@app-connect/core 1.7.26 → 1.7.27

package/handlers/auth.js

@@ -7,6 +7,7 @@ const adminCore = require('./admin');
 const { Connector } = require('../models/dynamo/connectorSchema');
 const { handleDatabaseError } = require('../lib/errorHandler');
 const managedAuthCore = require('./managedAuth');
+const managedOAuthCore = require('./managedOAuth');
 const { getHashValue } = require('../lib/util');
 
 async function onOAuthCallback({ platform, hostname, tokenUrl, query, hashedRcExtensionId, isFromMCP = false }) {
@@ -20,7 +21,19 @@ async function onOAuthCallback({ platform, hostname, tokenUrl, query, hashedRcEx
     if (proxyId) {
         proxyConfig = await Connector.getProxyConfig(proxyId);
     }
-    const oauthInfo = await platformModule.getOauthInfo({ tokenUrl, hostname, rcAccountId: query.rcAccountId, proxyId, proxyConfig, userEmail, isFromMCP });
+    let managedOAuthSource = null;
+    let oauthInfo = null;
+    if (query.rcAccountId) {
+        const managedOAuthResult = await managedOAuthCore.resolveManagedOAuthInfo({
+            rcAccountId: query.rcAccountId,
+            platform
+        });
+        managedOAuthSource = managedOAuthResult.source;
+        oauthInfo = managedOAuthResult.oauthInfo;
+    }
+    if (!oauthInfo) {
+        oauthInfo = await platformModule.getOauthInfo({ tokenUrl, hostname, rcAccountId: query.rcAccountId, proxyId, proxyConfig, userEmail, isFromMCP });
+    }
     if (oauthInfo.failMessage) {
         return {
             userInfo: null,
@@ -66,6 +79,12 @@ async function onOAuthCallback({ platform, hostname, tokenUrl, query, hashedRcEx
         if (platformModule.postSaveUserInfo) {
             userInfo = await platformModule.postSaveUserInfo({ userInfo, oauthApp });
         }
+        if (managedOAuthSource === 'pending') {
+            await managedOAuthCore.migratePendingManagedOAuth({
+                rcAccountId: query.rcAccountId,
+                platform
+            });
+        }
         return {
             userInfo,
             returnMessage
@@ -249,7 +268,12 @@ async function authValidation({ platform, userId }) {
     if (existingUser) {
         const platformModule = connectorRegistry.getConnector(platform);
         const proxyId = existingUser?.platformAdditionalInfo?.proxyId;
-        const oauthApp = oauth.getOAuthApp((await platformModule.getOauthInfo({ tokenUrl: existingUser?.platformAdditionalInfo?.tokenUrl, hostname: existingUser?.hostname, proxyId })));
+        const managedOAuthResult = await managedOAuthCore.resolveManagedOAuthInfo({
+            rcAccountId: existingUser.rcAccountId,
+            platform
+        });
+        const oauthInfo = managedOAuthResult.oauthInfo ?? await platformModule.getOauthInfo({ tokenUrl: existingUser?.platformAdditionalInfo?.tokenUrl, hostname: existingUser?.hostname, proxyId });
+        const oauthApp = oauth.getOAuthApp(oauthInfo);
         existingUser = await oauth.checkAndRefreshAccessToken(oauthApp, existingUser);
         const { successful, returnMessage, status } = await platformModule.authValidation({ user: existingUser });
         return {

package/handlers/log.js

@@ -184,7 +184,7 @@ async function createCallLog({ platform, userId, incomingData, hashedAccountId,
                             }
                         }
                     )
-                    const syncedPluginJwtToken = syncPluginTokenResponse?.data?.jwtToken ?? pluginJwtToken;
+                    const syncedPluginJwtToken = pluginCore.getRefreshedJwtTokenFromHeaders({ headers: syncPluginTokenResponse.headers });
                     axios.post(pluginEndpointUrl, {
                         data: incomingData,
                         config: userConfig,
@@ -304,6 +304,12 @@ async function createCallLog({ platform, userId, incomingData, hashedAccountId,
                 pluginAsyncTaskIds
             };
         }
+        else {
+            return {
+                successful: false,
+                returnMessage
+            };
+        }
     } catch (e) {
         return handleApiError(e, platform, 'createCallLog', { userId });
     }

