github',
+      baseProvider: 'github',
+      featureType: 'default',
+      isConnected: true,
+    })
+  })
+
+  it('should handle unauthenticated user', async () => {
+    authMockFns.mockGetSession.mockResolvedValueOnce(null)
+
+    const req = createMockRequest('GET')
+
+    const response = await GET(req)
+    const data = await response.json()
+
+    expect(response.status).toBe(401)
+    expect(data.error).toBe('User not authenticated')
+  })
+
+  it('should handle user with no connections', async () => {
+    authMockFns.mockGetSession.mockResolvedValueOnce({
+      user: { id: 'user-123' },
+    })
+
+    dbChainMockFns.where.mockResolvedValueOnce([])
+    dbChainMockFns.limit.mockResolvedValueOnce([])
+
+    const req = createMockRequest('GET')
+
+    const response = await GET(req)
+    const data = await response.json()
+
+    expect(response.status).toBe(200)
+    expect(data.connections).toHaveLength(0)
+  })
+
+  it('should handle database error', async () => {
+    authMockFns.mockGetSession.mockResolvedValueOnce({
+      user: { id: 'user-123' },
+    })
+
+    dbChainMockFns.where.mockRejectedValueOnce(new Error('Database error'))
+
+    const req = createMockRequest('GET')
+
+    const response = await GET(req)
+    const data = await response.json()
+
+    expect(response.status).toBe(500)
+    expect(data.error).toBe('Internal server error')
+  })
+
+  it('should decode ID token for display name', async () => {
+    authMockFns.mockGetSession.mockResolvedValueOnce({
+      user: { id: 'user-123' },
+    })
+
+    const mockAccounts = [
+      {
+        id: 'account-1',
+        providerId: 'google',
+        accountId: 'google-user-id',
+        scope: 'email profile',
+        updatedAt: new Date('2024-01-01'),
+        idToken: 'mock-jwt-token',
+      },
+    ]
+
+    mockDecodeJwt.mockReturnValueOnce({
+      email: 'decoded@example.com',
+      name: 'Decoded User',
+    })
+
+    dbChainMockFns.where.mockResolvedValueOnce(mockAccounts)
+    dbChainMockFns.limit.mockResolvedValueOnce([])
+
+    const req = createMockRequest('GET')
+
+    const response = await GET(req)
+    const data = await response.json()
+
+    expect(response.status).toBe(200)
+    expect(data.connections[0].accounts[0].name).toBe('decoded@example.com')
+  })
+})

apps/sim/app/api/auth/oauth/connections/route.ts

@@ -0,0 +1,139 @@
+import { account, db, user } from '@sim/db'
+import { createLogger } from '@sim/logger'
+import { eq } from 'drizzle-orm'
+import { decodeJwt } from 'jose'
+import { type NextRequest, NextResponse } from 'next/server'
+import type { OAuthConnection } from '@/lib/api/contracts/oauth-connections'
+import { getSession } from '@/lib/auth'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import type { OAuthProvider } from '@/lib/oauth'
+import { parseProvider } from '@/lib/oauth'
+
+const logger = createLogger('OAuthConnectionsAPI')
+
+interface GoogleIdToken {
+  email?: string
+  sub?: string
+  name?: string
+}
+
+/**
+ * Get all OAuth connections for the current user
+ */
+export const GET = withRouteHandler(async (request: NextRequest) => {
+  const requestId = generateRequestId()
+
+  try {
+    // Get the session
+    const session = await getSession()
+
+    // Check if the user is authenticated
+    if (!session?.user?.id) {
+      logger.warn(`[${requestId}] Unauthenticated request rejected`)
+      return NextResponse.json({ error: 'User not authenticated' }, { status: 401 })
+    }
+
+    // Get all accounts for this user
+    const accounts = await db.select().from(account).where(eq(account.userId, session.user.id))
+
+    // Get the user's email for fallback
+    const userRecord = await db
+      .select({ email: user.email })
+      .from(user)
+      .where(eq(user.id, session.user.id))
+      .limit(1)
+
+    const userEmail = userRecord.length > 0 ? userRecord[0]?.email : null
+
+    // Process accounts to determine connections
+    const connections: OAuthConnection[] = []
+
+    for (const acc of accounts) {
+      const { baseProvider, featureType } = parseProvider(acc.providerId as OAuthProvider)
+      const scopes = acc.scope ? acc.scope.split(/\s+/).filter(Boolean) : []
+
+      if (baseProvider) {
+        // Try multiple methods to get a user-friendly display name
+        let displayName = ''
+
+        // Method 1: Try to extract email from ID token (works for Google, etc.)
+        if (acc.idToken) {
+          try {
+            const decoded = decodeJwt<GoogleIdToken>(acc.idToken)
+            if (decoded.email) {
+              displayName = decoded.email
+            } else if (decoded.name) {
+              displayName = decoded.name
+            }
+          } catch (_error) {
+            logger.warn(`[${requestId}] Error decoding ID token`, {
+              accountId: acc.id,
+            })
+          }
+        }
+
+        // Method 2: For GitHub, the accountId might be the username
+        if (!displayName && baseProvider === 'github') {
+          displayName = `${acc.accountId} (GitHub)`
+        }
+
+        // Method 3: Use the user's email from our database
+        if (!displayName && userEmail) {
+          displayName = userEmail
+        }
+
+        // Fallback: Use accountId with provider type as context
+        if (!displayName) {
+          displayName = `${acc.accountId} (${baseProvider})`
+        }
+
+        // Create a unique connection key that includes the full provider ID
+        const connectionKey = acc.providerId
+
+        // Find existing connection for this specific provider ID
+        const existingConnection = connections.find((conn) => conn.provider === connectionKey)
+
+        const accountSummary = {
+          id: acc.id,
+          name: displayName,
+        }
+
+        if (existingConnection) {
+          // Add account to existing connection
+          existingConnection.accounts = existingConnection.accounts || []
+          existingConnection.accounts.push(accountSummary)
+
+          existingConnection.scopes = Array.from(
+            new Set([...(existingConnection.scopes || []), ...scopes])
+          )
+
+          const existingTimestamp = existingConnection.lastConnected
+            ? new Date(existingConnection.lastConnected).getTime()
+            : 0
+          const candidateTimestamp = acc.updatedAt.getTime()
+
+          if (candidateTimestamp > existingTimestamp) {
+            existingConnection.lastConnected = acc.updatedAt.toISOString()
+          }
+        } else {
+          // Create new connection
+          connections.push({
+            provider: connectionKey,
+            baseProvider,
+            featureType,
+            isConnected: true,
+            scopes,
+            lastConnected: acc.updatedAt.toISOString(),
+            accounts: [accountSummary],
+          })
+        }
+      }
+    }
+
+    return NextResponse.json({ connections }, { status: 200 })
+  } catch (error) {
+    logger.error(`[${requestId}] Error fetching OAuth connections`, error)
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
+  }
+})