fix(credentials): remove special scopes from additional scopes required hook, remove additionalScopes arg from tool definition (#1905)

2026-04-06 03:00:16 -04:00 · 2025-11-11 15:54:33 -08:00
parent 9b702c4793
commit b093550656
137 changed files with 52 additions and 226 deletions
--- a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel-new/components/editor/components/sub-block/components/tool-input/tool-input.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel-new/components/editor/components/sub-block/components/tool-input/tool-input.tsx
@@ -21,7 +21,11 @@ import {
 import { Switch } from '@/components/ui/switch'
 import { Toggle } from '@/components/ui/toggle'
 import { createLogger } from '@/lib/logs/console/logger'
-import type { OAuthProvider, OAuthService } from '@/lib/oauth/oauth'
+import {
+  getCanonicalScopesForProvider,
+  type OAuthProvider,
+  type OAuthService,
+} from '@/lib/oauth/oauth'
 import { cn } from '@/lib/utils'
 import {
  ChannelSelectorInput,
@@ -1713,7 +1717,7 @@ export function ToolInput({
                            value={tool.params.credential || ''}
                            onChange={(value) => handleParamChange(toolIndex, 'credential', value)}
                            provider={oauthConfig.provider as OAuthProvider}
-                            requiredScopes={oauthConfig.additionalScopes || []}
+                            requiredScopes={getCanonicalScopesForProvider(oauthConfig.provider)}
                            label={`Select ${oauthConfig.provider} account`}
                            serviceId={oauthConfig.provider}
                            disabled={disabled}
--- a/apps/sim/hooks/use-oauth-scope-status.ts
+++ b/apps/sim/hooks/use-oauth-scope-status.ts
@@ -44,19 +44,40 @@ export function getCredentialsNeedingReauth(credentials: Credential[]): Credenti
  return credentials.filter(credentialNeedsReauth)
 }

+/**
+ * Scopes that control token behavior but are not returned in OAuth token responses.
+ * These should be ignored when validating credential scopes.
+ */
+const IGNORED_SCOPES = new Set([
+  'offline_access', // Microsoft - requests refresh token
+  'refresh_token', // Salesforce - requests refresh token
+  'offline.access', // Airtable - requests refresh token (note: dot not underscore)
+])
+
 /**
 * Compute which of the provided requiredScopes are NOT granted by the credential.
+ * Note: Ignores special OAuth scopes that control token behavior (like offline_access)
+ * as they are not returned in the token response's scope list even when granted.
 */
 export function getMissingRequiredScopes(
  credential: Credential | undefined,
  requiredScopes: string[] = []
 ): string[] {
-  if (!credential) return [...requiredScopes]
+  if (!credential) {
+    // Filter out ignored scopes from required scopes as they're not returned by OAuth providers
+    return requiredScopes.filter((s) => !IGNORED_SCOPES.has(s))
+  }
+
  const granted = new Set((credential.scopes || []).map((s) => s))
  const missing: string[] = []
+
  for (const s of requiredScopes) {
+    // Skip ignored scopes as providers don't return them in the scope list even when granted
+    if (IGNORED_SCOPES.has(s)) continue
+
    if (!granted.has(s)) missing.push(s)
  }
+
  return missing
 }

--- a/apps/sim/tools/asana/add_comment.ts
+++ b/apps/sim/tools/asana/add_comment.ts
@@ -10,7 +10,6 @@ export const asanaAddCommentTool: ToolConfig<AsanaAddCommentParams, AsanaAddComm
  oauth: {
    required: true,
    provider: 'asana',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/asana/create_task.ts
+++ b/apps/sim/tools/asana/create_task.ts
@@ -10,7 +10,6 @@ export const asanaCreateTaskTool: ToolConfig<AsanaCreateTaskParams, AsanaCreateT
  oauth: {
    required: true,
    provider: 'asana',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/asana/get_projects.ts
+++ b/apps/sim/tools/asana/get_projects.ts
@@ -10,7 +10,6 @@ export const asanaGetProjectsTool: ToolConfig<AsanaGetProjectsParams, AsanaGetPr
  oauth: {
    required: true,
    provider: 'asana',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/asana/get_task.ts
+++ b/apps/sim/tools/asana/get_task.ts
@@ -10,7 +10,6 @@ export const asanaGetTaskTool: ToolConfig<AsanaGetTaskParams, AsanaGetTaskRespon
  oauth: {
    required: true,
    provider: 'asana',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/asana/search_tasks.ts
+++ b/apps/sim/tools/asana/search_tasks.ts
@@ -10,7 +10,6 @@ export const asanaSearchTasksTool: ToolConfig<AsanaSearchTasksParams, AsanaSearc
  oauth: {
    required: true,
    provider: 'asana',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/asana/update_task.ts
+++ b/apps/sim/tools/asana/update_task.ts
@@ -10,7 +10,6 @@ export const asanaUpdateTaskTool: ToolConfig<AsanaUpdateTaskParams, AsanaUpdateT
  oauth: {
    required: true,
    provider: 'asana',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/gmail/add_label.ts
+++ b/apps/sim/tools/gmail/add_label.ts
@@ -10,7 +10,6 @@ export const gmailAddLabelTool: ToolConfig<GmailLabelParams, GmailToolResponse>
  oauth: {
    required: true,
    provider: 'google-email',
-    additionalScopes: ['https://www.googleapis.com/auth/gmail.modify'],
  },

