fix(selectors): recheck post-resolution cancellation

Author: Bill Leoutsakos

apps/sim/lib/selectors/server/credentials.test.ts

@@ -226,4 +226,34 @@ describe('resolveSelectorOAuthAccessToken', () => {
 
     expect(mocks.resolveCredentialTokenBundle).not.toHaveBeenCalled()
   })
+
+  it('rechecks cancellation before consuming a fulfilled credential result', async () => {
+    mocks.resolveCredentialTokenBundle.mockResolvedValue({
+      accessToken: 'fulfilled-access-token',
+    })
+    const controller = new AbortController()
+    const protectedValues = createSelectorProtectedValues()
+    const recordCredentialUse = vi.fn()
+    const abortReason = new DOMException('Selector request canceled', 'AbortError')
+
+    const pending = resolveSelectorOAuthAccessToken({
+      credential: {
+        suppliedId: 'credential-1',
+        access: {
+          ok: true,
+          credentialOwnerUserId: 'owner-1',
+          resolvedCredentialId: 'credential-1',
+        },
+        signal: controller.signal,
+      },
+      serviceId: 'gmail',
+      protectedValues,
+      recordCredentialUse,
+    })
+    queueMicrotask(() => controller.abort(abortReason))
+
+    await expect(pending).rejects.toBe(abortReason)
+    expect(protectedValues.contains('fulfilled-access-token')).toBe(false)
+    expect(recordCredentialUse).not.toHaveBeenCalled()
+  })
 })

apps/sim/lib/selectors/server/credentials.ts

@@ -170,6 +170,7 @@ export async function resolveSelectorOAuthAccessToken(input: {
     ),
     input.credential.signal
   )
+  input.credential.signal?.throwIfAborted()
   const token = result?.accessToken
 
   if (!token) throw new SelectorConnectionUnavailableError()

apps/sim/lib/selectors/server/providers/credential-bundle.test.ts

@@ -70,4 +70,32 @@ describe('selector credential bundles', () => {
       { privacyMode: 'selector' }
     )
   })
+
+  it('rechecks cancellation before consuming a fulfilled credential bundle', async () => {
+    mockResolveCredentialAccessToken.mockResolvedValue({
+      accessToken: 'fulfilled-access-token',
+      cloudId: 'cloud-1',
+    })
+    const controller = new AbortController()
+    const protectedValues = createSelectorProtectedValues()
+    const recordCredentialUse = vi.fn()
+    const abortReason = new DOMException('Selector request canceled', 'AbortError')
+
+    const pending = resolveSelectorCredentialBundle({
+      credential: {
+        suppliedId: 'credential-1',
+        access: { ok: true, credentialOwnerUserId: 'owner-1' },
+        signal: controller.signal,
+      },
+      protectedValues,
+      providerId: 'atlassian',
+      recordCredentialUse,
+    })
+    queueMicrotask(() => controller.abort(abortReason))
+
+    await expect(pending).rejects.toBe(abortReason)
+    expect(protectedValues.contains('fulfilled-access-token')).toBe(false)
+    expect(protectedValues.contains('cloud-1')).toBe(false)
+    expect(recordCredentialUse).not.toHaveBeenCalled()
+  })
 })

apps/sim/lib/selectors/server/providers/credential-bundle.ts

@@ -48,6 +48,7 @@ export async function resolveSelectorCredentialBundle(input: {
       ),
       credential.signal
     )
+    credential.signal?.throwIfAborted()
   } catch (error) {
     if (credential.signal?.aborted) throw error
     throw new SelectorConnectionUnavailableError()