@inneranimalmedia/agentsam-sdk 2.6.3 → 2.6.5

package/packages/connectors/cloudflare/src/routes.js

@@ -7,10 +7,17 @@ import {
   resolveCloudflareOAuthClient,
   requestedCloudflareScopes,
   assertConnectionOwner,
+  upsertCloudflareUserOauthToken,
+  revokeCloudflareUserOauthTokens,
+  loadCloudflareConnectionRecord,
+  loadCloudflareFromUserOauthTokens,
 } from './index.js';
 import { resolveAuthenticatedOwner } from './owner.js';
 import { decryptSecret, sealToken, vaultConfigured } from './vault.js';
 
+const OAUTH_STATE_PROVIDER = 'cloudflare';
+const OAUTH_STATE_TTL_SECONDS = 600;
+
 function json(data, status = 200) {
   return new Response(JSON.stringify(data), {
     status,
@@ -41,16 +48,95 @@ function resolveReturnTo(url) {
   }
 }
 
+function bytesToHex(bytes) {
+  return [...bytes].map((b) => b.toString(16).padStart(2, '0')).join('');
+}
+
+async function hashOAuthState(state) {
+  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(String(state || '')));
+  return bytesToHex(new Uint8Array(digest));
+}
+
+function oauthStateAad(ownerId) {
+  return `oauth_state_nonces:${OAUTH_STATE_PROVIDER}:${ownerId}`;
+}
+
 async function deleteOAuthState(env, state) {
   if (env.DB) {
+    const stateHash = await hashOAuthState(state);
     await env.DB.prepare(
-      `DELETE FROM agentsam_cloudflare_oauth_state WHERE state = ?`,
-    ).bind(state).run();
+      `DELETE FROM oauth_state_nonces WHERE state_hash = ? AND provider = ?`,
+    ).bind(stateHash, OAUTH_STATE_PROVIDER).run();
   } else if (env.oauthState instanceof Map) {
     env.oauthState.delete(state);
   }
 }
 
+async function saveOAuthState(env, { state, ownerId, verifier, returnTo }) {
+  // In-memory fixture path (tests / local without vault).
+  if (env.oauthState instanceof Map && (!env.DB || !vaultConfigured(env))) {
+    env.oauthState.set(state, { ownerId, verifier, returnTo, createdAt: Math.floor(Date.now() / 1000) });
+    return { ok: true };
+  }
+  if (!env.DB) return { ok: false, error: 'db_unavailable' };
+  if (!vaultConfigured(env)) return { ok: false, error: 'vault_unavailable' };
+  const stateHash = await hashOAuthState(state);
+  const now = Math.floor(Date.now() / 1000);
+  const expiresAt = now + OAUTH_STATE_TTL_SECONDS;
+  const encrypted = await sealToken(env, verifier, oauthStateAad(ownerId));
+  const id = `osn_${crypto.randomUUID().replace(/-/g, '').slice(0, 20)}`;
+  await env.DB.prepare(
+    `DELETE FROM oauth_state_nonces
+     WHERE provider = ? AND (expires_at < ? OR consumed_at IS NOT NULL)`,
+  ).bind(OAUTH_STATE_PROVIDER, now).run();
+  await env.DB.prepare(
+    `INSERT INTO oauth_state_nonces (
+       id, tenant_id, user_id, provider, state_hash, code_verifier_encrypted,
+       redirect_after, metadata_json, expires_at, consumed_at, created_at
+     ) VALUES (?, NULL, ?, ?, ?, ?, ?, '{}', ?, NULL, ?)`,
+  ).bind(id, ownerId, OAUTH_STATE_PROVIDER, stateHash, encrypted, returnTo || null, expiresAt, now).run();
+  return { ok: true };
+}
+
+async function consumeOAuthState(env, state) {
+  if (env.oauthState instanceof Map && (!env.DB || env.oauthState.has(state))) {
+    const stored = env.oauthState.get(state);
+    if (!stored) {
+      // Fall through to D1 when Map miss and DB present.
