Stop Test connection from spending OAuth2 refresh tokens (#916)

* Stop Test connection from spending OAuth2 refresh tokens

Test connection, which the dashboard runs for every connector on each
load, refreshed OAuth2 tokens without the connector's id. The new tokens
were never saved, so a provider that rotates refresh tokens (JTL, Sage,
DATEV) revoked the one the connector kept, and its next refresh failed
with "Token has been revoked". The caller only saw the API's bare 401.

- Test connection and MCP tool discovery pass the connector id, so a
  refresh there is saved like any other.
- One OAuth2TokenService for the app. ConnectorsModule had its own
  instance, with its own cache and refresh mutex.
- A config without an id is keyed on its credentials, not on the token
  URL, which every workspace using the provider shares.
- The retry after a 401 goes through the refresh mutex and reuses a token
  obtained after the request was sent, instead of refreshing once per
  failed call.
- When that renewal fails, the error says what the token endpoint
  answered.
- Tokens are renewed at half their lifetime when that is under five
  minutes: Sage's 5-minute tokens were refreshed on every call.
- Storing a new authorization drops the cached token and last error.
- Sage Business Cloud can be authorized with the provider; the refresh
  token becomes optional.

* Key unsaved OAuth2 configs by object, not by a hash of their secrets

CodeQL read the SHA-256 of the client secret as an insecure password hash. The key only has to keep one config's token away from another's, and the config object already does that without touching the secret.

