snapshot of https://github.com/twentyhq/twenty.git (main, 2026-09-17; blobs > 131072B omitted)

packages/twenty-server/test/integration/metadata/suites/connection-provider/app-connection-management-guards.integration-spec.ts

@@ -0,0 +1,232 @@
+import request from 'supertest';
+import { buildBaseManifest } from 'test/integration/metadata/suites/application/utils/build-base-manifest.util';
+import { cleanupApplicationAndAppRegistration } from 'test/integration/metadata/suites/application/utils/cleanup-application-and-app-registration.util';
+import { setupApplicationForSync } from 'test/integration/metadata/suites/application/utils/setup-application-for-sync.util';
+import { syncApplication } from 'test/integration/metadata/suites/application/utils/sync-application.util';
+import { findConnectionProvidersByApplication } from 'test/integration/metadata/suites/connection-provider/utils/find-connection-providers-by-application.util';
+import { makeMetadataAPIRequestWithMemberRole } from 'test/integration/metadata/suites/utils/make-metadata-api-request-with-member-role.util';
+import { generateTransientToken } from 'test/integration/utils/generate-transient-token.util';
+import { getDataOrThrow } from 'test/integration/utils/query-messaging.util';
+import gql from 'graphql-tag';
+import { ConnectedAccountProvider } from 'twenty-shared/types';
+import { isDefined } from 'twenty-shared/utils';
+import { v4 as uuidv4 } from 'uuid';
+
+import { SEED_APPLE_WORKSPACE_ID } from 'src/engine/workspace-manager/dev-seeder/core/constants/seeder-workspaces.constant';
+import { USER_WORKSPACE_DATA_SEED_IDS } from 'src/engine/workspace-manager/dev-seeder/core/utils/seed-user-workspaces.util';
+
+const APP_ID = uuidv4();
+const APP_ROLE_ID = uuidv4();
+const APP_PROVIDER_ID = uuidv4();
+
+const SHARED_BY_TIM_ID = uuidv4();
+const PRIVATE_OF_TIM_ID = uuidv4();
+const PRIVATE_OF_JONY_ID = uuidv4();
+
+describe('app connection management guards (e2e)', () => {
+  let applicationDbId: string;
+  let providerDbId: string;
+
+  const insertAppConnection = async ({
+    id,
+    visibility,
+    userWorkspaceId,
+  }: {
+    id: string;
+    visibility: 'user' | 'workspace';
+    userWorkspaceId: string;
+  }): Promise<void> => {
+    await globalThis.testDataSource.query(
+      `INSERT INTO core."connectedAccount"
+         (id, handle, provider, visibility, "workspaceId", "userWorkspaceId",
+          "applicationId", "connectionProviderId")
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`,
+      [
+        id,
+        'slack-bot@apple.dev',
+        ConnectedAccountProvider.APP,
+        visibility,
+        SEED_APPLE_WORKSPACE_ID,
+        userWorkspaceId,
+        applicationDbId,
+        providerDbId,
+      ],
+    );
+  };
+
+  const generateMemberTransientToken = async (): Promise<string> => {
+    const response = await makeMetadataAPIRequestWithMemberRole({
+      query: gql`
+        mutation GenerateTransientToken {
+          generateTransientToken {
+            transientToken {
+              token
+            }
+          }
+        }
+      `,
+    });
+
+    const data = getDataOrThrow(response) as {
+      generateTransientToken: { transientToken: { token: string } };
+    };
+
+    return data.generateTransientToken.transientToken.token;
+  };
+
+  const startAuthorizeAndGetErrorMessage = async ({
+    reconnectingConnectedAccountId,
+    visibility,
+    asMember = false,
+  }: {
+    reconnectingConnectedAccountId?: string;
+    visibility?: 'user' | 'workspace';
+    asMember?: boolean;
+  }): Promise<string> => {
+    const response = await request(`http://localhost:${APP_PORT}`)
+      .get('/auth/apps/authorize')
+      .query({
+        applicationId: applicationDbId,
+        providerName: 'slack',
+        transientToken: asMember
+          ? await generateMemberTransientToken()
+          : await generateTransientToken(),
+        ...(isDefined(reconnectingConnectedAccountId)
+          ? { reconnectingConnectedAccountId }
+          : {}),
+        ...(isDefined(visibility) ? { visibility } : {}),
+      });
+
+    expect(response.status).toBe(302);
+
+    return (
+      new URL(response.headers.location).searchParams.get('errorMessage') ?? ''
+    );
+  };
+
