chore(credentials): satisfy test-pattern, unused-export, and test-type audits

Author: waleedlatif1

apps/sim/lib/credentials/aws-service-account.server.ts

@@ -37,8 +37,8 @@ import { AWS_SERVICE_ACCOUNT_PROVIDER_ID } from '@/lib/oauth/types'
  *   this credential's subject and exchanges it with STS for the customer's role.
  */
 
-export const AWS_WORKLOAD_IDENTITY_AUDIENCE = WORKLOAD_IDENTITY_AUDIENCES.aws
-export const AWS_CREDENTIAL_SECRET_TYPE = 'aws_credential_v1' as const
+const AWS_WORKLOAD_IDENTITY_AUDIENCE = WORKLOAD_IDENTITY_AUDIENCES.aws
+const AWS_CREDENTIAL_SECRET_TYPE = 'aws_credential_v1' as const
 
 const ROLE_ARN_PATTERN =
   /^arn:aws(?:-cn|-us-gov|-iso[a-z-]*)?:iam::\d{12}:role\/[\w+=,.@/-]{1,512}$/

apps/sim/lib/credentials/databricks-service-account.server.ts

@@ -31,8 +31,8 @@ import { DATABRICKS_SERVICE_ACCOUNT_PROVIDER_ID } from '@/lib/oauth/types'
  * which reach the tools as `accessToken` and `domain`.
  */
 
-export const DATABRICKS_CREDENTIAL_SECRET_TYPE = 'databricks_credential_v1' as const
-export const DATABRICKS_WORKLOAD_IDENTITY_AUDIENCE = WORKLOAD_IDENTITY_AUDIENCES.databricks
+const DATABRICKS_CREDENTIAL_SECRET_TYPE = 'databricks_credential_v1' as const
+const DATABRICKS_WORKLOAD_IDENTITY_AUDIENCE = WORKLOAD_IDENTITY_AUDIENCES.databricks
 
 const REQUEST_TIMEOUT_MS = 15_000
 const CLIENT_ID_PATTERN = /^[A-Za-z0-9-]{8,128}$/
@@ -92,7 +92,7 @@ const storedConfigSchema = z.discriminatedUnion('authType', [
   z.object(oidcShape).strict(),
 ])
 
-export type DatabricksCredentialConfig = z.infer<typeof storedConfigSchema>
+type DatabricksCredentialConfig = z.infer<typeof storedConfigSchema>
 
 const submittedConfigSchema = z.discriminatedUnion('authType', [
   patSchema,
@@ -142,7 +142,7 @@ async function requestWorkspaceToken(
 }
 
 /** A bearer token for the configured workspace. */
-export async function resolveDatabricksAccessToken(
+async function resolveDatabricksAccessToken(
   config: DatabricksCredentialConfig,
   owner: WorkloadIdentityOwner
 ): Promise<string> {

apps/sim/lib/credentials/workload-identity/issuer.test.ts

@@ -6,7 +6,10 @@ import { createLocalJWKSet, decodeProtectedHeader, jwtVerify } from 'jose'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { env } from '@/lib/core/config/env'
 
-const mutableEnv = env as Record<string, string | undefined>
+/** The shared env mock is mutable at runtime; its declared type is the real readonly env. */
+function setEnv(key: string, value: string | undefined) {
+  Reflect.set(env, key, value)
+}
 
 function rsaPem() {
   return generateKeyPairSync('rsa', { modulusLength: 2048 }).privateKey.export({
@@ -22,13 +25,13 @@ async function loadIssuer() {
 
 describe('workload identity issuer', () => {
   beforeEach(() => {
-    mutableEnv.WORKLOAD_IDENTITY_SIGNING_KEY = rsaPem()
+    setEnv('WORKLOAD_IDENTITY_SIGNING_KEY', rsaPem())
   })
 
   afterEach(() => {
-    mutableEnv.WORKLOAD_IDENTITY_SIGNING_KEY = undefined
-    mutableEnv.WORKLOAD_IDENTITY_PREVIOUS_KEY = undefined
-    mutableEnv.WORKLOAD_IDENTITY_ISSUER = undefined
+    setEnv('WORKLOAD_IDENTITY_SIGNING_KEY', undefined)
+    setEnv('WORKLOAD_IDENTITY_PREVIOUS_KEY', undefined)
+    setEnv('WORKLOAD_IDENTITY_ISSUER', undefined)
   })
 
