From 0da9e3c5c4708967bbf927a5873c08d103cbe0f2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Aur=C3=A9lien=20Sibiril?=
 <81782+aureliensibiril@users.noreply.github.com>
Date: Wed, 22 Jul 2026 09:58:41 +0200
Subject: [PATCH] Read Vercel team from the teamId callback param
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Vercel appends the customer's team to the OAuth completion callback as
teamId (camelCase), but the handler read query.Get("team_id"). The
lookup always missed, so every team install fell through to the
/v2/user personal-account fallback -- which returns 404 for a
team-scoped integration token -- leaving TeamID empty. The Vercel
driver then refused to build ("team_id is required") and every
access-review campaign targeting a Vercel team fetched zero accounts.

Personal-account installs were unaffected because they never send a
teamId and legitimately use the /v2/user path, which is why the
breakage only showed up for team installs.

Read the parameter under its real name so the team is captured and
persisted in the connector settings.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
---
 pkg/server/api/console/v1/resolver.go | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkg/server/api/console/v1/resolver.go b/pkg/server/api/console/v1/resolver.go
index 76d83e9d1..750a7bc43 100644
--- a/pkg/server/api/console/v1/resolver.go
+++ b/pkg/server/api/console/v1/resolver.go
@@ -356,13 +356,13 @@ func handleConnectorComplete(
 				}
 			}
 
-			// Vercel surfaces the customer's team_id as an OAuth callback
-			// query parameter (not in the token response body). When the
-			// install targets a personal account no team_id is sent — fall
-			// back to /v2/user.id as a synthetic TeamID; the v3 members
-			// endpoint accepts personal-account UIDs.
+			// Vercel surfaces the customer's team as the `teamId` OAuth
+			// callback query parameter (camelCase, not in the token response
+			// body). When the install targets a personal account no teamId is
+			// sent — fall back to /v2/user.id as a synthetic TeamID; the v3
+			// members endpoint accepts personal-account UIDs.
 			if connectorProvider == coredata.ConnectorProviderVercel {
-				teamID := query.Get("team_id")
+				teamID := query.Get("teamId")
 				if teamID == "" {
 					if oauth2Conn, ok := connection.(*connector.OAuth2Connection); ok && oauth2Conn.AccessToken != "" {
 						if uid, err := connector.FetchVercelUserID(r.Context(), oauth2Conn.AccessToken); err == nil {