+  beforeAll(async () => {
+    await setupApplicationForSync({
+      applicationUniversalIdentifier: APP_ID,
+      name: 'test-app-connection-management-guards',
+      description: 'App for testing app connection management guards',
+      sourcePath: 'test-app-connection-management-guards',
+    });
+
+    await syncApplication({
+      manifest: buildBaseManifest({
+        appId: APP_ID,
+        roleId: APP_ROLE_ID,
+        overrides: {
+          connectionProviders: [
+            {
+              universalIdentifier: APP_PROVIDER_ID,
+              name: 'slack',
+              displayName: 'Slack',
+              type: 'oauth',
+              oauth: {
+                authorizationEndpoint: 'https://slack.com/oauth/v2/authorize',
+                tokenEndpoint: 'https://slack.com/api/oauth.v2.access',
+                scopes: ['chat:write'],
+                clientIdVariable: 'SLACK_CLIENT_ID',
+                clientSecretVariable: 'SLACK_CLIENT_SECRET',
+              },
+            },
+          ],
+        },
+      }),
+      expectToFail: false,
+    });
+
+    jest.useRealTimers();
+
+    const [provider] = await findConnectionProvidersByApplication(APP_ID);
+
+    applicationDbId = provider.applicationId;
+    providerDbId = provider.id;
+
+    await insertAppConnection({
+      id: SHARED_BY_TIM_ID,
+      visibility: 'workspace',
+      userWorkspaceId: USER_WORKSPACE_DATA_SEED_IDS.TIM,
+    });
+    await insertAppConnection({
+      id: PRIVATE_OF_TIM_ID,
+      visibility: 'user',
+      userWorkspaceId: USER_WORKSPACE_DATA_SEED_IDS.TIM,
+    });
+    await insertAppConnection({
+      id: PRIVATE_OF_JONY_ID,
+      visibility: 'user',
+      userWorkspaceId: USER_WORKSPACE_DATA_SEED_IDS.JONY,
+    });
+  }, 180000);
+
+  afterAll(async () => {
+    await globalThis.testDataSource.query(
+      `DELETE FROM core."connectedAccount"
+        WHERE "workspaceId" = $1 AND "applicationId" = $2`,
+      [SEED_APPLE_WORKSPACE_ID, applicationDbId],
+    );
+
+    await cleanupApplicationAndAppRegistration({
+      applicationUniversalIdentifier: APP_ID,
+    });
+  }, 120000);
+
+  it('refuses to reconnect a private connection owned by another member', async () => {
+    const errorMessage = await startAuthorizeAndGetErrorMessage({
+      reconnectingConnectedAccountId: PRIVATE_OF_TIM_ID,
+    });
+
+    expect(errorMessage).toContain(
+      `Cannot reconnect connectedAccount ${PRIVATE_OF_TIM_ID}`,
+    );
+  });
+
+  it('lets a member with the Applications permission reconnect a workspace-shared connection', async () => {
+    const errorMessage = await startAuthorizeAndGetErrorMessage({
+      reconnectingConnectedAccountId: SHARED_BY_TIM_ID,
+    });
+
+    expect(errorMessage).not.toContain('Cannot reconnect connectedAccount');
+    expect(errorMessage).not.toContain('does not have permission');
+  });
+
+  it('refuses a member without the Applications permission to reconnect a workspace-shared connection', async () => {
+    const errorMessage = await startAuthorizeAndGetErrorMessage({
+      reconnectingConnectedAccountId: SHARED_BY_TIM_ID,
+      asMember: true,
+    });
+
+    expect(errorMessage).toContain('does not have permission');
+  });
+
+  it('refuses a member without the Applications permission to create a workspace-shared connection', async () => {
+    const errorMessage = await startAuthorizeAndGetErrorMessage({
+      visibility: 'workspace',
+      asMember: true,
+    });
+
+    expect(errorMessage).toContain('does not have permission');
+  });
+
+  it('refuses a member without the Applications permission to share their own private connection', async () => {
+    const errorMessage = await startAuthorizeAndGetErrorMessage({
+      reconnectingConnectedAccountId: PRIVATE_OF_JONY_ID,
+      visibility: 'workspace',
+      asMember: true,
+    });
+
+    expect(errorMessage).toContain('does not have permission');
+  });
+
+  it('lets a member without the Applications permission reconnect their own private connection', async () => {
+    const errorMessage = await startAuthorizeAndGetErrorMessage({
+      reconnectingConnectedAccountId: PRIVATE_OF_JONY_ID,
+      asMember: true,
+    });
+
+    expect(errorMessage).not.toContain('Cannot reconnect connectedAccount');
