fix(oauth): keep Slack connect fan-out unchanged and skip the cross-process check without Redis

Author: waleedlatif1

apps/sim/lib/auth/auth.ts

@@ -560,15 +560,11 @@ export const auth = betterAuth({
                 // proves the installation has live tokens, and a fan-out
                 // failure must not leave the hour-long flag blocking refreshes.
                 await clearOAuthRefreshDeadFlag(`slack:${teamId}`)
-                await fanOutSlackTokenChain(
-                  teamId,
-                  {
-                    accessToken: account.accessToken,
-                    refreshToken: account.refreshToken ?? null,
-                    accessTokenExpiresAt: account.accessTokenExpiresAt ?? null,
-                  },
-                  { freshlyIssued: true }
-                )
+                await fanOutSlackTokenChain(teamId, {
+                  accessToken: account.accessToken,
+                  refreshToken: account.refreshToken ?? null,
+                  accessTokenExpiresAt: account.accessTokenExpiresAt ?? null,
+                })
                 logger.info('[account.create.after] Propagated Slack installation token chain', {
                   userId: account.userId,
                   teamId,

apps/sim/lib/oauth/credential-revocation.integration.ts

@@ -7,14 +7,15 @@ import { generateId } from '@sim/utils/id'
 import { eq, inArray } from 'drizzle-orm'
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
-await vi.hoisted(async () => {
+const { redisUrl } = await vi.hoisted(async () => {
   const { readTestRedisUrl } = await import('@sim/db/testing/test-infrastructure')
   const redisUrl = readTestRedisUrl()
   if (redisUrl) process.env.REDIS_URL = redisUrl
   process.env.GOOGLE_CLIENT_ID = 'revocation-integration-client'
   process.env.GOOGLE_CLIENT_SECRET = 'revocation-integration-secret'
   process.env.SLACK_CLIENT_ID = 'revocation-integration-slack-client'
   process.env.SLACK_CLIENT_SECRET = 'revocation-integration-slack-secret'
+  return { redisUrl }
 })
 
 import { closeRedisConnection, getRedisClient } from '@/lib/core/config/redis'
@@ -357,29 +358,33 @@ describe('OAuth refresh-token revocation against PostgreSQL and Redis', () => {
     expect((await storedAccount()).refreshRevokedAt).toBeNull()
   })
 
-  it('answers a waiting refresh from the revocation another process recorded', async () => {
-    await expect(resolveToken()).rejects.toBeInstanceOf(CredentialRevokedError)
-    const { refreshRevokedAt, refreshRevokedCode, refreshRevokedTokenHash } = await storedAccount()
-    await db.update(account).set(CLEARED_REFRESH_REVOCATION).where(eq(account.id, accountId))
-    await expireRedisFlags()
-
-    const redis = getRedisClient()
-    if (!redis) throw new Error('This check needs TEST_REDIS_URL')
-    const lockKey = `oauth:refresh:${getOAuthRefreshCoordinationIdentity(accountId)}`
-    await redis.set(lockKey, 'another-process', 'EX', 60)
-    try {
-      const staleRow = await storedAccount()
-      const follower = refreshTokenIfNeeded('revocation-integration', staleRow, accountId)
-      await db
-        .update(account)
-        .set({ refreshRevokedAt, refreshRevokedCode, refreshRevokedTokenHash })
-        .where(eq(account.id, accountId))
-      await expect(follower).rejects.toBeInstanceOf(CredentialRevokedError)
-    } finally {
-      await redis.del(lockKey)
+  it.skipIf(!redisUrl)(
+    'answers a waiting refresh from the revocation another process recorded',
+    async () => {
+      await expect(resolveToken()).rejects.toBeInstanceOf(CredentialRevokedError)
+      const { refreshRevokedAt, refreshRevokedCode, refreshRevokedTokenHash } =
+        await storedAccount()
+      await db.update(account).set(CLEARED_REFRESH_REVOCATION).where(eq(account.id, accountId))
+      await expireRedisFlags()
+
+      const redis = getRedisClient()
+      if (!redis) throw new Error('This check needs TEST_REDIS_URL')
+      const lockKey = `oauth:refresh:${getOAuthRefreshCoordinationIdentity(accountId)}`
+      await redis.set(lockKey, 'another-process', 'EX', 60)
+      try {
+        const staleRow = await storedAccount()
+        const follower = refreshTokenIfNeeded('revocation-integration', staleRow, accountId)
+        await db
+          .update(account)
+          .set({ refreshRevokedAt, refreshRevokedCode, refreshRevokedTokenHash })
+          .where(eq(account.id, accountId))
+        await expect(follower).rejects.toBeInstanceOf(CredentialRevokedError)
+      } finally {
+        await redis.del(lockKey)
+      }
+      expect(providerRequests).toBe(1)
     }
-    expect(providerRequests).toBe(1)
-  })
+  )
 
   it('records a Slack revocation for the whole installation until a connect fans out', async () => {
     await insertSlackInstallation()

apps/sim/lib/oauth/slack.ts

@@ -54,8 +54,9 @@ interface FanOutOptions {
    */
   ifChainUnchangedSince?: Date
   /**
-   * The provider just issued this chain (a refresh or a connect), so a revocation recorded
-   * against the installation no longer holds. Omit when re-spreading a chain already stored.
+   * The provider just issued this chain in a refresh, so a revocation recorded against the
+   * installation no longer holds. Omit when re-spreading a chain already stored; a connect's
+   * credential draft clears the installation's record itself.
    */
   freshlyIssued?: boolean
 }