fix(oauth): preflight Google integration config#4793
Conversation
|
@RitwijParmar is attempting to deploy a commit to the Sim Team on Vercel. A member of the Team first needs to authorize it. |
PR SummaryLow Risk Overview The workspace OAuth modal calls this preflight for Google-family and Vertex AI providers before starting the flow; failures show in the modal instead of a confusing Google Self-hosting docs now list per-service Google callback URLs and note that the host must match Reviewed by Cursor Bugbot for commit b9d0ad6. Bugbot is set up for automated code reviews on this repo. Configure here. |
Greptile SummaryThis PR adds a server-side preflight check for Google OAuth provider configuration, giving self-hosted users a clear in-app error message (including the correct redirect URI) instead of a confusing Google
Confidence Score: 3/5The core guard only fires in The modal wires the preflight inside the apps/sim/app/workspace/[workspaceId]/components/oauth-modal.tsx — the preflight block needs to be extracted outside the Important Files Changed
Reviews (1): Last reviewed commit: "fix(oauth): preflight google integration..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| if (shouldPreflightOAuthProvider(providerId)) { | ||
| const providerConfig = await requestJson(getOAuthProviderConfigContract, { | ||
| query: { providerId }, | ||
| }) | ||
| if (!providerConfig.available) { | ||
| setError(providerConfig.message) | ||
| return | ||
| } | ||
| } |
There was a problem hiding this comment.
reauthorize mode
The shouldPreflightOAuthProvider check is nested inside if (isConnect), so when mode === 'reauthorize' the code falls through directly to client.oauth2.link() without any config validation. A self-hosted user whose Google credentials are broken or misconfigured will still be bounced to the invalid_client page when attempting to reauthorize — exactly the UX problem this PR set out to fix.
Moving the preflight block (lines 168–176) to just before the trello/shopify guards — outside both the isConnect block and the onConnectOverride early return — would cover both flows.
| } | ||
|
|
||
| const GOOGLE_CLIENT_ID_SUFFIX = '.apps.googleusercontent.com' | ||
| const PLACEHOLDER_PATTERN = /^(|your-|change-me|changeme|example|<.*>)$/i |
There was a problem hiding this comment.
PLACEHOLDER_PATTERN regex contains an empty first alternative (^(|your-|...)$), which makes the pattern match the empty string. The earlier if (!value) return false guard prevents this from causing a false positive, but the empty alternative is confusing and could mask intent. Consider removing it so the regex documents only the actual placeholder patterns it's designed to catch.
| const PLACEHOLDER_PATTERN = /^(|your-|change-me|changeme|example|<.*>)$/i | |
| const PLACEHOLDER_PATTERN = /^(your-|change-me|changeme|example|<.*>)$/i |
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit cd08394. Configure here.
|
|
||
| function shouldPreflightOAuthProvider(providerId: string): boolean { | ||
| return providerId === 'google' || providerId.startsWith('google-') || providerId === 'vertex-ai' | ||
| } |
There was a problem hiding this comment.
Duplicated Google provider predicate may diverge
Medium Severity
shouldPreflightOAuthProvider in the modal duplicates the exact logic of isGoogleProvider in provider-config.ts. The client-side gate decides whether to call the preflight API, while the server-side function decides what to validate — if a new Google-family provider is added to one but not the other, the preflight will silently be skipped or return a false positive. Extracting the predicate into a shared, dependency-free module (or exporting isGoogleProvider) would keep the two sides in sync.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit cd08394. Configure here.
1 participant
Summary
Fixes #860.
Self-hosted users can currently start the Google Sheets/Drive/Docs OAuth flow even when the Google integration OAuth env is missing, still placeholder text, or clearly not a Google web client ID. That sends them to Google and often ends in a confusing
invalid_clientpage before Sim can explain what is wrong.This adds a small authenticated preflight for Google integration OAuth that returns the exact callback URI Sim will use, blocks the obviously broken configurations before redirecting, and leaves non-Google providers untouched. I also added the callback URI examples to the self-hosting env docs.
Verification
/Users/ritwij/.bun/bin/bun test apps/sim/lib/oauth/provider-config.test.ts/Users/ritwij/.bun/bin/bunx biome check apps/sim/lib/oauth/provider-config.ts apps/sim/lib/oauth/provider-config.test.ts apps/sim/app/api/auth/oauth/provider-config/route.ts apps/sim/lib/api/contracts/auth.ts 'apps/sim/app/workspace/[workspaceId]/components/oauth-modal.tsx' apps/docs/content/docs/en/self-hosting/environment-variables.mdx\n-/Users/ritwij/.bun/bin/bun run --cwd apps/sim type-check