Skip to content

fix(credentials): remove special scopes from additional scopes required hook, remove additionalScopes arg from tool definition #1905

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
waleedlatif1 merged 1 commit into from
Nov 11, 2025
Merged

fix(credentials): remove special scopes from additional scopes required hook, remove additionalScopes arg from tool definition #1905

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions ...nts/panel-new/components/editor/components/sub-block/components/tool-input/tool-input.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,11 @@ import {
import { Switch } from '@/components/ui/switch'
import { Toggle } from '@/components/ui/toggle'
import { createLogger } from '@/lib/logs/console/logger'
import type { OAuthProvider, OAuthService } from '@/lib/oauth/oauth'
import {
getCanonicalScopesForProvider,
type OAuthProvider,
type OAuthService,
} from '@/lib/oauth/oauth'
import { cn } from '@/lib/utils'
import {
ChannelSelectorInput,
Expand Down Expand Up @@ -1713,7 +1717,7 @@ export function ToolInput({
value={tool.params.credential || ''}
onChange={(value) => handleParamChange(toolIndex, 'credential', value)}
provider={oauthConfig.provider as OAuthProvider}
requiredScopes={oauthConfig.additionalScopes || []}
requiredScopes={getCanonicalScopesForProvider(oauthConfig.provider)}
label={`Select ${oauthConfig.provider} account`}
serviceId={oauthConfig.provider}
disabled={disabled}
Expand Down
23 changes: 22 additions & 1 deletion apps/sim/hooks/use-oauth-scope-status.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,19 +44,40 @@ export function getCredentialsNeedingReauth(credentials: Credential[]): Credenti
return credentials.filter(credentialNeedsReauth)
}

/**
* Scopes that control token behavior but are not returned in OAuth token responses.
* These should be ignored when validating credential scopes.
*/
const IGNORED_SCOPES = new Set([
'offline_access', // Microsoft - requests refresh token
'refresh_token', // Salesforce - requests refresh token
'offline.access', // Airtable - requests refresh token (note: dot not underscore)
])

/**
* Compute which of the provided requiredScopes are NOT granted by the credential.
* Note: Ignores special OAuth scopes that control token behavior (like offline_access)
* as they are not returned in the token response's scope list even when granted.
*/
export function getMissingRequiredScopes(
credential: Credential | undefined,
requiredScopes: string[] = []
): string[] {
if (!credential) return [...requiredScopes]
if (!credential) {
// Filter out ignored scopes from required scopes as they're not returned by OAuth providers
return requiredScopes.filter((s) => !IGNORED_SCOPES.has(s))
}

const granted = new Set((credential.scopes || []).map((s) => s))
const missing: string[] = []

for (const s of requiredScopes) {
// Skip ignored scopes as providers don't return them in the scope list even when granted
if (IGNORED_SCOPES.has(s)) continue