package/handlers/managedOAuth.js

@@ -0,0 +1,247 @@
+const { AccountDataModel } = require('../models/accountDataModel');
+const { CacheModel } = require('../models/cacheModel');
+const { encode, decoded } = require('../lib/encode');
+
+const MANAGED_OAUTH_ACCOUNT_DATA_KEY = 'managed-oauth-account';
+const MANAGED_OAUTH_CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+const MANAGED_OAUTH_FIELDS = [
+    'clientId',
+    'clientSecret',
+    'accessTokenUri',
+    'authorizationUri',
+    'redirectUri',
+    'scopes',
+    'hostname'
+];
+
+function getPendingManagedOAuthCacheId({ rcAccountId }) {
+    return `${rcAccountId}-${MANAGED_OAUTH_ACCOUNT_DATA_KEY}`;
+}
+
+function isFilled(value) {
+    return value !== undefined && value !== null && value !== '';
+}
+
+function encryptStoredValue(value) {
+    return {
+        version: 1,
+        encrypted: true,
+        value: encode(JSON.stringify(value))
+    };
+}
+
+function decryptStoredValue(value) {
+    if (!value) {
+        return undefined;
+    }
+    if (value?.encrypted && value?.value) {
+        return JSON.parse(decoded(value.value));
+    }
+    return value;
+}
+
+function normalizeManagedOAuthValues(values = {}) {
+    const normalized = {};
+    MANAGED_OAUTH_FIELDS.forEach(field => {
+        if (isFilled(values[field])) {
+            normalized[field] = values[field];
+        }
+    });
+    return normalized;
+}
+
+function buildStoredData(values = {}) {
+    const normalized = normalizeManagedOAuthValues(values);
+    const fields = {};
+    Object.keys(normalized).forEach(key => {
+        fields[key] = encryptStoredValue(normalized[key]);
+    });
+    return { fields };
+}
+
+function decryptStoredData(data = {}) {
+    const fields = data?.fields ?? {};
+    const values = {};
+    Object.keys(fields).forEach(key => {
+        values[key] = decryptStoredValue(fields[key]);
+    });
+    return values;
+}
+
+function removeSecret(values = {}) {
+    const sanitized = { ...values };
+    delete sanitized.clientSecret;
+    return sanitized;
+}
+
+async function getAccountManagedOAuthRecord({ rcAccountId, platform }) {
+    if (!rcAccountId || !platform) {
+        return null;
+    }
+    return AccountDataModel.findOne({
+        where: {
+            rcAccountId,
+            platformName: platform,
+            dataKey: MANAGED_OAUTH_ACCOUNT_DATA_KEY
+        }
+    });
+}
+
+async function getPendingManagedOAuthRecord({ rcAccountId }) {
+    if (!rcAccountId) {
+        return null;
+    }
+    const record = await CacheModel.findByPk(getPendingManagedOAuthCacheId({ rcAccountId }));
+    if (!record) {
+        return null;
+    }
+    if (record.expiry && new Date(record.expiry).getTime() <= Date.now()) {
+        await record.destroy();
+        return null;
+    }
+    return record;
+}
+
+async function getAccountManagedOAuthValues({ rcAccountId, platform }) {
+    const record = await getAccountManagedOAuthRecord({ rcAccountId, platform });
+    return decryptStoredData(record?.data);
+}
+
+async function getPendingManagedOAuthValues({ rcAccountId }) {
+    const record = await getPendingManagedOAuthRecord({ rcAccountId });
+    return decryptStoredData(record?.data);
+}
+
+async function getManagedOAuthState({ rcAccountId, platform, isAdmin }) {
+    const accountValues = await getAccountManagedOAuthValues({ rcAccountId, platform });
+    const hasAccountOAuth = Object.keys(accountValues).length > 0;
+    const pendingValues = isAdmin && !hasAccountOAuth
+        ? await getPendingManagedOAuthValues({ rcAccountId })
+        : {};
+    const hasPendingOAuth = Object.keys(pendingValues).length > 0;
+
+    return {
+        isAdmin: !!isAdmin,
+        hasAccountOAuth,
+        hasPendingOAuth,
+        ...(hasAccountOAuth ? { oauthValues: removeSecret(accountValues) } : {}),