  params: {
--- a/apps/sim/tools/gmail/archive.ts
+++ b/apps/sim/tools/gmail/archive.ts
@@ -10,7 +10,6 @@ export const gmailArchiveTool: ToolConfig<GmailMarkReadParams, GmailToolResponse
  oauth: {
    required: true,
    provider: 'google-email',
-    additionalScopes: ['https://www.googleapis.com/auth/gmail.modify'],
  },

  params: {
--- a/apps/sim/tools/gmail/delete.ts
+++ b/apps/sim/tools/gmail/delete.ts
@@ -10,7 +10,6 @@ export const gmailDeleteTool: ToolConfig<GmailMarkReadParams, GmailToolResponse>
  oauth: {
    required: true,
    provider: 'google-email',
-    additionalScopes: ['https://www.googleapis.com/auth/gmail.modify'],
  },

  params: {
--- a/apps/sim/tools/gmail/draft.ts
+++ b/apps/sim/tools/gmail/draft.ts
@@ -10,7 +10,6 @@ export const gmailDraftTool: ToolConfig<GmailSendParams, GmailToolResponse> = {
  oauth: {
    required: true,
    provider: 'google-email',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/gmail/mark_read.ts
+++ b/apps/sim/tools/gmail/mark_read.ts
@@ -10,7 +10,6 @@ export const gmailMarkReadTool: ToolConfig<GmailMarkReadParams, GmailToolRespons
  oauth: {
    required: true,
    provider: 'google-email',
-    additionalScopes: ['https://www.googleapis.com/auth/gmail.modify'],
  },

  params: {
--- a/apps/sim/tools/gmail/mark_unread.ts
+++ b/apps/sim/tools/gmail/mark_unread.ts
@@ -10,7 +10,6 @@ export const gmailMarkUnreadTool: ToolConfig<GmailMarkReadParams, GmailToolRespo
  oauth: {
    required: true,
    provider: 'google-email',
-    additionalScopes: ['https://www.googleapis.com/auth/gmail.modify'],
  },

  params: {
--- a/apps/sim/tools/gmail/move.ts
+++ b/apps/sim/tools/gmail/move.ts
@@ -10,7 +10,6 @@ export const gmailMoveTool: ToolConfig<GmailMoveParams, GmailToolResponse> = {
  oauth: {
    required: true,
    provider: 'google-email',
-    additionalScopes: ['https://www.googleapis.com/auth/gmail.modify'],
  },

  params: {
--- a/apps/sim/tools/gmail/read.ts
+++ b/apps/sim/tools/gmail/read.ts
@@ -19,7 +19,6 @@ export const gmailReadTool: ToolConfig<GmailReadParams, GmailToolResponse> = {
  oauth: {
    required: true,
    provider: 'google-email',
-    additionalScopes: ['https://www.googleapis.com/auth/gmail.labels'],
  },

  params: {
--- a/apps/sim/tools/gmail/remove_label.ts
+++ b/apps/sim/tools/gmail/remove_label.ts
@@ -10,7 +10,6 @@ export const gmailRemoveLabelTool: ToolConfig<GmailLabelParams, GmailToolRespons
  oauth: {
    required: true,
    provider: 'google-email',
-    additionalScopes: ['https://www.googleapis.com/auth/gmail.modify'],
  },

  params: {
--- a/apps/sim/tools/gmail/search.ts
+++ b/apps/sim/tools/gmail/search.ts
@@ -18,7 +18,6 @@ export const gmailSearchTool: ToolConfig<GmailSearchParams, GmailToolResponse> =
  oauth: {
    required: true,
    provider: 'google-email',
-    additionalScopes: ['https://www.googleapis.com/auth/gmail.labels'],
  },

  params: {
--- a/apps/sim/tools/gmail/send.ts
+++ b/apps/sim/tools/gmail/send.ts
@@ -10,7 +10,6 @@ export const gmailSendTool: ToolConfig<GmailSendParams, GmailToolResponse> = {
  oauth: {
    required: true,
    provider: 'google-email',
-    additionalScopes: ['https://www.googleapis.com/auth/gmail.send'],
  },

  params: {
--- a/apps/sim/tools/gmail/unarchive.ts
+++ b/apps/sim/tools/gmail/unarchive.ts
@@ -10,7 +10,6 @@ export const gmailUnarchiveTool: ToolConfig<GmailMarkReadParams, GmailToolRespon
  oauth: {
    required: true,
    provider: 'google-email',
-    additionalScopes: ['https://www.googleapis.com/auth/gmail.modify'],
  },

  params: {
--- a/apps/sim/tools/google_calendar/create.ts
+++ b/apps/sim/tools/google_calendar/create.ts
@@ -16,7 +16,6 @@ export const createTool: ToolConfig<GoogleCalendarCreateParams, GoogleCalendarCr
  oauth: {
    required: true,
    provider: 'google-calendar',
-    additionalScopes: ['https://www.googleapis.com/auth/calendar'],
  },

