fix(credentials): redirect unavailable oauth starts

Author: TheodoreSpeaks

apps/sim/app/api/credential-groups/enroll/[token]/oauth/[optionId]/route.test.ts

@@ -69,13 +69,16 @@ describe('credential group OAuth start route', () => {
     })
   })
 
-  it('returns the same 404 for an unavailable enrollment or option', async () => {
+  it('returns an unavailable enrollment to its public page', async () => {
     mocks.authenticate.mockResolvedValue(null)
 
     const response = await GET(request(), context)
 
-    expect(response.status).toBe(404)
-    await expect(response.json()).resolves.toEqual({ error: 'Not found' })
+    expect(response.status).toBe(307)
+    expect(response.headers.get('location')).toBe(
+      '/credential-groups/enroll/invitation-token?oauth=unavailable'
+    )
+    expect(response.headers.get('cache-control')).toBe('no-store')
     expect(mocks.startOAuth).not.toHaveBeenCalled()
   })
 

apps/sim/app/api/credential-groups/enroll/[token]/oauth/[optionId]/route.ts

@@ -32,10 +32,7 @@ export const GET = withRouteHandler(
     const { token, optionId } = parsed.data.params
     const principal = await authenticateCredentialGroupEnrollment(token)
     if (!principal) {
-      return NextResponse.json(
-        { error: 'Not found' },
-        { status: 404, headers: { 'Cache-Control': 'no-store' } }
-      )
+      return createCredentialGroupEnrollmentRedirect(token, { oauth: 'unavailable' })
     }
 
     const enrollmentLimited = await enforceCredentialGroupEnrollmentOAuthRateLimit(