if (!granted.has(s)) missing.push(s)
}

return missing
}

Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/asana/add_comment.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ export const asanaAddCommentTool: ToolConfig<AsanaAddCommentParams, AsanaAddComm
oauth: {
required: true,
provider: 'asana',
additionalScopes: [],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/asana/create_task.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ export const asanaCreateTaskTool: ToolConfig<AsanaCreateTaskParams, AsanaCreateT
oauth: {
required: true,
provider: 'asana',
additionalScopes: [],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/asana/get_projects.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ export const asanaGetProjectsTool: ToolConfig<AsanaGetProjectsParams, AsanaGetPr
oauth: {
required: true,
provider: 'asana',
additionalScopes: [],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/asana/get_task.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ export const asanaGetTaskTool: ToolConfig<AsanaGetTaskParams, AsanaGetTaskRespon
oauth: {
required: true,
provider: 'asana',
additionalScopes: [],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/asana/search_tasks.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ export const asanaSearchTasksTool: ToolConfig<AsanaSearchTasksParams, AsanaSearc
oauth: {
required: true,
provider: 'asana',
additionalScopes: [],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/asana/update_task.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ export const asanaUpdateTaskTool: ToolConfig<AsanaUpdateTaskParams, AsanaUpdateT
oauth: {
required: true,
provider: 'asana',
additionalScopes: [],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/gmail/add_label.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ export const gmailAddLabelTool: ToolConfig<GmailLabelParams, GmailToolResponse>
oauth: {
required: true,
provider: 'google-email',
additionalScopes: ['https://www.googleapis.com/auth/gmail.modify'],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/gmail/archive.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ export const gmailArchiveTool: ToolConfig<GmailMarkReadParams, GmailToolResponse
oauth: {
required: true,
provider: 'google-email',
additionalScopes: ['https://www.googleapis.com/auth/gmail.modify'],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/gmail/delete.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ export const gmailDeleteTool: ToolConfig<GmailMarkReadParams, GmailToolResponse>
oauth: {
required: true,
provider: 'google-email',
additionalScopes: ['https://www.googleapis.com/auth/gmail.modify'],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/gmail/draft.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ export const gmailDraftTool: ToolConfig<GmailSendParams, GmailToolResponse> = {
oauth: {
required: true,
provider: 'google-email',
additionalScopes: [],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/gmail/mark_read.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ export const gmailMarkReadTool: ToolConfig<GmailMarkReadParams, GmailToolRespons
oauth: {
required: true,
provider: 'google-email',
additionalScopes: ['https://www.googleapis.com/auth/gmail.modify'],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/gmail/mark_unread.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ export const gmailMarkUnreadTool: ToolConfig<GmailMarkReadParams, GmailToolRespo
oauth: {
required: true,
provider: 'google-email',
additionalScopes: ['https://www.googleapis.com/auth/gmail.modify'],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/gmail/move.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ export const gmailMoveTool: ToolConfig<GmailMoveParams, GmailToolResponse> = {
oauth: {
required: true,
provider: 'google-email',
additionalScopes: ['https://www.googleapis.com/auth/gmail.modify'],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/gmail/read.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,6 @@ export const gmailReadTool: ToolConfig<GmailReadParams, GmailToolResponse> = {
oauth: {
required: true,
provider: 'google-email',
additionalScopes: ['https://www.googleapis.com/auth/gmail.labels'],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/gmail/remove_label.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ export const gmailRemoveLabelTool: ToolConfig<GmailLabelParams, GmailToolRespons
oauth: {
required: true,
provider: 'google-email',
additionalScopes: ['https://www.googleapis.com/auth/gmail.modify'],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/gmail/search.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,6 @@ export const gmailSearchTool: ToolConfig<GmailSearchParams, GmailToolResponse> =
oauth: {
required: true,
provider: 'google-email',
additionalScopes: ['https://www.googleapis.com/auth/gmail.labels'],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/gmail/send.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ export const gmailSendTool: ToolConfig<GmailSendParams, GmailToolResponse> = {
oauth: {
required: true,
provider: 'google-email',
additionalScopes: ['https://www.googleapis.com/auth/gmail.send'],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/gmail/unarchive.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ export const gmailUnarchiveTool: ToolConfig<GmailMarkReadParams, GmailToolRespon
oauth: {
required: true,
provider: 'google-email',
additionalScopes: ['https://www.googleapis.com/auth/gmail.modify'],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/google_calendar/create.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,6 @@ export const createTool: ToolConfig<GoogleCalendarCreateParams, GoogleCalendarCr
oauth: {
required: true,
provider: 'google-calendar',
additionalScopes: ['https://www.googleapis.com/auth/calendar'],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/google_calendar/get.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,6 @@ export const getTool: ToolConfig<GoogleCalendarGetParams, GoogleCalendarGetRespo
oauth: {
required: true,
provider: 'google-calendar',
additionalScopes: ['https://www.googleapis.com/auth/calendar'],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/google_calendar/invite.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,6 @@ export const inviteTool: ToolConfig<GoogleCalendarInviteParams, GoogleCalendarIn
oauth: {
required: true,
provider: 'google-calendar',
additionalScopes: ['https://www.googleapis.com/auth/calendar'],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/google_calendar/list.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,6 @@ export const listTool: ToolConfig<GoogleCalendarListParams, GoogleCalendarListRe
oauth: {
required: true,
provider: 'google-calendar',
additionalScopes: ['https://www.googleapis.com/auth/calendar'],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/google_calendar/quick_add.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,6 @@ export const quickAddTool: ToolConfig<
oauth: {
required: true,
provider: 'google-calendar',
additionalScopes: ['https://www.googleapis.com/auth/calendar'],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/google_calendar/update.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,6 @@ export const updateTool: ToolConfig<GoogleCalendarUpdateParams, GoogleCalendarTo
oauth: {
required: true,
provider: 'google-calendar',
additionalScopes: ['https://www.googleapis.com/auth/calendar'],
},

params: {
Expand Down
4 changes: 0 additions & 4 deletions apps/sim/tools/google_docs/create.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,10 +13,6 @@ export const createTool: ToolConfig<GoogleDocsToolParams, GoogleDocsCreateRespon
oauth: {
required: true,
provider: 'google-docs',
additionalScopes: [
'https://www.googleapis.com/auth/drive.readonly',
'https://www.googleapis.com/auth/drive.file',
],
},

