fix(auth): bound cleanup runtime and finish consent polish

Author: waleedlatif1

apps/docs/content/docs/api-reference/authentication.mdx

@@ -103,7 +103,7 @@ curl https://www.sim.ai/api/v2/workspaces \
 | Scope | Access |
 | --- | --- |
 | `api:read` | Read operations, including searches sent as POST requests |
-| `api:write` | Mutations and execution, including operations that can start external work |
+| `api:write` | Includes `api:read`, plus mutations and execution, including operations that can start external work |
 | `offline_access` | Refresh tokens for continued access after the access token expires |
 
 Scopes limit what an application may do; your current workspace membership and role still apply. Each endpoint documents its required scope. Some GET endpoints that perform external discovery require `api:write`, so HTTP method alone does not determine the permission.

apps/docs/content/docs/platform/self-hosting/authentication.mdx

@@ -98,14 +98,17 @@ returns 404 and the CLI falls back to the pairing-code handoff on its own.
 `DISABLE_AUTH=true` also forces the provider off because the authorization flow
 requires a real Better Auth user session.
 
-Access tokens are opaque and last an hour; refresh tokens rotate on every use
-and expire after thirty days. Nothing is cached, so revoking a grant under
+Access tokens are opaque and last an hour; refresh tokens rotate on every use.
+Each login has a fixed thirty-day lifetime that refreshing does not extend.
+Nothing is cached, so revoking a grant under
 **Settings → Authorized apps** stops the app on its very next request.
 