+    expect(errorMessage).not.toContain('does not have permission');
+  });
+});

packages/twenty-server/test/integration/metadata/suites/connection-provider/connection-provider-resolver.integration-spec.ts

@@ -0,0 +1,187 @@
+import { gql } from 'graphql-tag';
+import { buildBaseManifest } from 'test/integration/metadata/suites/application/utils/build-base-manifest.util';
+import { cleanupApplicationAndAppRegistration } from 'test/integration/metadata/suites/application/utils/cleanup-application-and-app-registration.util';
+import { setupApplicationForSync } from 'test/integration/metadata/suites/application/utils/setup-application-for-sync.util';
+import { syncApplication } from 'test/integration/metadata/suites/application/utils/sync-application.util';
+import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
+import { type Manifest } from 'twenty-shared/application';
+import { v4 as uuidv4 } from 'uuid';
+
+import { ConfigVariables } from 'src/engine/core-modules/twenty-config/config-variables';
+import { SEED_APPLE_WORKSPACE_ID } from 'src/engine/workspace-manager/dev-seeder/core/constants/seeder-workspaces.constant';
+
+const TEST_APP_ID = uuidv4();
+const TEST_ROLE_ID = uuidv4();
+const TEST_PROVIDER_ID = uuidv4();
+
+const buildManifest = (
+  overrides?: Partial<Pick<Manifest, 'connectionProviders'>>,
+) => buildBaseManifest({ appId: TEST_APP_ID, roleId: TEST_ROLE_ID, overrides });
+
+const findApplicationDbId = async (
+  universalIdentifier: string,
+): Promise<string> => {
+  const rows = await globalThis.testDataSource.query(
+    `SELECT id FROM core."application" WHERE "universalIdentifier" = $1`,
+    [universalIdentifier],
+  );
+
+  return rows[0].id;
+};
+
+describe('applicationConnectionProviders resolver (e2e)', () => {
+  beforeEach(async () => {
+    await setupApplicationForSync({
+      applicationUniversalIdentifier: TEST_APP_ID,
+      name: 'Test Application',
+      description: 'App for testing the connectionProviders resolver',
+      sourcePath: 'test-connection-provider-resolver',
+    });
+
+    await syncApplication({
+      manifest: buildManifest({
+        connectionProviders: [
+          {
+            universalIdentifier: TEST_PROVIDER_ID,
+            name: 'linear',
+            displayName: 'Linear',
+            type: 'oauth',
+            oauth: {
+              authorizationEndpoint: 'https://linear.app/oauth/authorize',
+              tokenEndpoint: 'https://api.linear.app/oauth/token',
+              scopes: ['read', 'write'],
+              clientIdVariable: 'LINEAR_CLIENT_ID',
+              clientSecretVariable: 'LINEAR_CLIENT_SECRET',
+            },
+          },
+        ],
+      }),
+      expectToFail: false,
+    });
+  }, 60000);
+
+  afterEach(async () => {
+    await cleanupApplicationAndAppRegistration({
+      applicationUniversalIdentifier: TEST_APP_ID,
+    });
+  });
+
+  it('returns the provider with type read from the entity and oauth.scopes from oauthConfig', async () => {
+    const applicationId = await findApplicationDbId(TEST_APP_ID);
+
+    const response = await makeMetadataAPIRequest({
+      query: gql`
+        query ApplicationConnectionProviders($applicationId: UUID!) {
+          applicationConnectionProviders(applicationId: $applicationId) {
+            id
+            applicationId
+            type
+            name
+            displayName
+            logoUrl
+            oauth {
+              scopes
+              isClientCredentialsConfigured
+            }
+          }
+        }
+      `,
+      variables: { applicationId },
+    });
+
+    expect(response.status).toBe(200);
+    expect(response.body.errors).toBeUndefined();
+
+    const providers = response.body.data.applicationConnectionProviders;
+
+    expect(providers).toHaveLength(1);
+    expect(providers[0]).toMatchObject({
+      applicationId,
+      type: 'oauth',
+      name: 'linear',
+      displayName: 'Linear',
+      logoUrl: null,
+      oauth: {
+        scopes: ['read', 'write'],
+        // The fixture registration's OAuth client_id / client_secret server
+        // variables are not filled in by setupApplicationForSync, so the
+        // resolver should report credentials as not configured.
