fix(mcp): use canonical serverId from contract; drop dual-semantics state field

- tool-input now passes result.serverId (the contract-defined property) to
  startOauthForServer instead of the duplicated result.id alias.
- Drop the unused state field from McpOauthRow. The DB column stores a hash;
  the in-memory copy was only ever assigned (never read for logic), and
  provider.state() was setting it to plaintext, creating an inconsistent
  hash-vs-plaintext type. Removing it eliminates the foot-gun.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: waleedlatif1

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/tool-input/tool-input.tsx

@@ -2142,7 +2142,7 @@ export const ToolInput = memo(function ToolInput({
             config: { ...config, enabled: true },
           })
           if (result.authType === 'oauth') {
-            await startOauthForServer(result.id)
+            await startOauthForServer(result.serverId)
           }
         }}
         workspaceId={workspaceId}

apps/sim/lib/mcp/oauth/provider.ts

@@ -74,7 +74,6 @@ export class SimMcpOauthProvider implements OAuthClientProvider {
   async state(): Promise<string> {
     const state = `${this.row.id}.${generateId()}`
     await saveState(this.row.id, state)
-    this.row.state = state
     return state
   }
 
@@ -139,7 +138,6 @@ export class SimMcpOauthProvider implements OAuthClientProvider {
       await clearVerifier(this.row.id)
       await clearState(this.row.id)
       this.row.codeVerifier = null
-      this.row.state = null
     }
   }
 

apps/sim/lib/mcp/oauth/storage.ts

@@ -21,7 +21,6 @@ export interface McpOauthRow {
   clientInformation: OAuthClientInformationMixed | null
   tokens: OAuthTokens | null
   codeVerifier: string | null
-  state: string | null
 }
 
 async function encryptTokens(tokens: OAuthTokens): Promise<string> {
@@ -74,7 +73,6 @@ export async function getOrCreateOauthRow(params: {
     clientInformation: null,
     tokens: null,
     codeVerifier: null,
-    state: null,
   }
 }
 
@@ -104,7 +102,6 @@ export async function loadOauthRow(params: {
       : null,
     tokens: row.tokens ? await decryptTokens(row.tokens) : null,
     codeVerifier: row.codeVerifier ? (await decryptSecret(row.codeVerifier)).decrypted : null,
-    state: row.state,
   }
 }
 
@@ -125,7 +122,6 @@ export async function loadOauthRowByState(state: string): Promise<McpOauthRow |
       : null,
     tokens: row.tokens ? await decryptTokens(row.tokens) : null,
     codeVerifier: row.codeVerifier ? (await decryptSecret(row.codeVerifier)).decrypted : null,
-    state: row.state,
   }
 }