 ### Registering an app
 
 Dynamic client registration is switched off, so clients are created by an
-operator. The Sim CLI is seeded by the migration; register anything else with:
+operator. Both `db:migrate` and the development `db:push` command install the
+OAuth lifecycle triggers and register the Sim CLI. Repeating either command
+preserves existing grants and client customizations. Register other apps with:
 
 ```bash
 DATABASE_URL=… \

apps/sim/app/(auth)/oauth/consent/consent-view.tsx

@@ -45,13 +45,8 @@ interface OAuthConsentViewProps {
 }
 
 /**
- * The host the authorization code will be delivered to, or `null` when the
- * request names none this page can read.
- *
- * A registered `client_name` is whatever the client called itself, so for a
- * public client the destination is the one part of the request an impostor
- * cannot borrow. A loopback address is named plainly rather than shown as an
- * IP, because "this computer" is what it means to the person reading it.
+ * Shows the redirect host beside the app name to help identify impersonation;
+ * names loopback callbacks as this computer.
  */
 function describeDestination(redirectUri: string | null): string | null {
   if (!redirectUri) return null
@@ -66,11 +61,8 @@ function describeDestination(redirectUri: string | null): string | null {
 }
 
 /**
- * The consent card: which app is asking, what it will be able to do, and as
- * whom. Every decision here is a real grant, so the copy names the app and the
- * account rather than a generic "an application" — the page is the only place
- * a relayed or phished authorization can be caught, which is also why the
- * first-party CLI never skips it.
+ * Always names the app and account, including for the CLI, so users can
+ * recognize relayed authorization attempts.
  */
 export function OAuthConsentView({
   refusal,

apps/sim/app/(auth)/oauth/consent/page.tsx

@@ -14,14 +14,8 @@ export const metadata: Metadata = {
 export const dynamic = 'force-dynamic'
 
 /**
- * The OAuth provider's `consentPage`. The plugin sends a signed-in user here with
- * the signed authorization query; the view shows who is asking and for what, and
- * the consent call carries that same query back so the plugin can mint a code
- * for exactly the request the user saw.
- *
- * A signed-out visitor (a stale tab, a shared link) goes through the same
- * bounce the plugin uses for its `loginPage`, which re-enters authorize after
- * sign-in and lands back here with a fresh signature.
+ * Renders the plugin's signed request; signed-out visitors restart through the
+ * login bridge to obtain a fresh authorization query.
  */
 export default async function OAuthConsentPage({
   searchParams,
@@ -55,13 +49,15 @@ export default async function OAuthConsentPage({
   const authorizationRequestKey = refusal ? null : JSON.stringify(raw)
 
   return (
-    <OAuthConsentView
-      refusal={refusal}
-      clientId={params?.client_id ?? null}
-      authorizationRequestKey={authorizationRequestKey}
-      scope={params?.scope ?? null}
-      redirectUri={params?.redirect_uri ?? null}
-      email={session.user.email}
-    />
+    <div className='[overflow-wrap:anywhere]'>
+      <OAuthConsentView
+        refusal={refusal}
+        clientId={params?.client_id ?? null}
+        authorizationRequestKey={authorizationRequestKey}
+        scope={params?.scope ?? null}
+        redirectUri={params?.redirect_uri ?? null}
+        email={session.user.email}
+      />
+    </div>
   )
 }

apps/sim/app/(auth)/oauth/consent/search-params.ts

@@ -1,16 +1,8 @@
 import { createSearchParamsCache, parseAsString } from 'nuqs/server'
 
 /**
- * The authorize parameters the consent card renders. The rest of the signed
- * query (`state`, `sig`, `exp`, …) stays untouched in `window.location.search`,
- * which is what the auth client forwards verbatim on the consent call.
- *
- * Read-only for the life of the page, so there is no `urlKeys` companion and
- * no client-side `useQueryStates` — the server component reads them and passes
- * them down as props.
- *
- * Deliberately nullable rather than `.withDefault('')`: a missing `client_id`
- * is a malformed request the card must refuse, not a value to fall back on.
+ * Read once for display; the auth client forwards the original signed query.
+ * Nullable parsers preserve missing identifiers for rejection.
  */
 const oauthConsentParsers = {
   client_id: parseAsString,

apps/sim/app/api/cron/cleanup-oauth-tokens/route.ts

@@ -6,6 +6,7 @@ import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { runCleanupOAuthTokens } from '@/background/cleanup-oauth-tokens'
 
 export const dynamic = 'force-dynamic'
+export const maxDuration = 60
 
 const logger = createLogger('CleanupOAuthTokensAPI')
 

apps/sim/background/cleanup-oauth-tokens.test.ts

@@ -1,7 +1,7 @@
 /**
  * @vitest-environment node
  */
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const mocks = vi.hoisted(() => ({
   select: vi.fn(),
@@ -45,13 +45,18 @@ function selectChain(rows: unknown[], captured: unknown[]) {
 
