fix(search-mcp): preserve existing API OAuth grants

Author: waleedlatif1

apps/sim/lib/api/server/routes/v2-api-key-auth.test.ts

@@ -13,7 +13,6 @@ const mocks = vi.hoisted(() => ({
 
 vi.mock('@/lib/core/config/env-flags', () => mocks.envFlags)
 vi.mock('@/lib/api-key/crypto', () => ({ hashApiKey: (value: string) => `hash:${value}` }))
-vi.mock('@/lib/auth/oauth-provider', () => ({ OAUTH_ACCESS_TOKEN_PREFIX: 'sim_oat_' }))
 vi.mock('@sim/security/hash', () => ({ sha256Hex: (value: string) => `oauth-hash:${value}` }))
 vi.mock('@/lib/api-key/service', () => ({ updateApiKeyLastUsed: mocks.updateLastUsed }))
 vi.mock('@/lib/billing/core/billing-attribution', () => ({
@@ -284,6 +283,45 @@ describe('v2 bearer token authentication', () => {
     expect(result.keyType).toBe('personal')
   })
 
+  it.each(['api:read', 'api:write'])(
+    'authenticates existing %s grants when Search MCP opts in',
+    async (scope) => {
+      queueTableRows(schemaMock.oauthAccessToken, [tokenRow({ resource: null, scopes: [scope] })])
+
+      await expect(
+        authenticateV2ApiKey(
+          { apiKey: null, bearer: 'sim_oat_secret' },
+          {
+            resource: 'https://sim.example/api/mcp/search/organizations/one',
+            allowUnboundApiTokens: true,
+          }
+        )
+      ).resolves.toMatchObject({
+        principal: { kind: 'oauth_access_token', userId: 'user-1', scopes: [scope] },
+      })
+    }
+  )
+
+  it('still refuses invalid or differently bound API grants when Search MCP opts in', async () => {
+    for (const overrides of [
+      { resource: 'https://sim.example/api/mcp/search/organizations/other' },
+      { expiresAt: new Date(0) },
+      { clientDisabled: true },
+      { userBanned: true },
+    ]) {
+      queueTableRows(schemaMock.oauthAccessToken, [tokenRow(overrides)])
+      await expect(
+        authenticateV2ApiKey(
+          { apiKey: null, bearer: 'sim_oat_secret' },
+          {
+            resource: 'https://sim.example/api/mcp/search/organizations/one',
+            allowUnboundApiTokens: true,
+          }
+        )
+      ).rejects.toBeInstanceOf(V2ApiKeyUnauthenticatedError)
+    }
+  })
+
   it('preserves auth-disabled deployment behavior without verifying an OAuth token', async () => {
     mocks.envFlags.isAuthDisabled = true
 

apps/sim/lib/api/server/routes/v2-api-key-auth.ts

@@ -11,7 +11,11 @@ import type { V2CredentialHeaders } from '@/lib/api/server/routes/v2-credential-
 import { hashApiKey } from '@/lib/api-key/crypto'
 import { updateApiKeyLastUsed } from '@/lib/api-key/service'
 import { ANONYMOUS_USER_ID } from '@/lib/auth/constants'
-import { InvalidOAuthAccessTokenError, verifyOAuthAccessToken } from '@/lib/auth/oauth-access-token'
+import {
+  InvalidOAuthAccessTokenError,
+  type OAuthAccessTokenOptions,
+  verifyOAuthAccessToken,
+} from '@/lib/auth/oauth-access-token'
 import { resolveWorkspaceBillingPayer } from '@/lib/billing/core/billing-attribution'
 import { getHighestPrioritySubscription } from '@/lib/billing/core/subscription'
 import { isAuthDisabled } from '@/lib/core/config/env-flags'
@@ -156,11 +160,14 @@ async function authenticateApiKey(apiKeyHeader: string): Promise<V2ApiKeyAuthCon
  * token and per user, on the user's own plan. A client that holds many tokens
  * for one user still shares that user's bucket.
  */
-async function authenticateBearer(token: string, resource?: string): Promise<V2ApiKeyAuthContext> {
+async function authenticateBearer(
+  token: string,
+  options: OAuthAccessTokenOptions
+): Promise<V2ApiKeyAuthContext> {
   let principal: OAuthAccessTokenPrincipal
   try {
-    principal = resource
-      ? await verifyOAuthAccessToken(token, { resource })
+    principal = options.resource
+      ? await verifyOAuthAccessToken(token, options)
       : await verifyOAuthAccessToken(token)
   } catch (error) {
     if (error instanceof InvalidOAuthAccessTokenError) {
@@ -188,7 +195,7 @@ async function authenticateBearer(token: string, resource?: string): Promise<V2A
  */
 export async function authenticateV2ApiKey(
   credential: V2CredentialHeaders,
-  options: { resource?: string } = {}
+  options: OAuthAccessTokenOptions = {}
 ): Promise<V2ApiKeyAuthContext> {
   if (isAuthDisabled) {
     return {
@@ -204,7 +211,7 @@ export async function authenticateV2ApiKey(
     }
   }
   if (credential.apiKey) return authenticateApiKey(credential.apiKey)
-  if (credential.bearer) return authenticateBearer(credential.bearer, options.resource)
+  if (credential.bearer) return authenticateBearer(credential.bearer, options)
   if (credential.malformedOAuthBearer) {
     throw new V2ApiKeyUnauthenticatedError('Invalid access token', 'bearer')
   }