  params: {
--- a/apps/sim/tools/google_calendar/get.ts
+++ b/apps/sim/tools/google_calendar/get.ts
@@ -15,7 +15,6 @@ export const getTool: ToolConfig<GoogleCalendarGetParams, GoogleCalendarGetRespo
  oauth: {
    required: true,
    provider: 'google-calendar',
-    additionalScopes: ['https://www.googleapis.com/auth/calendar'],
  },

  params: {
--- a/apps/sim/tools/google_calendar/invite.ts
+++ b/apps/sim/tools/google_calendar/invite.ts
@@ -14,7 +14,6 @@ export const inviteTool: ToolConfig<GoogleCalendarInviteParams, GoogleCalendarIn
  oauth: {
    required: true,
    provider: 'google-calendar',
-    additionalScopes: ['https://www.googleapis.com/auth/calendar'],
  },

  params: {
--- a/apps/sim/tools/google_calendar/list.ts
+++ b/apps/sim/tools/google_calendar/list.ts
@@ -16,7 +16,6 @@ export const listTool: ToolConfig<GoogleCalendarListParams, GoogleCalendarListRe
  oauth: {
    required: true,
    provider: 'google-calendar',
-    additionalScopes: ['https://www.googleapis.com/auth/calendar'],
  },

  params: {
--- a/apps/sim/tools/google_calendar/quick_add.ts
+++ b/apps/sim/tools/google_calendar/quick_add.ts
@@ -17,7 +17,6 @@ export const quickAddTool: ToolConfig<
  oauth: {
    required: true,
    provider: 'google-calendar',
-    additionalScopes: ['https://www.googleapis.com/auth/calendar'],
  },

  params: {
--- a/apps/sim/tools/google_calendar/update.ts
+++ b/apps/sim/tools/google_calendar/update.ts
@@ -14,7 +14,6 @@ export const updateTool: ToolConfig<GoogleCalendarUpdateParams, GoogleCalendarTo
  oauth: {
    required: true,
    provider: 'google-calendar',
-    additionalScopes: ['https://www.googleapis.com/auth/calendar'],
  },

  params: {
--- a/apps/sim/tools/google_docs/create.ts
+++ b/apps/sim/tools/google_docs/create.ts
@@ -13,10 +13,6 @@ export const createTool: ToolConfig<GoogleDocsToolParams, GoogleDocsCreateRespon
  oauth: {
    required: true,
    provider: 'google-docs',
-    additionalScopes: [
-      'https://www.googleapis.com/auth/drive.readonly',
-      'https://www.googleapis.com/auth/drive.file',
-    ],
  },

  params: {
--- a/apps/sim/tools/google_docs/read.ts
+++ b/apps/sim/tools/google_docs/read.ts
@@ -11,10 +11,6 @@ export const readTool: ToolConfig<GoogleDocsToolParams, GoogleDocsReadResponse>
  oauth: {
    required: true,
    provider: 'google-docs',
-    additionalScopes: [
-      'https://www.googleapis.com/auth/drive.readonly',
-      'https://www.googleapis.com/auth/drive.file',
-    ],
  },

  params: {
--- a/apps/sim/tools/google_docs/write.ts
+++ b/apps/sim/tools/google_docs/write.ts
@@ -9,10 +9,6 @@ export const writeTool: ToolConfig<GoogleDocsToolParams, GoogleDocsWriteResponse
  oauth: {
    required: true,
    provider: 'google-docs',
-    additionalScopes: [
-      'https://www.googleapis.com/auth/drive.readonly',
-      'https://www.googleapis.com/auth/drive.file',
-    ],
  },
  params: {
    accessToken: {
--- a/apps/sim/tools/google_drive/create_folder.ts
+++ b/apps/sim/tools/google_drive/create_folder.ts
@@ -10,10 +10,6 @@ export const createFolderTool: ToolConfig<GoogleDriveToolParams, GoogleDriveUplo
  oauth: {
    required: true,
    provider: 'google-drive',
-    additionalScopes: [
-      'https://www.googleapis.com/auth/drive.readonly',
-      'https://www.googleapis.com/auth/drive.file',
-    ],
  },

  params: {
--- a/apps/sim/tools/google_drive/download.ts
+++ b/apps/sim/tools/google_drive/download.ts
@@ -14,10 +14,6 @@ export const downloadTool: ToolConfig<GoogleDriveToolParams, GoogleDriveDownload
  oauth: {
    required: true,
    provider: 'google-drive',
-    additionalScopes: [
-      'https://www.googleapis.com/auth/drive.readonly',
-      'https://www.googleapis.com/auth/drive.file',
-    ],
  },

  params: {
--- a/apps/sim/tools/google_drive/get_content.ts
+++ b/apps/sim/tools/google_drive/get_content.ts
@@ -18,10 +18,6 @@ export const getContentTool: ToolConfig<GoogleDriveToolParams, GoogleDriveGetCon
  oauth: {
    required: true,
    provider: 'google-drive',
-    additionalScopes: [
-      'https://www.googleapis.com/auth/drive.readonly',
-      'https://www.googleapis.com/auth/drive.file',
-    ],
  },

  params: {
--- a/apps/sim/tools/google_drive/list.ts
+++ b/apps/sim/tools/google_drive/list.ts
@@ -10,10 +10,6 @@ export const listTool: ToolConfig<GoogleDriveToolParams, GoogleDriveListResponse
  oauth: {
    required: true,
    provider: 'google-drive',
-    additionalScopes: [
-      'https://www.googleapis.com/auth/drive.readonly',
-      'https://www.googleapis.com/auth/drive.file',
-    ],
  },

