From bd5b3ea779fa6351e937fc3639f0bb985ffc1ce9 Mon Sep 17 00:00:00 2001 From: hugocasa Date: Fri, 14 Aug 2026 18:45:11 +0200 Subject: [PATCH] fix: send sage_intacct oauth client credentials in the request body (#10685) Co-authored-by: Claude Opus 5 (1M context) --- backend/oauth_connect.json | 3 ++- backend/windmill-oauth/src/lib.rs | 12 ++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/backend/oauth_connect.json b/backend/oauth_connect.json index 9e74822d98..cec49861cd 100644 --- a/backend/oauth_connect.json +++ b/backend/oauth_connect.json @@ -159,7 +159,8 @@ "sage_intacct": { "auth_url": "https://api.intacct.com/ia/api/v1/oauth2/authorize", "token_url": "https://api.intacct.com/ia/api/v1/oauth2/token", - "scopes": ["offline_access"] + "scopes": ["offline_access"], + "req_body_auth": true }, "spotify": { "auth_url": "https://accounts.spotify.com/authorize", diff --git a/backend/windmill-oauth/src/lib.rs b/backend/windmill-oauth/src/lib.rs index 32648a2115..2650b68b4d 100644 --- a/backend/windmill-oauth/src/lib.rs +++ b/backend/windmill-oauth/src/lib.rs @@ -1179,6 +1179,18 @@ mod tests { assert!(verifier.verify("123", "body", "wrong_sig").is_err()); } + // Sage Intacct's token endpoint rejects HTTP Basic client authentication on the + // refresh_token grant (`invalid_client`), so its credentials must go in the form body. + #[test] + fn sage_intacct_registry_entry_uses_request_body_client_auth() { + let registry: HashMap = + serde_json::from_str(include_str!("../../oauth_connect.json")).unwrap(); + assert_eq!( + registry.get("sage_intacct").unwrap().req_body_auth, + Some(true) + ); + } + #[test] fn canonical_provider_name_strips_sandbox_suffix() { assert_eq!(canonical_provider_name("docusign_sandbox"), "docusign");