fix(mcp): preserve oauthClientSecret on POST upsert when not provided

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: waleedlatif1

apps/sim/app/api/mcp/servers/route.ts

@@ -127,9 +127,11 @@ export const POST = withRouteHandler(
         // User-supplied client credentials imply OAuth; pin authType regardless of probe.
         if (body.oauthClientId) resolvedAuthType = 'oauth'
 
+        const oauthClientSecretProvided = body.oauthClientSecret !== undefined
         const oauthClientSecretEncrypted = body.oauthClientSecret
           ? (await encryptSecret(body.oauthClientSecret)).encrypted
           : null
+        const oauthClientIdProvided = body.oauthClientId !== undefined
         const oauthClientId = body.oauthClientId || null
 
         const [existingServer] = await db
@@ -150,18 +152,20 @@ export const POST = withRouteHandler(
           )
 
           const urlChanged = existingServer.url !== body.url
-          const clientIdChanged = (oauthClientId || null) !== (existingServer.oauthClientId ?? null)
+          const clientIdChanged =
+            oauthClientIdProvided &&
+            (oauthClientId || null) !== (existingServer.oauthClientId ?? null)
           let clientSecretChanged = false
-          if (body.oauthClientSecret) {
-            if (!existingServer.oauthClientSecret) {
+          if (oauthClientSecretProvided) {
+            if (!body.oauthClientSecret) {
+              clientSecretChanged = existingServer.oauthClientSecret != null
+            } else if (!existingServer.oauthClientSecret) {
               clientSecretChanged = true
             } else {
               const currentPlaintext = (await decryptSecret(existingServer.oauthClientSecret))
                 .decrypted
               clientSecretChanged = currentPlaintext !== body.oauthClientSecret
             }
-          } else if (existingServer.oauthClientSecret) {
-            clientSecretChanged = true
           }
           const oauthCredsChanged = clientIdChanged || clientSecretChanged
 
@@ -172,26 +176,26 @@ export const POST = withRouteHandler(
             if (shouldClearOauth) {
               await tx.delete(mcpServerOauth).where(eq(mcpServerOauth.mcpServerId, serverId))
             }
-            await tx
-              .update(mcpServers)
-              .set({
-                name: body.name,
-                description: body.description,
-                transport: body.transport,
-                url: body.url,
-                authType: resolvedAuthType,
-                oauthClientId,
-                oauthClientSecret: oauthClientSecretEncrypted,
-                headers: body.headers || {},
-                timeout: body.timeout || 30000,
-                retries: body.retries || 3,
-                enabled: body.enabled !== false,
-                connectionStatus: resolvedAuthType === 'oauth' ? 'disconnected' : 'connected',
-                lastConnected: resolvedAuthType === 'oauth' ? null : new Date(),
-                updatedAt: new Date(),
-                deletedAt: null,
-              })
-              .where(eq(mcpServers.id, serverId))
+            const updateValues: Record<string, unknown> = {
+              name: body.name,
+              description: body.description,
+              transport: body.transport,
+              url: body.url,
+              authType: resolvedAuthType,
+              headers: body.headers || {},
+              timeout: body.timeout || 30000,
+              retries: body.retries || 3,
+              enabled: body.enabled !== false,
+              connectionStatus: resolvedAuthType === 'oauth' ? 'disconnected' : 'connected',
+              lastConnected: resolvedAuthType === 'oauth' ? null : new Date(),
+              updatedAt: new Date(),
+              deletedAt: null,
+            }
+            if (oauthClientIdProvided) updateValues.oauthClientId = oauthClientId
+            if (oauthClientSecretProvided) {
+              updateValues.oauthClientSecret = oauthClientSecretEncrypted
+            }
+            await tx.update(mcpServers).set(updateValues).where(eq(mcpServers.id, serverId))
           })
 
           if (shouldClearOauth) {