fix(credentials): keep Snowflake, Microsoft app, and Google keyless subjects unique

The subject-uniqueness scan from #9866 covered only AWS and Databricks. It now
also scans Snowflake, Microsoft app, and Google service account credentials,
so no two live credentials of an owner hold one keyless subject. Their keyed
secrets that carry no config (a Google JSON key, a Snowflake programmatic
access token) hold no subject and no longer read as unreadable. The three
keyless save paths report a newly bound subject so create checks it.

Author: waleedlatif1

apps/sim/lib/credentials/google-workload-identity.server.test.ts

@@ -264,7 +264,7 @@ describe('saving a keyless Google Cloud credential', () => {
 
     await expect(
       save({ subject: grant.subject, subjectProof: grant.subjectProof }, owner)
-    ).resolves.toMatchObject({ serviceAccountEmail: SA_EMAIL })
+    ).resolves.toMatchObject({ serviceAccountEmail: SA_EMAIL, newSubject: grant.subject })
   })
 
   it.each([

apps/sim/lib/credentials/google-workload-identity.server.ts

@@ -347,6 +347,8 @@ export interface GoogleWorkloadIdentitySaveResult {
   serviceAccountEmail: string
   /** The workload identity provider's resource name. */
   workloadIdentityProvider: string
+  /** A subject this save binds that the credential did not already hold. */
+  newSubject?: string
 }
 
 /**
@@ -405,6 +407,9 @@ export async function verifyAndEncryptGoogleWorkloadIdentityCredential(
     encryptedServiceAccountKey: encrypted,
     serviceAccountEmail: config.serviceAccountEmail,
     workloadIdentityProvider: googleWorkloadIdentityProviderName(config),
+    ...(config.subject !== readStoredSubject(owner.storedSecret)
+      ? { newSubject: config.subject }
+      : {}),
   }
 }
 

apps/sim/lib/credentials/microsoft-app-service-account.server.test.ts

@@ -231,6 +231,21 @@ describe('saving a Microsoft app credential', () => {
       expect(used).toContain(`sim-oidc|api://AzureADTokenExchange|${SUBJECT}`)
     })
 
+    it('reports a newly issued subject so the save can check no other credential holds it', async () => {
+      const grant = issueWorkloadIdentitySubject('microsoft', { workspaceId: 'ws-1' }, 'user-1')
+      fakeMicrosoft(fetch, {
+        acceptAssertion: (assertion) =>
+          assertion.endsWith(`|${grant.subject}`) || assertion.endsWith(`|${SUBJECT}`),
+      })
+
+      await expect(
+        save({ authType: 'federated', subject: grant.subject, subjectProof: grant.subjectProof })
+      ).resolves.toMatchObject({ newSubject: grant.subject })
+      await expect(save({ authType: 'federated' }, reconnectOwner)).resolves.not.toHaveProperty(
+        'newSubject'
+      )
+    })
+
     it('refuses an app that also accepts a subject no credential holds', async () => {
       fakeMicrosoft(fetch, { acceptAssertion: () => true })
 

apps/sim/lib/credentials/microsoft-app-service-account.server.ts

@@ -521,6 +521,8 @@ export interface MicrosoftAppCredentialSaveResult {
   /** The app's service principal object ID in the tenant. */
   servicePrincipalId: string
   tenantId: string
+  /** A subject this save binds that the credential did not already hold. */
+  newSubject?: string
 }
 
 /**
@@ -584,6 +586,9 @@ export async function verifyAndEncryptMicrosoftAppCredential(
     displayName: verified.value.displayName ?? config.clientId,
     servicePrincipalId: verified.value.id,
     tenantId: config.tenantId,
+    ...(config.authType === 'federated' && config.subject !== readStoredSubject(owner.storedSecret)
+      ? { newSubject: config.subject }
+      : {}),
   }
 }
 

apps/sim/lib/credentials/service-account-secret.ts

@@ -120,8 +120,8 @@ export interface ServiceAccountSecretResult {
   /** Slack custom bot: the derived bot user id (for reaction self-drop). */
   botUserId?: string
   /**
-   * Keyless AWS or Databricks: a subject this save binds that the credential did
-   * not already hold, which must not belong to another credential of the owner.
+   * Keyless AWS, Databricks, Snowflake, Microsoft app, or Google: a subject this save binds that
+   * the credential did not already hold, which must not belong to another credential of the owner.
    */
   newWorkloadIdentitySubject?: string
 }
@@ -301,6 +301,7 @@ async function buildGoogleWorkloadIdentitySecret(
       ...serviceAccountPrincipalMetadata(principal),
     },
     principal,
+    newWorkloadIdentitySubject: result.newSubject,
   }
 }
 