Author: Matteo Morelli

packages/backend/src/adapters/intl/sage-business-cloud.json

@@ -2,12 +2,31 @@
   "slug": "sage-business-cloud",
   "name": "Sage Business Cloud Accounting",
   "description": "Manage Sage Business Cloud Accounting (contacts, products, invoices, bank accounts, transactions) from any AI agent. 9 tools, OAuth2 auth.",
-  "instructions": "This connector wraps the Sage Business Cloud Accounting API v3.1 (api.accounting.sage.com).\n\n**Setup — OAuth2**:\n1. Register at https://developer.sage.com/accounting → **Create app**. Set callback URL.\n2. Complete the auth flow at `https://www.sageone.com/oauth2/auth/central?response_type=code&client_id=...&redirect_uri=...&scope=full_access&country=gb` (use the country code matching your Sage subscription — gb, us, ca, de, fr, ie, es).\n3. Exchange the code at `https://oauth.accounting.sage.com/token`.\n4. Set `SAGE_CLIENT_ID`, `SAGE_CLIENT_SECRET`, `SAGE_REFRESH_TOKEN`.\n\n**Authentication**: OAuth2 — engine handles refresh. Sends `Authorization: Bearer ${ACCESS_TOKEN}`.\n\n**Business ID header**: Sage scopes everything to a business. Pass `X-Business: <BUSINESS_ID>` header on each call OR rely on the default business of the user. To discover IDs: `GET /v3.1/businesses`.\n\n**Pagination**: `page` (1-based) + `items_per_page` (max 200).\n\n**Rate limits**: 100 req/min per token, 10k/day. 429 with `Retry-After`.\n\n**Out of scope here**: VAT return submission, Stripe-connect setup, multi-currency journal lines beyond standard, asset register.",
+  "instructions": "This connector wraps the Sage Business Cloud Accounting API v3.1 (api.accounting.sage.com). You authorize it once, in AnythingMCP; from then on the access token (5 minutes) is renewed automatically, and the refresh token Sage replaces on every renewal is stored for you.\n\n**Setup — OAuth2**:\n1. Register at https://developer.sage.com/accounting → **Create app**.\n2. In the app, add this **callback URL**: `https://cloud.anythingmcp.com/api/mcp-oauth/callback` on AnythingMCP Cloud, or `<your AnythingMCP server URL>/api/mcp-oauth/callback` when you host AnythingMCP yourself.\n3. Enter the app's client ID and client secret as `SAGE_CLIENT_ID` and `SAGE_CLIENT_SECRET`, leave `SAGE_REFRESH_TOKEN` empty, and install.\n4. Open the connector and click **Authorize with Provider**. Sign in to Sage, pick the business, approve, and you land back on the connector page with the tools ready.\n\n**Scopes**: the connector asks for `full_access`, which `sage_create_contact` needs. For a read-only connector, set the scope to `readonly` in the connector's OAuth settings before you authorize.\n\n**Already have a refresh token?** You can paste it into `SAGE_REFRESH_TOKEN` instead of step 4. Sage replaces the refresh token every time it is used, so paste one you have not used yet: a token you already exchanged by hand (for example with curl to test it) is refused with `invalid_grant`. The token Sage returned from that exchange is the one to paste.\n\n**Authentication**: OAuth2 — engine handles refresh. Sends `Authorization: Bearer ${ACCESS_TOKEN}`.\n\n**Business ID header**: Sage scopes everything to a business. Pass `X-Business: <BUSINESS_ID>` header on each call OR rely on the default business of the user. To discover IDs: `GET /v3.1/businesses`.\n\n**Pagination**: `page` (1-based) + `items_per_page` (max 200).\n\n**Rate limits**: 100 req/min per token, 10k/day. 429 with `Retry-After`.\n\n**Out of scope here**: VAT return submission, Stripe-connect setup, multi-currency journal lines beyond standard, asset register.",
   "region": "intl",
   "category": "accounting",
   "icon": "sage-business-cloud",
   "docsUrl": "https://developer.sage.com/accounting/reference/",
-  "requiredEnvVars": ["SAGE_CLIENT_ID", "SAGE_CLIENT_SECRET", "SAGE_REFRESH_TOKEN"],
+  "requiredEnvVars": ["SAGE_CLIENT_ID", "SAGE_CLIENT_SECRET"],
+  "optionalEnvVars": ["SAGE_REFRESH_TOKEN"],
+  "envVarMeta": {
+    "SAGE_CLIENT_ID": {
+      "label": "Client ID",
+      "kind": "credential",
+      "help": "Sage Developer → your app: the Client ID.",
+      "link": "https://developer.sage.com/accounting/"
+    },
+    "SAGE_CLIENT_SECRET": {
+      "label": "Client secret",
+      "help": "Same app, the Client secret. Paste it exactly as shown, special characters included.",
+      "link": "https://developer.sage.com/accounting/"
+    },
+    "SAGE_REFRESH_TOKEN": {
+      "label": "Refresh token",
+      "help": "Leave empty: the authorization with Sage fills it in. Sage replaces it on every use, so a token you already exchanged yourself no longer works.",
+      "advanced": true
+    }
+  },
   "connector": {
     "name": "Sage Business Cloud Accounting v3.1",
     "type": "REST",
@@ -17,7 +36,9 @@
       "clientId": "{{SAGE_CLIENT_ID}}",
       "clientSecret": "{{SAGE_CLIENT_SECRET}}",
       "refreshToken": "{{SAGE_REFRESH_TOKEN}}",
-      "tokenUrl": "https://oauth.accounting.sage.com/token"
+      "authorizationUrl": "https://www.sageone.com/oauth2/auth/central?filter=apiv3.1",
+      "tokenUrl": "https://oauth.accounting.sage.com/token",
+      "scopes": "full_access"
     }
   },
   "tools": [

packages/backend/src/connectors/connectors.controller.ts

@@ -1310,6 +1310,7 @@ export class ConnectorsController {
         authType: connector.authType,
         authConfig,
         headers: connector.headers as Record<string, string>,
+        connectorId: connector.id,
       });
 
       const parsedTools = remoteTools.map((rt) => ({
@@ -1590,6 +1591,7 @@ export class ConnectorsController {
             authConfig,
             headers: connector.headers as Record<string, string>,
             mcpPath: dto.url || '/mcp',
+            connectorId: connector.id,
           });
           for (const rt of remoteTools) {
             parsedTools.push({

packages/backend/src/connectors/connectors.module.ts

@@ -9,7 +9,6 @@ import { GraphqlEngine } from './engines/graphql.engine';
 import { McpClientEngine } from './engines/mcp-client.engine';
 import { DatabaseEngine } from './engines/database.engine';
 import { ODataEngine } from './engines/odata.engine';
-import { OAuth2TokenService } from './engines/oauth2-token.service';
 import { LoginTokenService } from './engines/login-token.service';
 import { GraphqlSchemaService } from './engines/graphql-schema.service';
 import { OpenApiParser } from './parsers/openapi.parser';
@@ -35,6 +34,10 @@ const ENGINES = [
 
 const PARSERS = [OpenApiParser, WsdlParser, GraphqlParser, PostmanParser, CurlParser];
 