+        ...(isAdmin && hasPendingOAuth ? { pendingValues } : {})
+    };
+}
+
+async function upsertPendingManagedOAuth({ rcAccountId, values = {} }) {
+    if (!rcAccountId) {
+        throw new Error('rcAccountId is required');
+    }
+    const id = getPendingManagedOAuthCacheId({ rcAccountId });
+    const data = buildStoredData(values);
+    const expiry = new Date(Date.now() + MANAGED_OAUTH_CACHE_TTL_MS);
+    const existing = await CacheModel.findByPk(id);
+    if (existing) {
+        await existing.update({
+            status: 'pending',
+            userId: rcAccountId,
+            cacheKey: MANAGED_OAUTH_ACCOUNT_DATA_KEY,
+            data,
+            expiry
+        });
+        return existing;
+    }
+    return CacheModel.create({
+        id,
+        status: 'pending',
+        userId: rcAccountId,
+        cacheKey: MANAGED_OAUTH_ACCOUNT_DATA_KEY,
+        data,
+        expiry
+    });
+}
+
+async function migratePendingManagedOAuth({ rcAccountId, platform }) {
+    const pending = await getPendingManagedOAuthRecord({ rcAccountId });
+    if (!pending) {
+        return false;
+    }
+    const existing = await getAccountManagedOAuthRecord({ rcAccountId, platform });
+    const data = pending.data ?? { fields: {} };
+    if (existing) {
+        await existing.update({ data });
+    }
+    else {
+        await AccountDataModel.create({
+            rcAccountId,
+            platformName: platform,
+            dataKey: MANAGED_OAUTH_ACCOUNT_DATA_KEY,
+            data
+        });
+    }
+    await pending.destroy();
+    return true;
+}
+
+async function resolveManagedOAuthInfo({ rcAccountId, platform }) {
+    const accountValues = await getAccountManagedOAuthValues({ rcAccountId, platform });
+    if (Object.keys(accountValues).length > 0) {
+        return {
+            source: 'account',
+            oauthInfo: accountValues
+        };
+    }
+    const pendingValues = await getPendingManagedOAuthValues({ rcAccountId });
+    if (Object.keys(pendingValues).length > 0) {
+        return {
+            source: 'pending',
+            oauthInfo: pendingValues
+        };
+    }
+    return {
+        source: null,
+        oauthInfo: null
+    };
+}
+
+async function clearPendingManagedOAuth({ rcAccountId }) {
+    if (!rcAccountId) {
+        return 0;
+    }
+    return CacheModel.destroy({
+        where: {
+            id: getPendingManagedOAuthCacheId({ rcAccountId })
+        }
+    });
+}
+
+async function clearAccountManagedOAuth({ rcAccountId, platform }) {
+    if (!rcAccountId || !platform) {
+        return 0;
+    }
+    return AccountDataModel.destroy({
+        where: {
+            rcAccountId,
+            platformName: platform,
+            dataKey: MANAGED_OAUTH_ACCOUNT_DATA_KEY
+        }
+    });
+}
+
+async function resetManagedOAuth({ rcAccountId, platform }) {
+    const deletedAccountCount = await clearAccountManagedOAuth({ rcAccountId, platform });
+    const deletedPendingCount = await clearPendingManagedOAuth({ rcAccountId });
+    return {
+        deletedAccountCount,
+        deletedPendingCount
+    };
+}
+
+exports.MANAGED_OAUTH_ACCOUNT_DATA_KEY = MANAGED_OAUTH_ACCOUNT_DATA_KEY;
+exports.MANAGED_OAUTH_FIELDS = MANAGED_OAUTH_FIELDS;
+exports.getManagedOAuthState = getManagedOAuthState;
+exports.upsertPendingManagedOAuth = upsertPendingManagedOAuth;
+exports.getPendingManagedOAuthValues = getPendingManagedOAuthValues;
+exports.getAccountManagedOAuthValues = getAccountManagedOAuthValues;
+exports.migratePendingManagedOAuth = migratePendingManagedOAuth;
+exports.resolveManagedOAuthInfo = resolveManagedOAuthInfo;
+exports.clearPendingManagedOAuth = clearPendingManagedOAuth;
+exports.clearAccountManagedOAuth = clearAccountManagedOAuth;
+exports.resetManagedOAuth = resetManagedOAuth;
+exports.removeSecret = removeSecret;