+        isClientCredentialsConfigured: false,
+      },
+    });
+  }, 60000);
+
+  it('resolves logoUrl through the public-assets route when the manifest declares a logo', async () => {
+    await syncApplication({
+      manifest: buildManifest({
+        connectionProviders: [
+          {
+            universalIdentifier: TEST_PROVIDER_ID,
+            name: 'linear',
+            displayName: 'Linear',
+            logo: 'public/linear-logomark.svg',
+            type: 'oauth',
+            oauth: {
+              authorizationEndpoint: 'https://linear.app/oauth/authorize',
+              tokenEndpoint: 'https://api.linear.app/oauth/token',
+              scopes: ['read', 'write'],
+              clientIdVariable: 'LINEAR_CLIENT_ID',
+              clientSecretVariable: 'LINEAR_CLIENT_SECRET',
+            },
+          },
+        ],
+      }),
+      expectToFail: false,
+    });
+
+    const applicationId = await findApplicationDbId(TEST_APP_ID);
+
+    const response = await makeMetadataAPIRequest({
+      query: gql`
+        query ApplicationConnectionProviders($applicationId: UUID!) {
+          applicationConnectionProviders(applicationId: $applicationId) {
+            logoUrl
+          }
+        }
+      `,
+      variables: { applicationId },
+    });
+
+    expect(response.status).toBe(200);
+    expect(response.body.errors).toBeUndefined();
+
+    const providers = response.body.data.applicationConnectionProviders;
+
+    const serverUrl =
+      process.env.SERVER_URL ?? new ConfigVariables().SERVER_URL;
+
+    expect(providers).toHaveLength(1);
+    expect(providers[0].logoUrl).toBe(
+      `${serverUrl}/public-assets/${SEED_APPLE_WORKSPACE_ID}/${applicationId}/public/linear-logomark.svg`,
+    );
+  }, 60000);
+
+  it('returns an empty array when the application has no connection providers', async () => {
+    await syncApplication({
+      manifest: buildManifest({ connectionProviders: [] }),
+      expectToFail: false,
+    });
+
+    const applicationId = await findApplicationDbId(TEST_APP_ID);
+
+    const response = await makeMetadataAPIRequest({
+      query: gql`
+        query ApplicationConnectionProviders($applicationId: UUID!) {
+          applicationConnectionProviders(applicationId: $applicationId) {
+            id
+          }
+        }
+      `,
+      variables: { applicationId },
+    });
+
+    expect(response.status).toBe(200);
+    expect(response.body.errors).toBeUndefined();
+    expect(response.body.data.applicationConnectionProviders).toEqual([]);
+  }, 60000);
+});

packages/twenty-server/test/integration/metadata/suites/connection-provider/report-app-connection-auth-failure.integration-spec.ts

@@ -0,0 +1,344 @@
+import { gql } from 'graphql-tag';
+import { buildBaseManifest } from 'test/integration/metadata/suites/application/utils/build-base-manifest.util';
+import { cleanupApplicationAndAppRegistration } from 'test/integration/metadata/suites/application/utils/cleanup-application-and-app-registration.util';
+import { generateApplicationToken } from 'test/integration/metadata/suites/application/utils/generate-application-token.util';
+import { setupApplicationForSync } from 'test/integration/metadata/suites/application/utils/setup-application-for-sync.util';
+import { syncApplication } from 'test/integration/metadata/suites/application/utils/sync-application.util';
+import { findConnectionProvidersByApplication } from 'test/integration/metadata/suites/connection-provider/utils/find-connection-providers-by-application.util';
+import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
+import { type Manifest } from 'twenty-shared/application';
+import { ConnectedAccountProvider } from 'twenty-shared/types';
+import { v4 as uuidv4 } from 'uuid';
+
+import { SEED_APPLE_WORKSPACE_ID } from 'src/engine/workspace-manager/dev-seeder/core/constants/seeder-workspaces.constant';
+
+const REPORT_AUTH_FAILURE_MUTATION = gql`
+  mutation ReportAppConnectionAuthFailure(
+    $input: ReportAppConnectionAuthFailureInput!
