Function createConnectDraft

apps/sim/app/api/auth/oauth2/authorize/route.ts:29–77

* Creates the pending credential draft at click time so its TTL starts when the * user actually initiates the connect. Better Auth's `account.create.after` hook * consumes this draft to materialize the real credential after the OAuth * callback; starting the clock here guarantees the draft outliv

(params: {
  userId: string
  workspaceId: string
  providerId: string
})

 * credential.
 */
async function createConnectDraft(params: {
  userId: string
  workspaceId: string
  providerId: string
}): Promise<void> {
  const { userId, workspaceId, providerId } = params

  const service = getAllOAuthServices().find((s) => s.providerId === providerId)
  const serviceName = service?.name ?? providerId

  let displayName = serviceName
  try {
    const [row] = await db.select({ name: user.name }).from(user).where(eq(user.id, userId))
    if (row?.name) {
      displayName = `${row.name}'s ${serviceName}`
    }
  } catch {
    // Fall back to service name only
  }

  const now = new Date()
  const expiresAt = new Date(now.getTime() + DRAFT_TTL_MS)
  await db
    .delete(pendingCredentialDraft)
    .where(
      and(eq(pendingCredentialDraft.userId, userId), lt(pendingCredentialDraft.expiresAt, now))
    )
  await db
    .insert(pendingCredentialDraft)
    .values({
      id: generateId(),
      userId,
      workspaceId,
      providerId,
      displayName,
      expiresAt,
      createdAt: now,
    })
    .onConflictDoUpdate({
      target: [
        pendingCredentialDraft.userId,
        pendingCredentialDraft.providerId,
        pendingCredentialDraft.workspaceId,
      ],
      set: { displayName, expiresAt, createdAt: now },
    })

  logger.info('Created OAuth connect credential draft', { userId, workspaceId, providerId })
}

/**
 * Browser-initiated entrypoint for linking a generic OAuth2 account.