 describe('runCleanupOAuthTokens', () => {
   beforeEach(() => {
-    vi.clearAllMocks()
+    vi.resetAllMocks()
+    vi.useFakeTimers({ toFake: ['Date'] })
     mocks.transaction.mockImplementation((work) =>
       work({ select: mocks.txSelect, delete: mocks.txDelete })
     )
     mocks.txSelect.mockImplementation(() => selectChain([], []))
   })
 
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
   it('deletes exactly the expired rows it selected, and reports both counts', async () => {
     const deletedFrom: unknown[] = []
     mocks.select
@@ -116,30 +121,92 @@ describe('runCleanupOAuthTokens', () => {
     expect(OAUTH_TOKEN_RETENTION_DAYS).toBeGreaterThan(0)
   })
 
-  it('bounds family cascades independently of direct token pages and stops a full backlog', async () => {
+  it('drains up to 50,000 families and access tokens with only ten families per transaction', async () => {
     const families = Array.from({ length: 10 }, (_, index) => ({
       id: `family-${index}`,
       clientId: 'client-1',
       sessionId: null,
       userId: 'user-1',
       consentId: null,
     }))
-    for (let page = 0; page < 10; page += 1) {
-      mocks.select.mockReturnValueOnce(selectChain(families, []))
-    }
-    mocks.select.mockReturnValueOnce(selectChain([], []))
+    const accessTokens = Array.from({ length: 5_000 }, (_, index) => ({ id: `access-${index}` }))
+    mocks.select.mockImplementation((fields: Record<string, unknown>) =>
+      selectChain('clientId' in fields ? families : accessTokens, [])
+    )
     mocks.txDelete.mockReturnValue({
       where: () => ({ returning: async () => families.map(({ id }) => ({ id })) }),
     })
+    mocks.delete.mockReturnValue({
+      where: () => ({ returning: async () => accessTokens }),
+    })
 
     await expect(runCleanupOAuthTokens()).resolves.toEqual({
-      tokenFamilies: 100,
-      accessTokens: 0,
+      tokenFamilies: 50_000,
+      accessTokens: 50_000,
     })
-    expect(mocks.transaction).toHaveBeenCalledTimes(10)
-    expect(mocks.limits.mock.calls.map(([limit]) => limit)).toEqual([
-      ...Array.from({ length: 10 }, () => 10),
-      5_000,
-    ])
+    expect(mocks.transaction).toHaveBeenCalledTimes(5_000)
+    expect(mocks.delete).toHaveBeenCalledTimes(10)
+    const limits = mocks.limits.mock.calls.map(([limit]) => limit)
+    expect(limits.filter((limit) => limit === 10)).toHaveLength(5_000)
+    expect(limits.filter((limit) => limit === 5_000)).toHaveLength(10)
+    expect(limits.slice(0, 4)).toEqual([10, 5_000, 10, 5_000])
+  })
+
+  it('stops at its deadline with committed progress from both backlogs', async () => {
+    const startedAt = Date.now()
+    const families = Array.from({ length: 10 }, (_, index) => ({
+      id: `family-${index}`,
+      clientId: 'client-1',
+      sessionId: null,
+      userId: 'user-1',
+      consentId: null,
+    }))
+    const accessTokens = Array.from({ length: 5_000 }, (_, index) => ({ id: `access-${index}` }))
+    mocks.select.mockImplementation((fields: Record<string, unknown>) =>
+      selectChain('clientId' in fields ? families : accessTokens, [])
+    )
+    mocks.txDelete.mockReturnValue({
+      where: () => ({ returning: async () => families.map(({ id }) => ({ id })) }),
+    })
+    mocks.delete.mockReturnValue({
+      where: () => ({
+        returning: async () => {
+          vi.setSystemTime(startedAt + 45_000)
+          return accessTokens
+        },
+      }),
+    })
+
+    await expect(runCleanupOAuthTokens()).resolves.toEqual({
+      tokenFamilies: 10,
+      accessTokens: 5_000,
+    })
+    expect(mocks.transaction).toHaveBeenCalledOnce()
+    expect(mocks.delete).toHaveBeenCalledOnce()
+    expect(mocks.select).toHaveBeenCalledTimes(2)
+  })
+
+  it('does not begin a delete when selection exhausts the deadline', async () => {
+    const startedAt = Date.now()
+    mocks.select.mockImplementation(() => {
+      vi.setSystemTime(startedAt + 45_000)
+      return selectChain(
+        [
+          {
+            id: 'family-1',
+            clientId: 'client-1',
+            sessionId: null,
+            userId: 'user-1',
+            consentId: null,
+          },
+        ],
+        []
+      )
+    })
+
+    await expect(runCleanupOAuthTokens()).resolves.toEqual({ tokenFamilies: 0, accessTokens: 0 })
+    expect(mocks.transaction).not.toHaveBeenCalled()
+    expect(mocks.delete).not.toHaveBeenCalled()
+    expect(mocks.select).toHaveBeenCalledOnce()
   })
 })

apps/sim/background/cleanup-oauth-tokens.ts

@@ -26,8 +26,11 @@ export const OAUTH_TOKEN_RETENTION_DAYS = 7
  * batch small independently of direct access-token deletion.
  */
 const OAUTH_FAMILY_SWEEP_LIMIT = 10
+const OAUTH_FAMILY_SWEEP_MAX_PAGES = 5_000
 const OAUTH_ACCESS_TOKEN_SWEEP_LIMIT = 5_000
-const OAUTH_TOKEN_SWEEP_MAX_PAGES = 10
+const OAUTH_ACCESS_TOKEN_SWEEP_MAX_PAGES = 10
+/** Stops admitting batches before the Helm cron's 60-second request timeout. */
+const OAUTH_TOKEN_SWEEP_BUDGET_MS = 45_000
 