  params: {
--- a/apps/sim/tools/google_drive/upload.ts
+++ b/apps/sim/tools/google_drive/upload.ts
@@ -18,10 +18,6 @@ export const uploadTool: ToolConfig<GoogleDriveToolParams, GoogleDriveUploadResp
  oauth: {
    required: true,
    provider: 'google-drive',
-    additionalScopes: [
-      'https://www.googleapis.com/auth/drive.readonly',
-      'https://www.googleapis.com/auth/drive.file',
-    ],
  },

  params: {
--- a/apps/sim/tools/google_form/get_responses.ts
+++ b/apps/sim/tools/google_form/get_responses.ts
@@ -15,7 +15,6 @@ export const getResponsesTool: ToolConfig<GoogleFormsGetResponsesParams> = {
  oauth: {
    required: true,
    provider: 'google-forms',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/google_sheets/append.ts
+++ b/apps/sim/tools/google_sheets/append.ts
@@ -13,7 +13,6 @@ export const appendTool: ToolConfig<GoogleSheetsToolParams, GoogleSheetsAppendRe
  oauth: {
    required: true,
    provider: 'google-sheets',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/google_sheets/read.ts
+++ b/apps/sim/tools/google_sheets/read.ts
@@ -10,7 +10,6 @@ export const readTool: ToolConfig<GoogleSheetsToolParams, GoogleSheetsReadRespon
  oauth: {
    required: true,
    provider: 'google-sheets',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/google_sheets/update.ts
+++ b/apps/sim/tools/google_sheets/update.ts
@@ -13,7 +13,6 @@ export const updateTool: ToolConfig<GoogleSheetsToolParams, GoogleSheetsUpdateRe
  oauth: {
    required: true,
    provider: 'google-sheets',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/google_sheets/write.ts
+++ b/apps/sim/tools/google_sheets/write.ts
@@ -10,7 +10,6 @@ export const writeTool: ToolConfig<GoogleSheetsToolParams, GoogleSheetsWriteResp
  oauth: {
    required: true,
    provider: 'google-sheets',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/google_vault/create_matters.ts
+++ b/apps/sim/tools/google_vault/create_matters.ts
@@ -17,7 +17,6 @@ export const createMattersTool: ToolConfig<GoogleVaultCreateMattersParams> = {
  oauth: {
    required: true,
    provider: 'google-vault',
-    additionalScopes: ['https://www.googleapis.com/auth/ediscovery'],
  },

  params: {
--- a/apps/sim/tools/google_vault/create_matters_export.ts
+++ b/apps/sim/tools/google_vault/create_matters_export.ts
@@ -12,7 +12,6 @@ export const createMattersExportTool: ToolConfig<GoogleVaultCreateMattersExportP
  oauth: {
    required: true,
    provider: 'google-vault',
-    additionalScopes: ['https://www.googleapis.com/auth/ediscovery'],
  },

  params: {
--- a/apps/sim/tools/google_vault/create_matters_holds.ts
+++ b/apps/sim/tools/google_vault/create_matters_holds.ts
@@ -12,7 +12,6 @@ export const createMattersHoldsTool: ToolConfig<GoogleVaultCreateMattersHoldsPar
  oauth: {
    required: true,
    provider: 'google-vault',
-    additionalScopes: ['https://www.googleapis.com/auth/ediscovery'],
  },

  params: {
--- a/apps/sim/tools/google_vault/download_export_file.ts
+++ b/apps/sim/tools/google_vault/download_export_file.ts
@@ -20,11 +20,6 @@ export const downloadExportFileTool: ToolConfig<DownloadParams> = {
  oauth: {
    required: true,
    provider: 'google-vault',
-    additionalScopes: [
-      'https://www.googleapis.com/auth/ediscovery',
-      // Required to fetch the object bytes from the Cloud Storage bucket that Vault uses
-      'https://www.googleapis.com/auth/devstorage.read_only',
-    ],
  },

  params: {
--- a/apps/sim/tools/google_vault/list_matters.ts
+++ b/apps/sim/tools/google_vault/list_matters.ts
@@ -16,7 +16,6 @@ export const listMattersTool: ToolConfig<GoogleVaultListMattersParams> = {
  oauth: {
    required: true,
    provider: 'google-vault',
-    additionalScopes: ['https://www.googleapis.com/auth/ediscovery'],
  },

  params: {
--- a/apps/sim/tools/google_vault/list_matters_export.ts
+++ b/apps/sim/tools/google_vault/list_matters_export.ts
@@ -12,7 +12,6 @@ export const listMattersExportTool: ToolConfig<GoogleVaultListMattersExportParam
  oauth: {
    required: true,
    provider: 'google-vault',
-    additionalScopes: ['https://www.googleapis.com/auth/ediscovery'],
  },

  params: {
--- a/apps/sim/tools/google_vault/list_matters_holds.ts
+++ b/apps/sim/tools/google_vault/list_matters_holds.ts
@@ -10,7 +10,6 @@ export const listMattersHoldsTool: ToolConfig<GoogleVaultListMattersHoldsParams>
  oauth: {
    required: true,
    provider: 'google-vault',
-    additionalScopes: ['https://www.googleapis.com/auth/ediscovery'],
  },