   it('mints a token a relying party verifies with the published JWKS and discovery document', async () => {
@@ -67,16 +70,16 @@ describe('workload identity issuer', () => {
 
   it('keeps verifying tokens signed by the previous key during rotation', async () => {
     const previousKey = rsaPem()
-    mutableEnv.WORKLOAD_IDENTITY_SIGNING_KEY = previousKey
+    setEnv('WORKLOAD_IDENTITY_SIGNING_KEY', previousKey)
     const before = await loadIssuer()
     const oldToken = await before.mintWorkloadIdentityToken({
       subject: 'sim:workspace:ws-1:credential:abc123def456',
       audience: 'sts.amazonaws.com',
       owner: { workspaceId: 'ws-1' },
     })
 
-    mutableEnv.WORKLOAD_IDENTITY_SIGNING_KEY = rsaPem()
-    mutableEnv.WORKLOAD_IDENTITY_PREVIOUS_KEY = previousKey
+    setEnv('WORKLOAD_IDENTITY_SIGNING_KEY', rsaPem())
+    setEnv('WORKLOAD_IDENTITY_PREVIOUS_KEY', previousKey)
     const after = await loadIssuer()
     const jwks = await after.getWorkloadIdentityJwks()
 
@@ -87,7 +90,7 @@ describe('workload identity issuer', () => {
   })
 
   it('publishes nothing and refuses to sign when no signing key is configured', async () => {
-    mutableEnv.WORKLOAD_IDENTITY_SIGNING_KEY = undefined
+    setEnv('WORKLOAD_IDENTITY_SIGNING_KEY', undefined)
     const issuer = await loadIssuer()
     const { workloadIdentityDiscoveryResponse, workloadIdentityJwksResponse } = await import(
       '@/lib/credentials/workload-identity/responses'
@@ -106,7 +109,7 @@ describe('workload identity issuer', () => {
   })
 
   it('uses the pinned issuer URL when one is configured', async () => {
-    mutableEnv.WORKLOAD_IDENTITY_ISSUER = 'https://oidc.example.com/workload/'
+    setEnv('WORKLOAD_IDENTITY_ISSUER', 'https://oidc.example.com/workload/')
     const issuer = await loadIssuer()
 
     expect(issuer.getWorkloadIdentityIssuer()).toBe('https://oidc.example.com/workload')

apps/sim/lib/credentials/workload-identity/subject.ts

@@ -41,10 +41,7 @@ function ownerSegment(owner: WorkloadIdentityOwner): string {
 }
 
 /** `sim:workspace:<id>:credential:<subjectId>` (or `sim:organization:…`). */
-export function buildWorkloadIdentitySubject(
-  owner: WorkloadIdentityOwner,
-  subjectId: string
-): string {
+function buildWorkloadIdentitySubject(owner: WorkloadIdentityOwner, subjectId: string): string {
   if (!SUBJECT_ID_PATTERN.test(subjectId)) {
     throw new WorkloadIdentitySubjectError('Invalid workload identity subject')
   }

apps/sim/lib/internal/aws/credentials.test.ts

@@ -1,7 +1,7 @@
 /**
  * @vitest-environment node
  */
-import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { describe, expect, it, vi } from 'vitest'
 import type { InternalToolOperationCall } from '@/lib/internal/tool-operations/types'
 
 const { mockGetAwsCredentialConfig, mockResolveAwsSessionCredentials } = vi.hoisted(() => ({
@@ -29,10 +29,6 @@ function call(overrides: Partial<InternalToolOperationCall> = {}): InternalToolO
 }
 
 describe('withAwsCredential', () => {
-  beforeEach(() => {
-    vi.clearAllMocks()
-  })
-
   it('hands an inline-key call to the family handler untouched', async () => {
     const request = call()
     const handler = vi.fn(async (received: InternalToolOperationCall) => {