+    } else {
+      env.oauthState.delete(state);
+      return {
+        owner_id: stored.ownerId,
+        code_verifier: stored.verifier,
+        return_to: stored.returnTo || '',
+        created_at: stored.createdAt || 0,
+      };
+    }
+  }
+  if (!env.DB) return null;
+  const stateHash = await hashOAuthState(state);
+  const row = await env.DB.prepare(
+    `SELECT id, user_id, code_verifier_encrypted, redirect_after, expires_at, created_at, consumed_at
+     FROM oauth_state_nonces
+     WHERE state_hash = ? AND provider = ?
+     LIMIT 1`,
+  ).bind(stateHash, OAUTH_STATE_PROVIDER).first();
+  if (!row || row.consumed_at) return null;
+  const now = Math.floor(Date.now() / 1000);
+  await env.DB.prepare(
+    `UPDATE oauth_state_nonces SET consumed_at = ? WHERE id = ?`,
+  ).bind(now, row.id).run();
+  if (Number(row.expires_at) <= now) return null;
+  if (!vaultConfigured(env) || !row.code_verifier_encrypted) return null;
+  const verifier = await decryptSecret(env, row.code_verifier_encrypted, oauthStateAad(row.user_id));
+  return {
+    owner_id: row.user_id,
+    code_verifier: verifier,
+    return_to: row.redirect_after || '',
+    created_at: row.created_at,
+  };
+}
+
 export function isCloudflareConnectionPath(pathname) {
   return pathname === '/api/connections/cloudflare'
     || pathname === '/api/connections/cloudflare/start'
@@ -60,24 +146,19 @@ export function isCloudflareConnectionPath(pathname) {
 
 async function ensureTables(env) {
   if (!env?.DB?.prepare) return;
-  await env.DB.prepare(`CREATE TABLE IF NOT EXISTS agentsam_cloudflare_connections (
-    connection_id TEXT PRIMARY KEY,
-    owner_id TEXT NOT NULL,
-    cloudflare_account_id TEXT,
-    scopes TEXT,
-    status TEXT,
-    access_token_encrypted TEXT,
-    refresh_token_encrypted TEXT,
-    created_at INTEGER,
-    updated_at INTEGER,
-    expires_at INTEGER
-  )`).run();
-  await env.DB.prepare(`CREATE TABLE IF NOT EXISTS agentsam_cloudflare_oauth_state (
-    state TEXT PRIMARY KEY,
-    owner_id TEXT NOT NULL,
-    code_verifier TEXT NOT NULL,
-    created_at INTEGER,
-    return_to TEXT
+  // PKCE state + resource inventory only. Connection credentials live in user_oauth_tokens (SSOT).
+  await env.DB.prepare(`CREATE TABLE IF NOT EXISTS oauth_state_nonces (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT,
+    user_id TEXT,
+    provider TEXT NOT NULL,
+    state_hash TEXT NOT NULL,
+    code_verifier_encrypted TEXT,
+    redirect_after TEXT,
+    metadata_json TEXT DEFAULT '{}',
+    expires_at INTEGER NOT NULL,
+    consumed_at INTEGER,
+    created_at INTEGER DEFAULT (unixepoch())
   )`).run();
   await env.DB.prepare(`CREATE TABLE IF NOT EXISTS integration_resources (
     id TEXT PRIMARY KEY,
@@ -93,23 +174,83 @@ async function ensureTables(env) {
     created_at TEXT NOT NULL DEFAULT (datetime('now')),
     updated_at TEXT NOT NULL DEFAULT (datetime('now'))
   )`).run();
+  // Best-effort one-shot: copy legacy agentsam_cloudflare_connections → user_oauth_tokens.
+  await migrateLegacyCloudflareConnections(env);
 }
 
+let legacyMigrateAttempted = false;
+
+/**
+ * One-shot migrate of connected legacy rows into user_oauth_tokens, then supersede legacy.
+ * Safe no-op when the legacy table is absent or vault cannot decrypt.
+ */
+async function migrateLegacyCloudflareConnections(env) {
+  if (legacyMigrateAttempted || !env?.DB?.prepare) return;
+  legacyMigrateAttempted = true;
+  if (!vaultConfigured(env)) return;
+  let results = [];
+  try {
+    const out = await env.DB.prepare(`
+      SELECT connection_id, owner_id, cloudflare_account_id, scopes,
+             access_token_encrypted, refresh_token_encrypted, expires_at
+      FROM agentsam_cloudflare_connections
+      WHERE status = 'connected' AND access_token_encrypted IS NOT NULL
+    `).all();
+    results = out?.results || [];
+  } catch {
+    return;
+  }
+  for (const row of results) {
+    const ownerId = String(row.owner_id || '').trim();
+    if (!ownerId) continue;
+    try {
+      const existing = await loadCloudflareConnectionRecord(env, ownerId);
+      if (existing) {
+        await env.DB.prepare(`
+          UPDATE agentsam_cloudflare_connections
+          SET status = 'superseded', access_token_encrypted = NULL,
+              refresh_token_encrypted = NULL, updated_at = unixepoch()
+          WHERE connection_id = ?
+        `).bind(row.connection_id).run();
+        continue;
+      }
+      const aad = `cloudflare-connection:${ownerId}`;
+      const accessToken = await decryptSecret(env, row.access_token_encrypted, aad);
+      const refreshToken = row.refresh_token_encrypted
+        ? await decryptSecret(env, row.refresh_token_encrypted, aad)
+        : null;
+      const spine = await upsertCloudflareUserOauthToken(env, {
+        userId: ownerId,
+        accessToken,
+        refreshToken,
+        scopes: row.scopes || '',
+        accountId: row.cloudflare_account_id || null,
+        expiresAt: row.expires_at ? Number(row.expires_at) : null,
+      });
+      if (spine?.ok) {
+        await env.DB.prepare(`
+          UPDATE agentsam_cloudflare_connections
+          SET status = 'superseded', access_token_encrypted = NULL,
+              refresh_token_encrypted = NULL, updated_at = unixepoch()
+          WHERE connection_id = ?
+        `).bind(row.connection_id).run();
+      }
+    } catch (err) {
+      console.error('cloudflare_legacy_migrate_failed', String(err?.message || err));
+    }
+  }
+}
+
+/**
+ * Optional host-declared resources only — never bake product account IDs here.
+ * Shape: env.AGENTSAM_RESOURCE_SCOPE_JSON = { "resources": [ { key, type, id, name, metadata? } ] }
+ */
 async function seedKnownCloudflareResources(env, ownerId, connectionId, cloudflareAccountId) {
   if (!env?.DB?.prepare || !cloudflareAccountId) return;
-  let configuredScopes = {};
-  try { configuredScopes = JSON.parse(env.AGENTSAM_RESOURCE_SCOPE_JSON || '{}'); } catch { configuredScopes = {}; }
-  const resources = [
-    { key: 'agentsam-sdk', type: 'worker', id: 'agentsam-sdk', name: 'AgentSam SDK / Local Studio' },
-    { key: 'agentsam-cad-creator', type: 'worker', id: 'agentsam-cad-creator', name: 'AgentSam CAD Creator' },
-    { key: 'agentsam-client-cms-editor', type: 'worker', id: 'agentsam-client-cms-editor', name: 'AgentSam Client CMS Editor' },
-    { key: 'fuelnfreetime', type: 'worker', id: 'fuelnfreetime', name: 'Fuel & Free Time', metadata: {
-      zone_id: '816a5d2284103e4481987ceeb16c2ca9',
-      d1_database_id: '9fd6ff92-e407-4b51-8b01-3c93f3845bb2',
-      r2_bucket: 'fuelnfreetime',
-      ...(configuredScopes.fuelnfreetime || {}),
-    } },
-  ];
+  let configured = {};
+  try { configured = JSON.parse(env.AGENTSAM_RESOURCE_SCOPE_JSON || '{}'); } catch { configured = {}; }
+  const resources = Array.isArray(configured.resources) ? configured.resources : [];
+  if (!resources.length) return;
   const statements = resources.map((resource) => env.DB.prepare(`
     INSERT OR REPLACE INTO integration_resources (
       id, tenant_id, connection_id, provider, resource_type, provider_resource_id,
@@ -119,18 +260,34 @@ async function seedKnownCloudflareResources(env, ownerId, connectionId, cloudfla
     `ires_cf_${cloudflareAccountId}_${resource.key}`,
     ownerId,
     connectionId,
-    resource.type,
-    resource.id,
-    resource.name,
+    resource.type || 'worker',
+    resource.id || resource.key,
+    resource.name || resource.key,
     JSON.stringify({ cloudflare_account_id: cloudflareAccountId, ...(resource.metadata || {}) }),
   ));
   if (typeof env.DB.batch === 'function') await env.DB.batch(statements);
   else for (const statement of statements) await statement.run();
 }
 
-export async function handleCloudflareConnectionRequest(request, env) {
+/**
+ * @param {Request} request
+ * @param {object} env
+ * @param {{
+ *   defaultCapabilities?: string[],
+ *   app?: { id: string },
+ *   routeRegistry?: object,
+ *   loginPath?: string,
+ * }} [options]
+ *   Host app supplies default capability ids when the request omits ?capabilities=.
