fix(mcp): clean up uncertain OAuth locks

Author: waleedlatif1

apps/sim/lib/mcp/oauth/storage.test.ts

@@ -164,15 +164,37 @@ describe('withMcpOauthRefreshLock', () => {
     expect(fn).not.toHaveBeenCalled()
   })
 
-  it('falls open when Redis is unavailable on acquire', async () => {
+  it('cleans up an uncertain owner token before falling open when Redis is unavailable', async () => {
     mockAcquireLock.mockRejectedValueOnce(new Error('Redis connection refused'))
     const fn = vi.fn(async () => 'uncoordinated')
 
     const result = await withMcpOauthRefreshLock('row-redis-down', fn)
 
     expect(result).toBe('uncoordinated')
     expect(fn).toHaveBeenCalledTimes(1)
-    expect(mockReleaseLock).not.toHaveBeenCalled()
+    expect(mockReleaseLock).toHaveBeenCalledWith(
+      'mcp:oauth:refresh:row-redis-down',
+      expect.any(String)
+    )
+  })
+
+  it('cleans up an uncertain owner token before propagating cancellation', async () => {
+    const controller = new AbortController()
+    mockAcquireLock.mockImplementationOnce(async () => {
+      controller.abort(new Error('cancelled'))
+      throw new Error('Redis operation timed out')
+    })
+    const fn = vi.fn(async () => 'should-not-run')
+
+    await expect(
+      withMcpOauthRefreshLock('row-aborted-acquire', fn, controller.signal)
+    ).rejects.toThrow('cancelled')
+
+    expect(mockReleaseLock).toHaveBeenCalledWith(
+      'mcp:oauth:refresh:row-aborted-acquire',
+      expect.any(String)
+    )
+    expect(fn).not.toHaveBeenCalled()
   })
 
   it('releases the lock even when fn throws', async () => {

apps/sim/lib/mcp/oauth/storage.ts

@@ -350,6 +350,12 @@ async function runWithRedisMutex<T>(
     try {
       acquired = await acquireLock(lockKey, ownerToken, REFRESH_LOCK_TTL_SEC)
     } catch (error) {
+      await releaseLock(lockKey, ownerToken).catch((releaseError) => {
+        logger.warn('Refresh lock cleanup after acquire failure failed (will expire via TTL)', {
+          rowId,
+          error: toError(releaseError).message,
+        })
+      })
       signal?.throwIfAborted()
       logger.warn('Redis unavailable, running OAuth flow uncoordinated', {
         rowId,