fix(credentials): close wave 4 review findings on keyless Google Cloud credentials

- Drop the tokeninfo check: a token from generateAccessToken already proves
  the provider accepted Sim's token and the impersonation binding, and
  tokeninfo puts a live token in a query string.
- Test that saving fails closed when the stray-subject pin probe hits an STS
  outage or an unreachable IAM endpoint.
- Pass --project=<project number> on all three gcloud setup commands, drop
  the unused Resource Manager API from the docs, and raise the shared
  validation error for an empty scope list.

Author: waleedlatif1

apps/docs/content/docs/integrations/google-service-account.mdx

@@ -185,7 +185,7 @@ Keyless credentials work with Google Cloud APIs that the service account calls a
 
 <Steps>
   <Step>
-    In the [Google Cloud Console](https://console.cloud.google.com/), enable the IAM, Resource Manager, Service Account Credentials, and Security Token Service APIs in the project that will hold the workload identity pool, and note its **project number** (on the project's Dashboard; it's numeric, not the project ID).
+    In the [Google Cloud Console](https://console.cloud.google.com/), enable the IAM, Service Account Credentials, and Security Token Service APIs in the project that will hold the workload identity pool, and note its **project number** (on the project's Dashboard; it's numeric, not the project ID).
   </Step>
   <Step>
     Create or pick a service account, and grant it the roles your workflows need (for example, BigQuery Data Viewer and BigQuery Job User, or Vertex AI User). No key is needed.
@@ -194,29 +194,32 @@ Keyless credentials work with Google Cloud APIs that the service account calls a
     In Sim, open the **Google BigQuery** integration, choose **Add service account**, and set **Authentication** to **Workload Identity Federation (keyless, via Sim OIDC)**. Enter the project number, a pool ID and provider ID (4 to 32 lowercase letters, digits, or hyphens, not starting with `gcp-`), and the service account email (`name@project-id.iam.gserviceaccount.com`).
   </Step>
   <Step>
-    The dialog shows the **Issuer**, **Audience**, and **Subject**, and three `gcloud` commands with your values filled in. Run them in that project. They create the pool, an OIDC provider for Sim's issuer with the attribute mapping `google.subject=assertion.sub` and an attribute condition that accepts only this credential's subject, and grant that subject `roles/iam.workloadIdentityUser` on the service account:
+    The dialog shows the **Issuer**, **Audience**, and **Subject**, and three `gcloud` commands with your values filled in. Run them in that project. They run against the project number you entered and create the pool, an OIDC provider for Sim's issuer with the attribute mapping `google.subject=assertion.sub` and an attribute condition that accepts only this credential's subject, and grant that subject `roles/iam.workloadIdentityUser` on the service account:
 
     ```bash
     gcloud iam workload-identity-pools create POOL_ID \
+        --project="PROJECT_NUMBER" \
         --location="global" \
         --display-name="Sim"
 
     gcloud iam workload-identity-pools providers create-oidc PROVIDER_ID \
+        --project="PROJECT_NUMBER" \
         --location="global" \
         --workload-identity-pool="POOL_ID" \
         --issuer-uri="ISSUER" \
         --attribute-mapping="google.subject=assertion.sub" \
         --attribute-condition="assertion.sub=='SUBJECT'"
 
     gcloud iam service-accounts add-iam-policy-binding SERVICE_ACCOUNT_EMAIL \
+        --project="PROJECT_NUMBER" \
         --role="roles/iam.workloadIdentityUser" \
         --member="principal://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/subject/SUBJECT"
     ```
 
     The provider sets no allowed audiences, so it accepts its own resource name, which is the **Audience** the dialog shows.
   </Step>
   <Step>
-    Save in Sim. Sim exchanges a token at STS, impersonates the service account, and confirms Google accepts the resulting token. It also checks that a subject no credential holds can't impersonate the service account, so only this credential can use it. New IAM bindings can take a few minutes to apply; if saving fails right after you run the commands, wait and try again.
+    Save in Sim. Sim exchanges a token at STS and impersonates the service account; a token from that step proves the setup works. It also checks that a subject no credential holds can't impersonate the service account, so only this credential can use it. New IAM bindings can take a few minutes to apply; if saving fails right after you run the commands, wait and try again.
   </Step>
 </Steps>
 

apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/google-keyless-fields.tsx

