fix(credentials): correct keyless setup instructions and enforce the saved-credential contract on every credential block by waleedlatif1 · Pull Request #9878 · simstudioai/sim

waleedlatif1 · 2026-11-11T04:43:56Z

Summary

Follow-ups from the final release audit of the saved-credential and keyless work. The new auth methods worked end to end, but a first-time user following the setup instructions literally would get stuck. This PR fixes those instructions and closes a gap in the registry contract.

Setup instructions fixed (each checked against the vendor's docs):

AWS: the docs now have you enter the Role ARN before setting the trust policy. The policy shows <AWS_ACCOUNT_ID> until then, and IAM rejects that placeholder. The dialog says so too.
Databricks: the federation-policy command needs an account-level CLI login (databricks auth login --host <account console URL> --account-id …), not a workspace profile or the web terminal.
Google:
- The pool placeholder was sim, which is not a valid pool ID; it is now sim-pool, and both ID fields have a format hint.
- The docs note that only user-managed service accounts work.
- They say to skip pool creation when the pool already exists.
- The API list now includes Resource Manager.
Snowflake: rename SIM_WORKFLOWS when it already exists, and run the statement as a role that can create users.
Bitbucket: workspace and project access tokens need Premium; repository tokens do not.
Microsoft: the keyless dialog now says where in Entra to paste the issuer, subject and audience.
Self-hosting: the keyless section lists all five providers.

Other copy:

Errors no longer assume the caller used "the dialog"; they also point to sim credentials keyless-subject.
"Workspace user" is now "Google Workspace user", and "pinned account" is now "the Account ID set on the credential".
The CLI example uses aws-service-account throughout.
The AWS catalog hint mentions stsRegion.

The registry contract now covers every credential block.

check-block-registry's saved-credential contract used to check only successor blocks, so a new native token+host block was never probed for host steering. It now runs for every block with a saved-credential picker. The per-block logic is in savedCredentialContractErrors, so it can be tested.
Fixes for blocks the widened check caught:
- Coda, Harmonic and Oracle DB tools now declare credentialKind: 'service-account'. These providers only have service-account credentials, so nothing changes for users.
- NetSuite pins instanceUrl. The executor already overwrote it.
The probe gained URL-shaped and ID-shaped placeholders so it can build Jama's and Higgsfield's URLs. It is not loosened.

Reconnects: reconnecting an AWS or Databricks access-key credential opens on access keys, not keyless. MIXED_MODE_PROVIDERS now covers all keyless providers.

Snowflake keyless: a host refused by egress policy is reported as host_not_allowed, the same as the other token checks.

Skills:

add-integration covers new integrations using the native saved-credential pattern: hidden accessToken with oauth: { required: true, credentialKind: 'service-account' }, host params pinned with authoritativeParams, and the inline picker plus manualCredential twin.
add-integration also gains a keyless row and the API/CLI two-step flow.
add-block and add-integration now agree that credential-only successors keep the legacy block's name.
validate-integration gains checks for native token blocks and keyless providers.

Fixtures: test tokens that looked like real vendor tokens (Bitbucket ATCTT…, GitLab glpat-…, AWS AKIA…, a JWT-shaped DocuSign token) are now neutral values, so secret scanners don't flag them.

Type of Change

Bug fix
Documentation

Testing

New contract-script tests:
- a native block with an unpinned host fails;
- the same block with the host pinned passes;
- a tool that accepts any credential kind fails;
- a URL builder with mixed validation is probed.
Reverting the loop change or the placeholders turns them red.
prepare-workload-identity reports keyless only for each provider's keyless config. The old code fails the AWS and Databricks keyless cases.
Snowflake egress refusal maps to host_not_allowed; reverting the guard turns it red.
Commands run, all passing:
- bun run lint; type-check for apps/sim and packages/sim-cli.
- check-block-registry.ts origin/staging.
- check:test-patterns, check:comment-hygiene, check:tool-metadata, check:skills, check:docs, check:cli-docs.
- content:verify-compatibility.
Targeted Vitest covered the contract script, prepare-workload-identity, the validators, minters and subject check, the AWS/Databricks/Microsoft/Google servers, token-resolution, provider-catalog, the Coda/Harmonic/Oracle/NetSuite tools, and the sim-cli commands.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing (new tests pass the test-audit authoring gate)
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

…ential block, reopen key-based reconnects on their mode, and tighten fixtures and skills - check-block-registry runs the saved-credential contract for every block with a saved-credential picker, not only successors; the per-block contract moves to saved-credential-contract.ts with tests. The host probe gains a path-shaped id and a per-param shape so mixed-validation builders (Jama, Higgsfield) are probed, not guessed. - Blocks the widened check caught: Coda, Harmonic, and Oracle Database tools declare credentialKind 'service-account'; NetSuite pins instanceUrl in authoritativeParams; Vanta's assetExternalAccountId is a filter, not a host. - prepareWorkloadIdentity covers every keyless provider (AWS, Databricks added) and reuses audiences.ts for the provider-id mapping; the AWS and Databricks dialogs reopen a reconnect on the stored mode. - Snowflake keyless verification maps an egress refusal to host_not_allowed. - Neutral token fixtures in new credential tests; subject uniqueness TSDoc; skills describe native token blocks, the picker shape, keyless setup, and the successor naming exception.