apps/sim/lib/auth/oauth-access-token.test.ts

@@ -4,7 +4,6 @@
 import { dbChainMockFns, queueTableRows, resetDbChainMock, schemaMock } from '@sim/testing'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-vi.mock('@/lib/auth/oauth-provider', () => ({ OAUTH_ACCESS_TOKEN_PREFIX: 'sim_oat_' }))
 vi.mock('@sim/security/hash', () => ({ sha256Hex: (value: string) => `hash:${value}` }))
 
 import {
@@ -146,4 +145,30 @@ describe('verifyOAuthAccessToken', () => {
       reason: 'wrong_resource',
     })
   })
+
+  it.each(['api:read', 'api:write'])(
+    'preserves %s tokens only when the resource explicitly accepts API grants',
+    async (scope) => {
+      const resource = 'https://sim.example/api/mcp/search/organizations/one'
+      queueTableRows(schemaMock.oauthAccessToken, [row({ scopes: [scope] })])
+      await expect(
+        verifyOAuthAccessToken('sim_oat_api', { resource, allowUnboundApiTokens: true })
+      ).resolves.toMatchObject({ userId: 'user-1', scopes: [scope] })
+    }
+  )
+
+  it('never relaxes audience checks for Search-only or differently bound grants', async () => {
+    const resource = 'https://sim.example/api/mcp/search/organizations/one'
+    for (const token of [
+      row({ scopes: ['search:read'] }),
+      row({ scopes: ['offline_access'] }),
+      row({ resource: `${resource}-other`, scopes: ['api:read'] }),
+      row({ resource: `${resource}-other`, scopes: ['search:read'] }),
+    ]) {
+      queueTableRows(schemaMock.oauthAccessToken, [token])
+      await expect(
+        verifyOAuthAccessToken('sim_oat_other', { resource, allowUnboundApiTokens: true })
+      ).rejects.toMatchObject({ reason: 'wrong_resource' })
+    }
+  })
 })

apps/sim/lib/auth/oauth-access-token.ts

@@ -5,7 +5,11 @@ import { createLogger } from '@sim/logger'
 import { sha256Hex } from '@sim/security/hash'
 import { eq } from 'drizzle-orm'
 import { isAccountBlocked } from '@/lib/auth/ban'
-import { OAUTH_ACCESS_TOKEN_PREFIX } from '@/lib/auth/oauth-provider'
+import {
+  OAUTH_ACCESS_TOKEN_PREFIX,
+  OAUTH_API_READ_SCOPE,
+  oauthScopeSatisfies,
+} from '@/lib/auth/oauth-provider'
 
 const logger = createLogger('OAuthAccessToken')
 
@@ -66,6 +70,12 @@ function looksLikeOAuthAccessToken(token: string): boolean {
   return token.startsWith(OAUTH_ACCESS_TOKEN_PREFIX)
 }
 
