fix(credentials): refuse keyless AWS and Databricks create when keyless isn't configured

Author: waleedlatif1

apps/sim/lib/credentials/aws-service-account.server.test.ts

@@ -9,6 +9,7 @@ const hoisted = vi.hoisted(() => ({ send: vi.fn() }))
 
 vi.mock('@/lib/core/security/encryption', () => encryptionMock)
 vi.mock('@/lib/credentials/workload-identity/issuer', () => ({
+  isWorkloadIdentityConfigured: async () => true,
   mintWorkloadIdentityToken: async ({ subject }: { subject: string }) => `token-for:${subject}`,
 }))
 vi.mock('@aws-sdk/client-sts', async (importActual) => ({
@@ -87,6 +88,20 @@ describe('saving a keyless AWS role', () => {
     expect(encryptionMockFns.mockEncryptSecret).not.toHaveBeenCalled()
   })
 
+  it('reads a provider message that ends in a period as one sentence', async () => {
+    hoisted.send.mockRejectedValue(
+      Object.assign(new Error('Not authorized to perform sts:AssumeRoleWithWebIdentity.'), {
+        name: 'AccessDenied',
+      })
+    )
+
+    await expect(
+      verifyAndEncryptAwsCredential(keylessReconnect.serialized, keylessReconnect.owner)
+    ).rejects.toThrow(
+      'Sim could not assume this role: Not authorized to perform sts:AssumeRoleWithWebIdentity. Check that'
+    )
+  })
+
   it('does not save when the any-subject check cannot be completed', async () => {
     roleTrusting(true)
     const pinned = hoisted.send.getMockImplementation()

apps/sim/lib/credentials/aws-service-account.server.ts

@@ -7,21 +7,22 @@ import {
 } from '@aws-sdk/client-sts'
 import { db } from '@sim/db'
 import { credential } from '@sim/db/schema'
-import { getErrorMessage } from '@sim/utils/errors'
 import { and, eq, isNull, or } from 'drizzle-orm'
 import { z } from 'zod'
 import { awsRequestHandler } from '@/lib/core/network/proxy-agent.server'
 import { decryptSecret, encryptSecret } from '@/lib/core/security/encryption'
-import { parseServiceAccountConfig } from '@/lib/credentials/service-account-config'
+import { failureClause, parseServiceAccountConfig } from '@/lib/credentials/service-account-config'
 import { WORKLOAD_IDENTITY_AUDIENCES } from '@/lib/credentials/workload-identity/audiences'
 import {
+  isWorkloadIdentityConfigured,
   mintWorkloadIdentityToken,
   type WorkloadIdentityOwner,
 } from '@/lib/credentials/workload-identity/issuer'
 import {
   bindWorkloadIdentitySubject,
   newWorkloadIdentitySubject,
   type WorkloadIdentityCredentialOwner,
+  WorkloadIdentityNotConfiguredError,
 } from '@/lib/credentials/workload-identity/subject'
 import { AWS_SERVICE_ACCOUNT_PROVIDER_ID } from '@/lib/oauth/types'
 
@@ -236,7 +237,7 @@ function bindSubject(
 }
 
 function verificationFailure(config: AwsCredentialConfig, error: unknown): AwsCredentialError {
-  const detail = getErrorMessage(error, 'Unknown error')
+  const detail = failureClause(error)
   if (config.authType === 'oidc_role') {
     return new AwsCredentialError(
       `Sim could not assume this role: ${detail}. Check that the role trusts the Sim OIDC provider with this exact subject and audience ${AWS_WORKLOAD_IDENTITY_AUDIENCE}.`
@@ -265,6 +266,9 @@ export async function verifyAndEncryptAwsCredential(
   const submitted = parsed.data
   let config: AwsCredentialConfig
   if (submitted.authType === 'oidc_role') {
+    if (!(await isWorkloadIdentityConfigured())) {
+      throw new WorkloadIdentityNotConfiguredError('Use access keys.')
+    }
     const { subject, subjectProof, ...rest } = submitted
     config = {
       ...rest,
@@ -334,7 +338,7 @@ async function assertRolePinsSubject(
   } catch (error) {
     if (error instanceof Error && error.name === 'AccessDenied') return
     throw new AwsCredentialError(
-      `Sim could not confirm the role's trust policy limits it to this credential: ${getErrorMessage(error, 'Unknown error')}. Try again.`
+      `Sim could not confirm the role's trust policy limits it to this credential: ${failureClause(error)}. Try again.`
     )
   }
   throw new AwsCredentialError(

apps/sim/lib/credentials/databricks-service-account.server.test.ts

@@ -9,6 +9,7 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 vi.mock('@/lib/core/security/encryption', () => encryptionMock)
 vi.mock('@/lib/credentials/workload-identity/issuer', () => ({
+  isWorkloadIdentityConfigured: async () => true,
   MAX_WORKLOAD_IDENTITY_TOKEN_TTL_SECONDS: 3600,
   mintWorkloadIdentityToken: async ({ subject }: { subject: string }) => `token-for:${subject}`,
 }))

