fix(credentials): close final-audit findings on keyless wording, issuer logs, and WhatsApp IDs

The Databricks refusal names the real cause (a subject_claim other than sub),
the issuer failure log points at the key or issuer, the AWS troubleshooting
leads with the message users see, rotation steps cover background workers,
and a WhatsApp phone number ID can no longer leave its path segment.

Author: waleedlatif1

apps/docs/content/docs/integrations/aws-credentials.mdx

@@ -64,15 +64,15 @@ Generate a key with `openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:204
 
 To rotate the signing key without failed runs:
 
-1. Set the new key as `WORKLOAD_IDENTITY_PREVIOUS_KEY` and redeploy. Sim publishes it but keeps signing with the current key.
+1. Set the new key as `WORKLOAD_IDENTITY_PREVIOUS_KEY` and redeploy (including any background workers that run workflows). Sim publishes it but keeps signing with the current key.
 2. Wait at least 5 minutes, so every cached copy of the published keys includes the new one.
-3. Swap them: set the new key as `WORKLOAD_IDENTITY_SIGNING_KEY` and the old key as `WORKLOAD_IDENTITY_PREVIOUS_KEY`, and redeploy.
-4. After 5 more minutes, remove `WORKLOAD_IDENTITY_PREVIOUS_KEY`.
+3. Swap them: set the new key as `WORKLOAD_IDENTITY_SIGNING_KEY` and the old key as `WORKLOAD_IDENTITY_PREVIOUS_KEY`, and redeploy everything that runs workflows.
+4. Once every instance signs with the new key, wait 5 more minutes, then remove `WORKLOAD_IDENTITY_PREVIOUS_KEY`.
 
 Without a signing key, the keyless option is unavailable and access keys work as usual.
 
 ## Troubleshooting
 
 - **`InvalidIdentityToken` or "No OpenIDConnect provider found":** the IAM identity provider's URL or audience doesn't match the dialog exactly, or AWS can't reach the issuer. Open `<issuer>/.well-known/openid-configuration` from outside your network; it must load over `https`.
-- **`AccessDenied` when saving:** the role's trust policy doesn't trust this credential's subject. Paste the trust policy from the dialog again; if you chose **Issue a new subject**, update the policy to the new one.
+- **"Sim could not assume this role: Not authorized to perform sts:AssumeRoleWithWebIdentity":** the role's trust policy doesn't trust this credential's subject. Paste the trust policy from the dialog again; if you chose **Issue a new subject**, update the policy to the new one.
 - **"This role trusts every Sim subject":** the trust policy is missing the `sub` condition. Use the policy from the dialog.

apps/docs/content/docs/integrations/databricks-credentials.mdx

@@ -45,4 +45,4 @@ Keyless connections need `WORKLOAD_IDENTITY_SIGNING_KEY` set and an `https` issu
 ## Troubleshooting
 
 - **"Databricks rejected the token request":** the federation policy's issuer, audience, or subject doesn't match the dialog, or the policy is on a different service principal than the application ID you entered.
-- **"This service principal's federation policy trusts every Sim subject":** the policy has no `subject`. Recreate it with the command from the dialog.
+- **"This service principal's federation policy also trusts other Sim credentials":** the policy's `subject_claim` isn't `sub`, so it matches more than this connection. Recreate it with the command from the dialog.

apps/sim/lib/credentials/databricks-service-account.server.test.ts

@@ -115,7 +115,7 @@ describe('saving a keyless Databricks connection', () => {
 
     await expect(
       verifyAndEncryptDatabricksCredential(JSON.stringify(config), reconnectOwner)
-    ).rejects.toThrow(/every Sim subject/)
+    ).rejects.toThrow(/also trusts other Sim credentials/)
     expect(encryptionMockFns.mockEncryptSecret).not.toHaveBeenCalled()
   })
 

apps/sim/lib/credentials/databricks-service-account.server.ts

@@ -255,9 +255,10 @@ async function verifyWorkspaceIdentity(
 
 /**
  * Sim signs tokens for any service principal a member names, and every Sim
- * tenant shares the issuer and audience, so a federation policy that doesn't
- * pin `subject` would let any Sim workspace act as the principal. Exchanging a
- * subject no credential holds must be refused before the credential is saved.
+ * tenant shares the issuer and audience, so a federation policy that matches on
+ * a claim other than `sub` (a `subject_claim` of `sim_workspace_id`, say) would
+ * let other Sim credentials act as the principal. Exchanging a subject no
+ * credential holds must be refused before the credential is saved.
  */
 async function assertPolicyPinsSubject(
   config: Extract<DatabricksCredentialConfig, { authType: 'oidc_federation' }>,
@@ -280,7 +281,7 @@ async function assertPolicyPinsSubject(
     )
   }
   throw new DatabricksCredentialError(
-    `This service principal's federation policy trusts every Sim subject. Use the policy shown in the dialog, whose subject is ${config.subject}, so only this credential can use it.`
+    `This service principal's federation policy also trusts other Sim credentials. Use the policy shown in the dialog, which matches the sub claim to ${config.subject}, so only this credential can use it.`
   )
 }
 

apps/sim/lib/credentials/workload-identity/issuer.ts

@@ -109,7 +109,12 @@ function loadSigningMaterial(): Promise<SigningMaterial> {
       return { privateKey, kid: current.kid as string, jwks: { keys } }
     })()
     signingMaterial.catch((error: unknown) => {
-      logger.error('Workload identity signing key is set but unusable', { error })
+      logger.error(
+        'Workload identity is configured but unusable (check the signing key and issuer)',
+        {
+          error,
+        }
+      )
     })
   }
   return signingMaterial

apps/sim/tools/whatsapp/utils.ts

@@ -1,4 +1,5 @@
 import { isRecordLike, toRecord } from '@sim/utils/object'
+import { safeUrlPathSegment } from '@/tools/url-path'
 import type { WhatsAppMediaType, WhatsAppSendResponse } from '@/tools/whatsapp/types'
 
 /** WhatsApp Cloud API Graph version used by every outbound tool. */
@@ -9,7 +10,7 @@ export function buildMessagesUrl(phoneNumberId: string | undefined): string {
   if (!phoneNumberId) {
     throw new Error('WhatsApp Phone Number ID is required')
   }
-  return `https://graph.facebook.com/${WHATSAPP_GRAPH_VERSION}/${encodeURIComponent(phoneNumberId.trim())}/messages`
+  return `https://graph.facebook.com/${WHATSAPP_GRAPH_VERSION}/${safeUrlPathSegment(phoneNumberId.trim(), 'phoneNumberId')}/messages`
 }
 
 /** Build the media upload endpoint for a given business phone number ID. */

apps/sim/tools/whatsapp/whatsapp.test.ts

@@ -23,11 +23,12 @@ describe('WhatsApp request URL and headers', () => {
     )
   })
 
-  it('keeps a phone number ID inside its own path segment', () => {
-    const url = sendMessageTool.request.url({ ...auth, phoneNumberId: '../../999/register#' })
-
-    expect(new URL(url as string).pathname).toBe('/v25.0/..%2F..%2F999%2Fregister%23/messages')
-  })
+  it.each(['../../999/register#', '..', '123/subscribed_apps?'])(
+    'refuses a phone number ID that would leave its path segment (%s)',
+    (phoneNumberId) => {
+      expect(() => sendMessageTool.request.url({ ...auth, phoneNumberId })).toThrow()
+    }
+  )
 })
 
 describe('sendMessageTool body', () => {