+ *   Host MUST supply app + routeRegistry for session owner resolution (APP contract).
+ *   The connector package itself has no product-specific default set.
+ */
+export async function handleCloudflareConnectionRequest(request, env, options = {}) {
   const url = new URL(request.url);
   const client = resolveCloudflareOAuthClient(env);
+  const hostDefaultCapabilities = Array.isArray(options.defaultCapabilities)
+    ? options.defaultCapabilities.filter(Boolean)
+    : [];
   if (request.method === 'OPTIONS') {
     return new Response(null, { status: 204 });
   }
@@ -141,12 +298,33 @@ export async function handleCloudflareConnectionRequest(request, env) {
   }
 
   const isCallback = url.pathname === CLOUDFLARE_CALLBACK_PATH && request.method === 'GET';
+  const isStart = url.pathname === '/api/connections/cloudflare/start' && request.method === 'GET';
   let ownerId = '';
   try {
-    ownerId = await resolveAuthenticatedOwner(request, env, url, body);
+    ownerId = await resolveAuthenticatedOwner(request, env, url, body, {
+      app: options.app,
+      routeRegistry: options.routeRegistry,
+    });
   } catch (err) {
     if (!isCallback || err.code === 'untrusted_owner_hint') {
       const code = err.code || 'unauthenticated';
+      // Browser GET /start without a session → Local Studio login, then return here.
+      if (isStart && (code === 'unauthenticated' || code === 'AUTH_APP_UNRESOLVED')) {
+        if (code === 'AUTH_APP_UNRESOLVED' && (!options.app?.id || !options.routeRegistry)) {
+          return json({
+            ok: false,
+            error: 'AUTH_APP_UNRESOLVED',
+            message: 'Host must pass app + routeRegistry into Cloudflare connection handler',
+          }, 500);
+        }
+        const loginPath = String(options.loginPath || '/auth/login').startsWith('/')
+          ? String(options.loginPath || '/auth/login')
+          : `/${options.loginPath}`;
+        const next = `${url.pathname}${url.search}`;
+        const login = new URL(loginPath, url.origin);
+        login.searchParams.set('next', next);
+        return redirect(login.toString());
+      }
       return json({ ok: false, error: code }, code === 'untrusted_owner_hint' ? 400 : 401);
     }
   }
@@ -171,27 +349,9 @@ export async function handleCloudflareConnectionRequest(request, env) {
   await ensureTables(env);
 
   if (url.pathname === '/api/connections/cloudflare' && request.method === 'GET') {
-    let connection = null;
-    if (env.DB) {
-      const row = await env.DB.prepare(
-        `SELECT connection_id, owner_id, cloudflare_account_id, scopes, status, created_at, updated_at, expires_at
-         FROM agentsam_cloudflare_connections
-         WHERE owner_id = ? AND status = 'connected'
-         ORDER BY updated_at DESC LIMIT 1`,
-      ).bind(ownerId).first();
-      if (row) {
-        connection = {
-          connectionId: row.connection_id,
