feat(scopes): add scopes warning hook

[Sg312]

Summary

Add hook to check if user is missing auth scopes and needs to reauthenticate

Type of Change

• New feature

Testing

Manual

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Preview	Comments	Updated (UTC)
docs	Skipped			Nov 8, 2025 0:30am

[greptile-apps]

Greptile Overview

Greptile Summary

This PR implements OAuth scope tracking and validation infrastructure to detect when stored credentials have insufficient or mismatched scopes compared to what the application expects.

Key Changes:

• Added evaluateScopeCoverage() function to compare granted scopes against canonical scopes defined in provider configuration
• Extended Connections and Credentials API responses to include scope metadata: canonicalScopes, grantedScopes, missingScopes, extraScopes, and requiresReauthorization
• Created client-side hooks in use-oauth-scope-status.ts for checking credential authorization status
• Updated tests to mock new scope evaluation functions

Implementation Details:

• The scope evaluation logic normalizes and deduplicates scopes, then compares them against canonical scopes from OAUTH_PROVIDERS configuration
• Both API routes now call evaluateScopeCoverage() for each account and merge scope data into responses
• The connections route aggregates scope information across multiple accounts for the same provider

Issues Found:

• The requiresReauthorization flag incorrectly triggers when extra scopes are present (line 696 in oauth.ts) - extra permissions shouldn't require reauth, only missing ones should

Confidence Score: 4/5

• Safe to merge after fixing the requiresReauthorization logic
• The implementation is well-structured with proper test coverage and follows the existing patterns in the codebase. The logic issue with extra scopes incorrectly triggering reauthorization needs to be fixed to avoid false warnings to users.
• apps/sim/lib/oauth/oauth.ts requires attention for the requiresReauthorization logic fix on line 696

Important Files Changed

File Analysis

Filename	Score	Overview
apps/sim/lib/oauth/oauth.ts	4/5	Added scope evaluation utilities with one logic issue: requiresReauthorization incorrectly triggers on extra scopes
apps/sim/app/api/auth/oauth/connections/route.ts	5/5	Integrated scope evaluation into connections API, properly merging scope data across multiple accounts
apps/sim/app/api/auth/oauth/credentials/route.ts	4/5	Added scope evaluation to credentials API with minor inconsistency in provider parsing approach

Sequence Diagram

sequenceDiagram
participant Client
participant Route as API Route
participant Lib as OAuth Library
participant DB as Database
Client->>Route: Request OAuth connections
Route->>DB: Fetch user accounts
DB-->>Route: Return accounts
loop Process accounts
Route->>Lib: Parse provider ID
Lib-->>Route: Provider details
Route->>Lib: Evaluate scope coverage
Lib->>Lib: Retrieve canonical scopes
Lib->>Lib: Normalize granted scopes
Lib->>Lib: Calculate differences
Lib-->>Route: Scope analysis
Route->>Route: Aggregate data
end
Route-->>Client: Return with scope metadata

Loading

Additional Comments (1)

1. apps/sim/app/api/auth/oauth/credentials/route.ts, line 121 (link)

   style: use parseProvider utility for consistency instead of manual string splitting

_{6 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}