chore(credentials): cleanup pass

- Keyless setup query gets its own key root, so broad credential
  invalidations can't refetch an open setup and mint a new subject
- Named staleTime constant for the setup query
- Correct stale comments (relying parties, Databricks param names)
- Tighten tests: assert the refusal reason, make the BYOK guard reachable,
  drop a duplicate and a test that could not fail

Author: waleedlatif1

apps/sim/blocks/utils.ts

@@ -83,7 +83,7 @@ interface SavedCredentialOptions {
  * The fields of a credential-only successor to a block that takes inline
  * secrets. The legacy block keeps its own definition and keeps running; the
  * successor spreads it, then these fields swap its secret fields for a
- * required saved-credential picker in the same place. Fields that depended on
+ * saved-credential picker in the same place. Fields that depended on
  * a replaced secret depend on the credential instead.
  */
 export function withSavedCredential(

apps/sim/hooks/queries/scoped-credentials.ts

@@ -117,6 +117,19 @@ export function useUpdateScopedCredential() {
   })
 }
 
+/**
+ * Its own root, not under `workspaceCredentialKeys.all`: broad credential
+ * invalidations would refetch an open setup and mint a new subject mid-copy.
+ */
+const workloadIdentityKeys = {
+  all: ['workloadIdentitySetup'] as const,
+  setup: (workspaceId: string | undefined, provider: string, sessionKey: string) =>
+    [...workloadIdentityKeys.all, workspaceId ?? 'none', provider, sessionKey] as const,
+}
+
+/** A setup's subject is minted once per modal session and never refreshed. */
+const WORKLOAD_IDENTITY_SETUP_STALE_TIME = Number.POSITIVE_INFINITY
+
 /**
  * The trust setup for a new keyless AWS role or Databricks service principal:
  * the issuer to register and the signed subject it must trust. Each fetch
@@ -130,18 +143,14 @@ export function useWorkloadIdentitySetup(input: {
   enabled: boolean
 }) {
   return useQuery({
-    queryKey: workspaceCredentialKeys.workloadIdentity(
-      input.workspaceId,
-      input.provider,
-      input.sessionKey
-    ),
+    queryKey: workloadIdentityKeys.setup(input.workspaceId, input.provider, input.sessionKey),
     queryFn: async ({ signal }) =>
       requestJson(prepareWorkloadIdentityContract, {
         body: { workspaceId: input.workspaceId ?? '', provider: input.provider },
         signal,
       }),
     enabled: input.enabled && Boolean(input.workspaceId),
-    staleTime: Number.POSITIVE_INFINITY,
+    staleTime: WORKLOAD_IDENTITY_SETUP_STALE_TIME,
     gcTime: 0,
     retry: false,
     refetchOnWindowFocus: false,

apps/sim/hooks/queries/utils/credential-keys.ts

@@ -23,15 +23,6 @@ export const workspaceCredentialKeys = {
     workspaceId
       ? ([...workspaceCredentialKeys.detail(credentialId), 'workspace', workspaceId] as const)
       : workspaceCredentialKeys.detail(credentialId),
-  /** One keyless cloud setup per connect-modal session (each fetch mints a new subject). */
-  workloadIdentity: (workspaceId: string | undefined, provider: string, sessionKey: string) =>
-    [
-      ...workspaceCredentialKeys.all,
-      'workloadIdentity',
-      workspaceId ?? 'none',
-      provider,
-      sessionKey,
-    ] as const,
   members: (credentialId?: string) =>
     [...workspaceCredentialKeys.detail(credentialId), 'members'] as const,
   /**

apps/sim/lib/credentials/aws-service-account.server.test.ts

@@ -126,10 +126,4 @@ describe('loading a saved AWS credential for a run', () => {
       'AWS credential is unavailable'
     )
   })
-
-  it('refuses when the run has no owner scope at all', async () => {
-    await expect(getAwsCredentialConfig('cred-1', {})).rejects.toThrow(
-      'AWS credential is unavailable'
-    )
-  })
 })

apps/sim/lib/credentials/aws-service-account.server.ts

@@ -36,7 +36,7 @@ import { AWS_SERVICE_ACCOUNT_PROVIDER_ID } from '@/lib/oauth/types'
  * session token, IAM create access key) return the credentials they issue, as
  * the same operations do with inline keys. Using a credential therefore includes
  * issuing whatever its IAM permissions allow.
- * - `access_keys`: a long-lived IAM user key pair, used as-is (today's inline behavior).
+ * - `access_keys`: a long-lived IAM user key pair, used as-is, like inline keys.
  * - `assume_role`: a key pair that assumes a role, optionally with an external ID.
  * - `oidc_role`: no stored key at all — Sim signs a short-lived OIDC token for
  *   this credential's subject and exchanges it with STS for the customer's role.