+// OAuth2TokenService comes from McpServerModule: one instance for the whole
+// app. A second one here had its own token cache and refresh mutex, so a
+// Test connection and a tool call could refresh with the same refresh token
+// at once, and a provider that rotates it revoked the connector's token.
 @Module({
   imports: [McpServerModule, McpServersModule, LicenseModule],
   controllers: [ConnectorsController, McpOAuthCallbackController, ToolsController],
@@ -43,7 +46,6 @@ const PARSERS = [OpenApiParser, WsdlParser, GraphqlParser, PostmanParser, CurlPa
     McpOAuthService,
     CatalogResyncService,
     CatalogReconciler,
-    OAuth2TokenService,
     LoginTokenService,
     GraphqlSchemaService,
     ...ENGINES,
@@ -53,7 +55,6 @@ const PARSERS = [OpenApiParser, WsdlParser, GraphqlParser, PostmanParser, CurlPa
     ConnectorsService,
     McpOAuthService,
     CatalogResyncService,
-    OAuth2TokenService,
     LoginTokenService,
     GraphqlSchemaService,
     ...ENGINES,

packages/backend/src/connectors/connectors.service.oauth.spec.ts

@@ -0,0 +1,92 @@
+import { ConnectorsService } from './connectors.service';
+import { encrypt } from '../common/crypto/encryption.util';
+
+/**
+ * Test connection runs on every dashboard load (health-check) and refreshes
+ * OAuth2 tokens like a tool call does. Before this, it did so without the
+ * connector's id, so the refreshed tokens were never saved: a provider that
+ * rotates refresh tokens (JTL, Sage, DATEV) revoked the one the connector
+ * kept, and its next refresh failed with "Token has been revoked".
+ */
+describe('ConnectorsService OAuth2 token bookkeeping', () => {
+  const KEY = 'k'.repeat(24) + 'Zq7!pL2@vN9#xR4$';
+  const authConfig = {
+    clientId: 'cid',
+    clientSecret: 'secret',
+    tokenUrl: 'https://oauth2.example.com/token',
+    refreshToken: 'rt-1',
+    accessToken: 'at-1',
+  };
+  const row = {
+    id: 'conn-ffn',
+    name: 'FFN Connect',
+    type: 'REST',
+    baseUrl: 'https://api.example.com',
+    authType: 'OAUTH2',
+    authConfig: encrypt(JSON.stringify(authConfig), KEY),
+    headers: null,
+    envVars: null,
+    healthcheckPath: '/merchant/info',
+    tools: [],
+  };
+
+  let prisma: any;
+  let restEngine: any;
+  let graphqlEngine: any;
+  let mcpClientEngine: any;
+  let tokens: any;
+  let service: ConnectorsService;
+
+  beforeEach(() => {
+    prisma = {
+      connector: {
+        findUnique: jest.fn().mockResolvedValue(row),
+        update: jest.fn().mockResolvedValue(row),
+      },
+    };
+    restEngine = { execute: jest.fn().mockResolvedValue({ ok: true }) };
+    graphqlEngine = { execute: jest.fn().mockResolvedValue({ __typename: 'Query' }) };
+    mcpClientEngine = { listTools: jest.fn().mockResolvedValue([]) };
+    tokens = { forget: jest.fn() };
+    service = new ConnectorsService(
+      prisma,
+      { get: () => KEY } as any,
+      restEngine,
+      {} as any,
+      graphqlEngine,
+      {} as any,
+      mcpClientEngine,
+      undefined,
+      tokens,
+    );
+  });
+
+  it.each([
+    ['REST', () => restEngine.execute.mock.calls[0][0]],
+    ['GRAPHQL', () => graphqlEngine.execute.mock.calls[0][0]],
+    ['MCP', () => mcpClientEngine.listTools.mock.calls[0][0]],
+  ])('Test connection of a %s connector names the connector to the engine', async (type, sent) => {
+    prisma.connector.findUnique.mockResolvedValue({ ...row, type });
+
+    await service.testConnection('conn-ffn');
+
+    expect(sent()).toEqual(expect.objectContaining({ connectorId: 'conn-ffn' }));
+  });
+
+  it('forgets cached tokens when the authorization is stored', async () => {
+    await service.updateAuthConfigMerge('conn-ffn', {
+      accessToken: 'at-2',
+      refreshToken: 'rt-2',
+    });
+
+    expect(tokens.forget).toHaveBeenCalledWith('conn-ffn');
+  });
+
+  it('forgets cached tokens when the whole auth config is replaced, and only then', async () => {
+    await service.update('conn-ffn', { name: 'Renamed' });
+    expect(tokens.forget).not.toHaveBeenCalled();
+
+    await service.update('conn-ffn', { authConfig: { ...authConfig, refreshToken: 'rt-9' } });
+    expect(tokens.forget).toHaveBeenCalledWith('conn-ffn');
+  });
+});