apps/sim/lib/credentials/databricks-service-account.server.ts

@@ -6,13 +6,14 @@ import { z } from 'zod'
 import { decryptSecret, encryptSecret } from '@/lib/core/security/encryption'
 import { validateDatabricksWorkspaceHost } from '@/lib/core/security/input-validation'
 import { isPayloadSizeLimitError, readResponseJsonWithLimit } from '@/lib/core/utils/stream-limits'
-import { parseServiceAccountConfig } from '@/lib/credentials/service-account-config'
+import { failureClause, parseServiceAccountConfig } from '@/lib/credentials/service-account-config'
 import {
   providerFailureCode,
   TokenServiceAccountValidationError,
 } from '@/lib/credentials/token-service-accounts/errors'
 import { WORKLOAD_IDENTITY_AUDIENCES } from '@/lib/credentials/workload-identity/audiences'
 import {
+  isWorkloadIdentityConfigured,
   MAX_WORKLOAD_IDENTITY_TOKEN_TTL_SECONDS,
   mintWorkloadIdentityToken,
   type WorkloadIdentityOwner,
@@ -21,6 +22,7 @@ import {
   bindWorkloadIdentitySubject,
   newWorkloadIdentitySubject,
   type WorkloadIdentityCredentialOwner,
+  WorkloadIdentityNotConfiguredError,
 } from '@/lib/credentials/workload-identity/subject'
 import { DATABRICKS_SERVICE_ACCOUNT_PROVIDER_ID } from '@/lib/oauth/types'
 
@@ -298,7 +300,7 @@ async function assertPolicyPinsSubject(
       providerFailureCode(error.status) === 'invalid_credentials'
     if (refused) return
     throw new DatabricksCredentialError(
-      `Sim could not confirm the federation policy limits this service principal to this credential: ${getErrorMessage(error, 'Unknown error')}. Try again.`
+      `Sim could not confirm the federation policy limits this service principal to this credential: ${failureClause(error)}. Try again.`
     )
   }
   throw new DatabricksCredentialError(
@@ -325,6 +327,11 @@ export async function verifyAndEncryptDatabricksCredential(
   const submitted = parsed.data
   let config: DatabricksCredentialConfig
   if (submitted.authType === 'oidc_federation') {
+    if (!(await isWorkloadIdentityConfigured())) {
+      throw new WorkloadIdentityNotConfiguredError(
+        'Use a personal access token or a service principal OAuth secret.'
+      )
+    }
     const { subject, subjectProof, ...rest } = submitted
     config = { ...rest, subject: bindSubject(subject, subjectProof, owner) }
   } else {

apps/sim/lib/credentials/google-workload-identity.server.ts

@@ -360,7 +360,7 @@ export async function verifyAndEncryptGoogleWorkloadIdentityCredential(
   )
   if (!parsed.success) throw new GoogleWorkloadIdentityError(parsed.message)
   if (!(await isWorkloadIdentityConfigured())) {
-    throw new WorkloadIdentityNotConfiguredError()
+    throw new WorkloadIdentityNotConfiguredError('Use a JSON key.')
   }
   const submitted = parsed.data
   const config: GoogleWorkloadIdentityConfig = {

apps/sim/lib/credentials/microsoft-app-service-account.server.ts

@@ -547,7 +547,7 @@ export async function verifyAndEncryptMicrosoftAppCredential(
   let config: MicrosoftAppConfig
   if (submitted.authType === 'federated') {
     if (!(await isWorkloadIdentityConfigured())) {
-      throw new WorkloadIdentityNotConfiguredError()
+      throw new WorkloadIdentityNotConfiguredError('Use a client secret or certificate.')
     }
     const { subject, subjectProof, ...rest } = submitted
     config = { ...rest, subject: bindSubject(subject, subjectProof, owner) }

apps/sim/lib/credentials/service-account-config.ts

@@ -1,7 +1,17 @@
+import { getErrorMessage } from '@sim/utils/errors'
 import type { z } from 'zod'
 
 const MAX_CONFIG_BYTES = 64 * 1024
 
+/**
+ * A failure's message without its closing punctuation, so it can sit inside a
+ * sentence that adds the remedy — a provider message that already ends in a
+ * period would otherwise print two.
+ */
+export function failureClause(error: unknown): string {
+  return getErrorMessage(error, 'Unknown error').replace(/[.\s]+$/, '')
+}
+
 /**
  * Parses a service-account configuration submitted as JSON (the connect modal's
  * `serviceAccountJson`) against its provider schema. Returns the first

apps/sim/lib/credentials/service-account-secret.test.ts

@@ -380,32 +380,61 @@ describe('verifyAndBuildServiceAccountSecret', () => {
     expect(result.principal).toBeNull()
   })
 