@@ -125,7 +125,7 @@ export function GoogleKeylessFields({ input, onChange, setup }: GoogleKeylessFie
         <ChipModalField
           type='custom'
           title='Setup commands'
-          hint='Run in the project above. They create the pool and an OIDC provider that accepts only this credential’s subject, then let that subject impersonate the service account.'
+          hint='They run in the project above and create the pool and an OIDC provider that accepts only this credential’s subject, then let that subject impersonate the service account.'
         >
           {(aria) => (
             <ChipTextarea

apps/sim/lib/credentials/google-workload-identity.server.test.ts

@@ -54,7 +54,7 @@ interface RecordedRequest {
 }
 
 /**
- * A fake Google STS, IAM Credentials, and tokeninfo. STS accepts a Sim token
+ * A fake Google STS and IAM Credentials. STS accepts a Sim token
  * only for the provider's own audience and for subjects `acceptSubject`
  * allows, and returns a federated token naming the subject; IAM lets the
  * subjects `canImpersonate` allows impersonate the service account.
@@ -114,9 +114,6 @@ function fakeGoogle(
         expireTime: new Date(Date.now() + 3600_000).toISOString(),
       })
     }
-    if (url.startsWith('https://oauth2.googleapis.com/tokeninfo?')) {
-      return jsonResponse({ scope: CLOUD_PLATFORM, expires_in: 3599 })
-    }
     return jsonResponse({}, 404)
   })
   return { sts, iam }
@@ -213,6 +210,35 @@ describe('saving a keyless Google Cloud credential', () => {
     expect(encryptionMockFns.mockEncryptSecret).not.toHaveBeenCalled()
   })
 
+  it.each([
+    {
+      label: 'STS is unavailable for the stray subject',
+      fail: (url: string, body: string) =>
+        url.startsWith('https://sts.') && !body.includes(SUBJECT)
+          ? jsonResponse({ error: 'temporarily_unavailable' }, 503)
+          : undefined,
+    },
+    {
+      label: 'IAM is unreachable for the stray subject',
+      fail: (url: string, _body: string, auth: string) => {
+        if (url.startsWith('https://iamcredentials.') && auth !== `Bearer fed:${SUBJECT}`) {
+          throw new TypeError('fetch failed')
+        }
+        return undefined
+      },
+    },
+  ])('refuses to save when it cannot confirm the subject is pinned: $label', async ({ fail }) => {
+    fakeGoogle(fetch, { canImpersonate: (subject) => subject === SUBJECT })
+    const google = fetch.getMockImplementation()
+    fetch.mockImplementation(async (url: string, init: RequestInit = {}) => {
+      const auth = new Headers(init.headers).get('authorization') ?? ''
+      return fail(url, String(init.body ?? ''), auth) ?? google?.(url, init)
+    })
+
+    await expect(save({})).rejects.toThrow(/could not confirm this service account trusts only/)
+    expect(encryptionMockFns.mockEncryptSecret).not.toHaveBeenCalled()
+  })
+
   it('saves when the provider’s attribute condition refuses every other subject', async () => {
     const google = fakeGoogle(fetch, { acceptSubject: (subject) => subject === SUBJECT })
 
@@ -344,6 +370,15 @@ describe('getting a keyless Google Cloud token for a run', () => {
     }
   )
 
+  it('refuses a request with no scopes in the shared validation shape', async () => {
+    fakeGoogle(fetch)
+
+    await expect(resolve({ credentialId: 'cred-no-scopes', scopes: [] })).rejects.toMatchObject({
+      code: 'invalid_credentials',
+    })
+    expect(fetch).not.toHaveBeenCalled()
+  })
+
   it('reuses a minted token until the stored secret changes', async () => {
     const google = fakeGoogle(fetch)
     await resolve({ credentialId: 'cred-cache' })

apps/sim/lib/credentials/google-workload-identity.server.ts

@@ -52,7 +52,6 @@ const SUBMITTED_AUTH_TYPE = 'workload_identity' as const
 
 const STS_TOKEN_URL = 'https://sts.googleapis.com/v1/token'
 const IAM_CREDENTIALS_ORIGIN = 'https://iamcredentials.googleapis.com'
-const TOKENINFO_URL = 'https://oauth2.googleapis.com/tokeninfo'
 const CLOUD_PLATFORM_SCOPE = 'https://www.googleapis.com/auth/cloud-platform'
 const TOKEN_EXCHANGE_GRANT = 'urn:ietf:params:oauth:grant-type:token-exchange'
 const ACCESS_TOKEN_TYPE = 'urn:ietf:params:oauth:token-type:access_token'
@@ -284,38 +283,6 @@ async function mintServiceAccountToken(
   return impersonateServiceAccount(config, federatedToken, scopes)
 }
 
