[waleedlatif1]

Summary

• Gate new hosted Ads, Meet, and Chat OAuth grants behind a default-off deployment opt-in, including authorization callbacks and managed enrollment. Reject cross-service scope requests even when the opt-in is enabled.
• Support an isolated client for these connectors during authorization and refresh, while keeping normal Google sign-in and other integrations on the shared client. Changing the isolated client requires reconnecting affected credentials; configure the same client in the app and worker.

Type of Change

• Bug fix

Testing

25 integration checks exercise real authentication HTTP handlers with disposable PostgreSQL/Redis and loopback provider endpoints. Guard-removal checks demonstrate the intended regressions. Passed 129 focused tests, root script tests, all 20 workspace test tasks (37,889 app tests), 26 workspace type checks, 60 audits, lint, four generators, and the block registry check. These fixtures do not establish live Google acceptance.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 16, 2026 11:18pm UTC

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

1 issue found across 10 files

Confidence score: 2/5

• In google-verification.ts, the callback supplies no scopes, so the empty requestedScopes lets a tampered Ads, Meet, or Chat authorization request pass when the feature flag is enabled. Bind the requested scopes before this check.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/sim/lib/auth/connectors/google-verification.ts">

<violation number="1" location="apps/sim/lib/auth/connectors/google-verification.ts:36">
P1: The callback path passes no scopes into this helper, so `requestedScopes` is empty and this branch accepts a tampered Ads, Meet, or Chat authorization request when the feature flag is enabled. Bind the requested scopes to OAuth state and revalidate them during the callback before accepting the grant.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

P1: The callback path passes no scopes into this helper, so requestedScopes is empty and this branch accepts a tampered Ads, Meet, or Chat authorization request when the feature flag is enabled. Bind the requested scopes to OAuth state and revalidate them during the callback before accepting the grant.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At apps/sim/lib/auth/connectors/google-verification.ts, line 36:

<comment>The callback path passes no scopes into this helper, so `requestedScopes` is empty and this branch accepts a tampered Ads, Meet, or Chat authorization request when the feature flag is enabled. Bind the requested scopes to OAuth state and revalidate them during the callback before accepting the grant.</comment>

<file context>
@@ -0,0 +1,41 @@
+    if (requestedScopes.some((scope) => !allowedScopes.has(scope))) {
+      return 'This Google connection cannot request permissions for another service.'
+    }
+    if (await isFeatureEnabled('google-unverified-oauth')) return undefined
+  } else if (!requestedScopes.some((scope) => UNVERIFIED_SCOPES.has(scope))) {
+    return undefined
</file context>

[greptile-apps]

Confidence Score: 4/5

[Critical impact] Adds verification gates to Google OAuth integrations.

Fix the credential availability checks before merging so isolated-only Google clients work through the credential catalog.

Findings

1.  Isolated connections appear unavailable ▶

Summary

This PR gates new hosted Google Ads, Meet, and Chat grants and adds an optional isolated OAuth client.

• Hosted Ads, Meet, and Chat grants now need an opt-in and service-specific scopes.
• Ads, Meet, and Chat use a separate Google OAuth client for grants and refreshes.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[New Google grant] --> B{Hosted verification provider?}
  B -->|Yes| C[Check allowed scopes and deployment opt-in]
  B -->|No| D[Check requested restricted scopes]
  C --> E[Select isolated client when configured]
  E --> F[Authorization and token exchange]
  F --> G[Refresh with the same service-specific client]
  H[Credential catalog] --> I[Check shared Google client]
  I --> J[Isolated-only configuration appears unavailable]

Loading

_{Reviews (1) · Last reviewed commit: "fix(oauth): isolate verification-gated G..." · Reviewed by Greptile}

[greptile-apps]

Isolated connections appear unavailable

If a deployment configures only GOOGLE_VERIFICATION_CLIENT_ID and GOOGLE_VERIFICATION_CLIENT_SECRET, this helper accepts Ads, Meet, and Chat for authorization. But the credential catalog still checks the shared GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET through availability.server.ts and resolveIntegrationAvailability. It marks these services unavailable and hides their ordinary OAuth credentials from discovery.

Update those availability checks to use the same service-specific client selection.