-  it('refuses a keyless credential on a deployment without workload identity, with its code', async () => {
-    await expect(
-      verifyAndBuildServiceAccountSecret('snowflake-service-account', {
-        serviceAccountJson: JSON.stringify({
-          authType: 'workload_identity',
-          host: 'myorg-myaccount.snowflakecomputing.com',
-        }),
-        owner: { workspaceId: 'ws-1', actorUserId: 'user-1' },
-      })
-    ).rejects.toMatchObject({
-      code: 'validation',
-      detailCode: 'WORKLOAD_IDENTITY_NOT_CONFIGURED',
-    })
-  })
-
-  it('passes a keyless refusal through with its code rather than as a verification failure', async () => {
-    await expect(
-      verifyAndBuildServiceAccountSecret('aws-service-account', {
-        serviceAccountJson: JSON.stringify({
-          authType: 'oidc_role',
-          roleArn: 'arn:aws:iam::123456789012:role/SimWorkflows',
-        }),
-        owner: { workspaceId: 'ws-1', actorUserId: 'user-1' },
+  it.each([
+    [
+      'aws-service-account',
+      { authType: 'oidc_role', roleArn: 'arn:aws:iam::123456789012:role/SimWorkflows' },
+      'Use access keys.',
+    ],
+    [
+      'databricks-service-account',
+      {
+        authType: 'oidc_federation',
+        host: 'dbc-abc123.cloud.databricks.com',
+        clientId: '11111111-2222-3333-4444-555555555555',
+      },
+      'Use a personal access token or a service principal OAuth secret.',
+    ],
+    [
+      'snowflake-service-account',
+      { authType: 'workload_identity', host: 'myorg-myaccount.snowflakecomputing.com' },
+      'Use a programmatic access token.',
+    ],
+    [
+      'microsoft-app-service-account',
+      {
+        authType: 'federated',
+        tenantId: '11111111-2222-3333-4444-555555555555',
+        clientId: '66666666-7777-8888-9999-000000000000',
+      },
+      'Use a client secret or certificate.',
+    ],
+    [
+      'google-service-account',
+      {
+        authType: 'workload_identity',
+        projectNumber: '123456789012',
+        poolId: 'sim-pool',
+        providerId: 'sim-provider',
+        serviceAccountEmail: 'sim-workflows@my-project.iam.gserviceaccount.com',
+      },
+      'Use a JSON key.',
+    ],
+  ])(
+    'refuses a keyless %s credential where this deployment cannot sign',
+    async (providerId, configuration, remedy) => {
+      await expect(
+        verifyAndBuildServiceAccountSecret(providerId, {
+          serviceAccountJson: JSON.stringify(configuration),
+          owner: { workspaceId: 'ws-1', actorUserId: 'user-1' },
+        })
+      ).rejects.toMatchObject({
+        code: 'validation',
+        detailCode: 'WORKLOAD_IDENTITY_NOT_CONFIGURED',
+        message: `Keyless connections are not available on this deployment. ${remedy}`,
       })
-    ).rejects.toMatchObject({ detailCode: 'WORKLOAD_IDENTITY_SUBJECT_REQUIRED' })
-  })
+    }
+  )
 
   it('throws when client-credential required fields are missing, without minting', async () => {
     await expect(

apps/sim/lib/credentials/snowflake-service-account.server.ts

@@ -153,7 +153,7 @@ export async function verifyAndEncryptSnowflakeKeylessCredential(
   )
   if (!parsed.success) throw new SnowflakeCredentialError(parsed.message)
   if (!(await isWorkloadIdentityConfigured())) {
-    throw new WorkloadIdentityNotConfiguredError()
+    throw new WorkloadIdentityNotConfiguredError('Use a programmatic access token.')
   }
   const { host, subject: submittedSubject, subjectProof } = parsed.data
   const subject = bindWorkloadIdentitySubject({

apps/sim/lib/credentials/workload-identity/subject.ts

@@ -96,11 +96,16 @@ export class WorkloadIdentitySubjectError extends KeylessCredentialRefusedError
   }
 }
 
-/** This deployment has no usable signing key, so it cannot issue or verify keyless credentials. */
+/**
+ * This deployment has no usable signing key, so it cannot issue or verify
+ * keyless credentials.
+ *
+ * @param remedy The provider's key-based alternative, as one sentence.
+ */
 export class WorkloadIdentityNotConfiguredError extends KeylessCredentialRefusedError {
-  constructor() {
+  constructor(remedy = 'Use a key- or token-based credential.') {
     super(
-      'Keyless connections are not available on this deployment. Use a key- or token-based credential.',
+      `Keyless connections are not available on this deployment. ${remedy}`,
       'WORKLOAD_IDENTITY_NOT_CONFIGURED'
     )
     this.name = 'WorkloadIdentityNotConfiguredError'