Function revokeMcpOauthTokens

apps/sim/lib/mcp/oauth/revoke.ts:19–75

(mcpServerId: string)

 * Never throws — revocation is advisory and must not block disconnect/delete flows.
 */
export async function revokeMcpOauthTokens(mcpServerId: string): Promise<void> {
  try {
    const row = await loadOauthRow({ mcpServerId })
    if (!row?.tokens) return

    const [server] = await db
      .select({
        url: mcpServers.url,
        oauthClientId: mcpServers.oauthClientId,
        oauthClientSecret: mcpServers.oauthClientSecret,
      })
      .from(mcpServers)
      .where(eq(mcpServers.id, mcpServerId))
      .limit(1)
    if (!server?.url) return

    const ssrfGuardedFetch = createSsrfGuardedMcpFetch()
    const info = await discoverOAuthServerInfo(server.url, { fetchFn: ssrfGuardedFetch }).catch(
      () => undefined
    )
    const metadata = info?.authorizationServerMetadata as
      | (Record<string, unknown> & { revocation_endpoint?: string })
      | undefined
    const revocationEndpoint = metadata?.revocation_endpoint
    if (!revocationEndpoint) return

    const clientInfo = row.clientInformation
    const clientId = clientInfo?.client_id ?? server.oauthClientId ?? undefined
    if (!clientId) return

    let clientSecret = clientInfo?.client_secret
    if (!clientSecret && server.oauthClientSecret) {
      try {
        const { decrypted } = await decryptSecret(server.oauthClientSecret)
        clientSecret = decrypted
      } catch {
        clientSecret = undefined
      }
    }

    const tokensToRevoke: Array<{ token: string; hint: 'refresh_token' | 'access_token' }> = []
    if (row.tokens.refresh_token) {
      tokensToRevoke.push({ token: row.tokens.refresh_token, hint: 'refresh_token' })
    }
    if (row.tokens.access_token) {
      tokensToRevoke.push({ token: row.tokens.access_token, hint: 'access_token' })
    }

    for (const { token, hint } of tokensToRevoke) {
      await postRevoke(revocationEndpoint, token, hint, clientId, clientSecret, ssrfGuardedFetch)
    }
  } catch (error) {
    logger.warn(`Token revocation failed for server ${mcpServerId}`, {
      error: toError(error).message,
    })
  }
}