packages/backend/src/connectors/connectors.service.ts

@@ -24,6 +24,7 @@ import { resolveAdapterIcon } from './connector-icon.util';
 import { applySchemaDefaults } from '../common/schema-defaults.util';
 import { renderStaticResponse } from './static-response.util';
 import { ODataEngine, isODataBuiltinMethod } from './engines/odata.engine';
+import { OAuth2TokenService } from './engines/oauth2-token.service';
 
 @Injectable()
 export class ConnectorsService {
@@ -39,6 +40,7 @@ export class ConnectorsService {
     private readonly databaseEngine: DatabaseEngine,
     private readonly mcpClientEngine: McpClientEngine,
     @Optional() private readonly odataEngine?: ODataEngine,
+    @Optional() private readonly oauth2TokenService?: OAuth2TokenService,
   ) {
     this.encryptionKey = getRequiredSecret(
       'ENCRYPTION_KEY',
@@ -166,10 +168,12 @@ export class ConnectorsService {
       updateData.baseUrl = normalizeConnectorBaseUrl(data.baseUrl, existing.type);
     }
 
-    return this.prisma.connector.update({
+    const updated = await this.prisma.connector.update({
       where: { id },
       data: updateData,
     });
+    if (data.authConfig) this.oauth2TokenService?.forget(id);
+    return updated;
   }
 
   /**
@@ -189,12 +193,16 @@ export class ConnectorsService {
         ) as Record<string, unknown>)
       : {};
     const merged = { ...existing, ...patch };
-    return this.prisma.connector.update({
+    const updated = await this.prisma.connector.update({
       where: { id },
       data: {
         authConfig: encrypt(JSON.stringify(merged), this.encryptionKey),
       },
     });
+    // A new authorization or new client settings: a token cached from the
+    // old ones, or the error the old refresh token got, no longer applies.
+    this.oauth2TokenService?.forget(id);
+    return updated;
   }
 
   async remove(id: string): Promise<void> {
@@ -279,6 +287,10 @@ export class ConnectorsService {
               authType: connector.authType,
               authConfig,
               headers,
+              // Without it an OAuth2 refresh here was never saved: the
+              // provider rotated the refresh token, the connector kept the
+              // spent one, and its next refresh was refused as revoked.
+              connectorId: connector.id,
             },
             { method: 'GET', path },
             {},
@@ -292,6 +304,7 @@ export class ConnectorsService {
               authType: connector.authType,
               authConfig,
               headers: connector.headers as Record<string, string>,
+              connectorId: connector.id,
             },
             { method: 'query', path: '{ __typename }' },
             {},
@@ -331,6 +344,7 @@ export class ConnectorsService {
             authType: connector.authType,
             authConfig,
             headers: connector.headers as Record<string, string>,
+            connectorId: connector.id,
           });
           return {
             ok: true,
@@ -358,6 +372,7 @@ export class ConnectorsService {
    * Throws what the server or the transport threw.
    */
   async discoverRemoteMcpTools(connector: {
+    id?: string;
     name: string;
     baseUrl: string;
     authType: string;
@@ -383,6 +398,7 @@ export class ConnectorsService {
       authType: connector.authType,
       authConfig,
       headers,
+      connectorId: connector.id,
     });
     return remote.map((rt) => ({
       name: rt.name,