- AWS: enter the Role ARN before setting the trust policy, so it never carries the <AWS_ACCOUNT_ID> placeholder IAM rejects (dialog hint and docs). - Databricks: the federation-policy command needs an account-level CLI login. - Google: a valid sample pool ID, ID format hints, user-managed service accounts only, skip the pool command when the pool exists, and the API list from Google's guide (adds Resource Manager). - Bitbucket: workspace and project access tokens need Premium; repository tokens do not. - Snowflake: rename SIM_WORKFLOWS if it exists; USERADMIN runs the statement. - Microsoft keyless dialog says where the federated credential goes. - Server errors name the trust values for API and CLI callers too; Google Workspace and Account ID wording; AWS catalog hint mentions stsRegion; the CLI keyless example uses aws-service-account throughout. - Self-hosting env vars list every keyless provider.

vercel · 2026-11-11T04:43:59Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Nov 11, 2026 5:21am UTC

greptile-apps · 2026-11-11T04:46:54Z

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no new actionable failures remain.

Summary

This PR corrects keyless setup guidance and extends saved-credential checks to native blocks.

Every block with a saved-credential picker gets checked against the credential contract.
Reconnect dialogs reopen in the sign-in mode saved on the credential.
Provider setup guides and credential prompts now spell out the steps users need.
Snowflake reports a blocked account host as not allowed.
Credential tests use neutral values instead of token-shaped examples.

_{Reviews (2) · Last reviewed commit: "fix(credentials): reopen every keyless-c..." · Reviewed by Greptile}

cubic-dev-ai

All reported issues were addressed across 57 files

_{Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic}

…d auth mode and reject native credential tools without a policy - prepareWorkloadIdentity reports the reconnected credential's stored authType (reconnectAuthType), for an admin of a credential in the same workspace, whether or not this deployment can sign. reconnectsKeyless is removed from the contract and hook. The AWS, Databricks, Snowflake, Microsoft and Google dialogs reopen on that mode, so an assume_role, personal_access_token or certificate credential keeps its auth. - The saved-credential contract fails a native credential block whose tool has no oauth policy: the executor would never fill its token. - The Snowflake hint and docs say where to change SIM_WORKFLOWS; the DocuSign account_not_found message covers a credential with no Account ID; the docs baseline's reviewed CLI example entries carry their new byte length; the contract test fixtures use a real OAuth service id.

waleedlatif1 · 2026-11-11T05:15:25Z

@greptile

waleedlatif1 · 2026-11-11T05:15:26Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-11-11T05:15:32Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 61 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

…red auth mode (#9878's reconnectAuthType)

waleedlatif1 added 2 commits November 10, 2026 20:43

greptile-apps Bot reviewed Nov 11, 2026

View reviewed changes

Comment thread apps/sim/scripts/saved-credential-contract.ts Resolved

vercel Bot deployed to Preview November 11, 2026 04:50

View deployment

cubic-dev-ai Bot reviewed Nov 11, 2026

View reviewed changes

vercel Bot deployed to Preview November 11, 2026 05:21

View deployment

waleedlatif1 merged commit a4bbaf7 into staging Nov 11, 2026
83 checks passed

waleedlatif1 deleted the fix/saved-credential-contract-all-blocks branch November 11, 2026 05:32

waleedlatif1 mentioned this pull request Nov 11, 2026

v0.9.53: saved credentials with keyless AWS and Databricks OIDC, read-only API keys, workspace members endpoint, trigger health and pinned versions, proxy support, search source permissions #9871

Merged

waleedlatif1 added a commit that referenced this pull request Nov 11, 2026

fix(credentials): reopen a Platform reconnect on the credential's sto…

bca74ad

…red auth mode (#9878's reconnectAuthType)

Navigation Menu

Repository navigation

fix(credentials): correct keyless setup instructions and enforce the saved-credential contract on every credential block - #9878

fix(credentials): correct keyless setup instructions and enforce the saved-credential contract on every credential block#9878
waleedlatif1 merged 3 commits into
stagingfrom
fix/saved-credential-contract-all-blocks

waleedlatif1 commented Nov 11, 2026

Uh oh!

vercel Bot commented Nov 11, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Nov 11, 2026 •

edited

Loading

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Nov 11, 2026

Uh oh!

waleedlatif1 commented Nov 11, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 11, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

waleedlatif1 commented Nov 11, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Nov 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented Nov 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Nov 11, 2026

Uh oh!

waleedlatif1 commented Nov 11, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 11, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Nov 11, 2026 •

edited

Loading

greptile-apps Bot commented Nov 11, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading