improvement(oauth): resolve credential tokens in-process instead of hopping the token route

[waleedlatif1]

Summary

• Server-side workflow execution (app container and background workers) now resolves OAuth credential access tokens through the shared application dispatch (resolveCredentialAccessToken) instead of HTTP-POSTing its own /api/auth/oauth/token route — dropping an internal round-trip on every credentialed tool call and per-call internal-JWT mint/verify
• The route's managed / service-account / plain-OAuth dispatch moved verbatim into lib/oauth/token-resolution.ts; the route is now a thin adapter and its tests pass unmodified. Managed-credential delegations bind in-process (bindExecutorManagedOAuthDelegation) with the same DB re-validation, audience, and per-credential scope as the wire path
• The browser tool-execution path keeps the HTTP call (session-cookie auth) but now goes through requestJson + the existing contract instead of a raw annotated fetch; the route's wire path stays intact for compatibility during deploy rollout
• The old rationale for the hop (workers lacking OAuth client config) no longer holds — connector sync has been refreshing tokens in-process on workers for some time. The architecture rule is updated accordingly, and refresh-failure logs now include the underlying cause so a missing provider client pair is diagnosable
• Cleanups along the way: renamed the unrelated resolveCredentialTokenBundle (was colliding with the new dispatcher name), removed the now-dead executor delegation-header builder, deduped input types, and fixed a falsy impersonateEmail edge so empty subblock state keeps resolving

Type of Change

• Improvement

Testing

• bun run type-check, bun run lint:check, bun run check:audits (40/40 incl. api-validation strict, tool-request/registry boundary)
• 302 tests across the 14 affected suites; the untouched route test suite passing unmodified pins wire behavior
• New unit coverage: dispatcher branches (managed delegation codes, scope policy, error projection), in-process delegation binder, executor resolver

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 1, 2026 3:14am UTC

[greptile-apps]

Greptile Summary

The PR moves server-side OAuth credential-token resolution from an internal HTTP round trip to the shared in-process application dispatch while retaining the browser route path.

• Centralizes managed OAuth, service-account, and standard OAuth token dispatch.
• Adds in-process executor delegation binding with canonical workflow and credential-scope validation.
• Updates tool and Vertex credential consumers to use the complete token payload.
• Retains the HTTP adapter for browser and deployment compatibility.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/oauth/token-resolution.ts	Centralizes the managed OAuth, service-account, and ordinary OAuth dispatch while preserving authorization and error projection.
apps/sim/executor/utils/credential-token.ts	Replaces the internal token-route request with in-process dispatch and binds managed credential use to the executor delegation origin.
apps/sim/lib/credentials/application/managed-oauth-delegation.ts	Adds an in-process managed OAuth delegation binder that retains canonical execution validation and per-credential scope.
apps/sim/app/api/auth/oauth/token/route.ts	Reduces the POST route to an authenticated adapter over the shared token-resolution dispatch.
apps/sim/tools/index.ts	Uses in-process resolution on the server, retains contract-backed HTTP resolution in the browser, and consumes the full token payload.

Sequence Diagram

sequenceDiagram
    participant E as Server-side executor
    participant D as Token resolution dispatch
    participant A as Authorization and delegation binding
    participant C as Credential service
    participant P as OAuth provider
    E->>D: Resolve credential token in-process
    D->>A: Authenticate or bind managed delegation
    A-->>D: Authorized credential scope
    D->>C: Load credential and resolve token
    C->>P: Refresh token when required
    P-->>C: Refreshed token
    C-->>D: Credential token payload
    D-->>E: Access token and provider metadata

Loading

_{Reviews (2): Last reviewed commit: "chore(tools): drop the orphaned wire-pay..." | Re-trigger Greptile}

[cubic-dev-ai]

All reported issues were addressed across 23 files

<sub>Heads up: you’re close to your included review allowance. Set a flex budget so reviews don’t pause.

Fix all with cubic | Re-trigger cubic</sub>

[waleedlatif1]

@greptile