package/index.js

@@ -41,6 +41,7 @@ const {
     sqliteCallLogsPkIncludesExtension,
 } = require('./lib/migrateCallLogsSchema');
 const managedAuthCore = require('./handlers/managedAuth');
+const managedOAuthCore = require('./handlers/managedOAuth');
 
 let packageJson = null;
 try {
@@ -80,83 +81,6 @@ async function initDB() {
         await CacheModel.sync();
         await CallDownListModel.sync();
         await AccountDataModel.sync();
-
-        const queryInterface = CallLogModel.sequelize.getQueryInterface();
-        const sequelizeInstance = CallLogModel.sequelize;
-        const dialect = sequelizeInstance.getDialect();
-        const callLogsColumns = await queryInterface.describeTable('callLogs');
-        const hasExtensionNumber = Object.keys(callLogsColumns).some(
-            (col) => col.toLowerCase() === 'extensionnumber',
-        );
-        // Sequelize's SQLite addConstraint appends PRIMARY KEY instead of replacing it.
-        const needsSqliteCallLogsRebuild =
-            dialect === 'sqlite' &&
-            (!hasExtensionNumber || !(await sqliteCallLogsPkIncludesExtension(sequelizeInstance)));
-
-        if (needsSqliteCallLogsRebuild) {
-            const transaction = await sequelizeInstance.transaction();
-
-            try {
-                await migrateCallLogsExtensionNumberSqlite(sequelizeInstance, transaction);
-                await transaction.commit();
-            } catch (err) {
-                await transaction.rollback();
-                throw err;
-            }
-        } else if (!hasExtensionNumber) {
-            // sync() fills new Postgres DBs; legacy installs need alter + new PK constraint.
-            const transaction = await sequelizeInstance.transaction();
-
-            try {
-                await queryInterface.addColumn('callLogs', 'extensionNumber', {
-                    type: Sequelize.STRING,
-                    defaultValue: '',
-                    allowNull: false,
-                }, { transaction });
-
-                // Postgres already has a PK on (id, sessionId); addConstraint would try to add a second PK and fail.
-                if (dialect === 'postgres') {
-                    const relname = CallLogModel.tableName;
-                    const pkRows = await sequelizeInstance.query(
-                        `
-                        SELECT c.conname AS name
-                        FROM pg_constraint c
-                        INNER JOIN pg_class rel ON c.conrelid = rel.oid
-                        INNER JOIN pg_namespace nsp ON rel.relnamespace = nsp.oid
-                        WHERE c.contype = 'p'
-                          AND nsp.nspname = current_schema()
-                          AND rel.relname = :relname
-                        `,
-                        {
-                            replacements: { relname },
-                            transaction,
-                            type: Sequelize.QueryTypes.SELECT,
-                        },
-                    );
-                    const pkName = pkRows[0]?.name;
-                    if (pkName) {
-                        const qTable = queryInterface.queryGenerator.quoteTable(CallLogModel.tableName);
-                        const qName = queryInterface.queryGenerator.quoteIdentifier(pkName);
-                        await sequelizeInstance.query(
-                            `ALTER TABLE ${qTable} DROP CONSTRAINT ${qName}`,
-                            { transaction },
-                        );
-                    }
-                }
-
-                await queryInterface.addConstraint('callLogs', {
-                    fields: ['id', 'sessionId', 'extensionNumber'],
-                    type: 'primary key',
-                    name: 'callLogs_pkey',
-                    transaction,
-                });
-
-                await transaction.commit();
-            } catch (err) {
-                await transaction.rollback();
-                throw err;
-            }
-        }
     }
 }
 