  params: {
--- a/apps/sim/tools/jira/add_comment.ts
+++ b/apps/sim/tools/jira/add_comment.ts
@@ -11,7 +11,6 @@ export const jiraAddCommentTool: ToolConfig<JiraAddCommentParams, JiraAddComment
  oauth: {
    required: true,
    provider: 'jira',
-    additionalScopes: ['write:comment:jira', 'read:jira-work', 'read:jira-user'],
  },

  params: {
--- a/apps/sim/tools/jira/add_watcher.ts
+++ b/apps/sim/tools/jira/add_watcher.ts
@@ -27,7 +27,6 @@ export const jiraAddWatcherTool: ToolConfig<JiraAddWatcherParams, JiraAddWatcher
  oauth: {
    required: true,
    provider: 'jira',
-    additionalScopes: ['write:jira-work', 'read:jira-user'],
  },

  params: {
--- a/apps/sim/tools/jira/add_worklog.ts
+++ b/apps/sim/tools/jira/add_worklog.ts
@@ -11,7 +11,6 @@ export const jiraAddWorklogTool: ToolConfig<JiraAddWorklogParams, JiraAddWorklog
  oauth: {
    required: true,
    provider: 'jira',
-    additionalScopes: ['write:issue-worklog:jira', 'read:jira-work', 'read:jira-user'],
  },

  params: {
--- a/apps/sim/tools/jira/assign_issue.ts
+++ b/apps/sim/tools/jira/assign_issue.ts
@@ -27,7 +27,6 @@ export const jiraAssignIssueTool: ToolConfig<JiraAssignIssueParams, JiraAssignIs
  oauth: {
    required: true,
    provider: 'jira',
-    additionalScopes: ['write:jira-work', 'read:jira-user'],
  },

  params: {
--- a/apps/sim/tools/jira/bulk_read.ts
+++ b/apps/sim/tools/jira/bulk_read.ts
@@ -10,7 +10,6 @@ export const jiraBulkRetrieveTool: ToolConfig<JiraRetrieveBulkParams, JiraRetrie
  oauth: {
    required: true,
    provider: 'jira',
-    additionalScopes: ['read:jira-work', 'read:jira-user', 'read:me', 'offline_access'],
  },

  params: {
--- a/apps/sim/tools/jira/create_issue_link.ts
+++ b/apps/sim/tools/jira/create_issue_link.ts
@@ -34,7 +34,6 @@ export const jiraCreateIssueLinkTool: ToolConfig<
  oauth: {
    required: true,
    provider: 'jira',
-    additionalScopes: ['write:issue-link:jira', 'read:jira-work'],
  },

  params: {
--- a/apps/sim/tools/jira/delete_attachment.ts
+++ b/apps/sim/tools/jira/delete_attachment.ts
@@ -28,7 +28,6 @@ export const jiraDeleteAttachmentTool: ToolConfig<
  oauth: {
    required: true,
    provider: 'jira',
-    additionalScopes: ['delete:attachment:jira', 'read:jira-work'],
  },

  params: {
--- a/apps/sim/tools/jira/delete_comment.ts
+++ b/apps/sim/tools/jira/delete_comment.ts
@@ -28,7 +28,6 @@ export const jiraDeleteCommentTool: ToolConfig<JiraDeleteCommentParams, JiraDele
    oauth: {
      required: true,
      provider: 'jira',
-      additionalScopes: ['delete:comment:jira', 'read:jira-work'],
    },

    params: {
--- a/apps/sim/tools/jira/delete_issue.ts
+++ b/apps/sim/tools/jira/delete_issue.ts
@@ -26,7 +26,6 @@ export const jiraDeleteIssueTool: ToolConfig<JiraDeleteIssueParams, JiraDeleteIs
  oauth: {
    required: true,
    provider: 'jira',
-    additionalScopes: ['delete:issue:jira', 'read:jira-work'],
  },

  params: {
--- a/apps/sim/tools/jira/delete_issue_link.ts
+++ b/apps/sim/tools/jira/delete_issue_link.ts
@@ -28,7 +28,6 @@ export const jiraDeleteIssueLinkTool: ToolConfig<
  oauth: {
    required: true,
    provider: 'jira',
-    additionalScopes: ['delete:issue-link:jira', 'read:jira-work'],
  },

  params: {
--- a/apps/sim/tools/jira/delete_worklog.ts
+++ b/apps/sim/tools/jira/delete_worklog.ts
@@ -28,7 +28,6 @@ export const jiraDeleteWorklogTool: ToolConfig<JiraDeleteWorklogParams, JiraDele
    oauth: {
      required: true,
      provider: 'jira',
-      additionalScopes: ['delete:issue-worklog:jira', 'read:jira-work'],
    },

    params: {
--- a/apps/sim/tools/jira/get_attachments.ts
+++ b/apps/sim/tools/jira/get_attachments.ts
@@ -14,7 +14,6 @@ export const jiraGetAttachmentsTool: ToolConfig<
  oauth: {
    required: true,
    provider: 'jira',
-    additionalScopes: ['read:attachment:jira', 'read:jira-work', 'read:jira-user'],
  },

