fix(credentials): reopen every keyless-capable reconnect on its stored auth mode and reject native credential tools without a policy

- prepareWorkloadIdentity reports the reconnected credential's stored authType
  (reconnectAuthType), for an admin of a credential in the same workspace, whether or
  not this deployment can sign. reconnectsKeyless is removed from the contract and hook.
  The AWS, Databricks, Snowflake, Microsoft and Google dialogs reopen on that mode, so
  an assume_role, personal_access_token or certificate credential keeps its auth.
- The saved-credential contract fails a native credential block whose tool has no
  oauth policy: the executor would never fill its token.
- The Snowflake hint and docs say where to change SIM_WORKFLOWS; the DocuSign
  account_not_found message covers a credential with no Account ID; the docs
  baseline's reviewed CLI example entries carry their new byte length; the contract
  test fixtures use a real OAuth service id.

Author: waleedlatif1

apps/docs/content/docs/integrations/snowflake-service-account.mdx

@@ -24,7 +24,7 @@ Snowflake's [workload identity federation](https://docs.snowflake.com/en/user-gu
     In Sim, add a **Snowflake** connection, choose **Service user (keyless, via Sim OIDC)**, and enter the account host (`myorg-myaccount.snowflakecomputing.com`). The dialog shows the issuer, audience, and subject for this connection, and the statement to run.
   </Step>
   <Step>
-    A user whose role can create users (for example USERADMIN) runs the statement from the dialog. Rename the user if SIM_WORKFLOWS already exists. It looks like this:
+    A user whose role can create users (for example USERADMIN) runs the statement from the dialog. If SIM_WORKFLOWS already exists, change the name in the statement you run and in the follow-up GRANT and ALTER commands below. It looks like this:
 
 ```sql
 CREATE USER SIM_WORKFLOWS

apps/docs/scripts/fixtures/content-baseline.json

@@ -3017,7 +3017,7 @@
           "lang": "bash",
           "meta": null,
           "sha256": "48d4019bc1905094aec776873af1d5a4e94ec2f52d043c51bbbb559b6a876944",
-          "bytes": 262,
+          "bytes": 276,
           "line": 102
         },
         {
@@ -3080,7 +3080,7 @@
           "lang": "bash",
           "meta": null,
           "sha256": "48d4019bc1905094aec776873af1d5a4e94ec2f52d043c51bbbb559b6a876944",
-          "bytes": 262,
+          "bytes": 276,
           "line": 375
         }
       ],
@@ -11191,7 +11191,7 @@
           "lang": "bash",
           "meta": null,
           "sha256": "48d4019bc1905094aec776873af1d5a4e94ec2f52d043c51bbbb559b6a876944",
-          "bytes": 262,
+          "bytes": 276,
           "line": 788
         },
         {
@@ -11205,7 +11205,7 @@
           "lang": "bash",
           "meta": null,
           "sha256": "48d4019bc1905094aec776873af1d5a4e94ec2f52d043c51bbbb559b6a876944",
-          "bytes": 262,
+          "bytes": 276,
           "line": 824
         },
         {

apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/aws-account-modal.tsx

@@ -114,13 +114,10 @@ function AwsAccountForm({
   const [displayName, setDisplayName] = useState(initialDisplayName ?? '')
   const [description, setDescription] = useState(initialDescription ?? '')
 
-  // A reconnect opens on keyless only for a keyless credential, so a key-based connection is
-  // never switched to keyless by default; a new connection defaults to keyless wherever this
-  // deployment supports it.
+  // A reconnect opens on the credential's stored mode, so it never switches auth by default;
+  // a new connection defaults to keyless wherever this deployment supports it.
   const defaultAuthType: AwsAuthType = credentialId
-    ? keyless.reconnectsKeyless
-      ? 'oidc_role'
-      : 'access_keys'
+    ? (keyless.reconnectAuthType ?? 'access_keys')
     : keyless.available
       ? 'oidc_role'
       : 'access_keys'

apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/connect-service-account-modal.tsx

@@ -675,12 +675,12 @@ function GoogleServiceAccountModalForm({
   const keylessOffer = googleKeylessOffer({
     oauthServiceId,
     available: Boolean(keyless.available),
-    reconnectsKeyless: keyless.reconnectsKeyless,
+    reconnectsKeyless: keyless.reconnectAuthType === 'workload_identity',
   })
   const offerKeyless = keylessOffer === 'offer'
   const [selectedAuthType, setSelectedAuthType] = useState<GoogleAuthType | null>(null)
   const authType: GoogleAuthType = offerKeyless
-    ? (selectedAuthType ?? (keyless.reconnectsKeyless ? 'workload_identity' : 'json_key'))
+    ? (selectedAuthType ?? keyless.reconnectAuthType ?? 'json_key')
     : 'json_key'
   const [keylessInput, setKeylessInput] = useState<GoogleKeylessInput>(EMPTY_GOOGLE_KEYLESS_INPUT)
   const [jsonInput, setJsonInput] = useState('')

apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/databricks-account-modal.tsx

@@ -93,13 +93,10 @@ function DatabricksAccountForm({
   const [displayName, setDisplayName] = useState(initialDisplayName ?? '')
   const [description, setDescription] = useState(initialDescription ?? '')
 
-  // A reconnect opens on keyless only for a keyless credential, so a key-based connection is
-  // never switched to keyless by default; a new connection defaults to keyless wherever this
-  // deployment supports it.