+  ) {
+    reportAppConnectionAuthFailure(input: $input)
+  }
+`;
+
+const OWNING_APP_ID = uuidv4();
+const OWNING_APP_ROLE_ID = uuidv4();
+const OWNING_APP_PROVIDER_ID = uuidv4();
+
+const OTHER_APP_ID = uuidv4();
+const OTHER_APP_ROLE_ID = uuidv4();
+const OTHER_APP_PROVIDER_ID = uuidv4();
+
+const buildManifestWithProvider = ({
+  appId,
+  roleId,
+  roleLabel,
+  providerId,
+}: {
+  appId: string;
+  roleId: string;
+  roleLabel: string;
+  providerId: string;
+}): Manifest =>
+  buildBaseManifest({
+    appId,
+    roleId,
+    overrides: {
+      roles: [
+        {
+          universalIdentifier: roleId,
+          label: roleLabel,
+          description: 'A test role',
+        },
+      ],
+      connectionProviders: [
+        {
+          universalIdentifier: providerId,
+          name: 'slack',
+          displayName: 'Slack',
+          type: 'oauth',
+          oauth: {
+            authorizationEndpoint: 'https://slack.com/oauth/v2/authorize',
+            tokenEndpoint: 'https://slack.com/api/oauth.v2.access',
+            scopes: ['chat:write'],
+            clientIdVariable: 'SLACK_CLIENT_ID',
+            clientSecretVariable: 'SLACK_CLIENT_SECRET',
+          },
+        },
+      ],
+    },
+  });
+
+const findAuthFailure = async (
+  connectedAccountId: string,
+): Promise<{ authFailedAt: Date | null; authFailedReason: string | null }> => {
+  const [row] = await globalThis.testDataSource.query(
+    `SELECT "authFailedAt", "authFailedReason"
+       FROM core."connectedAccount" WHERE id = $1`,
+    [connectedAccountId],
+  );
+
+  return row;
+};
+
+describe('reportAppConnectionAuthFailure resolver (e2e)', () => {
+  let owningApplicationToken: string;
+  let adminUserWorkspaceId: string;
+  let owningApplicationDbId: string;
+  let owningProviderDbId: string;
+  let otherApplicationDbId: string;
+  let otherProviderDbId: string;
+
+  const insertAppConnection = async ({
+    id,
+    applicationId,
+    connectionProviderId,
+    visibility,
+    userWorkspaceId,
+    provider = ConnectedAccountProvider.APP,
+  }: {
+    id: string;
+    applicationId: string;
+    connectionProviderId: string;
+    visibility: 'user' | 'workspace';
+    userWorkspaceId: string;
+    provider?: ConnectedAccountProvider;
+  }): Promise<void> => {
+    await globalThis.testDataSource.query(
+      `INSERT INTO core."connectedAccount"
+         (id, handle, provider, visibility, "workspaceId", "userWorkspaceId",
+          "applicationId", "connectionProviderId")
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`,
+      [
+        id,
+        'slack-bot@apple.dev',
+        provider,
+        visibility,
+        SEED_APPLE_WORKSPACE_ID,
+        userWorkspaceId,
+        applicationId,
+        connectionProviderId,
+      ],
+    );
+  };
+
+  const reportAuthFailure = ({
+    id,
+    reason,
+    token = owningApplicationToken,
+  }: {
+    id: string;
+    reason?: string;
+    token?: string;
+  }) =>
+    makeMetadataAPIRequest(
+      {
+        query: REPORT_AUTH_FAILURE_MUTATION,
+        variables: { input: { id, reason } },
+      },
+      token,
+    );
+
+  beforeAll(async () => {
+    for (const { appId, roleId, providerId, sourcePath } of [
+      {
+        appId: OWNING_APP_ID,
+        roleId: OWNING_APP_ROLE_ID,
+        providerId: OWNING_APP_PROVIDER_ID,
+        sourcePath: 'test-report-auth-failure-owner',
+      },
+      {
+        appId: OTHER_APP_ID,
+        roleId: OTHER_APP_ROLE_ID,
+        providerId: OTHER_APP_PROVIDER_ID,
+        sourcePath: 'test-report-auth-failure-other',