@@ -518,6 +442,35 @@ function createCoreRouter() {
             res.status(400).send(tracer ? tracer.wrapResponse({ error: e.message || e }) : { error: e.message || e });
         }
     });
+    router.get('/oauthManagedAuthState', async function (req, res) {
+        const tracer = req.headers['is-debug'] === 'true' ? DebugTracer.fromRequest(req) : null;
+        tracer?.trace('oauthManagedAuthState:start', { query: req.query });
+        try {
+            const platform = req.query.platform;
+            const rcAccessToken = req.query.rcAccessToken;
+            if (!platform) {
+                res.status(400).send(tracer ? tracer.wrapResponse('Missing platform name') : 'Missing platform name');
+                return;
+            }
+            if (!rcAccessToken) {
+                res.status(400).send(tracer ? tracer.wrapResponse('Missing RingCentral access token') : 'Missing RingCentral access token');
+                return;
+            }
+            const { rcAccountId } = await adminCore.validateRcUserToken({ rcAccessToken });
+            const adminValidation = await adminCore.validateAdminRole({ rcAccessToken });
+            const state = await managedOAuthCore.getManagedOAuthState({
+                platform,
+                rcAccountId,
+                isAdmin: !!adminValidation.isValidated
+            });
+            res.status(200).send(tracer ? tracer.wrapResponse(state) : state);
+        }
+        catch (e) {
+            logger.error('Get managed OAuth state failed', { stack: e.stack });
+            tracer?.traceError('oauthManagedAuthState:error', e);
+            res.status(400).send(tracer ? tracer.wrapResponse({ error: e.message || e }) : { error: e.message || e });
+        }
+    });
     // Obsolete
     router.get('/serverVersionInfo', (req, res) => {
         const defaultCrmManifest = connectorRegistry.getManifest('default');
@@ -711,6 +664,75 @@ function createCoreRouter() {
             res.status(400).send(tracer ? tracer.wrapResponse({ error: e.message || e }) : { error: e.message || e });
         }
     });
+    router.post('/admin/managedOAuth/cache', async function (req, res) {
+        const tracer = req.headers['is-debug'] === 'true' ? DebugTracer.fromRequest(req) : null;
+        tracer?.trace('setAdminManagedOAuthCache:start', {
+            body: {
+                hasValues: !!req.body?.values,
+                valueKeys: Object.keys(req.body?.values ?? {}).filter(key => key !== 'clientSecret')
+            }
+        });
+        try {
+            const { isValidated, rcAccountId } = await adminCore.validateAdminRole({ rcAccessToken: req.query.rcAccessToken });
+            if (!isValidated) {
+                res.status(403).send(tracer ? tracer.wrapResponse('Admin validation failed') : 'Admin validation failed');
+                return;
+            }
+            await managedOAuthCore.upsertPendingManagedOAuth({
+                rcAccountId: rcAccountId?.toString(),
+                values: req.body?.values ?? {}
+            });
+            res.status(200).send(tracer ? tracer.wrapResponse({ successful: true }) : { successful: true });
+        }
+        catch (e) {
+            logger.error('Set managed OAuth pending cache failed', { stack: e.stack });
+            tracer?.traceError('setAdminManagedOAuthCache:error', e);
+            res.status(400).send(tracer ? tracer.wrapResponse({ error: e.message || e }) : { error: e.message || e });
+        }
+    });
+    router.delete('/admin/managedOAuth/cache', async function (req, res) {
+        const tracer = req.headers['is-debug'] === 'true' ? DebugTracer.fromRequest(req) : null;
+        tracer?.trace('deleteAdminManagedOAuthCache:start', {});
+        try {
+            const { isValidated, rcAccountId } = await adminCore.validateAdminRole({ rcAccessToken: req.query.rcAccessToken });
+            if (!isValidated) {
+                res.status(403).send(tracer ? tracer.wrapResponse('Admin validation failed') : 'Admin validation failed');
+                return;
+            }
+            await managedOAuthCore.clearPendingManagedOAuth({ rcAccountId: rcAccountId?.toString() });
+            res.status(200).send(tracer ? tracer.wrapResponse({ successful: true }) : { successful: true });
+        }
+        catch (e) {
+            logger.error('Delete managed OAuth pending cache failed', { stack: e.stack });
+            tracer?.traceError('deleteAdminManagedOAuthCache:error', e);
+            res.status(400).send(tracer ? tracer.wrapResponse({ error: e.message || e }) : { error: e.message || e });
+        }
+    });
+    router.delete('/admin/managedOAuth/account', async function (req, res) {
+        const tracer = req.headers['is-debug'] === 'true' ? DebugTracer.fromRequest(req) : null;
+        tracer?.trace('deleteAdminManagedOAuthAccount:start', { query: req.query });
+        try {
+            const { isValidated, rcAccountId } = await adminCore.validateAdminRole({ rcAccessToken: req.query.rcAccessToken });
+            if (!isValidated) {
+                res.status(403).send(tracer ? tracer.wrapResponse('Admin validation failed') : 'Admin validation failed');
+                return;
+            }
+            if (!req.query.platform) {
+                res.status(400).send(tracer ? tracer.wrapResponse('Missing platform name') : 'Missing platform name');
+                return;
+            }
+            await managedOAuthCore.resetManagedOAuth({
+                rcAccountId: rcAccountId?.toString(),
+                platform: req.query.platform
+            });
+            res.status(200).send(tracer ? tracer.wrapResponse({ successful: true }) : { successful: true });
+        }
+        catch (e) {
+            logger.error('Delete managed OAuth account failed', { stack: e.stack });
+            tracer?.traceError('deleteAdminManagedOAuthAccount:error', e);
+            res.status(400).send(tracer ? tracer.wrapResponse({ error: e.message || e }) : { error: e.message || e });
+        }
+    });
     router.post('/admin/userMapping', async function (req, res) {
         const requestStartTime = new Date().getTime();
         const tracer = req.headers['is-debug'] === 'true' ? DebugTracer.fromRequest(req) : null;

