feat(auth): enable OAuth with permission-group controls

[waleedlatif1]

Summary

• Enable OAuth whenever authentication is enabled and remove the rollout flag, its configuration, and stale documentation.
• Add OAuth App Access to the existing permission groups. Enforce current policy during authorization, token issuance and refresh, and API use while preserving existing API-key behavior and grant revocation.
• Return authorization denials to verified callbacks and cover policy changes with real PostgreSQL integration tests.
• Companion infrastructure tests: https://github.com/simstudioai/infra/pull/336.

Type of Change

• Feature

Testing

• 43,750 app tests and 944 CLI tests passed.
• 15 PostgreSQL integration tests passed, including pre-issued codes, cached consent, concurrent permission updates and Enterprise activation, refresh refusal and recovery, replay containment, and revocation.
• Five permission-update regression tests passed, including awaited lock acquisition and preserving the current policy during partial or metadata updates.
• Tested the built CLI against a local server and PostgreSQL without rollout configuration: PKCE login, workflow operations, existing-token denial and recovery, denied login callback, logout, and grant revocation.
• Typecheck, lint, all 46 repository audits, block registry validation, and docs manifest checks passed.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 8, 2026 7:38am UTC

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[greptile-apps]

Greptile Summary

This PR enables the OAuth provider whenever authentication is enabled and introduces permission-group enforcement throughout the OAuth lifecycle.

• Removes the OAuth rollout feature flag, environment variable, workflow configuration, and obsolete documentation.
• Adds OAuth App Access and CLI-related permission checks across authorization, token issuance, refresh, API access, billing, and audit operations.
• Returns policy denials through verified OAuth callbacks while preserving revocation and existing API-key behavior.
• Serializes refresh-time entitlement and permission-policy reads with concurrent organization and permission-group updates.
• Adds unit and PostgreSQL integration coverage for policy changes, token rotation, consent, replay, revocation, and Enterprise activation.

Confidence Score: 5/5

The PR appears safe to merge; the two previously identified refresh-policy races are resolved and no new actionable failures remain.

Refresh now acquires the organization mutation locks before reading Enterprise entitlement on the same transaction, then evaluates OAuth policy under the permission-group lock before consuming or rotating the token family. The executor reaches the underlying entitlement queries and is distinct from the earlier preflight cache key. Both previous findings are fully fixed, and the current changes add regression coverage for concurrent policy restriction and Enterprise activation.

Important Files Changed

Filename	Overview
apps/sim/lib/auth/oauth-token-family.ts	Refresh rotation now rechecks the Enterprise permission regime within the locked transaction before applying current OAuth policy.
apps/sim/lib/permission-groups/resolve.server.ts	Permission-regime resolution accepts a transaction executor so entitlement reads cannot reuse an earlier preflight result.
apps/sim/app/api/auth/oauth2/authorize/route.ts	Authorization is tied to authentication availability and forwards access denials only to validated client callbacks.
apps/sim/app/api/auth/oauth2/token/route.ts	Token issuance and refresh enforce current OAuth access policy while retaining protocol-safe error handling.
apps/sim/lib/api/server/routes/v2-api-key-auth.ts	OAuth bearer-token API requests gain permission-group enforcement without changing existing API-key behavior.
apps/sim/app/api/organizations/[id]/permission-groups/[groupId]/route.ts	Permission-group updates are serialized and preserve stored policy during partial or metadata-only edits.

Sequence Diagram

sequenceDiagram
    participant Client as OAuth Client
    participant Auth as Authorization Server
    participant Policy as Permission Groups
    participant Tokens as Token Store
    participant API as Sim API

    Client->>Auth: Authorization request with PKCE
    Auth->>Policy: Check oauth_apps.use and CLI policy
    alt Access permitted
        Auth-->>Client: Authorization code
        Client->>Auth: Exchange code
        Auth->>Policy: Recheck current policy
        Auth->>Tokens: Issue token family
        Auth-->>Client: Access and refresh tokens
        Client->>API: Access token
        API->>Policy: Check current workspace/account policy
        API-->>Client: Authorized response
    else Access restricted
        Auth-->>Client: access_denied at verified callback
    end
    Client->>Auth: Refresh token
    Auth->>Policy: Read entitlement and policy under locks
    alt Still permitted
        Auth->>Tokens: Atomically rotate token family
        Auth-->>Client: Replacement tokens
    else Permission revoked
        Auth-->>Client: invalid_grant without consuming token
    end

Loading

_{Reviews (4): Last reviewed commit: "fix(auth): recheck OAuth entitlement und..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[waleedlatif1]

@greptile

[waleedlatif1]

@greptileai

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[waleedlatif1]

@greptileai

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.