packages/backend/src/connectors/engines/graphql.engine.spec.ts

@@ -16,7 +16,8 @@ describe('GraphqlEngine', () => {
   beforeEach(() => {
     mockOAuth2TokenService = {
       getAccessToken: jest.fn().mockResolvedValue('oauth2-access-token'),
-      refreshToken: jest.fn().mockResolvedValue('new-access-token'),
+      renewAfterRejection: jest.fn().mockResolvedValue('new-access-token'),
+      renewalFailedError: jest.fn().mockReturnValue(undefined),
     } as any;
     mockLoginTokenService = {
       getToken: jest.fn().mockResolvedValue({
@@ -278,7 +279,7 @@ describe('GraphqlEngine', () => {
 
   it('should refresh OAuth2 token and retry on 401', async () => {
     mockOAuth2TokenService.getAccessToken.mockResolvedValue('expired-token');
-    mockOAuth2TokenService.refreshToken.mockResolvedValue('fresh-token');
+    mockOAuth2TokenService.renewAfterRejection.mockResolvedValue('fresh-token');
 
     // AxiosError is auto-mocked, so create instance and set properties manually
     const error401 = new AxiosError() as any;
@@ -299,9 +300,10 @@ describe('GraphqlEngine', () => {
     );
 
     expect(result).toEqual({ me: { id: '1' } });
-    expect(mockOAuth2TokenService.refreshToken).toHaveBeenCalledWith(
+    expect(mockOAuth2TokenService.renewAfterRejection).toHaveBeenCalledWith(
       expect.objectContaining({ refreshToken: 'rt', tokenUrl: 'https://auth/token' }),
       'conn-1',
+      expect.any(Number),
     );
     expect(mockedAxios.post).toHaveBeenCalledTimes(2);
   });

packages/backend/src/connectors/engines/graphql.engine.ts

@@ -190,6 +190,7 @@ export class GraphqlEngine {
       axiosOpts.proxy = false;
     }
 
+    const sentAt = Date.now();
     try {
       const response = await axios.post(config.baseUrl, requestConfig, axiosOpts);
 
@@ -212,9 +213,10 @@ export class GraphqlEngine {
         this.logger.debug(
           'OAuth2: access token expired, attempting refresh...',
         );
-        const newToken = await this.oauth2TokenService.refreshToken(
+        const newToken = await this.oauth2TokenService.renewAfterRejection(
           config.authConfig,
           config.connectorId,
+          sentAt,
         );
         if (newToken) {
           headers['Authorization'] = `Bearer ${newToken}`;
@@ -232,6 +234,11 @@ export class GraphqlEngine {
 
           return retryResponse.data.data;
         }
+        const renewalFailed = this.oauth2TokenService.renewalFailedError(
+          config.authConfig,
+          config.connectorId,
+        );
+        if (renewalFailed) throw renewalFailed;
       }
       // LOGIN_TOKEN auto-relogin on 401
       if (

packages/backend/src/connectors/engines/mcp-client.engine.ts

@@ -54,6 +54,7 @@ export class McpClientEngine {
       version: '1.0.0',
     });
 
+    const sentAt = Date.now();
     try {
       await client.connect(transport);
 
@@ -72,9 +73,10 @@ export class McpClientEngine {
         error?.message?.includes?.('401')
       ) {
         this.logger.debug('MCP OAuth2: 401 despite proactive refresh, retrying...');
-        const newToken = await this.oauth2TokenService.refreshToken(
+        const newToken = await this.oauth2TokenService.renewAfterRejection(
           config.authConfig,
           config.connectorId,
+          sentAt,
         );
         if (newToken) {
           const retryHeaders: Record<string, string> = { ...config.headers };