-          ownerId: row.owner_id,
-          cloudflareAccountId: row.cloudflare_account_id,
-          scopes: row.scopes ? String(row.scopes).split(' ') : [],
-          status: row.status,
-          createdAt: row.created_at,
-          updatedAt: row.updated_at,
-          expiresAt: row.expires_at,
-        };
-      }
-    }
+    const connection = env.DB
+      ? await loadCloudflareConnectionRecord(env, ownerId)
+      : null;
     return json({ ok: true, ...cloudflareConnectionSafeStatus(env, connection, ownerId) });
   }
 
@@ -202,25 +362,58 @@ export async function handleCloudflareConnectionRequest(request, env) {
     const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
     const challenge = btoa(String.fromCharCode(...new Uint8Array(digest))).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
     const returnTo = resolveReturnTo(url);
-    if (env.DB) {
-      await env.DB.prepare(
-        `DELETE FROM agentsam_cloudflare_oauth_state WHERE created_at < unixepoch() - 600`,
-      ).run();
-      await env.DB.prepare(
-        `INSERT INTO agentsam_cloudflare_oauth_state (state, owner_id, code_verifier, created_at, return_to)
-         VALUES (?, ?, ?, unixepoch(), ?)`,
-      ).bind(state, ownerId, verifier, returnTo || null).run();
-    } else if (env.oauthState instanceof Map) {
-      env.oauthState.set(state, { ownerId, verifier, returnTo });
+    const saved = await saveOAuthState(env, { state, ownerId, verifier, returnTo });
+    if (!saved.ok) {
+      return json({
+        ok: false,
+        error: saved.error || 'oauth_state_unavailable',
+        message: saved.error === 'vault_unavailable'
+          ? 'VAULT_MASTER_KEY required to encrypt OAuth PKCE verifier'
+          : 'oauth state store unavailable',
+      }, 503);
     }
     const redirectUri = `${url.origin}${CLOUDFLARE_CALLBACK_PATH}`;
+    const capabilityParam = url.searchParams.get('capabilities') || url.searchParams.get('capability') || '';
+    const packsParam = url.searchParams.get('packs') || url.searchParams.get('pack') || '';
+    const requested = capabilityParam
+      .split(',')
+      .map((s) => s.trim())
+      .filter(Boolean);
+    const requestedPacks = packsParam
+      .split(',')
+      .map((s) => s.trim().toLowerCase())
+      .filter(Boolean);
+    // Explicit packs win alone. Host defaults only when neither packs nor capabilities were requested.
+    const capabilitySet = requested.length
+      ? requested
+      : (requestedPacks.length ? [] : hostDefaultCapabilities);
+    const scopes = requestedCloudflareScopes({
+      capabilities: capabilitySet,
+      packs: requestedPacks,
+    });
     const authorize = buildAuthorizeUrl({
       clientId: String(env.CLOUDFLARE_OAUTH_CLIENT_ID),
       redirectUri,
       state,
       codeChallenge: challenge,
+      scopes,
+    });
+    // Browser navigation → 302 to Cloudflare. XHR/fetch (Integrations UI) → JSON.