+export interface OAuthAccessTokenOptions {
+  resource?: string
+  /** Search MCP also accepts existing full-API grants; Search-only tokens still need an audience. */
+  allowUnboundApiTokens?: boolean
+}
+
 /**
  * Resolves an opaque OAuth access token to the principal it stands for.
  *
@@ -78,7 +88,7 @@ function looksLikeOAuthAccessToken(token: string): boolean {
  */
 export async function verifyOAuthAccessToken(
   token: string,
-  options: { resource?: string } = {}
+  options: OAuthAccessTokenOptions = {}
 ): Promise<OAuthAccessTokenPrincipal> {
   if (!looksLikeOAuthAccessToken(token)) throw new InvalidOAuthAccessTokenError('malformed')
   const raw = token.slice(OAUTH_ACCESS_TOKEN_PREFIX.length)
@@ -105,7 +115,12 @@ export async function verifyOAuthAccessToken(
     .limit(1)
 
   if (!row) throw new InvalidOAuthAccessTokenError('unknown')
-  if ((row.resource ?? null) !== (options.resource ?? null)) {
+  const acceptsUnboundApiToken =
+    options.allowUnboundApiTokens &&
+    options.resource &&
+    row.resource == null &&
+    oauthScopeSatisfies(row.scopes, OAUTH_API_READ_SCOPE)
+  if ((row.resource ?? null) !== (options.resource ?? null) && !acceptsUnboundApiToken) {
     throw new InvalidOAuthAccessTokenError('wrong_resource')
   }
   if (row.expiresAt <= new Date()) throw new InvalidOAuthAccessTokenError('expired')

apps/sim/lib/knowledge/mcp/route-handler.test.ts

@@ -169,7 +169,7 @@ describe('organization MCP request admission', () => {
     expect(mocks.close).toHaveBeenCalledOnce()
     expect(mocks.authenticate).toHaveBeenCalledWith(
       { apiKey: 'personal-key', bearer: null },
-      { resource }
+      { resource, allowUnboundApiTokens: true }
     )
   })
   it('preserves API keys supplied in the MCP bearer header', async () => {
@@ -178,7 +178,7 @@ describe('organization MCP request admission', () => {
     expect((await post(req)).status).toBe(200)
     expect(mocks.authenticate).toHaveBeenCalledWith(
       { apiKey: 'personal-key', bearer: null },
-      { resource }
+      { resource, allowUnboundApiTokens: true }
     )
   })
   it('authenticates OAuth bearer tokens and checks organization membership', async () => {
@@ -198,7 +198,10 @@ describe('organization MCP request admission', () => {
       keyType: 'oauth',
     })
     expect((await post(req)).status).toBe(200)
-    expect(mocks.authenticate).toHaveBeenCalledWith({ apiKey: null, bearer: token }, { resource })
+    expect(mocks.authenticate).toHaveBeenCalledWith(
+      { apiKey: null, bearer: token },
+      { resource, allowUnboundApiTokens: true }
+    )
     expect(mocks.index).toHaveBeenCalledWith({ kind: 'organization', organizationId: 'org-1' })
   })
   it('rejects workspace API keys even if the workspace ID matches the organization ID', async () => {

apps/sim/lib/knowledge/mcp/route-handler.ts

@@ -36,7 +36,7 @@ function mcpAuth(resource: string) {
           apiKey: apiKey ?? (oauthBearer ? null : (bearer ?? null)),
           bearer: oauthBearer,
         },
-        { resource }
+        { resource, allowUnboundApiTokens: true }
       )
     },
   }

packages/db/schema.ts

@@ -4247,6 +4247,7 @@ export const oauthRefreshToken = pgTable(
       'oauth_refresh_token_generation_check',
       sql`${table.generation} BETWEEN 0 AND 1000`
     ),
+    /** contract-pending(after #7613 is fully deployed): validate oauth_refresh_token_search_resource_check separately so rollout avoids a token-table scan. */
     searchResourceCheck: check(
       'oauth_refresh_token_search_resource_check',
       sql`NOT ('search:read' = ANY(${table.scopes})) OR ${table.resource} IS NOT NULL`
@@ -4281,6 +4282,7 @@ export const oauthAccessToken = pgTable(
     userClientIdx: index('oauth_access_token_user_client_idx').on(table.userId, table.clientId),
     /** Drives the cleanup pass; nothing else reads tokens by expiry. */
     expiresAtIdx: index('oauth_access_token_expires_at_idx').on(table.expiresAt),
+    /** contract-pending(after #7613 is fully deployed): validate oauth_access_token_search_resource_check separately so rollout avoids a token-table scan. */
     searchResourceCheck: check(
       'oauth_access_token_search_resource_check',
       sql`NOT ('search:read' = ANY(${table.scopes})) OR ${table.resource} IS NOT NULL`