  params: {
--- a/apps/sim/tools/jira/get_comments.ts
+++ b/apps/sim/tools/jira/get_comments.ts
@@ -34,7 +34,6 @@ export const jiraGetCommentsTool: ToolConfig<JiraGetCommentsParams, JiraGetComme
  oauth: {
    required: true,
    provider: 'jira',
-    additionalScopes: ['read:comment:jira', 'read:jira-work', 'read:jira-user'],
  },

  params: {
--- a/apps/sim/tools/jira/get_worklogs.ts
+++ b/apps/sim/tools/jira/get_worklogs.ts
@@ -37,7 +37,6 @@ export const jiraGetWorklogsTool: ToolConfig<JiraGetWorklogsParams, JiraGetWorkl
  oauth: {
    required: true,
    provider: 'jira',
-    additionalScopes: ['read:issue-worklog:jira', 'read:jira-work', 'read:jira-user'],
  },

  params: {
--- a/apps/sim/tools/jira/remove_watcher.ts
+++ b/apps/sim/tools/jira/remove_watcher.ts
@@ -28,7 +28,6 @@ export const jiraRemoveWatcherTool: ToolConfig<JiraRemoveWatcherParams, JiraRemo
    oauth: {
      required: true,
      provider: 'jira',
-      additionalScopes: ['write:jira-work', 'read:jira-user'],
    },

    params: {
--- a/apps/sim/tools/jira/retrieve.ts
+++ b/apps/sim/tools/jira/retrieve.ts
@@ -14,7 +14,6 @@ export const jiraRetrieveTool: ToolConfig<JiraRetrieveParams, JiraRetrieveRespon
  oauth: {
    required: true,
    provider: 'jira',
-    additionalScopes: ['read:jira-work', 'read:jira-user', 'read:me', 'offline_access'],
  },

  params: {
--- a/apps/sim/tools/jira/search_issues.ts
+++ b/apps/sim/tools/jira/search_issues.ts
@@ -11,7 +11,6 @@ export const jiraSearchIssuesTool: ToolConfig<JiraSearchIssuesParams, JiraSearch
  oauth: {
    required: true,
    provider: 'jira',
-    additionalScopes: ['read:jira-work', 'read:jira-user'],
  },

  params: {
--- a/apps/sim/tools/jira/transition_issue.ts
+++ b/apps/sim/tools/jira/transition_issue.ts
@@ -14,7 +14,6 @@ export const jiraTransitionIssueTool: ToolConfig<
  oauth: {
    required: true,
    provider: 'jira',
-    additionalScopes: ['write:jira-work'],
  },

  params: {
--- a/apps/sim/tools/jira/update.ts
+++ b/apps/sim/tools/jira/update.ts
@@ -10,7 +10,6 @@ export const jiraUpdateTool: ToolConfig<JiraUpdateParams, JiraUpdateResponse> =
  oauth: {
    required: true,
    provider: 'jira',
-    additionalScopes: ['read:jira-user', 'write:jira-work', 'write:issue:jira', 'read:jira-work'],
  },

  params: {
--- a/apps/sim/tools/jira/update_comment.ts
+++ b/apps/sim/tools/jira/update_comment.ts
@@ -12,7 +12,6 @@ export const jiraUpdateCommentTool: ToolConfig<JiraUpdateCommentParams, JiraUpda
    oauth: {
      required: true,
      provider: 'jira',
-      additionalScopes: ['write:comment:jira', 'read:jira-work', 'read:jira-user'],
    },

    params: {
--- a/apps/sim/tools/jira/update_worklog.ts
+++ b/apps/sim/tools/jira/update_worklog.ts
@@ -12,7 +12,6 @@ export const jiraUpdateWorklogTool: ToolConfig<JiraUpdateWorklogParams, JiraUpda
    oauth: {
      required: true,
      provider: 'jira',
-      additionalScopes: ['write:issue-worklog:jira', 'read:jira-work', 'read:jira-user'],
    },

    params: {
--- a/apps/sim/tools/jira/write.ts
+++ b/apps/sim/tools/jira/write.ts
@@ -10,17 +10,6 @@ export const jiraWriteTool: ToolConfig<JiraWriteParams, JiraWriteResponse> = {
  oauth: {
    required: true,
    provider: 'jira',
-    additionalScopes: [
-      'read:jira-user',
-      'write:jira-work',
-      'read:project:jira',
-      'read:issue:jira',
-      'write:issue:jira',
-      'write:comment:jira',
-      'write:comment.property:jira',
-      'write:attachment:jira',
-      'read:attachment:jira',
-    ],
  },