package/mcp/tools/logout.js

@@ -71,7 +71,10 @@ async function execute(args) {
         }
         const platformModule = connectorRegistry.getConnector(platform);
         try {
-            await platformModule.unAuthorize({ user: userToLogout });
+            const logoutResult = await platformModule.unAuthorize({ user: userToLogout });
+            if (!logoutResult.successful) {
+                throw new Error(logoutResult.returnMessage.message);
+            }
         }
         catch (error) {
             console.log(error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@app-connect/core",
-  "version": "1.7.26",
+  "version": "1.7.27",
   "description": "RingCentral App Connect Core",
   "main": "index.js",
   "repository": {

package/releaseNotes.json

@@ -1,4 +1,12 @@
 {
+    "1.7.27": {
+        "global": [
+            {
+                "type": "New",
+                "description": "Managed OAuth for platforms with dynamic OAuth configs for different accounts"
+            }
+        ]
+    },
     "1.7.26": {
         "global": [
             {

package/test/handlers/auth.test.js

@@ -23,6 +23,7 @@ const { Connector } = require('../../models/dynamo/connectorSchema');
 const { RingCentral } = require('../../lib/ringcentral');
 const adminCore = require('../../handlers/admin');
 const { AccountDataModel } = require('../../models/accountDataModel');
+const { CacheModel } = require('../../models/cacheModel');
 const { encode } = require('../../lib/encode');
 const { getHashValue } = require('../../lib/util');
 
@@ -664,6 +665,11 @@ describe('Auth Handler', () => {
       oauth.getOAuthApp.mockReturnValue(mockOAuthApp);
     });
 