-/**
- * Asks Google's tokeninfo endpoint about the impersonated token. It needs no
- * IAM role and no enabled API, unlike a Resource Manager or BigQuery read, so
- * it works for a service account that only holds BigQuery or Vertex AI roles.
- * @see https://docs.cloud.google.com/docs/authentication/token-types
- */
-async function confirmTokenAccepted(accessToken: string): Promise<void> {
-  let response: Response
-  try {
-    response = await fetch(`${TOKENINFO_URL}?access_token=${encodeURIComponent(accessToken)}`, {
-      headers: { Accept: 'application/json' },
-      redirect: 'error',
-      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-    })
-  } catch {
-    throw new GoogleWorkloadIdentityError('Could not reach Google Cloud. Try again.')
-  }
-  const info = (await response.json().catch(() => ({}))) as { scope?: unknown }
-  if (
-    response.status !== 200 ||
-    typeof info.scope !== 'string' ||
-    !info.scope.split(' ').includes(CLOUD_PLATFORM_SCOPE)
-  ) {
-    throw new GoogleWorkloadIdentityError(
-      isProviderOutage(response.status)
-        ? 'Google Cloud is unavailable. Try again.'
-        : 'Google Cloud did not accept the service account token it issued. Try again.',
-      response.status
-    )
-  }
-}
-
 function isRefusal(error: unknown): boolean {
   return (
     error instanceof GoogleWorkloadIdentityError &&
@@ -385,8 +352,7 @@ export interface GoogleWorkloadIdentitySaveResult {
 /**
  * Validates the submitted configuration, then proves it end to end: Sim's
  * token is exchanged at STS, the federated token impersonates the service
- * account, and Google accepts the resulting token. Alongside, a subject no
- * credential holds must be refused. Returns the encrypted blob.
+ * account. Alongside, a subject no credential holds must be refused. Returns the encrypted blob.
  */
 export async function verifyAndEncryptGoogleWorkloadIdentityCredential(
   serialized: string,
@@ -415,10 +381,9 @@ export async function verifyAndEncryptGoogleWorkloadIdentityCredential(
     throw new GoogleWorkloadIdentityError('This credential’s subject is too long for Google Cloud.')
   }
 
-  const verify = async () => {
-    const token = await mintServiceAccountToken(config, owner, [CLOUD_PLATFORM_SCOPE])
-    await confirmTokenAccepted(token.accessToken)
-  }
+  // A token from generateAccessToken proves the provider accepted Sim's token and the
+  // service account lets this subject impersonate it.
+  const verify = () => mintServiceAccountToken(config, owner, [CLOUD_PLATFORM_SCOPE])
   // The pin probe is independent of the verification, so both run at once; a
   // verification failure still reports first.
   const [verified, pinned] = await Promise.allSettled([
@@ -485,7 +450,10 @@ export async function resolveGoogleWorkloadIdentityToken(
     })
   }
   if (input.scopes.length === 0) {
-    throw new Error('Scopes are required for service account credentials')
+    throw new TokenServiceAccountValidationError('invalid_credentials', 400, {
+      step: 'google_keyless_scopes',
+      reason: 'scopes are required for service account credentials',
+    })
   }
   const scopeKey = [...new Set(input.scopes)].sort().join(' ')
   const cacheKey = `${input.credentialId}:${input.secretVersion}:${scopeKey}`

apps/sim/lib/credentials/google-workload-identity.ts

@@ -130,17 +130,20 @@ export function googleWorkloadIdentitySetupCommands(input: {
   const { ref, serviceAccountEmail, issuer, subject } = input
   return [
     `gcloud iam workload-identity-pools create ${ref.poolId} \\`,
+    `    --project="${ref.projectNumber}" \\`,
     '    --location="global" \\',
     '    --display-name="Sim"',
     '',
     `gcloud iam workload-identity-pools providers create-oidc ${ref.providerId} \\`,
+    `    --project="${ref.projectNumber}" \\`,
     '    --location="global" \\',
     `    --workload-identity-pool="${ref.poolId}" \\`,
     `    --issuer-uri="${issuer}" \\`,
     '    --attribute-mapping="google.subject=assertion.sub" \\',
     `    --attribute-condition="assertion.sub=='${subject}'"`,
     '',
     `gcloud iam service-accounts add-iam-policy-binding ${serviceAccountEmail} \\`,
+    `    --project="${ref.projectNumber}" \\`,
     '    --role="roles/iam.workloadIdentityUser" \\',
     `    --member="${googleWorkloadIdentityPrincipal(ref, subject)}"`,
   ].join('\n')