  params: {
--- a/apps/sim/tools/microsoft_excel/read.ts
+++ b/apps/sim/tools/microsoft_excel/read.ts
@@ -18,7 +18,6 @@ export const readTool: ToolConfig<MicrosoftExcelToolParams, MicrosoftExcelReadRe
  oauth: {
    required: true,
    provider: 'microsoft-excel',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/microsoft_excel/table_add.ts
+++ b/apps/sim/tools/microsoft_excel/table_add.ts
@@ -17,7 +17,6 @@ export const tableAddTool: ToolConfig<
  oauth: {
    required: true,
    provider: 'microsoft-excel',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/microsoft_excel/write.ts
+++ b/apps/sim/tools/microsoft_excel/write.ts
@@ -14,7 +14,6 @@ export const writeTool: ToolConfig<MicrosoftExcelToolParams, MicrosoftExcelWrite
  oauth: {
    required: true,
    provider: 'microsoft-excel',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/microsoft_planner/create_bucket.ts
+++ b/apps/sim/tools/microsoft_planner/create_bucket.ts
@@ -19,7 +19,6 @@ export const createBucketTool: ToolConfig<
  oauth: {
    required: true,
    provider: 'microsoft-planner',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/microsoft_planner/create_task.ts
+++ b/apps/sim/tools/microsoft_planner/create_task.ts
@@ -20,7 +20,6 @@ export const createTaskTool: ToolConfig<
  oauth: {
    required: true,
    provider: 'microsoft-planner',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/microsoft_planner/delete_bucket.ts
+++ b/apps/sim/tools/microsoft_planner/delete_bucket.ts
@@ -19,7 +19,6 @@ export const deleteBucketTool: ToolConfig<
  oauth: {
    required: true,
    provider: 'microsoft-planner',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/microsoft_planner/delete_task.ts
+++ b/apps/sim/tools/microsoft_planner/delete_task.ts
@@ -19,7 +19,6 @@ export const deleteTaskTool: ToolConfig<
  oauth: {
    required: true,
    provider: 'microsoft-planner',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/microsoft_planner/get_task_details.ts
+++ b/apps/sim/tools/microsoft_planner/get_task_details.ts
@@ -19,7 +19,6 @@ export const getTaskDetailsTool: ToolConfig<
  oauth: {
    required: true,
    provider: 'microsoft-planner',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/microsoft_planner/list_buckets.ts
+++ b/apps/sim/tools/microsoft_planner/list_buckets.ts
@@ -19,7 +19,6 @@ export const listBucketsTool: ToolConfig<
  oauth: {
    required: true,
    provider: 'microsoft-planner',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/microsoft_planner/list_plans.ts
+++ b/apps/sim/tools/microsoft_planner/list_plans.ts
@@ -19,7 +19,6 @@ export const listPlansTool: ToolConfig<
  oauth: {
    required: true,
    provider: 'microsoft-planner',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/microsoft_planner/read_bucket.ts
+++ b/apps/sim/tools/microsoft_planner/read_bucket.ts
@@ -19,7 +19,6 @@ export const readBucketTool: ToolConfig<
  oauth: {
    required: true,
    provider: 'microsoft-planner',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/microsoft_planner/read_plan.ts
+++ b/apps/sim/tools/microsoft_planner/read_plan.ts
@@ -19,7 +19,6 @@ export const readPlanTool: ToolConfig<
  oauth: {
    required: true,
    provider: 'microsoft-planner',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/microsoft_planner/read_task.ts
+++ b/apps/sim/tools/microsoft_planner/read_task.ts
@@ -18,7 +18,6 @@ export const readTaskTool: ToolConfig<MicrosoftPlannerToolParams, MicrosoftPlann
  oauth: {
    required: true,
    provider: 'microsoft-planner',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/microsoft_planner/update_bucket.ts
+++ b/apps/sim/tools/microsoft_planner/update_bucket.ts
@@ -20,7 +20,6 @@ export const updateBucketTool: ToolConfig<
  oauth: {
    required: true,
    provider: 'microsoft-planner',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/microsoft_planner/update_task.ts
+++ b/apps/sim/tools/microsoft_planner/update_task.ts
@@ -21,7 +21,6 @@ export const updateTaskTool: ToolConfig<
  oauth: {
    required: true,
    provider: 'microsoft-planner',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/microsoft_planner/update_task_details.ts
+++ b/apps/sim/tools/microsoft_planner/update_task_details.ts
@@ -21,7 +21,6 @@ export const updateTaskDetailsTool: ToolConfig<
  oauth: {
    required: true,
    provider: 'microsoft-planner',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/notion/create_database.ts
+++ b/apps/sim/tools/notion/create_database.ts
@@ -10,7 +10,6 @@ export const notionCreateDatabaseTool: ToolConfig<NotionCreateDatabaseParams, No
  oauth: {
    required: true,
    provider: 'notion',
-    additionalScopes: ['workspace.content', 'page.write'],
  },

  params: {
--- a/apps/sim/tools/notion/create_page.ts
+++ b/apps/sim/tools/notion/create_page.ts
@@ -10,7 +10,6 @@ export const notionCreatePageTool: ToolConfig<NotionCreatePageParams, NotionResp
  oauth: {
    required: true,
    provider: 'notion',
-    additionalScopes: ['workspace.content', 'page.write'],
  },

  params: {
--- a/apps/sim/tools/notion/query_database.ts
+++ b/apps/sim/tools/notion/query_database.ts
@@ -11,7 +11,6 @@ export const notionQueryDatabaseTool: ToolConfig<NotionQueryDatabaseParams, Noti
  oauth: {
    required: true,
    provider: 'notion',
-    additionalScopes: ['workspace.content', 'database.read'],
  },

