feat(auth): add scoped OAuth access and browser-based CLI login - #7488
Merged
Conversation
Sim becomes an authorization server, so other software can sign a person in and act as them with their consent. `sim login` uses it by default, replacing a permanent personal API key with a short-lived, scoped, revocable token. Built on `@better-auth/oauth-provider@1.6.27`, pinned to match the Better Auth already in the tree — no upgrade required. Tokens are opaque rather than JWTs, so revoking an app in settings or running `sim logout` takes effect on the very next request. Access tokens last an hour; refresh tokens rotate on every use and expire after thirty days. A new principal kind, `oauth_access_token`, is admitted exactly where `personal_api_key` is and nowhere else; `check:principal-kind-parity` fails the build if the two ever drift apart. Write scope is derived from the HTTP method at v2 admission rather than from an operation's `minimumRole`, because several POST routes only read — a role-derived rule let a read-only token write. The consent card refuses to render for a request Sim did not issue: an unsigned query, a repeated parameter, or a client the server declines to name. Clients are operator-created rows. Dynamic registration is off, and every one of the plugin's client CRUD endpoints is closed at the source. Off with `OAUTH_PROVIDER_ENABLED=false`, which the CLI detects and falls back to the existing pairing-code handoff.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
# Conflicts: # packages/db/migrations/meta/0321_snapshot.json # packages/db/migrations/meta/_journal.json
waleedlatif1
marked this pull request as ready for review
September 5, 2026 01:43
Collaborator
Author
Collaborator
Author
|
@cubic-dev-ai review this PR |
Contributor
@waleedlatif1 I have started the AI code review. It will take a few minutes to complete. |
Collaborator
Author
|
@greptile-apps review this PR |
Collaborator
Author
Collaborator
Author
|
@cubic-dev-ai review this PR |
Collaborator
Author
|
@greptile-apps review this PR |
Contributor
@waleedlatif1 I have started the AI code review. It will take a few minutes to complete. |
Contributor
Greptile SummaryAdds delegated OAuth authorization for CLI and registered applications while preserving existing API-key, session, connector-linking, and browserless authentication flows.
Confidence Score: 5/5The PR appears safe to merge because no outstanding correctness, security, or repository-rule failures remain. The previous refresh-token downscoping concern was correctly withdrawn after confirming the RFC-defined behavior, and the resolved consent-component thread does not represent a violation of the repository’s current component convention. No changes were made after the previous review, and no accepted new findings remain.
|
| Filename | Overview |
|---|---|
| apps/sim/lib/auth/oauth-token-family.ts | Implements bounded OAuth token-family rotation, refresh-token reuse handling, lifetime enforcement, and revocation. |
| apps/sim/lib/auth/oauth-provider.ts | Configures the scoped OAuth provider and its supported grants, clients, and lifecycle behavior. |
| apps/sim/lib/core/application/oauth-authorization.ts | Applies OAuth scope authorization alongside existing application-operation and workspace-role checks. |
| packages/sim-cli/src/auth/oauth-flow.ts | Implements browser-based CLI authorization-code login with PKCE and loopback callback handling. |
| packages/sim-cli/src/auth/refresh.ts | Coordinates credential locking and refresh-token rotation across concurrent CLI processes. |
| packages/db/migrations/0323_oauth_provider.sql | Adds the persistent OAuth grants, clients, access tokens, refresh tokens, and lifecycle schema. |
| apps/sim/app/(auth)/oauth/consent/consent-view.tsx | Renders OAuth consent and approval states using the existing authentication UI conventions. |
Sequence Diagram
sequenceDiagram
participant CLI
participant Browser
participant OAuth as Sim OAuth Provider
participant DB as PostgreSQL
participant API as Sim API
CLI->>CLI: Generate PKCE verifier and challenge
CLI->>Browser: Open authorization request
Browser->>OAuth: Authenticate and review consent
OAuth->>DB: Persist grant and token family
OAuth-->>Browser: Redirect with authorization code
Browser-->>CLI: Deliver code to loopback callback
CLI->>OAuth: Exchange code and PKCE verifier
OAuth->>DB: Validate code and issue tokens