+      },
+    ]) {
+      await setupApplicationForSync({
+        applicationUniversalIdentifier: appId,
+        name: sourcePath,
+        description: 'App for testing auth-failure reporting',
+        sourcePath,
+      });
+
+      await syncApplication({
+        manifest: buildManifestWithProvider({
+          appId,
+          roleId,
+          roleLabel: `Test Role ${sourcePath}`,
+          providerId,
+        }),
+        expectToFail: false,
+      });
+    }
+
+    jest.useRealTimers();
+
+    const [owningProvider] =
+      await findConnectionProvidersByApplication(OWNING_APP_ID);
+    const [otherProvider] =
+      await findConnectionProvidersByApplication(OTHER_APP_ID);
+
+    owningApplicationDbId = owningProvider.applicationId;
+    owningProviderDbId = owningProvider.id;
+    otherApplicationDbId = otherProvider.applicationId;
+    otherProviderDbId = otherProvider.id;
+
+    const [userWorkspace] = await globalThis.testDataSource.query(
+      `SELECT id FROM core."userWorkspace" WHERE "workspaceId" = $1 LIMIT 1`,
+      [SEED_APPLE_WORKSPACE_ID],
+    );
+
+    adminUserWorkspaceId = userWorkspace.id;
+
+    // Minted with the admin token, so it carries that admin's userWorkspaceId
+    // alongside the owning applicationId.
+    const { data } = await generateApplicationToken({
+      applicationId: owningApplicationDbId,
+      expectToFail: false,
+    });
+
+    owningApplicationToken =
+      data.generateApplicationToken.applicationAccessToken.token;
+  }, 180000);
+
+  afterEach(async () => {
+    await globalThis.testDataSource.query(
+      `DELETE FROM core."connectedAccount" WHERE "workspaceId" = $1
+         AND "applicationId" IN ($2, $3)`,
+      [SEED_APPLE_WORKSPACE_ID, owningApplicationDbId, otherApplicationDbId],
+    );
+  });
+
+  afterAll(async () => {
+    for (const appId of [OWNING_APP_ID, OTHER_APP_ID]) {
+      await cleanupApplicationAndAppRegistration({
+        applicationUniversalIdentifier: appId,
+      });
+    }
+  }, 120000);
+
+  it('marks the calling application own connection as auth-failed with the reason', async () => {
+    const connectedAccountId = uuidv4();
+
+    await insertAppConnection({
+      id: connectedAccountId,
+      applicationId: owningApplicationDbId,
+      connectionProviderId: owningProviderDbId,
+      visibility: 'workspace',
+      userWorkspaceId: adminUserWorkspaceId,
+    });
+
+    const response = await reportAuthFailure({
+      id: connectedAccountId,
+      reason: 'Slack rejected the stored token (invalid_auth)',
+    });
+
+    expect(response.body.errors).toBeUndefined();
+    expect(response.body.data.reportAppConnectionAuthFailure).toBe(true);
+
+    const { authFailedAt, authFailedReason } =
+      await findAuthFailure(connectedAccountId);
+
+    expect(authFailedAt).not.toBeNull();
+    expect(authFailedReason).toBe(
+      'Slack rejected the stored token (invalid_auth)',
+    );
+  });
+
+  it('leaves the reason empty when the caller gives none', async () => {
+    const connectedAccountId = uuidv4();
+
+    await insertAppConnection({
+      id: connectedAccountId,
+      applicationId: owningApplicationDbId,
+      connectionProviderId: owningProviderDbId,
+      visibility: 'workspace',
+      userWorkspaceId: adminUserWorkspaceId,
+    });
+
+    const response = await reportAuthFailure({ id: connectedAccountId });
+
+    expect(response.body.errors).toBeUndefined();
+
+    const { authFailedAt, authFailedReason } =
+      await findAuthFailure(connectedAccountId);
+
+    expect(authFailedAt).not.toBeNull();