+    const accept = String(request.headers.get('accept') || '');
+    const mode = String(request.headers.get('sec-fetch-mode') || '');
+    const wantsJson = accept.includes('application/json')
+      || mode === 'cors'
+      || request.headers.get('x-agentsam-oauth') === 'json';
+    if (!wantsJson) {
+      return Response.redirect(authorize, 302);
+    }
+    return json({
+      ok: true,
+      authorize_url: authorize,
+      callback: CLOUDFLARE_CALLBACK_PATH,
+      capabilities: capabilitySet,
+      scopes,
     });
-    return json({ ok: true, authorize_url: authorize, callback: CLOUDFLARE_CALLBACK_PATH });
   }
 
   if (url.pathname === CLOUDFLARE_CALLBACK_PATH && request.method === 'GET') {
@@ -228,14 +421,11 @@ export async function handleCloudflareConnectionRequest(request, env) {
     const state = url.searchParams.get('state') || '';
     const providerError = url.searchParams.get('error') || '';
     let stored = null;
-    if (env.DB) {
-      stored = await env.DB.prepare(
-        `SELECT owner_id, code_verifier, created_at, return_to
-         FROM agentsam_cloudflare_oauth_state WHERE state = ?`,
-      ).bind(state).first();
-    } else if (env.oauthState instanceof Map) {
-      stored = env.oauthState.get(state);
-      if (stored) stored = { owner_id: stored.ownerId, code_verifier: stored.verifier, return_to: stored.returnTo || '' };
+    try {
+      stored = await consumeOAuthState(env, state);
+    } catch (err) {
+      console.error('cloudflare_oauth_state_consume_failed', String(err?.message || err));
+      return settingsRedirect(url, 'error', 'oauth_state_unavailable', '');
     }
     if (!stored) {
       // A callback without a one-time PKCE state is forged or expired. Keep
@@ -248,11 +438,9 @@ export async function handleCloudflareConnectionRequest(request, env) {
     }
     const createdAt = Number(stored.created_at || 0);
     const now = Math.floor(Date.now() / 1000);
-    if (createdAt && now - createdAt > 10 * 60) {
-      await deleteOAuthState(env, state);
+    if (createdAt && now - createdAt > OAUTH_STATE_TTL_SECONDS) {
       return settingsRedirect(url, 'error', 'oauth_state_expired', stored.return_to || '');
     }
-    await deleteOAuthState(env, state);
     if (providerError) {
       return settingsRedirect(url, 'error', providerError, stored.return_to || '');
     }
@@ -279,47 +467,43 @@ export async function handleCloudflareConnectionRequest(request, env) {
       return settingsRedirect(url, 'error', 'token_exchange_failed', stored.return_to || '');
     }
     const tokens = await tokenRes.json();
-    const connectionId = `cfconn_${crypto.randomUUID().replace(/-/g, '').slice(0, 16)}`;
-    if (tokens.access_token && !vaultConfigured(env)) {
-      return settingsRedirect(url, 'error', 'vault_unavailable', stored.return_to || '');
-    }
-    const aad = `cloudflare-connection:${ownerId}`;
-    let accessEnc = null;
-    let refreshEnc = null;
+    const grantedScopeStr = tokens.scope || requestedCloudflareScopes({ capabilities: hostDefaultCapabilities }).join(' ');
+    const capabilitySet = hostDefaultCapabilities.slice();
+
+    // SSOT: user_oauth_tokens only (scope union + client_id provenance + vault seal).
+    let spine = null;
     try {
-      accessEnc = await sealToken(env, tokens.access_token, aad);
-      refreshEnc = await sealToken(env, tokens.refresh_token, aad);
+      spine = await upsertCloudflareUserOauthToken(env, {
+        userId: ownerId,
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token || null,
+        scopes: grantedScopeStr,
+        accountId: tokens.account_id || null,
+        expiresAt: tokens.expires_in
+          ? Math.floor(Date.now() / 1000) + Number(tokens.expires_in)
+          : null,
+        clientId: String(env.CLOUDFLARE_OAUTH_CLIENT_ID || ''),
+        capabilitySet,
+      });
+      if (!spine?.ok) {
+        console.error('cloudflare_user_oauth_tokens_upsert_failed', spine?.error || 'unknown');
+        return settingsRedirect(url, 'error', spine?.error || 'connection_persist_failed', stored.return_to || '');
+      }
     } catch (err) {
-      return settingsRedirect(url, 'error', err.code || 'vault_unavailable', stored.return_to || '');
+      console.error('cloudflare_user_oauth_tokens_upsert_threw', String(err?.message || err));
+      return settingsRedirect(url, 'error', 'connection_persist_failed', stored.return_to || '');
