fix(oauth): reject invalid refresh lifetimes

Author: Bill Leoutsakos

apps/sim/lib/oauth/oauth.test.ts

@@ -503,6 +503,27 @@ describe('OAuth Token Refresh', () => {
       })
     })
 
+    it.concurrent.each([0, -1, '0', '-1'])(
+      'should fall back when token expiry is not positive: %s',
+      async (expiresIn) => {
+        const mockFetch = vi.fn().mockResolvedValue(
+          Response.json({
+            access_token: 'new_access_token',
+            expires_in: expiresIn,
+          })
+        )
+
+        const result = await withMockFetch(mockFetch, () =>
+          refreshOAuthToken('google', 'old_refresh_token')
+        )
+
+        expect(result).toMatchObject({
+          ok: true,
+          expiresIn: 3600,
+        })
+      }
+    )
+
     it.concurrent('should handle providers that return new refresh tokens', async () => {
       const refreshToken = 'old_refresh_token'
       const newRefreshToken = 'new_refresh_token'

apps/sim/lib/oauth/oauth.ts

@@ -1891,7 +1891,8 @@ export async function refreshOAuthToken(
         : typeof expiresInCandidate === 'string' && expiresInCandidate.trim()
           ? Number(expiresInCandidate)
           : Number.NaN
-    const expiresIn = Number.isFinite(parsedExpiresIn) ? parsedExpiresIn : 3600
+    const expiresIn =
+      Number.isFinite(parsedExpiresIn) && parsedExpiresIn > 0 ? parsedExpiresIn : 3600
 
     if (!accessToken) {
       logger.warn('No access token found in refresh response', {