+    expect(authFailedReason).toBeNull();
+  });
+
+  it('refuses a connection owned by another application', async () => {
+    const connectedAccountId = uuidv4();
+
+    await insertAppConnection({
+      id: connectedAccountId,
+      applicationId: otherApplicationDbId,
+      connectionProviderId: otherProviderDbId,
+      visibility: 'workspace',
+      userWorkspaceId: adminUserWorkspaceId,
+    });
+
+    const response = await reportAuthFailure({
+      id: connectedAccountId,
+      reason: 'Should never be written',
+    });
+
+    expect(response.body.errors).toBeDefined();
+    expect(await findAuthFailure(connectedAccountId)).toEqual({
+      authFailedAt: null,
+      authFailedReason: null,
+    });
+  });
+
+  it("refuses another user's user-visibility connection", async () => {
+    const connectedAccountId = uuidv4();
+
+    await insertAppConnection({
+      id: connectedAccountId,
+      applicationId: owningApplicationDbId,
+      connectionProviderId: owningProviderDbId,
+      visibility: 'user',
+      userWorkspaceId: uuidv4(),
+    });
+
+    const response = await reportAuthFailure({
+      id: connectedAccountId,
+      reason: 'Should never be written',
+    });
+
+    expect(response.body.errors).toBeDefined();
+    expect(await findAuthFailure(connectedAccountId)).toEqual({
+      authFailedAt: null,
+      authFailedReason: null,
+    });
+  });
+
+  it('rejects a reason longer than 1000 characters without touching the row', async () => {
+    const connectedAccountId = uuidv4();
+
+    await insertAppConnection({
+      id: connectedAccountId,
+      applicationId: owningApplicationDbId,
+      connectionProviderId: owningProviderDbId,
+      visibility: 'workspace',
+      userWorkspaceId: adminUserWorkspaceId,
+    });
+
+    const response = await reportAuthFailure({
+      id: connectedAccountId,
+      reason: 'a'.repeat(1001),
+    });
+
+    expect(response.body.errors).toBeDefined();
+    expect(await findAuthFailure(connectedAccountId)).toEqual({
+      authFailedAt: null,
+      authFailedReason: null,
+    });
+  });
+
+  it('refuses an unknown connection id', async () => {
+    const response = await reportAuthFailure({ id: uuidv4() });
+
+    expect(response.body.errors).toBeDefined();
+  });
+});

packages/twenty-server/test/integration/metadata/suites/connection-provider/utils/find-connection-providers-by-application.util.ts

@@ -0,0 +1,30 @@
+import { type StoredOAuthConnectionProviderConfig } from 'twenty-shared/application';
+
+type ConnectionProviderRow = {
+  id: string;
+  universalIdentifier: string;
+  applicationId: string;
+  workspaceId: string;
+  name: string;
+  displayName: string;
+  type: string;
+  oauthConfig: StoredOAuthConnectionProviderConfig | null;
+  onConnectLogicFunctionUniversalIdentifier: string | null;
+  onDisconnectLogicFunctionUniversalIdentifier: string | null;
+};
+
+export const findConnectionProvidersByApplication = async (
+  applicationUniversalIdentifier: string,
+): Promise<ConnectionProviderRow[]> => {
+  return globalThis.testDataSource.query(
+    `SELECT cp.id, cp."universalIdentifier", cp."applicationId",
+            cp."workspaceId", cp.name, cp."displayName", cp.type,
+            cp."oauthConfig", cp."onConnectLogicFunctionUniversalIdentifier",
+            cp."onDisconnectLogicFunctionUniversalIdentifier"
+       FROM core."connectionProvider" cp
+       JOIN core."application" app ON app.id = cp."applicationId"
+      WHERE app."universalIdentifier" = $1
+   ORDER BY cp.name`,
+    [applicationUniversalIdentifier],
+  );
+};