+    afterEach(async () => {
+      await AccountDataModel.destroy({ where: {} });
+      await CacheModel.destroy({ where: {} });
+    });
+
     test('should handle successful OAuth callback', async () => {
       // Arrange
       const mockUserInfo = {
@@ -892,6 +898,74 @@ describe('Auth Handler', () => {
         overridingOption
       );
     });
+
+    test('should use pending managed OAuth info and promote it after successful callback', async () => {
+      await CacheModel.create({
+        id: 'rc-managed-managed-oauth-account',
+        status: 'pending',
+        userId: 'rc-managed',
+        cacheKey: 'managed-oauth-account',
+        expiry: new Date(Date.now() + 60000),
+        data: {
+          fields: {
+            clientId: { version: 1, encrypted: true, value: encode(JSON.stringify('managed-client-id')) },
+            clientSecret: { version: 1, encrypted: true, value: encode(JSON.stringify('managed-client-secret')) },
+            accessTokenUri: { version: 1, encrypted: true, value: encode(JSON.stringify('https://managed.example.com/token')) },
+            authorizationUri: { version: 1, encrypted: true, value: encode(JSON.stringify('https://managed.example.com/authorize')) },
+            redirectUri: { version: 1, encrypted: true, value: encode(JSON.stringify('https://ringcentral.github.io/ringcentral-embeddable/redirect.html')) },
+            hostname: { version: 1, encrypted: true, value: encode(JSON.stringify('managed.example.com')) }
+          }
+        }
+      });
+
+      const mockConnector = global.testUtils.createMockConnector({
+        getOauthInfo: jest.fn(),
+        getUserInfo: jest.fn().mockResolvedValue({
+          successful: true,
+          platformUserInfo: { id: 'managed-oauth-user', name: 'Managed OAuth User' },
+          returnMessage: { messageType: 'success', message: 'OK' }
+        })
+      });
+      connectorRegistry.getConnector.mockReturnValue(mockConnector);
+      mockOAuthApp.code.getToken.mockResolvedValue({
+        accessToken: 'token',
+        refreshToken: 'refresh',
+        expires: new Date()
+      });
+
+      const result = await authHandler.onOAuthCallback({
+        platform: 'testCRM',
+        hostname: 'old.example.com',
+        tokenUrl: '',
+        query: {
+          callbackUri: 'https://app.example.com/callback?code=code123',
+          rcAccountId: 'rc-managed'
+        }
+      });
+
+      expect(result.userInfo.id).toBe('managed-oauth-user');
+      expect(mockConnector.getOauthInfo).not.toHaveBeenCalled();
+      expect(oauth.getOAuthApp).toHaveBeenCalledWith(expect.objectContaining({
+        clientId: 'managed-client-id',
+        clientSecret: 'managed-client-secret',
+        accessTokenUri: 'https://managed.example.com/token',
+        authorizationUri: 'https://managed.example.com/authorize'
+      }));
+      expect(mockConnector.getUserInfo).toHaveBeenCalledWith(expect.objectContaining({
+        hostname: 'managed.example.com',
+        tokenUrl: 'https://managed.example.com/token'
+      }));
+      const promoted = await AccountDataModel.findOne({
+        where: {
+          rcAccountId: 'rc-managed',
+          platformName: 'testCRM',
+          dataKey: 'managed-oauth-account'
+        }
+      });
+      expect(promoted).not.toBeNull();
+      const pending = await CacheModel.findByPk('rc-managed-managed-oauth-account');
+      expect(pending).toBeNull();
+    });
   });
 
   describe('getLicenseStatus', () => {

package/test/routes/managedAuthRoutes.test.js

@@ -8,6 +8,12 @@ jest.mock('../../handlers/admin', () => ({
 jest.mock('../../handlers/managedAuth', () => ({
   getManagedAuthState: jest.fn(),
 }));
+jest.mock('../../handlers/managedOAuth', () => ({
+  getManagedOAuthState: jest.fn(),
+  upsertPendingManagedOAuth: jest.fn(),
+  clearPendingManagedOAuth: jest.fn(),
+  resetManagedOAuth: jest.fn(),
+}));
 jest.mock('../../handlers/auth', () => ({
   onApiKeyLogin: jest.fn(),
 }));
@@ -18,6 +24,7 @@ jest.mock('../../lib/jwt', () => ({
 
 const adminCore = require('../../handlers/admin');
 const managedAuthCore = require('../../handlers/managedAuth');
+const managedOAuthCore = require('../../handlers/managedOAuth');
 const authCore = require('../../handlers/auth');
 const { createCoreRouter } = require('../../index');
 
@@ -63,6 +70,130 @@ describe('Managed Auth Routes', () => {
     });
   });
 
