fix(search): deny revoked Atlassian grants and bound provider requests

Author: waleedlatif1

apps/sim/lib/auth/connectors/managed-oauth.test.ts

@@ -115,6 +115,19 @@ describe('Atlassian managed OAuth connector', () => {
     expect(jira.isTerminalRefreshError('invalid_grant')).toBe(true)
     expect(jira.isTerminalRefreshError('temporarily_unavailable')).toBe(false)
   })
+
+  it.each(['jira', 'confluence'] as const)(
+    'requires reconnect after %s rejects a revoked refresh grant',
+    (provider) => {
+      const connector = createAtlassianManagedOAuthConnector(provider)
+      expect(connector.isTerminalRefreshError('invalid_grant')).toBe(true)
+      expect(connector.isTerminalRefreshError('unauthorized_client')).toBe(true)
+      expect(connector.isTerminalRefreshError('invalid_client')).toBe(false)
+      expect(connector.isTerminalRefreshError('temporarily_unavailable')).toBe(false)
+      expect(connector.isTerminalRefreshError('server_error')).toBe(false)
+      expect(connector.isTerminalRefreshError(undefined)).toBe(false)
+    }
+  )
 })
 
 describe('userinfo-backed managed OAuth connectors', () => {

apps/sim/lib/auth/connectors/managed-oauth.ts

@@ -239,7 +239,7 @@ export function createAtlassianManagedOAuthConnector(
       return requiredScopes.every((scope) => granted.has(scope))
     },
     isTerminalRefreshError(errorCode) {
-      return errorCode === 'invalid_grant'
+      return errorCode === 'invalid_grant' || errorCode === 'unauthorized_client'
     },
   }
 }

apps/sim/lib/knowledge/__integration__/jira-member.integration.ts

@@ -99,6 +99,7 @@ describe('Jira member indexing and authorization in PostgreSQL', () => {
   const failures = new Map<string, 400 | 401>()
   const requests: { token: string; page: string | null }[] = []
   const refreshAttempts: string[] = []
+  let refreshError: 'invalid_grant' | 'unauthorized_client' = 'invalid_grant'
   let billing: Awaited<ReturnType<typeof resolveBillingAttribution>>
   const actor = (userId: string): Principal => ({
     kind: 'session',
@@ -126,10 +127,7 @@ describe('Jira member indexing and authorization in PostgreSQL', () => {
         if (!person || failures.get(person.accessToken) !== 401)
           throw new Error('Unexpected Jira fixture token refresh')
         refreshAttempts.push(person.userId)
-        return Response.json(
-          { error: 'invalid_grant', error_description: 'Unknown or invalid refresh token.' },
-          { status: 403 }
-        )
+        return Response.json({ error: refreshError }, { status: 403 })
       }
       const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : {}))
       const token = headers.get('Authorization')?.replace(/^Bearer /, '') ?? ''
@@ -262,6 +260,7 @@ describe('Jira member indexing and authorization in PostgreSQL', () => {
   })
 
   beforeEach(async () => {
+    refreshError = 'invalid_grant'
     failures.clear()
     requests.length = 0
     refreshAttempts.length = 0
@@ -526,20 +525,27 @@ describe('Jira member indexing and authorization in PostgreSQL', () => {
     await assertAccess(alice, ['1', '2'])
   })
 
-  it('marks a provider-rejected credential for reconnect and immediately hides that member corpus', async () => {
-    failures.set(alice.accessToken, 401)
-    const result = await sync()
-    expect(result.membersFailed).toBe(1)
-    expect(refreshAttempts).toEqual([alice.userId])
-    const [saved] = await db.select().from(credential).where(eq(credential.id, alice.credentialId))
-    expect(saved.managedOauthStatus).toBe('needs_reauth')
-    await assertAccess(alice, [])
-    await assertAccess(bob, ['1', '3'])
-    expect(
-      await db
+  it.each(['invalid_grant', 'unauthorized_client'] as const)(
+    'marks a %s refresh rejection for reconnect and immediately hides that member corpus',
+    async (errorCode) => {
+      refreshError = errorCode
+      failures.set(alice.accessToken, 401)
+      const result = await sync()
+      expect(result.membersFailed).toBe(1)
+      expect(refreshAttempts).toEqual([alice.userId])
+      const [saved] = await db
         .select()
-        .from(document)
-        .where(and(eq(document.connectorId, connectorId), isNull(document.deletedAt)))
-    ).toHaveLength(4)
-  })
+        .from(credential)
+        .where(eq(credential.id, alice.credentialId))
+      expect(saved.managedOauthStatus).toBe('needs_reauth')
+      await assertAccess(alice, [])
+      await assertAccess(bob, ['1', '3'])
+      expect(
+        await db
+          .select()
+          .from(document)
+          .where(and(eq(document.connectorId, connectorId), isNull(document.deletedAt)))
+      ).toHaveLength(4)
+    }
+  )
 })