 export interface CleanupOAuthTokensResult {
   tokenFamilies: number
@@ -117,60 +120,79 @@ async function deleteExpiredFamilyBatch(
  * later reuse go unnoticed while descendants remained active. The family row
  * therefore owns retention and cascades every generation when it expires.
  *
- * Families go first and their refresh/access tokens follow by cascade. The
- * second pass catches expired access tokens for still-live families and access
- * tokens issued without a refresh grant. Both passes use bounded indexed pages.
+ * Interleaves family and access-token pages so neither backlog prevents the
+ * other from making progress before the deadline. Family deletion cascades its
+ * remaining tokens; access pages also catch tokens from still-live families or
+ * grants without refresh tokens. Both sweeps retain a 50,000-row run cap while
+ * family transactions stay small enough to bound their descendant cascades.
  */
 export async function runCleanupOAuthTokens(): Promise<CleanupOAuthTokensResult> {
-  const cutoff = new Date(Date.now() - OAUTH_TOKEN_RETENTION_DAYS * 24 * 60 * 60 * 1000)
+  const startedAt = Date.now()
+  const deadline = startedAt + OAUTH_TOKEN_SWEEP_BUDGET_MS
+  const cutoff = new Date(startedAt - OAUTH_TOKEN_RETENTION_DAYS * 24 * 60 * 60 * 1000)
   let tokenFamilies = 0
   let accessTokens = 0
+  let moreFamilies = true
+  let moreAccessTokens = true
 
-  for (let page = 0; page < OAUTH_TOKEN_SWEEP_MAX_PAGES; page += 1) {
-    const staleFamilies = await db
-      .select({
-        id: oauthTokenFamily.id,
-        clientId: oauthTokenFamily.clientId,
-        sessionId: oauthTokenFamily.sessionId,
-        userId: oauthTokenFamily.userId,
-        consentId: oauthTokenFamily.consentId,
-      })
-      .from(oauthTokenFamily)
-      .where(lt(oauthTokenFamily.expiresAt, cutoff))
-      .orderBy(asc(oauthTokenFamily.expiresAt), asc(oauthTokenFamily.id))
-      .limit(OAUTH_FAMILY_SWEEP_LIMIT)
-    if (staleFamilies.length === 0) break
+  for (let page = 0; page < OAUTH_FAMILY_SWEEP_MAX_PAGES; page += 1) {
+    if (Date.now() >= deadline || (!moreFamilies && !moreAccessTokens)) break
 
-    tokenFamilies += await deleteExpiredFamilyBatch(staleFamilies, cutoff)
-    if (staleFamilies.length < OAUTH_FAMILY_SWEEP_LIMIT) break
-  }
+    if (moreFamilies) {
+      const staleFamilies = await db
+        .select({
+          id: oauthTokenFamily.id,
+          clientId: oauthTokenFamily.clientId,
+          sessionId: oauthTokenFamily.sessionId,
+          userId: oauthTokenFamily.userId,
+          consentId: oauthTokenFamily.consentId,
+        })
+        .from(oauthTokenFamily)
+        .where(lt(oauthTokenFamily.expiresAt, cutoff))
+        .orderBy(asc(oauthTokenFamily.expiresAt), asc(oauthTokenFamily.id))
+        .limit(OAUTH_FAMILY_SWEEP_LIMIT)
+      if (Date.now() >= deadline) break
 
-  for (let page = 0; page < OAUTH_TOKEN_SWEEP_MAX_PAGES; page += 1) {
-    const staleAccess = await db
-      .select({ id: oauthAccessToken.id })
-      .from(oauthAccessToken)
-      .where(lt(oauthAccessToken.expiresAt, cutoff))
-      .orderBy(asc(oauthAccessToken.expiresAt), asc(oauthAccessToken.id))
-      .limit(OAUTH_ACCESS_TOKEN_SWEEP_LIMIT)
-    if (staleAccess.length === 0) break
+      if (staleFamilies.length > 0) {
+        tokenFamilies += await deleteExpiredFamilyBatch(staleFamilies, cutoff)
+      }
+      moreFamilies = staleFamilies.length === OAUTH_FAMILY_SWEEP_LIMIT
+    }
 
-    const deleted = await db
-      .delete(oauthAccessToken)
-      .where(
-        inArray(
-          oauthAccessToken.id,
-          staleAccess.map((row) => row.id)
-        )
-      )
-      .returning({ id: oauthAccessToken.id })
-    accessTokens += deleted.length
-    if (staleAccess.length < OAUTH_ACCESS_TOKEN_SWEEP_LIMIT) break
+    if (Date.now() >= deadline) break
+    if (moreAccessTokens && page < OAUTH_ACCESS_TOKEN_SWEEP_MAX_PAGES) {
+      const staleAccess = await db
+        .select({ id: oauthAccessToken.id })
+        .from(oauthAccessToken)
+        .where(lt(oauthAccessToken.expiresAt, cutoff))
+        .orderBy(asc(oauthAccessToken.expiresAt), asc(oauthAccessToken.id))
+        .limit(OAUTH_ACCESS_TOKEN_SWEEP_LIMIT)
+      if (Date.now() >= deadline) break
+
+      if (staleAccess.length > 0) {
+        const deleted = await db
+          .delete(oauthAccessToken)
+          .where(
+            inArray(
+              oauthAccessToken.id,
+              staleAccess.map((row) => row.id)
+            )
+          )
+          .returning({ id: oauthAccessToken.id })
+        accessTokens += deleted.length
+      }
+      moreAccessTokens =
+        staleAccess.length === OAUTH_ACCESS_TOKEN_SWEEP_LIMIT &&
+        page + 1 < OAUTH_ACCESS_TOKEN_SWEEP_MAX_PAGES
+    }
   }
 
   const result = { tokenFamilies, accessTokens }
   logger.info('Swept expired OAuth tokens', {
     ...result,
     retentionDays: OAUTH_TOKEN_RETENTION_DAYS,
+    elapsedMs: Date.now() - startedAt,
+    deadlineReached: Date.now() >= deadline,
   })
   return result
 }