OAuth-->>CLI: Access and refresh tokens
CLI->>API: Bearer access token
API->>DB: Validate token, scopes, and membership
API-->>CLI: Scoped operation response
CLI->>OAuth: Rotate refresh token when needed
OAuth->>DB: Consume old token and store replacement
OAuth-->>CLI: New access and refresh tokens
Reviews (7): Last reviewed commit: "Merge remote-tracking branch 'origin/sta..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Collaborator
Author
Collaborator
Author
|
@cubic-dev-ai review this PR |
waleedlatif1
changed the title
Collaborator
Author
Collaborator
Author
|
@cubic-dev-ai review this PR |
Contributor
@waleedlatif1 I have started the AI code review. It will take a few minutes to complete. |
Collaborator
Author
Collaborator
Author
|
@cubic-dev-ai review this PR |
Contributor
@waleedlatif1 I have started the AI code review. It will take a few minutes to complete. |
Collaborator
Author
Collaborator
Author
|
@cubic-dev-ai review this PR |
Contributor
@waleedlatif1 I have started the AI code review. It will take a few minutes to complete. |
Collaborator
Author
Collaborator
Author
|
@cubic-dev-ai review this PR |
Contributor
@waleedlatif1 I have started the AI code review. It will take a few minutes to complete. |
waleedlatif1
added a commit
that referenced
this pull request
Sep 8, 2026
Brings PR #7488 (OAuth provider) under the SCIM branch so #7567 can target it. - SCIM migration renumbered to 0324_scim_provisioning after the OAuth branch's 0323; regenerated from the merged schema (identical apart from the number). - Forbidden detail codes keep both INSUFFICIENT_SCOPE and SCIM_MANAGED_MEMBERSHIP; OpenAPI docs regenerated. - SCIM ships with the enterprise plan on the hosted product: the outer gate is now isScimDeploymentEnabled() (hosted, or SCIM_ENABLED / ENTERPRISE_ENABLED self-hosted) and the plan check stays per organization. The env variable remains the self-hosted switch and is bundled under ENTERPRISE_ENABLED. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DGXcwsHzYGp6pUDWRtJKpz
waleedlatif1
added a commit
that referenced
this pull request
Sep 8, 2026
#7488 landed on staging as a squash, so the branch now carries staging itself. Same resolutions as the OAuth merge: both forbidden detail codes, OpenAPI regenerated, chart 1.10.0, journal keeps 0323_oauth_provider then 0324_scim_provisioning. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DGXcwsHzYGp6pUDWRtJKpz
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds delegated OAuth access for the CLI and operator-registered applications.
sim loginuses authorization code + PKCE with short-lived opaque access tokens, rotating refresh tokens, explicit consent, and immediate revocation. Existing API keys, session login, connector OAuth linking, and the browserless CLI pairing flow remain supported.Authorization and lifecycle
api:readorapi:write, independently of its minimum workspace role and HTTP method. Searches can be read-only POSTs; execution and external discovery require write access.offline_access,api:read, andapi:write.oauth-providerflag at request time. The existing environment variable is only a fallback when AppConfig has no document. Existing connector/oauth2/linkand callback routes continue to work with the provider enabled or disabled.Browser and CLI
proper-lockfilewith async-context reentrancy. Separate-process tests cover competing refreshes and refresh/logout ordering. OAuth response bodies are byte-capped, and bundled dependency declarations and license notices are complete.Deployment
Requires PostgreSQL 15+. SQL migration
0323adds the OAuth schema after staging’s existing migrations. Script migration0012installs the shared trigger and CLI-registration lifecycle;db:pushinvokes the same idempotent reconciler. Reapplication preserves existing grants and operator customizations. Both fresh provisioning paths now run in dedicated PostgreSQL CI jobs.Enable the global
oauth-providerAppConfig entry after migrations are applied and older app instances have drained. Better Auth registers the provider once and request-time guards cover its direct calls and authorization continuations, so runtime changes need no restart.OAuth cleanup is scheduled in Docker and Helm, with small family transactions, independent access-token pages, and a shared time budget.
Verification
db:push, fulldb:migrate, and migration replay passed; all 12 provider lifecycle integration tests passed on both provisioning paths.