fix(sailpoint): bind the token cache to the client secret

Include a hash of client_secret in the token cache key so a caller with a matching
tenant/clientId but the wrong secret cannot reuse another principal's cached bearer token -
a mismatched secret now misses the cache and fails the token exchange. Regression test added.

Author: mzxchandra

apps/sim/app/api/tools/sailpoint/client.ts

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto'
 import { sleep } from '@sim/utils/helpers'
 import { isRecordLike } from '@sim/utils/object'
 import { backoffWithJitter, parseRetryAfter } from '@sim/utils/retry'
@@ -126,7 +127,11 @@ const tokenCache = new Map<string, CachedToken>()
 
 function cacheKey(creds: SailPointServerCredentials): string {
   const { host } = resolveSailPointHosts(creds.tenant, creds.apiVersion)
-  return `${host}:${creds.clientId}:${creds.apiVersion}`
+  // Bind the cache entry to the exact client_secret (hashed) so a caller with a matching
+  // tenant/clientId but the wrong secret can never reuse another principal's cached token - a
+  // mismatched secret produces a different key, misses the cache, and fails the token exchange.
+  const secretHash = createHash('sha256').update(creds.clientSecret).digest('hex').slice(0, 16)
+  return `${host}:${creds.clientId}:${creds.apiVersion}:${secretHash}`
 }
 
 /** Drops any cached token for these credentials so the next call re-exchanges. */

apps/sim/app/api/tools/sailpoint/query/route.test.ts

@@ -197,6 +197,30 @@ describe('SailPoint query route', () => {
     expect(fetchMock.mock.calls[2]?.[0]).toContain('/v2025/accounts')
   })
 
+  it('does not share a cached token across different client secrets', async () => {
+    fetchMock
+      .mockResolvedValueOnce(tokenResponse())
+      .mockResolvedValueOnce(jsonResponse([{ id: 'a1' }]))
+      .mockResolvedValueOnce(tokenResponse())
+      .mockResolvedValueOnce(jsonResponse([{ id: 'a2' }]))
+
+    const makeRequest = (secret: string) =>
+      createMockRequest('POST', {
+        clientId: 'shared-client',
+        clientSecret: secret,
+        tenant: 'acme-secret',
+        operation: 'sailpoint_list_accounts',
+      })
+
+    await POST(makeRequest('secret-A'))
+    await POST(makeRequest('secret-B'))
+
+    // A different secret must not reuse the first principal's token: 2 exchanges + 2 API calls.
+    expect(fetchMock).toHaveBeenCalledTimes(4)
+    expect(fetchMock.mock.calls[0]?.[0]).toContain('/oauth/token')
+    expect(fetchMock.mock.calls[2]?.[0]).toContain('/oauth/token')
+  })
+
   it('backs off and retries on a 429 response', async () => {
     fetchMock
       .mockResolvedValueOnce(tokenResponse())