fix(credentials): address review round 1

- A scoped 403 whose body can't be read is provider_unavailable, never accepted
- Provider error snippets read through the bounded reader
- Props interfaces for KeylessTrustFields and useWorkloadIdentitySetup; TSDoc on issuer responses

Author: waleedlatif1

apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/keyless-connection.tsx

@@ -74,8 +74,12 @@ export function keylessSubjectFields(setup: KeylessSetup) {
   return setup.trust ? { subject: setup.trust.subject, subjectProof: setup.trust.subjectProof } : {}
 }
 
+interface KeylessTrustFieldsProps {
+  setup: KeylessSetup
+}
+
 /** Reconnect choice plus the issuer, audience, and subject the customer configures. */
-export function KeylessTrustFields({ setup }: { setup: KeylessSetup }) {
+export function KeylessTrustFields({ setup }: KeylessTrustFieldsProps) {
   return (
     <>
       {setup.isReconnect && (

apps/sim/hooks/queries/scoped-credentials.ts

@@ -130,18 +130,21 @@ const workloadIdentityKeys = {
 /** A setup's subject is minted once per modal session and never refreshed. */
 const WORKLOAD_IDENTITY_SETUP_STALE_TIME = Number.POSITIVE_INFINITY
 
+interface UseWorkloadIdentitySetupProps {
+  workspaceId?: string
+  provider: WorkloadIdentityProvider
+  /** One per modal session, so each open gets its own subject. */
+  sessionKey: string
+  enabled: boolean
+}
+
 /**
  * The trust setup for a new keyless AWS role or Databricks service principal:
  * the issuer to register and the signed subject it must trust. Each fetch
  * mints a new subject, so the key carries the modal session and the result
  * never goes stale or refetches while the person is copying it.
  */
-export function useWorkloadIdentitySetup(input: {
-  workspaceId?: string
-  provider: WorkloadIdentityProvider
-  sessionKey: string
-  enabled: boolean
-}) {
+export function useWorkloadIdentitySetup(input: UseWorkloadIdentitySetupProps) {
   return useQuery({
     queryKey: workloadIdentityKeys.setup(input.workspaceId, input.provider, input.sessionKey),
     queryFn: async ({ signal }) =>

apps/sim/lib/credentials/token-service-accounts/errors.test.ts

@@ -124,9 +124,24 @@ describe('token service-account error helpers', () => {
       expect(snippet).toBe(`${'x'.repeat(500)}...`)
     })
 
+    it('stops reading an oversized error body instead of buffering all of it', async () => {
+      let pulled = 0
+      const chunk = new Uint8Array(16 * 1024).fill(120)
+      const body = new ReadableStream<Uint8Array>({
+        pull(controller) {
+          pulled++
+          if (pulled > 1000) controller.close()
+          else controller.enqueue(chunk)
+        },
+      })
+
+      await expect(readProviderErrorSnippet(new Response(body, { status: 500 }))).resolves.toBe('')
+      expect(pulled).toBeLessThan(20)
+    })
+
     it('never throws on an unreadable body', async () => {
       const res = new Response('gone', { status: 500 })
-      vi.spyOn(res, 'text').mockRejectedValue(new Error('body stream already read'))
+      await res.text()
 
       await expect(readProviderErrorSnippet(res)).resolves.toBe('')
     })

apps/sim/lib/credentials/token-service-accounts/errors.ts

@@ -1,5 +1,9 @@
 import { getErrorMessage } from '@sim/utils/errors'
 import { truncate } from '@sim/utils/string'
+import {
+  DEFAULT_MAX_ERROR_BODY_BYTES,
+  readResponseTextWithLimit,
+} from '@/lib/core/utils/stream-limits'
 
 /**
  * Discrete validation failure codes returned to the client for token
@@ -142,7 +146,12 @@ export async function parseProviderJson<T>(res: Response, step: string): Promise
  */
 export async function readProviderErrorSnippet(res: Response): Promise<string> {
   try {
-    return truncate(await res.text(), ERROR_SNIPPET_MAX_LENGTH)
+    // Bounded: a provider or proxy can answer with an arbitrarily large error body.
+    const text = await readResponseTextWithLimit(res, {
+      maxBytes: DEFAULT_MAX_ERROR_BODY_BYTES,
+      label: 'provider error response',
+    })
+    return truncate(text, ERROR_SNIPPET_MAX_LENGTH)
   } catch {
     return ''
   }

apps/sim/lib/credentials/token-service-accounts/validators/http.ts

@@ -83,11 +83,19 @@ export function tokenCheckValidator(check: TokenCheck): TokenServiceAccountValid
       response.status === 403 &&
       (response.headers.get('content-type') ?? '').includes('application/json')
     if (check.rejectsKey && !response.ok) {
-      const errorBody = await readJsonBody(response, check.serviceLabel).catch(() => null)
-      if (check.rejectsKey(errorBody)) {
+      const unreadable = Symbol('unreadable')
+      const errorBody = await readJsonBody(response, check.serviceLabel).catch(() => unreadable)
+      if (errorBody !== unreadable && check.rejectsKey(errorBody)) {
         throw new TokenServiceAccountValidationError('invalid_credentials', 400, { step: 'verify' })
       }
       if (scopedForbidden) {
+        // Only a body that was read and doesn't name a bad key proves the token.
+        if (errorBody === unreadable) {
+          throw new TokenServiceAccountValidationError('provider_unavailable', response.status, {
+            step: 'verify',
+            reason: 'unreadable 403 body',
+          })
+        }
         return accepted
       }
       const callerError =
@@ -97,7 +105,10 @@ export function tokenCheckValidator(check: TokenCheck): TokenServiceAccountValid
       throw new TokenServiceAccountValidationError(
         callerError ? 'invalid_credentials' : 'provider_unavailable',
         response.status,
-        { step: 'verify', body: truncate(JSON.stringify(errorBody) ?? '', 500) }
+        {
+          step: 'verify',
+          body: errorBody === unreadable ? '' : truncate(JSON.stringify(errorBody) ?? '', 500),
+        }
       )
     }
     if (!scopedForbidden) {

apps/sim/lib/credentials/token-service-accounts/validators/token-checks.test.ts

@@ -61,6 +61,22 @@ describe('Brex saved token verification', () => {
     })
   })
 
+  it('does not accept a 403 whose body cannot be read to tell a bad token apart', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn().mockResolvedValue(
+        new Response('{"message": "Invalid or Revoked', {
+          status: 403,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      )
+    )
+
+    await expect(validateBrexServiceAccount({ apiToken: 'bxt_unknown' })).rejects.toMatchObject({
+      code: 'provider_unavailable',
+    })
+  })
+
   it('accepts a valid token that only lacks the user scope', async () => {
     vi.stubGlobal(
       'fetch',

apps/sim/lib/credentials/workload-identity/responses.ts

@@ -20,11 +20,13 @@ function notConfigured() {
   return new NextResponse(null, { status: 404 })
 }
 
+/** The issuer's OpenID discovery document, or 404 when this deployment has no usable signing key. */
 export async function workloadIdentityDiscoveryResponse() {
   if (!(await isWorkloadIdentityConfigured())) return notConfigured()
   return NextResponse.json(getWorkloadIdentityDiscoveryDocument(), { headers: DISCOVERY_HEADERS })
 }
 
+/** The issuer's public signing keys (JWKS), or 404 when this deployment has no usable signing key. */
 export async function workloadIdentityJwksResponse() {
   const jwks = await getWorkloadIdentityJwks().catch(() => null)
   if (!jwks) return notConfigured()