     }
-    if (env.DB) {
-      const removePrevious = env.DB.prepare(
-        `UPDATE agentsam_cloudflare_connections
-         SET status = 'superseded', access_token_encrypted = NULL,
-             refresh_token_encrypted = NULL, updated_at = unixepoch()
-         WHERE owner_id = ? AND status = 'connected'`,
-      ).bind(ownerId);
-      const insertConnection = env.DB.prepare(
-        `INSERT INTO agentsam_cloudflare_connections (
-           connection_id, owner_id, cloudflare_account_id, scopes, status,
-           access_token_encrypted, refresh_token_encrypted, created_at, updated_at, expires_at
-         ) VALUES (?, ?, ?, ?, 'connected', ?, ?, unixepoch(), unixepoch(), ?)`,
-      ).bind(
-        connectionId,
+
+    const connectionId = spine.connectionId || spine.accountId || `uot_${ownerId}`;
+    try {
+      await seedKnownCloudflareResources(
+        env,
         ownerId,
-        tokens.account_id || null,
-        (tokens.scope || requestedCloudflareScopes().join(' ')),
-        accessEnc,
-        refreshEnc,
-        tokens.expires_in ? Math.floor(Date.now() / 1000) + Number(tokens.expires_in) : null,
+        connectionId,
+        spine.accountId || tokens.account_id || null,
       );
-      if (typeof env.DB.batch === 'function') {
-        await env.DB.batch([removePrevious, insertConnection]);
-      } else {
-        await removePrevious.run();
-        await insertConnection.run();
-      }
-      await seedKnownCloudflareResources(env, ownerId, connectionId, tokens.account_id || null);
+    } catch (err) {
+      console.error('cloudflare_resource_seed_failed', String(err?.message || err));
     }
     return settingsRedirect(url, 'connected', '', stored.return_to || '');
   }
@@ -327,35 +511,25 @@ export async function handleCloudflareConnectionRequest(request, env) {
   if (url.pathname === '/api/connections/cloudflare/disconnect' && request.method === 'POST') {
     let providerRevoked = false;
     if (env.DB) {
-      const row = await env.DB.prepare(
-        `SELECT connection_id, owner_id, access_token_encrypted
-         FROM agentsam_cloudflare_connections
-         WHERE owner_id = ? AND status = 'connected'
-         ORDER BY updated_at DESC LIMIT 1`,
-      ).bind(ownerId).first();
-      if (row) {
-        assertConnectionOwner({ ownerId: row.owner_id, connectionId: row.connection_id }, ownerId);
-        if (row.access_token_encrypted) {
-          try {
-            const token = await decryptSecret(env, row.access_token_encrypted, `cloudflare-connection:${ownerId}`);
-            const revokeParams = new URLSearchParams({ token, client_id: String(env.CLOUDFLARE_OAUTH_CLIENT_ID) });
-            const revokeResponse = await fetch(CLOUDFLARE_OAUTH_REVOKE_URL, {
-              method: 'POST',
-              headers: { 'content-type': 'application/x-www-form-urlencoded' },
-              body: revokeParams,
-            });
-            providerRevoked = revokeResponse.ok;
-          } catch (error) {
-            console.error('cloudflare_token_revoke_failed', String(error?.message || error));
-          }
+      const cred = await loadCloudflareFromUserOauthTokens(env, ownerId);
+      if (cred?.bearerToken) {
+        assertConnectionOwner({ ownerId, connectionId: cred.connectionId }, ownerId);
+        try {
+          const revokeParams = new URLSearchParams({
+            token: cred.bearerToken,
+            client_id: String(env.CLOUDFLARE_OAUTH_CLIENT_ID),
+          });
+          const revokeResponse = await fetch(CLOUDFLARE_OAUTH_REVOKE_URL, {
+            method: 'POST',
+            headers: { 'content-type': 'application/x-www-form-urlencoded' },
+            body: revokeParams,
+          });
+          providerRevoked = revokeResponse.ok;
+        } catch (error) {
+          console.error('cloudflare_token_revoke_failed', String(error?.message || error));
         }
-        await env.DB.prepare(`
-          UPDATE agentsam_cloudflare_connections
-          SET status = 'revoked', access_token_encrypted = NULL,
-              refresh_token_encrypted = NULL, expires_at = unixepoch(), updated_at = unixepoch()
-          WHERE connection_id = ? AND owner_id = ?
-        `).bind(row.connection_id, ownerId).run();
       }
+      await revokeCloudflareUserOauthTokens(env, ownerId);
     }
     return json({ ok: true, status: 'not_configured', provider_revoked: providerRevoked });
   }