+  // A reconnect opens on the credential's stored mode, so it never switches auth by default;
+  // a new connection defaults to keyless wherever this deployment supports it.
   const defaultAuthType: DatabricksAuthType = credentialId
-    ? keyless.reconnectsKeyless
-      ? 'oidc_federation'
-      : 'service_principal'
+    ? (keyless.reconnectAuthType ?? 'service_principal')
     : keyless.available
       ? 'oidc_federation'
       : 'service_principal'

apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/keyless-connection.tsx

@@ -5,7 +5,12 @@ import { ChipModalError, ChipModalField } from '@sim/emcn'
 import { generateShortId } from '@sim/utils/id'
 import { isApiClientError } from '@/lib/api/client/errors'
 import { resourceScopeFields, resourceScopeFromOwner } from '@/lib/core/resource-scope'
-import type { WorkloadIdentityProvider } from '@/lib/credentials/workload-identity/audiences'
+import {
+  WORKLOAD_IDENTITY_KEYLESS_CONFIGS,
+  WORKLOAD_IDENTITY_PROVIDER_AUTH_TYPES,
+  type WorkloadIdentityProvider,
+  type WorkloadIdentityProviderAuthType,
+} from '@/lib/credentials/workload-identity/audiences'
 import {
   useCreateScopedCredential,
   useUpdateScopedCredential,
@@ -20,8 +25,8 @@ import {
 
 export type TrustSubjectChoice = 'keep' | 'new'
 
-interface KeylessSetupInput {
-  provider: WorkloadIdentityProvider
+interface KeylessSetupInput<P extends WorkloadIdentityProvider> {
+  provider: P
   workspaceId?: string
   organizationId?: string
   credentialId?: string
@@ -37,13 +42,13 @@ interface KeylessSetupInput {
  * reconnect the configured trust is kept by default: issuing a new subject
  * would break the role or federation policy the customer already set up.
  */
-export function useKeylessSetup({
+export function useKeylessSetup<P extends WorkloadIdentityProvider>({
   provider,
   workspaceId,
   organizationId,
   credentialId,
   enabled = true,
-}: KeylessSetupInput) {
+}: KeylessSetupInput<P>) {
   const [sessionKey] = useState(() => generateShortId())
   const [subjectChoice, setSubjectChoice] = useState<TrustSubjectChoice>(
     credentialId ? 'keep' : 'new'
@@ -57,11 +62,17 @@ export function useKeylessSetup({
     credentialId,
   })
   const trust = setup.data?.available ? setup.data : undefined
+  const storedAuthType = providerAuthType(provider, setup.data?.reconnectAuthType)
+  // A keyless credential reopens on keyless only where this deployment can still sign.
+  const reconnectAuthType =
+    storedAuthType === WORKLOAD_IDENTITY_KEYLESS_CONFIGS[provider].authType && !trust
+      ? undefined
+      : storedAuthType
   return {
     /** Undefined while this deployment's support is still loading. */
     available: workspaceScoped ? setup.data?.available : false,
-    /** The credential being reconnected is keyless (reported for Snowflake and Google only). */
-    reconnectsKeyless: Boolean(setup.data?.available && setup.data.reconnectsKeyless),
+    /** The stored mode of the credential being reconnected; a reconnect reopens on it. */
+    reconnectAuthType,
     isReconnect: Boolean(credentialId),
     subjectChoice,
     setSubjectChoice,
@@ -73,7 +84,17 @@ export function useKeylessSetup({
   }
 }
 
-export type KeylessSetup = ReturnType<typeof useKeylessSetup>
+export type KeylessSetup<P extends WorkloadIdentityProvider = WorkloadIdentityProvider> =
+  ReturnType<typeof useKeylessSetup<P>>
+
+function providerAuthType<P extends WorkloadIdentityProvider>(
+  provider: P,
+  value: string | undefined
+): WorkloadIdentityProviderAuthType<P> | undefined {
+  const modes: readonly WorkloadIdentityProviderAuthType<P>[] =
+    WORKLOAD_IDENTITY_PROVIDER_AUTH_TYPES[provider]
+  return modes.find((mode) => mode === value)
+}
 
 /** The subject fields of a keyless config: a new subject with its proof, or none to keep the stored one. */
 export function keylessSubjectFields(setup: KeylessSetup) {

apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/microsoft-app-account-modal.tsx

@@ -89,12 +89,10 @@ function MicrosoftAppAccountForm({
   const [displayName, setDisplayName] = useState(initialDisplayName ?? '')
   const [description, setDescription] = useState(initialDescription ?? '')
 
-  // A reconnect opens on keyless only for a keyless credential, which has a subject to keep; a
-  // new connection defaults to keyless wherever this deployment supports it.
