fix(credentials): offer keyless Google setup only in a Google Cloud context

Reconnecting a keyless Google service account from a Workspace integration
(Gmail, Drive, ...) offered the keyless form, saving a credential that
integration can never use. The dialog now offers keyless only for a Google
Cloud service (new or reconnect) or on the credential's own page; from a
Workspace integration it explains the credential works only with BigQuery and
Vertex AI and does not save. The chat connect control passes its service so
it gets the same gate.

Author: waleedlatif1

apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/special-tags/special-tags.tsx

@@ -2540,6 +2540,7 @@ function ServiceAccountConnectDisplay({
             atlassianProduct={match?.providerId === 'confluence' ? 'confluence' : 'jira'}
             serviceName={target.serviceName}
             serviceIcon={target.serviceIcon}
+            oauthServiceId={service?.providerId}
             credentialId={reconnectCredentialId}
             credentialDisplayName={reconnectCredential?.displayName ?? undefined}
             onCreated={() => {

apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/connect-service-account-modal.tsx

@@ -4,6 +4,7 @@ import { type ComponentType, useState } from 'react'
 import {
   ChipModal,
   ChipModalBody,
+  ChipModalDescription,
   ChipModalError,
   ChipModalField,
   ChipModalFooter,
@@ -25,7 +26,10 @@ import {
   type ClientCredentialAccountProviderId,
   getClientCredentialAccountDescriptor,
 } from '@/lib/credentials/client-credential-accounts/descriptors'
-import { GOOGLE_KEYLESS_SERVICES } from '@/lib/credentials/google-workload-identity'
+import {
+  GOOGLE_KEYLESS_SERVICES,
+  googleKeylessOffer,
+} from '@/lib/credentials/google-workload-identity'
 import type { ServiceAccountSecretFields } from '@/lib/credentials/service-account-secret'
 import {
   getTokenServiceAccountDescriptor,
@@ -668,7 +672,12 @@ function GoogleServiceAccountModalForm({
     onCreated,
     onClose: () => onOpenChange(false),
   })
-  const offerKeyless = Boolean(keyless.available) && (cloudService || keyless.reconnectsKeyless)
+  const keylessOffer = googleKeylessOffer({
+    oauthServiceId,
+    available: Boolean(keyless.available),
+    reconnectsKeyless: keyless.reconnectsKeyless,
+  })
+  const offerKeyless = keylessOffer === 'offer'
   const [selectedAuthType, setSelectedAuthType] = useState<GoogleAuthType | null>(null)
   const authType: GoogleAuthType = offerKeyless
     ? (selectedAuthType ?? (keyless.reconnectsKeyless ? 'workload_identity' : 'json_key'))
@@ -764,10 +773,12 @@ function GoogleServiceAccountModalForm({
 
   const isPending =
     createCredential.isPending || updateCredential.isPending || keylessSubmit.isPending
+  const cloudOnly = keylessOffer === 'cloud_only'
   const isDisabled =
-    authType === 'workload_identity'
+    cloudOnly ||
+    (authType === 'workload_identity'
       ? isPending || !keyless.ready || !isGoogleKeylessInputComplete(keylessInput)
-      : !jsonInput.trim() || isPending
+      : !jsonInput.trim() || isPending)
   const submitError = authType === 'workload_identity' ? keylessSubmit.error : error
 
   return (
@@ -817,7 +828,14 @@ function GoogleServiceAccountModalForm({
           />
         )}
 
-        {authType === 'json_key' && (
+        {cloudOnly && (
+          <ChipModalDescription>
+            This keyless credential works only with Google Cloud services (BigQuery, Vertex AI).
+            Reconnect it from one of those integrations or from the credential’s own page.
+          </ChipModalDescription>
+        )}
+
+        {authType === 'json_key' && !cloudOnly && (
           <>
             <ChipModalField
               type='textarea'

apps/sim/lib/credentials/google-workload-identity.test.ts

@@ -0,0 +1,50 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import { googleKeylessOffer } from '@/lib/credentials/google-workload-identity'
+
+describe('keyless setup in the Google service account dialog', () => {
+  it.each(['google-drive', 'gmail', 'google-sheets'])(
+    'never offers the keyless form when reconnecting a keyless credential from %s',
+    (oauthServiceId) => {
+      expect(googleKeylessOffer({ oauthServiceId, available: true, reconnectsKeyless: true })).toBe(
+        'cloud_only'
+      )
+    }
+  )
+
+  it('offers JSON keys only for a new connection from a Workspace service', () => {
+    expect(
+      googleKeylessOffer({ oauthServiceId: 'gmail', available: true, reconnectsKeyless: false })
+    ).toBe('none')
+  })
+
+  it.each([true, false])(
+    'offers keyless for BigQuery whether or not the reconnected credential is keyless (%s)',
+    (reconnectsKeyless) => {
+      expect(
+        googleKeylessOffer({
+          oauthServiceId: 'google-bigquery',
+          available: true,
+          reconnectsKeyless,
+        })
+      ).toBe('offer')
+    }
+  )
+
+  it('keeps a keyless credential keyless when reconnected from its own page', () => {
+    expect(googleKeylessOffer({ available: true, reconnectsKeyless: true })).toBe('offer')
+    expect(googleKeylessOffer({ available: true, reconnectsKeyless: false })).toBe('none')
+  })
+
+  it('offers nothing keyless where this deployment cannot sign tokens', () => {
+    expect(
+      googleKeylessOffer({
+        oauthServiceId: 'google-bigquery',
+        available: false,
+        reconnectsKeyless: true,
+      })
+    ).toBe('none')
+  })
+})

apps/sim/lib/credentials/google-workload-identity.ts

@@ -21,6 +21,29 @@ export const GOOGLE_KEYLESS_SERVICES: ReadonlySet<string> = new Set([
   'vertex-ai',
 ])
 
+/**
+ * What a Google service account connect dialog offers for keyless setup.
+ *
+ * - `offer`: a Google Cloud service (new or reconnect), or a keyless credential
+ *   reconnected from a context that names no service (its own detail page).
+ * - `cloud_only`: a keyless credential reconnected from a Google Workspace
+ *   service, which can never use it; the dialog explains instead of saving.
+ * - `none`: JSON key only.
+ */
+export function googleKeylessOffer(input: {
+  /** The OAuth service the dialog was opened for, when it was opened for one. */
+  oauthServiceId?: string
+  /** This deployment can sign workload-identity tokens for this owner. */
+  available: boolean
+  /** The credential being reconnected is keyless. */
+  reconnectsKeyless: boolean
+}): 'offer' | 'cloud_only' | 'none' {
+  if (!input.available) return 'none'
+  if (input.oauthServiceId && GOOGLE_KEYLESS_SERVICES.has(input.oauthServiceId)) return 'offer'
+  if (!input.reconnectsKeyless) return 'none'
+  return input.oauthServiceId ? 'cloud_only' : 'offer'
+}
+
 /** The `type` of a keyless credential's stored secret; a JSON key's is `service_account`. */
 export const GOOGLE_WORKLOAD_IDENTITY_SECRET_TYPE = 'google_workload_identity_v1' as const