fix(monday): support OAuth 2.1

Merged
BI
2mo ago
+660-24

Summary

Fix Monday account connections for the OAuth 2.1 flow used by the production Monday app.

The observed production failure occurs at authorization with invalid_scope because the live Monday app version does not accept the seven scopes Sim requests. The connector was also still configured for the legacy Monday flow: PKCE was disabled, code exchange and refresh used the legacy token endpoint, and refresh-token rotation and JWT access-token expiry were not handled. Updating only the Monday app settings would therefore expose later callback and refresh failures.

This PR:

  • adds a bounded, secret-safe Monday OAuth 2.1 code exchange using PKCE and the new token endpoint
  • derives access-token expiry from the JWT exp claim, then expires_in, then the documented one-hour fallback
  • enables JSON client-credential requests and mandatory refresh-token rotation for ordinary credentials
  • requires PKCE and refresh tokens for newly enrolled managed Monday credentials
  • rejects Monday GraphQL user-info errors even when the response is HTTP 200
  • preserves existing legacy Monday credentials with no expiry or refresh token
  • leaves the API-key path, callback route, base URL logic, environment capabilities, and database schema unchanged

Production report: https://sim-ai.slack.com/archives/C093DF8MA21/p1788311390749429

Type of Change

  • Bug fix
  • New feature
  • Breaking change
  • Documentation
  • Other: ___________

Testing

Passed locally:

  • focused Monday OAuth, managed OAuth, standard-provider, credential persistence, and API-key tests: 148 tests
  • full apps/sim Vitest suite: 2,869 files passed, 7 skipped; 39,606 tests passed, 67 skipped
  • bun run --cwd apps/sim type-check
  • bun run --cwd apps/sim lint:check
  • bun run check:api-validation
  • bun run check

Review focus:

  • the exact callback and PKCE verifier forwarded to the Monday v2 token endpoint
  • mandatory persistence of every rotated refresh token
  • compatibility behavior for legacy credentials that have no expiry and no refresh token
  • secret-safe handling of malformed or oversized token responses

Required Monday rollout configuration

Before production rollout, configure the matching Monday app version in Monday Developer Center:

  1. Enable the new OAuth flow.
  2. Enable all seven scopes requested by Sim: boards:read, boards:write, updates:read, updates:write, webhooks:read, webhooks:write, and me:read.
  3. Register the exact callback for each environment. Production must include https://www.sim.ai/api/auth/oauth2/callback/monday.
  4. Validate the draft with Active for me.
  5. Deploy this compatible code before publishing the corrected production Monday app version.

Users whose authorization already failed must start the connection again after the app version is published. Existing credentials are intentionally not migrated in this PR.

Checklist

  • Code follows project style guidelines
  • Self-reviewed my changes
  • Tests added/updated and passing
  • No new warnings introduced
  • I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Screenshots/Videos

Not applicable; this change has no UI modifications.