apps/sim/lib/credentials/databricks-service-account.server.ts

@@ -21,15 +21,15 @@ import { DATABRICKS_SERVICE_ACCOUNT_PROVIDER_ID } from '@/lib/oauth/types'
 /**
  * Saved Databricks connections for the Databricks block.
  *
- * - `personal_access_token`: a PAT used as-is (today's inline behavior).
+ * - `personal_access_token`: a PAT used as-is, like an inline token.
  * - `service_principal`: OAuth machine-to-machine — the service principal's
  *   client ID and secret mint a workspace token per run.
  * - `oidc_federation`: no stored secret — Sim signs a short-lived OIDC token
  *   for this credential's subject and exchanges it (RFC 8693) for a token of
  *   the service principal whose federation policy trusts it.
  *
- * Every mode resolves server-side to a bearer token plus the workspace host,
- * which reach the tools as `accessToken` and `domain`.
+ * Every mode resolves server-side to a bearer token plus the workspace host
+ * (`accessToken`, `domain`), which fill the tools' `apiKey` and `host`.
  */
 
 const DATABRICKS_CREDENTIAL_SECRET_TYPE = 'databricks_credential_v1' as const

apps/sim/lib/credentials/token-service-accounts/validators/token-checks.ts

@@ -288,7 +288,6 @@ export const validateFirefliesServiceAccount = tokenCheckValidator({
  */
 const FLINT_VERIFY_URL = 'https://app.tryflint.com/api/v1/agent/tasks/bg-00000000-00000000'
 
-/** Verifies a Flint API key. */
 export async function validateFlintServiceAccount(
   fields: TokenServiceAccountFields
 ): Promise<TokenServiceAccountValidationResult> {

apps/sim/lib/credentials/workload-identity/responses.ts

@@ -6,7 +6,7 @@ import {
 } from '@/lib/credentials/workload-identity/issuer'
 
 /**
- * Cloud providers fetch these anonymously (AWS STS, Azure AD, Databricks) and
+ * Cloud providers fetch these anonymously (AWS STS, Databricks) and
  * cache them; five minutes keeps a key rotation visible quickly. "No issuer
  * here" is a 404 rather than an empty document, so a self-hosted deployment
  * without a signing key never advertises one.

apps/sim/lib/internal/aws/credentials.test.ts

@@ -154,12 +154,3 @@ describe('withAwsCredential', () => {
     expect(handler).not.toHaveBeenCalled()
   })
 })
-
-describe('awsClientCredentials', () => {
-  it('returns exactly the inline pair outside a saved-credential call', () => {
-    expect(awsClientCredentials('AKIAINLINE', 'inline-secret')).toStrictEqual({
-      accessKeyId: 'AKIAINLINE',
-      secretAccessKey: 'inline-secret',
-    })
-  })
-})

apps/sim/tools/index.test.ts

@@ -1161,7 +1161,10 @@ describe('executeTool Function', () => {
         { executionContext: context() }
       )
 
-      expect(result.success).toBe(false)
+      expect(result).toMatchObject({
+        success: false,
+        error: expect.stringContaining('requires a service-account credential'),
+      })
       expect(mockExecuteInternalToolOperation).not.toHaveBeenCalled()
     })
 
@@ -1175,7 +1178,7 @@ describe('executeTool Function', () => {
 
       mockValidateUrlWithDNS.mockResolvedValue({ isValid: true, resolvedIP: '52.216.0.1' })
       ;(tools as Record<string, unknown>).s3_get_object = s3GetObjectTool
-      const result = await executeTool(
+      await executeTool(
         's3_get_object',
         {
           s3Uri: 'https://bucket.s3.us-east-1.amazonaws.com/report.csv',
@@ -1184,7 +1187,6 @@ describe('executeTool Function', () => {
         { executionContext: context() }
       ).finally(() => Reflect.deleteProperty(tools, 's3_get_object'))
 
-      expect(result.error).not.toMatch(/sign|credential/i)
       expect(mockResolveAuthorizedAwsCredential).toHaveBeenCalledWith(
         'aws-credential',
         expect.objectContaining({ workspaceId: 'workspace-456', executionId: 'execution-1' }),
@@ -6800,7 +6802,12 @@ describe('Hosted Key Injection', () => {
       await executeTool(
         'test_hosted_saved_credential',
         { credential: 'saved-credential' },
-        { executionContext: createToolExecutionContext({ userId: 'user-1' }) }
+        {
+          executionContext: createToolExecutionContext({
+            userId: 'user-1',
+            workspaceId: 'workspace-456',
+          }),
+        }
       )
 
       expect(mockGetBYOKKey).not.toHaveBeenCalled()