params: {
Expand Down
4 changes: 0 additions & 4 deletions apps/sim/tools/google_docs/read.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,10 +11,6 @@ export const readTool: ToolConfig<GoogleDocsToolParams, GoogleDocsReadResponse>
oauth: {
required: true,
provider: 'google-docs',
additionalScopes: [
'https://www.googleapis.com/auth/drive.readonly',
'https://www.googleapis.com/auth/drive.file',
],
},

params: {
Expand Down
4 changes: 0 additions & 4 deletions apps/sim/tools/google_docs/write.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,10 +9,6 @@ export const writeTool: ToolConfig<GoogleDocsToolParams, GoogleDocsWriteResponse
oauth: {
required: true,
provider: 'google-docs',
additionalScopes: [
'https://www.googleapis.com/auth/drive.readonly',
'https://www.googleapis.com/auth/drive.file',
],
},
params: {
accessToken: {
Expand Down
4 changes: 0 additions & 4 deletions apps/sim/tools/google_drive/create_folder.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,10 +10,6 @@ export const createFolderTool: ToolConfig<GoogleDriveToolParams, GoogleDriveUplo
oauth: {
required: true,
provider: 'google-drive',
additionalScopes: [
'https://www.googleapis.com/auth/drive.readonly',
'https://www.googleapis.com/auth/drive.file',
],
},

params: {
Expand Down
4 changes: 0 additions & 4 deletions apps/sim/tools/google_drive/download.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,6 @@ export const downloadTool: ToolConfig<GoogleDriveToolParams, GoogleDriveDownload
oauth: {
required: true,
provider: 'google-drive',
additionalScopes: [
'https://www.googleapis.com/auth/drive.readonly',
'https://www.googleapis.com/auth/drive.file',
],
},

params: {
Expand Down
4 changes: 0 additions & 4 deletions apps/sim/tools/google_drive/get_content.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,10 +18,6 @@ export const getContentTool: ToolConfig<GoogleDriveToolParams, GoogleDriveGetCon
oauth: {
required: true,
provider: 'google-drive',
additionalScopes: [
'https://www.googleapis.com/auth/drive.readonly',
'https://www.googleapis.com/auth/drive.file',
],
},

params: {
Expand Down
4 changes: 0 additions & 4 deletions apps/sim/tools/google_drive/list.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,10 +10,6 @@ export const listTool: ToolConfig<GoogleDriveToolParams, GoogleDriveListResponse
oauth: {
required: true,
provider: 'google-drive',
additionalScopes: [
'https://www.googleapis.com/auth/drive.readonly',
'https://www.googleapis.com/auth/drive.file',
],
},

params: {
Expand Down
4 changes: 0 additions & 4 deletions apps/sim/tools/google_drive/upload.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,10 +18,6 @@ export const uploadTool: ToolConfig<GoogleDriveToolParams, GoogleDriveUploadResp
oauth: {
required: true,
provider: 'google-drive',
additionalScopes: [
'https://www.googleapis.com/auth/drive.readonly',
'https://www.googleapis.com/auth/drive.file',
],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/google_form/get_responses.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,6 @@ export const getResponsesTool: ToolConfig<GoogleFormsGetResponsesParams> = {
oauth: {
required: true,
provider: 'google-forms',
additionalScopes: [],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/google_sheets/append.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,6 @@ export const appendTool: ToolConfig<GoogleSheetsToolParams, GoogleSheetsAppendRe
oauth: {
required: true,
provider: 'google-sheets',
additionalScopes: [],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/google_sheets/read.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ export const readTool: ToolConfig<GoogleSheetsToolParams, GoogleSheetsReadRespon
oauth: {
required: true,
provider: 'google-sheets',
additionalScopes: [],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/google_sheets/update.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,6 @@ export const updateTool: ToolConfig<GoogleSheetsToolParams, GoogleSheetsUpdateRe
oauth: {
required: true,
provider: 'google-sheets',
additionalScopes: [],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/google_sheets/write.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ export const writeTool: ToolConfig<GoogleSheetsToolParams, GoogleSheetsWriteResp
oauth: {
required: true,
provider: 'google-sheets',
additionalScopes: [],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/google_vault/create_matters.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,6 @@ export const createMattersTool: ToolConfig<GoogleVaultCreateMattersParams> = {
oauth: {
required: true,
provider: 'google-vault',
additionalScopes: ['https://www.googleapis.com/auth/ediscovery'],
},

params: {
Expand Down
1 change: 0 additions & 1 deletion apps/sim/tools/google_vault/create_matters_export.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,6 @@ export const createMattersExportTool: ToolConfig<GoogleVaultCreateMattersExportP
oauth: {
required: true,
provider: 'google-vault',
additionalScopes: ['https://www.googleapis.com/auth/ediscovery'],
},

params: {
Expand Down
Loading