improvement(search): clarify setup requirements and focus account connections

Author: waleedlatif1

apps/sim/app/api/credential-groups/enroll/[token]/oauth/[optionId]/route.test.ts

@@ -38,9 +38,9 @@ const context = {
   params: Promise.resolve({ token: 'invitation-token', optionId: 'option-1' }),
 }
 
-function request() {
+function request(query = '') {
   return new NextRequest(
-    'http://localhost:3000/api/credential-groups/enroll/invitation-token/oauth/option-1'
+    `http://localhost:3000/api/credential-groups/enroll/invitation-token/oauth/option-1${query}`
   )
 }
 
@@ -69,6 +69,41 @@ describe('credential group OAuth start route', () => {
     })
   })
 
+  it('forwards only the closed Search return context to the authorized operation', async () => {
+    await GET(request('?returnTo=search'), context)
+    expect(mocks.startOAuth).toHaveBeenCalledWith(
+      expect.objectContaining({
+        principal,
+        input: { invitationToken: 'invitation-token', optionId: 'option-1', returnTo: 'search' },
+      })
+    )
+    mocks.startOAuth.mockClear()
+    const response = await GET(request('?returnTo=https://external.test'), context)
+    expect(response.status).toBe(400)
+    expect(mocks.startOAuth).not.toHaveBeenCalled()
+  })
+
+  it.each(['ip', 'enrollment', 'unavailable', 'configuration'])(
+    'preserves exact Search focus after %s failure',
+    async (failure) => {
+      if (failure === 'ip')
+        mocks.ipRateLimit.mockResolvedValue(NextResponse.json({}, { status: 429 }))
+      if (failure === 'enrollment')
+        mocks.enrollmentRateLimit.mockResolvedValue(NextResponse.json({}, { status: 429 }))
+      if (failure === 'unavailable') mocks.authenticate.mockResolvedValue(null)
+      if (failure === 'configuration')
+        mocks.startOAuth.mockRejectedValue(new Error('Unavailable configuration'))
+      const response = await GET(request('?returnTo=search'), context)
+      const location = new URL(response.headers.get('location')!, 'http://localhost')
+      expect(location.pathname).toBe('/credential-groups/enroll/invitation-token')
+      expect(location.searchParams.get('optionId')).toBe('option-1')
+      expect(location.searchParams.get('returnTo')).toBe('search')
+      expect(location.searchParams.get('oauth')).toBe(
+        failure === 'ip' || failure === 'enrollment' ? 'rate_limited' : 'unavailable'
+      )
+    }
+  )
+
   it('returns an unavailable enrollment to its public page', async () => {
     mocks.authenticate.mockResolvedValue(null)
 

apps/sim/app/api/credential-groups/enroll/[token]/oauth/[optionId]/route.ts

@@ -29,25 +29,27 @@ export const GET = withRouteHandler(
     const parsed = await parseRequest(startCredentialGroupOAuthContract, request, context)
     if (!parsed.success) return limited ?? parsed.response
     const { token, optionId } = parsed.data.params
+    const { returnTo } = parsed.data.query
+    const focus: Record<string, string> = returnTo ? { optionId, returnTo } : {}
     if (limited) {
-      return createCredentialGroupEnrollmentRedirect(token, { oauth: 'rate_limited' })
+      return createCredentialGroupEnrollmentRedirect(token, { ...focus, oauth: 'rate_limited' })
     }
     const principal = await authenticateCredentialGroupEnrollment(token)
     if (!principal) {
-      return createCredentialGroupEnrollmentRedirect(token, { oauth: 'unavailable' })
+      return createCredentialGroupEnrollmentRedirect(token, { ...focus, oauth: 'unavailable' })
     }
 
     const enrollmentLimited = await enforceCredentialGroupEnrollmentOAuthRateLimit(
       principal.enrollmentId
     )
     if (enrollmentLimited) {
-      return createCredentialGroupEnrollmentRedirect(token, { oauth: 'rate_limited' })
+      return createCredentialGroupEnrollmentRedirect(token, { ...focus, oauth: 'rate_limited' })
     }
 
     try {
       const { authorizationUrl } = await startPublicCredentialGroupOAuth.execute({
         principal,
-        input: { invitationToken: token, optionId },
+        input: { invitationToken: token, optionId, ...(returnTo ? { returnTo } : {}) },
         request,
       })
       const response = NextResponse.redirect(authorizationUrl)
@@ -59,6 +61,7 @@ export const GET = withRouteHandler(
         error: getErrorMessage(error),
       })
       return createCredentialGroupEnrollmentRedirect(token, {
+        ...focus,
         oauth:
           error instanceof CredentialGroupOAuthError && error.statusCode === 409
             ? 'configuration_changed'

