fix(oauth): scope unauthorized_client as terminal to Atlassian refreshes

[waleedlatif1]

Summary

• fix(oauth): treat unauthorized_client as a terminal refresh error #8167 made unauthorized_client a terminal refresh error for every provider. Only Atlassian uses it for a revoked or rotated-out refresh token; elsewhere it usually describes the app registration
• Globally, that reached two places it should not: managed OAuth credentials (Microsoft, Salesforce, Dropbox, Zoom, Notion, HubSpot and others) would be persistently marked as needing reauthorization, and connectors on those credentials would be unscheduled with a reconnect prompt, all over one client configuration fault
• Scopes the code to confluence and jira via a provider-specific set; isTerminalRefreshError takes an optional provider id, and the OAuth refresh path passes it. Managed OAuth adapters call without a provider and keep their previous classification (the managed Atlassian adapter already classifies it itself)

Type of Change

• Bug fix

Testing

• Unit tests: terminal for Confluence and Jira, not terminal for other providers or with no provider; refresh path asserts the provider is passed
• Mutation-checked: dropping the provider argument, the provider map, or re-adding the code globally each fails a test
• OAuth, managed OAuth and credential-group suites pass; type-check and check:audits pass

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 22, 2026 10:28pm UTC

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge with no actionable correctness, security, or repository-rule issues identified.

Summary

This PR limits unauthorized_client terminal refresh handling to Atlassian providers while preserving globally terminal OAuth errors.

• Passes the provider ID through the credential refresh path.
• Classifies unauthorized_client as terminal only for Confluence and Jira.
• Uses a ReadonlyMap to avoid inherited object-property matches.
• Adds coverage for Atlassian, non-Atlassian, absent, and prototype-like provider IDs.

_{Reviews (2) · Last reviewed commit: "fix(oauth): look up provider terminal co..."}

[cubic-dev-ai]

All reported issues were addressed across 4 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 4 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}