chore(credentials): log a broken JWKS and keep the successor map out of credential display

The JWKS route still answers 404 when the signing key is broken, but warns
with the error. The GitLab personal-token display reads its block type
from the catalog entry instead of importing the generated successor map
into a client-imported module.

Author: waleedlatif1

apps/sim/lib/credentials/workload-identity/responses.ts

@@ -1,10 +1,13 @@
+import { createLogger } from '@sim/logger'
 import { NextResponse } from 'next/server'
 import {
   getWorkloadIdentityDiscoveryDocument,
   getWorkloadIdentityJwks,
   isWorkloadIdentityConfigured,
 } from '@/lib/credentials/workload-identity/issuer'
 
+const logger = createLogger('WorkloadIdentityDiscovery')
+
 /**
  * Cloud providers fetch these anonymously (AWS STS, Databricks) and
  * cache them; five minutes keeps a key rotation visible quickly. "No issuer
@@ -28,7 +31,11 @@ export async function workloadIdentityDiscoveryResponse() {
 
 /** The issuer's public signing keys (JWKS), or 404 when this deployment has no usable signing key. */
 export async function workloadIdentityJwksResponse() {
-  const jwks = await getWorkloadIdentityJwks().catch(() => null)
+  const jwks = await getWorkloadIdentityJwks().catch((error: unknown) => {
+    // Still a 404 to the provider, but a broken signing key must not look like an unconfigured one.
+    logger.warn('Could not build the workload identity JWKS', { error })
+    return null
+  })
   if (!jwks) return notConfigured()
   return NextResponse.json(jwks, { headers: DISCOVERY_HEADERS })
 }

apps/sim/lib/integrations/credential-display.ts

@@ -22,7 +22,6 @@ import { CANONICAL_SERVICE_ACCOUNT_SLUGS } from '@/lib/integrations/oauth-servic
 import { OAUTH_PROVIDERS } from '@/lib/oauth/oauth'
 import type { OAuthProvider, OAuthServiceConfig } from '@/lib/oauth/types'
 import { getServiceConfigByProviderId, parseProvider } from '@/lib/oauth/utils'
-import { resolveAccessControlBlockType } from '@/lib/permission-groups/integration-allowlist'
 
 /**
  * Above this many covered integrations the subtitle states a count instead of
@@ -227,7 +226,7 @@ export function resolveCredentialDisplay(credential: DisplayableCredential): Cre
     return {
       service: null,
       integration,
-      blockType: resolveAccessControlBlockType('gitlab'),
+      blockType: integration?.type ?? 'gitlab',
       icon: GitlabIcon,
       familyName: null,
       coveredIntegrations: integration ? [integration] : [],