fix(credentials): address review round 2

Ashby's restricted-key check reads the missing permission from object-shaped
error entries too, and a GitLab host that doesn't resolve is reported as not
found instead of the provider being unavailable.

Author: waleedlatif1

apps/sim/lib/credentials/token-service-accounts/validators/gitlab.test.ts

@@ -62,6 +62,18 @@ describe('GitLab saved token verification', () => {
     ).rejects.toMatchObject({ code: 'provider_unavailable' })
   })
 
+  it('reports a host that does not exist as not found, so the user fixes it instead of retrying', async () => {
+    fetch.mockRejectedValue(
+      new Error('url hostname could not be resolved', {
+        cause: Object.assign(new Error('getaddrinfo ENOTFOUND'), { code: 'ENOTFOUND' }),
+      })
+    )
+
+    await expect(
+      validateGitLabServiceAccount({ apiToken: 'glpat-x', domain: 'gitlab.exmaple.com' })
+    ).rejects.toMatchObject({ code: 'site_not_found' })
+  })
+
   it('reports an unreachable GitLab instance as unavailable, not as a bad token', async () => {
     fetch.mockResolvedValue(jsonResponse({ message: 'Bad Gateway' }, 502))
 

apps/sim/lib/credentials/token-service-accounts/validators/gitlab.ts

@@ -48,7 +48,14 @@ export async function validateGitLabServiceAccount(
         logUrlValidationDetails: false,
       }
     )
-  } catch {
+  } catch (error) {
+    // Only ENOTFOUND proves the host doesn't exist; other lookup and network failures may pass.
+    if ((error as { cause?: { code?: unknown } })?.cause?.code === 'ENOTFOUND') {
+      throw new TokenServiceAccountValidationError('site_not_found', 400, {
+        step: 'verify',
+        reason: 'host does not resolve',
+      })
+    }
     throw new TokenServiceAccountValidationError('provider_unavailable', 502, {
       step: 'verify',
       reason: 'could not reach the GitLab host',

apps/sim/lib/credentials/token-service-accounts/validators/token-checks.test.ts

@@ -155,6 +155,24 @@ describe('Ashby saved API key verification', () => {
     })
   })
 
+  it('accepts a valid key whose missing permission Ashby names in its errors list', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi
+        .fn()
+        .mockResolvedValue(
+          jsonResponse(
+            { success: false, errors: [{ message: 'missing_endpoint_permission' }] },
+            403
+          )
+        )
+    )
+
+    await expect(validateAshbyServiceAccount({ apiToken: 'scoped' })).resolves.toMatchObject({
+      displayName: 'Ashby',
+    })
+  })
+
   it('rejects a deactivated key Ashby answers with a 403', async () => {
     vi.stubGlobal(
       'fetch',

apps/sim/lib/credentials/token-service-accounts/validators/token-checks.ts

@@ -107,7 +107,10 @@ export const validateAshbyServiceAccount = tokenCheckValidator({
   }),
   provesKey: (errorBody) => {
     const { errorInfo, errors } = toRecord(errorBody)
-    return [toRecord(errorInfo).code, ...toArray(errors)].includes('missing_endpoint_permission')
+    const messages = toArray(errors).map((entry) =>
+      typeof entry === 'string' ? entry : toRecord(entry).message
+    )
+    return [toRecord(errorInfo).code, ...messages].includes('missing_endpoint_permission')
   },
 })