+  describe('GET /oauthManagedAuthState', () => {
+    test('should validate rcAccessToken and return managed OAuth state for validated account', async () => {
+      adminCore.validateRcUserToken.mockResolvedValue({
+        rcAccountId: 'validated-account-id',
+        rcExtensionId: 'validated-extension-id',
+      });
+      adminCore.validateAdminRole.mockResolvedValue({
+        isValidated: true,
+        rcAccountId: 'validated-account-id',
+      });
+      managedOAuthCore.getManagedOAuthState.mockResolvedValue({
+        isAdmin: true,
+        hasAccountOAuth: false,
+        hasPendingOAuth: true,
+        pendingValues: {
+          clientId: 'client-id',
+          clientSecret: 'client-secret',
+        },
+      });
+
+      const response = await request(app)
+        .get('/oauthManagedAuthState')
+        .query({
+          platform: 'testCRM',
+          rcAccessToken: 'valid-rc-token',
+          rcAccountId: 'spoofed-account-id',
+        });
+
+      expect(response.status).toBe(200);
+      expect(adminCore.validateRcUserToken).toHaveBeenCalledWith({ rcAccessToken: 'valid-rc-token' });
+      expect(adminCore.validateAdminRole).toHaveBeenCalledWith({ rcAccessToken: 'valid-rc-token' });
+      expect(managedOAuthCore.getManagedOAuthState).toHaveBeenCalledWith({
+        platform: 'testCRM',
+        rcAccountId: 'validated-account-id',
+        isAdmin: true,
+      });
+      expect(response.body.pendingValues.clientSecret).toBe('client-secret');
+    });
+  });
+
+  describe('POST /admin/managedOAuth/cache', () => {
+    test('should require admin role and write pending managed OAuth values for validated account', async () => {
+      adminCore.validateAdminRole.mockResolvedValue({
+        isValidated: true,
+        rcAccountId: 'validated-account-id',
+      });
+      managedOAuthCore.upsertPendingManagedOAuth.mockResolvedValue({});
+
+      const values = {
+        clientId: 'client-id',
+        clientSecret: 'client-secret',
+      };
+
+      const response = await request(app)
+        .post('/admin/managedOAuth/cache')
+        .query({ rcAccessToken: 'valid-rc-token' })
+        .send({ values });
+
+      expect(response.status).toBe(200);
+      expect(managedOAuthCore.upsertPendingManagedOAuth).toHaveBeenCalledWith({
+        rcAccountId: 'validated-account-id',
+        values,
+      });
+    });
+
+    test('should reject non-admin users', async () => {
+      adminCore.validateAdminRole.mockResolvedValue({
+        isValidated: false,
+        rcAccountId: 'validated-account-id',
+      });
+
+      const response = await request(app)
+        .post('/admin/managedOAuth/cache')
+        .query({ rcAccessToken: 'valid-rc-token' })
+        .send({ values: { clientId: 'client-id' } });
+
+      expect(response.status).toBe(403);
+      expect(managedOAuthCore.upsertPendingManagedOAuth).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('DELETE /admin/managedOAuth/account', () => {
+    test('should require admin role and delete managed OAuth account for validated account', async () => {
+      adminCore.validateAdminRole.mockResolvedValue({
+        isValidated: true,
+        rcAccountId: 'validated-account-id',
+      });
+      managedOAuthCore.resetManagedOAuth.mockResolvedValue({
+        deletedAccountCount: 1,
+        deletedPendingCount: 1,
+      });
+
+      const response = await request(app)
+        .delete('/admin/managedOAuth/account')
+        .query({
+          rcAccessToken: 'valid-rc-token',
+          platform: 'testCRM',
+        });
+
+      expect(response.status).toBe(200);
+      expect(managedOAuthCore.resetManagedOAuth).toHaveBeenCalledWith({
+        rcAccountId: 'validated-account-id',
+        platform: 'testCRM',
+      });
+    });
+
+    test('should reject non-admin users', async () => {
+      adminCore.validateAdminRole.mockResolvedValue({
+        isValidated: false,
+        rcAccountId: 'validated-account-id',
+      });
+
+      const response = await request(app)
+        .delete('/admin/managedOAuth/account')
+        .query({
+          rcAccessToken: 'valid-rc-token',
+          platform: 'testCRM',
+        });
+
+      expect(response.status).toBe(403);
+      expect(managedOAuthCore.resetManagedOAuth).not.toHaveBeenCalled();
+    });
+  });
+
   describe('POST /apiKeyLogin', () => {
 
     test('should validate rcAccessToken and ignore spoofed rc ids in body', async () => {