fix(auth): detect nested grok oauth credentials

Author: skulidropek

packages/api/src/services/project-auth.ts

@@ -241,7 +241,7 @@ const grokUserSettingsCredentialMarkers: ReadonlyArray<RegExp> = [
   /"accessToken"\s*:\s*"[^"]+"/u,
   /"refreshToken"\s*:\s*"[^"]+"/u,
   /"authToken"\s*:\s*"[^"]+"/u,
-  /"oauth"\s*:\s*\{[^}]*"(?:apiKey|accessToken|access_token|authToken|refreshToken|refresh_token|token)"\s*:\s*"[^"]+"/su
+  /"oauth"\s*:\s*\{[\s\S]*?"(?:apiKey|accessToken|access_token|authToken|refreshToken|refresh_token|token)"\s*:\s*"[^"]+"/u
 ]
 
 const hasGrokUserSettingsCredentials = (

packages/app/src/lib/usecases/auth-grok-helpers.ts

@@ -178,7 +178,7 @@ const grokUserSettingsCredentialMarkers: ReadonlyArray<RegExp> = [
   /"accessToken"\s*:\s*"[^"]+"/u,
   /"refreshToken"\s*:\s*"[^"]+"/u,
   /"authToken"\s*:\s*"[^"]+"/u,
-  /"oauth"\s*:\s*\{[^}]*"(?:apiKey|accessToken|access_token|authToken|refreshToken|refresh_token|token)"\s*:\s*"[^"]+"/su
+  /"oauth"\s*:\s*\{[\s\S]*?"(?:apiKey|accessToken|access_token|authToken|refreshToken|refresh_token|token)"\s*:\s*"[^"]+"/u
 ]
 
 const hasGrokUserSettingsCredentials = (content: string): boolean =>

packages/lib/src/usecases/auth-grok-helpers.ts

@@ -177,7 +177,7 @@ const grokUserSettingsCredentialMarkers: ReadonlyArray<RegExp> = [
   /"accessToken"\s*:\s*"[^"]+"/u,
   /"refreshToken"\s*:\s*"[^"]+"/u,
   /"authToken"\s*:\s*"[^"]+"/u,
-  /"oauth"\s*:\s*\{[^}]*"(?:apiKey|accessToken|access_token|authToken|refreshToken|refresh_token|token)"\s*:\s*"[^"]+"/su
+  /"oauth"\s*:\s*\{[\s\S]*?"(?:apiKey|accessToken|access_token|authToken|refreshToken|refresh_token|token)"\s*:\s*"[^"]+"/u
 ]
 
 const hasGrokUserSettingsCredentials = (content: string): boolean =>

packages/lib/tests/usecases/auth-grok.test.ts

@@ -181,6 +181,25 @@ describe("authGrokLogin", () => {
       })
     ).pipe(Effect.provide(NodeContext.layer)))
 
+  it.effect("detects nested oauth user settings as Grok credentials", () =>
+    withTempDir((root) =>
+      Effect.gen(function*(_) {
+        const fs = yield* _(FileSystem.FileSystem)
+        const path = yield* _(Path.Path)
+        const accountPath = path.join(root, "default")
+
+        const detected = yield* _(
+          detectUserSettingsPayload(fs, path, accountPath, {
+            oauth: {
+              meta: {},
+              accessToken: "oauth-token"
+            }
+          })
+        )
+        expect(detected).toBe(true)
+      })
+    ).pipe(Effect.provide(NodeContext.layer)))
+
   it.effect("does not treat bootstrap user settings as Grok credentials", () =>
     withTempDir((root) =>
       Effect.gen(function*(_) {