  params: {
--- a/apps/sim/tools/notion/read.ts
+++ b/apps/sim/tools/notion/read.ts
@@ -10,7 +10,6 @@ export const notionReadTool: ToolConfig<NotionReadParams, NotionResponse> = {
  oauth: {
    required: true,
    provider: 'notion',
-    additionalScopes: ['workspace.content', 'page.read'],
  },

  params: {
--- a/apps/sim/tools/notion/read_database.ts
+++ b/apps/sim/tools/notion/read_database.ts
@@ -15,7 +15,6 @@ export const notionReadDatabaseTool: ToolConfig<NotionReadDatabaseParams, Notion
  oauth: {
    required: true,
    provider: 'notion',
-    additionalScopes: ['workspace.content', 'database.read'],
  },

  params: {
--- a/apps/sim/tools/notion/search.ts
+++ b/apps/sim/tools/notion/search.ts
@@ -11,7 +11,6 @@ export const notionSearchTool: ToolConfig<NotionSearchParams, NotionResponse> =
  oauth: {
    required: true,
    provider: 'notion',
-    additionalScopes: ['workspace.content', 'page.read'],
  },

  params: {
--- a/apps/sim/tools/notion/update_page.ts
+++ b/apps/sim/tools/notion/update_page.ts
@@ -10,7 +10,6 @@ export const notionUpdatePageTool: ToolConfig<NotionUpdatePageParams, NotionResp
  oauth: {
    required: true,
    provider: 'notion',
-    additionalScopes: ['workspace.content', 'page.write'],
  },

  params: {
--- a/apps/sim/tools/notion/write.ts
+++ b/apps/sim/tools/notion/write.ts
@@ -10,7 +10,6 @@ export const notionWriteTool: ToolConfig<NotionWriteParams, NotionResponse> = {
  oauth: {
    required: true,
    provider: 'notion',
-    additionalScopes: ['workspace.content', 'page.write'],
  },

  params: {
--- a/apps/sim/tools/onedrive/create_folder.ts
+++ b/apps/sim/tools/onedrive/create_folder.ts
@@ -10,7 +10,6 @@ export const createFolderTool: ToolConfig<OneDriveToolParams, OneDriveUploadResp
  oauth: {
    required: true,
    provider: 'onedrive',
-    additionalScopes: [],
  },

  params: {
--- a/apps/sim/tools/onedrive/delete.ts
+++ b/apps/sim/tools/onedrive/delete.ts
@@ -13,14 +13,6 @@ export const deleteTool: ToolConfig<OneDriveToolParams, OneDriveDeleteResponse>
  oauth: {
    required: true,
    provider: 'onedrive',
-    additionalScopes: [
-      'openid',
-      'profile',
-      'email',
-      'Files.Read',
-      'Files.ReadWrite',
-      'offline_access',
-    ],
  },

  params: {
--- a/apps/sim/tools/onedrive/download.ts
+++ b/apps/sim/tools/onedrive/download.ts
@@ -13,7 +13,6 @@ export const downloadTool: ToolConfig<OneDriveToolParams, OneDriveDownloadRespon
  oauth: {
    required: true,
    provider: 'onedrive',
-    additionalScopes: ['Files.Read', 'Files.ReadWrite', 'offline_access'],
  },

  params: {
--- a/apps/sim/tools/onedrive/list.ts
+++ b/apps/sim/tools/onedrive/list.ts
@@ -14,14 +14,6 @@ export const listTool: ToolConfig<OneDriveToolParams, OneDriveListResponse> = {
  oauth: {
    required: true,
    provider: 'onedrive',
-    additionalScopes: [
-      'openid',
-      'profile',
-      'email',
-      'Files.Read',
-      'Files.ReadWrite',
-      'offline_access',
-    ],
  },

  params: {
--- a/apps/sim/tools/onedrive/upload.ts
+++ b/apps/sim/tools/onedrive/upload.ts
@@ -13,14 +13,6 @@ export const uploadTool: ToolConfig<OneDriveToolParams, OneDriveUploadResponse>
  oauth: {
    required: true,
    provider: 'onedrive',
-    additionalScopes: [
-      'openid',
-      'profile',
-      'email',
-      'Files.Read',
-      'Files.ReadWrite',
-      'offline_access',
-    ],
  },

  params: {
--- a/apps/sim/tools/reddit/delete.ts
+++ b/apps/sim/tools/reddit/delete.ts
@@ -10,7 +10,6 @@ export const deleteTool: ToolConfig<RedditDeleteParams, RedditWriteResponse> = {
  oauth: {
    required: true,
    provider: 'reddit',
-    additionalScopes: ['edit'],
  },

  params: {
--- a/apps/sim/tools/reddit/edit.ts
+++ b/apps/sim/tools/reddit/edit.ts
@@ -10,7 +10,6 @@ export const editTool: ToolConfig<RedditEditParams, RedditWriteResponse> = {
  oauth: {
    required: true,
    provider: 'reddit',
-    additionalScopes: ['edit'],
  },

  params: {
--- a/apps/sim/tools/reddit/get_comments.ts
+++ b/apps/sim/tools/reddit/get_comments.ts
@@ -10,7 +10,6 @@ export const getCommentsTool: ToolConfig<RedditCommentsParams, RedditCommentsRes
  oauth: {
    required: true,
    provider: 'reddit',
-    additionalScopes: ['read'],
  },

  params: {
--- a/Show More
+++ b/Show More