+  // A reconnect opens on the credential's stored mode, so it never switches auth by default;
+  // a new connection defaults to keyless wherever this deployment supports it.
   const defaultAuthType: MicrosoftAuthType = credentialId
-    ? keyless.reconnectsKeyless
-      ? 'federated'
-      : 'client_secret'
+    ? (keyless.reconnectAuthType ?? 'client_secret')
     : keyless.available
       ? 'federated'
       : 'client_secret'

apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/snowflake-account-modal.tsx

@@ -135,7 +135,7 @@ function SnowflakeAccountForm({
   initialDescription,
   onCreated,
   keyless,
-}: SnowflakeAccountModalProps & { keyless: KeylessSetup }) {
+}: SnowflakeAccountModalProps & { keyless: KeylessSetup<'snowflake'> }) {
   const close = () => onOpenChange(false)
   const keylessSubmit = useSavedConnectionSubmit({
     providerId: SNOWFLAKE_SERVICE_ACCOUNT_PROVIDER_ID,
@@ -155,13 +155,10 @@ function SnowflakeAccountForm({
   const [displayName, setDisplayName] = useState(initialDisplayName ?? '')
   const [description, setDescription] = useState(initialDescription ?? '')
 
-  // A reconnect opens on the credential's current mode, so a keyless connection is never
-  // turned into a token one by default; a new connection defaults to keyless wherever this
-  // deployment supports it.
+  // A reconnect opens on the credential's stored mode, so it never switches auth by default;
+  // a new connection defaults to keyless wherever this deployment supports it.
   const defaultAuthType: SnowflakeAuthType = credentialId
-    ? keyless.reconnectsKeyless
-      ? 'workload_identity'
-      : 'programmatic_access_token'
+    ? (keyless.reconnectAuthType ?? 'programmatic_access_token')
     : keyless.available
       ? 'workload_identity'
       : 'programmatic_access_token'
@@ -301,7 +298,7 @@ function SnowflakeAccountForm({
           <ChipModalField
             type='custom'
             title='Service user'
-            hint='An admin runs this once in the account, then grants the user a role and sets it as its default role, before you save. Rename the user if SIM_WORKFLOWS already exists.'
+            hint='An admin runs this once in the account, then grants the user a role and sets it as its default role, before you save. If SIM_WORKFLOWS already exists, change the name in the statement you run and in any follow-up GRANT or ALTER commands.'
           >
             {(aria) => (
               <ChipTextarea

apps/sim/lib/api/contracts/credentials.ts

@@ -5,7 +5,10 @@ import {
   ATLASSIAN_PRODUCTS,
   getMissingServiceAccountFields,
 } from '@/lib/credentials/service-account-fields'
-import { WORKLOAD_IDENTITY_PROVIDERS } from '@/lib/credentials/workload-identity/audiences'
+import {
+  WORKLOAD_IDENTITY_AUTH_TYPE_LIST,
+  WORKLOAD_IDENTITY_PROVIDERS,
+} from '@/lib/credentials/workload-identity/audiences'
 import type { OAuthProvider } from '@/lib/oauth/types'
 
 export const atlassianProductSchema = z.enum(ATLASSIAN_PRODUCTS)
@@ -560,6 +563,9 @@ export const createWorkspaceCredentialContract = defineRouteContract({
  * dialog's contract and the public `createCredentialWorkloadIdentitySubject`
  * operation so the two cannot describe the same grant differently.
  */
+/** The reconnected credential's stored auth mode, so the dialog reopens on it. */
+const reconnectAuthTypeSchema = z.enum(WORKLOAD_IDENTITY_AUTH_TYPE_LIST).optional()
+
 export const workloadIdentitySubjectGrantShape = {
   issuer: z
     .string()
@@ -598,12 +604,11 @@ export const prepareWorkloadIdentityContract = defineRouteContract({
     mode: 'json',
     schema: z.discriminatedUnion('available', [
       /** This deployment has no workload-identity signing key; offer key-based modes only. */
-      z.object({ available: z.literal(false) }),
+      z.object({ available: z.literal(false), reconnectAuthType: reconnectAuthTypeSchema }),
       z.object({
         available: z.literal(true),
         ...workloadIdentitySubjectGrantShape,
-        /** The reconnected credential is keyless (Snowflake, Microsoft app, and Google only). */
-        reconnectsKeyless: z.literal(true).optional(),
+        reconnectAuthType: reconnectAuthTypeSchema,
       }),
     ]),
   },