apps/sim/app/api/credential-groups/oauth-callback.ts

@@ -53,10 +53,13 @@ export async function handleCredentialGroupOAuthCallback({
       { status: 400, headers: { 'Cache-Control': 'no-store' } }
     )
   }
+  const focus: Record<string, string> = attempt.returnTo
+    ? { optionId: attempt.optionId, returnTo: attempt.returnTo }
+    : {}
   const failureRedirect = (oauth: CredentialGroupOAuthFailure) =>
     attempt.completionRedirect
       ? createCredentialGroupCompletionRedirect(oauth)
-      : createCredentialGroupEnrollmentRedirect(attempt.invitationToken, { oauth })
+      : createCredentialGroupEnrollmentRedirect(attempt.invitationToken, { ...focus, oauth })
   if (limited) {
     return failureRedirect('rate_limited')
   }
@@ -78,6 +81,7 @@ export async function handleCredentialGroupOAuthCallback({
     return attempt.completionRedirect
       ? createCredentialGroupCompletionRedirect()
       : createCredentialGroupEnrollmentRedirect(attempt.invitationToken, {
+          ...focus,
           connected: attempt.optionId,
         })
   } catch (error) {

apps/sim/app/api/credential-groups/oauth/[provider]/callback/route.test.ts

@@ -80,6 +80,56 @@ describe('credential group OAuth callback', () => {
     )
   })
 
+  it('restores the exact focused option after a successful Search connection', async () => {
+    mocks.consumeAttempt.mockResolvedValue({ ...attempt, optionId: 'site-two', returnTo: 'search' })
+    const response = await GET(request('state=state-1&code=code-1'), context)
+    expect(response.headers.get('location')).toBe(
+      '/credential-groups/enroll/invitation-token?optionId=site-two&returnTo=search&connected=site-two'
+    )
+    expect(mocks.completeOAuth).toHaveBeenCalledWith(
+      expect.objectContaining({
+        principal,
+        input: expect.objectContaining({
+          attempt: expect.objectContaining({ optionId: 'site-two' }),
+        }),
+      })
+    )
+  })
+
+  it.each([
+    [new CredentialGroupInvitationUnavailableError(), 'unavailable'],
+    [new CredentialGroupOAuthError('Sign in with your own account', 403), 'account_mismatch'],
+    [new CredentialGroupOAuthError('Missing scopes', 403), 'permissions_required'],
+    [new CredentialGroupOAuthError('Changed settings', 409), 'configuration_changed'],
+    [new Error('Provider failed'), 'failed'],
+  ])('retains Search focus after a rejected provider exchange: %s', async (error, status) => {
+    mocks.consumeAttempt.mockResolvedValue({ ...attempt, returnTo: 'search' })
+    mocks.completeOAuth.mockRejectedValueOnce(error)
+    const response = await GET(request('state=state-1&code=code-1'), context)
+    expect(response.headers.get('location')).toBe(
+      `/credential-groups/enroll/invitation-token?optionId=option-1&returnTo=search&oauth=${status}`
+    )
+  })
+
+  it.each(['denied', 'rate_limited'])(
+    'retains Search focus without exchanging after %s',
+    async (status) => {
+      mocks.consumeAttempt.mockResolvedValue({ ...attempt, returnTo: 'search' })
+      if (status === 'rate_limited')
+        mocks.rateLimit.mockResolvedValue(NextResponse.json({}, { status: 429 }))
+      const response = await GET(
+        request(
+          status === 'denied' ? 'state=state-1&error=access_denied' : 'state=state-1&code=code-1'
+        ),
+        context
+      )
+      expect(response.headers.get('location')).toBe(
+        `/credential-groups/enroll/invitation-token?optionId=option-1&returnTo=search&oauth=${status}`
+      )
+      expect(mocks.completeOAuth).not.toHaveBeenCalled()
+    }
+  )
+
   it('rejects standard providers on the custom callback route', async () => {
     const response = await GET(
       new NextRequest(

apps/sim/app/credential-groups/enroll/[token]/oauth-reconnect-link.tsx

@@ -1,15 +1,15 @@
 'use client'
 
-import { chipVariants } from '@sim/emcn'
+import { type ChipLinkProps, chipVariants } from '@sim/emcn'
 
-interface OAuthConnectLinkProps {
+interface OAuthConnectLinkProps extends Pick<ChipLinkProps, 'variant'> {
   href: string
   reconnect?: boolean
 }
 
-export function OAuthConnectLink({ href, reconnect = false }: OAuthConnectLinkProps) {
+export function OAuthConnectLink({ href, reconnect = false, variant }: OAuthConnectLinkProps) {
   return (
-    <a href={href} className={chipVariants()}>
+    <a href={href} className={chipVariants({ variant })}>
       {reconnect ? 'Reconnect' : 'Connect'}
     </a>
   )