@@ -391,6 +392,7 @@ async function buildMicrosoftAppServiceAccountSecret(
       ...serviceAccountPrincipalMetadata(principal),
     },
     principal,
+    newWorkloadIdentitySubject: result.newSubject,
   }
 }
 

apps/sim/lib/credentials/snowflake-service-account.server.test.ts

@@ -117,6 +117,7 @@ describe('saving a keyless Snowflake connection', () => {
     )
 
     expect(saved.displayName).toBe('SIM_WORKFLOWS (MYORG-MYACCOUNT)')
+    expect(saved.newWorkloadIdentitySubject).toBe(grant.subject)
     expect(secureFetch.mock.calls[0][0]).toBe(`https://${HOST}/api/v2/statements`)
     expect(secureFetch.mock.calls[0][1]).toMatchObject({ maxRedirects: 0 })
     expect(fetch).not.toHaveBeenCalled()

apps/sim/lib/credentials/snowflake-service-account.server.ts

@@ -130,6 +130,8 @@ export interface SnowflakeKeylessSecret {
   displayName: string
   auditMetadata: Record<string, string>
   principal: ServiceAccountPrincipal | null
+  /** A subject this save binds that the credential did not already hold. */
+  newWorkloadIdentitySubject?: string
 }
 
 /**
@@ -194,6 +196,9 @@ export async function verifyAndEncryptSnowflakeKeylessCredential(
     displayName: validation.displayName,
     auditMetadata: { ...validation.auditMetadata, ...principalMetadata },
     principal: validation.principal,
+    ...(subject !== readStoredSubject(owner.storedSecret)
+      ? { newWorkloadIdentitySubject: subject }
+      : {}),
   }
 }
 

apps/sim/lib/credentials/workload-identity/subject.test.ts

@@ -1,13 +1,20 @@
 /**
  * @vitest-environment node
  */
-import { describe, expect, it } from 'vitest'
+import { flattenMockConditions } from '@sim/testing'
+import { encryptionMock, encryptionMockFns } from '@sim/testing/mocks/encryption.mock'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('@/lib/core/security/encryption', () => encryptionMock)
+
 import {
+  assertWorkloadIdentitySubjectUnclaimed,
   bindWorkloadIdentitySubject,
   issueWorkloadIdentitySubject,
   verifyWorkloadIdentitySubject,
   WorkloadIdentitySubjectError,
 } from '@/lib/credentials/workload-identity/subject'
+import type { DbTransaction } from '@/lib/db/types'
 
 const owner = { workspaceId: 'ws-1' }
 const now = Date.UTC(2026, 10, 6)
@@ -170,3 +177,112 @@ describe('binding a subject to a saved credential', () => {
     ).toThrow(WorkloadIdentitySubjectError)
   })
 })
+
+describe('keyless subject uniqueness across providers', () => {
+  const SUBJECT = 'sim:workspace:ws-1:credential:abcdef0123456789'
+
+  interface StoredCredential {
+    id: string
+    providerId: string
+    secret: object
+  }
+
+  /**
+   * A transaction whose credential query returns only the rows its provider
+   * filter admits, so a provider missing from the scan is never checked.
+   */
+  function transactionWith(rows: StoredCredential[]): DbTransaction {
+    encryptionMockFns.mockDecryptSecret.mockImplementation(async (encrypted: string) => ({
+      decrypted: JSON.stringify(rows.find((row) => row.id === encrypted)?.secret),
+    }))
+    const tx = {
+      execute: async () => [],
+      select: () => ({
+        from: () => ({
+          where: async (condition: unknown) => {
+            const providerFilter = flattenMockConditions(condition).find(
+              (node) => node.type === 'inArray'
+            )
+            const admitted = Array.isArray(providerFilter?.values) ? providerFilter.values : []
+            return rows
+              .filter((row) => admitted.includes(row.providerId))
+              .map((row) => ({
+                id: row.id,
+                displayName: row.id,
+                encryptedServiceAccountKey: row.id,
+              }))
+          },
+        }),
+      }),
+    }
+    return tx as unknown as DbTransaction
+  }
+
+  function claim(rows: StoredCredential[]) {
+    return assertWorkloadIdentitySubjectUnclaimed(transactionWith(rows), {
+      subject: SUBJECT,
+      scope: { kind: 'workspace', workspaceId: 'ws-1' },
+    })
+  }
+
+  beforeEach(() => {
+    encryptionMockFns.mockDecryptSecret.mockReset()
+  })
+
+  it.each([
+    {
+      providerId: 'snowflake-service-account',
+      secret: {
+        type: 'snowflake_workload_identity_v1',
+        config: {
+          authType: 'workload_identity',
+          host: 'org-acct.snowflakecomputing.com',
+          subject: SUBJECT,
+        },
+      },
+    },
+    {
+      providerId: 'microsoft-app-service-account',
+      secret: {
+        type: 'microsoft_app_credential_v1',
+        config: { authType: 'federated', tenantId: 't', clientId: 'c', subject: SUBJECT },
+      },
+    },
+    {
+      providerId: 'google-service-account',
+      secret: {
+        type: 'google_workload_identity_v1',
+        config: { projectNumber: '1', poolId: 'pool', providerId: 'prov', subject: SUBJECT },
+      },
+    },
+  ])(
+    'refuses a subject a live $providerId credential already holds',
+    async ({ providerId, secret }) => {
+      await expect(claim([{ id: 'held', providerId, secret }])).rejects.toThrow(
+        /Another credential already uses this trust setup/
+      )
+    }
+  )
+
+  it('is not blocked by key-based Google and Snowflake credentials, which hold no subject', async () => {
+    await expect(
+      claim([
+        {
+          id: 'json-key',
+          providerId: 'google-service-account',
+          secret: { type: 'service_account', client_email: 'sa@p.iam.gserviceaccount.com' },
+        },
+        {
+          id: 'pat',
+          providerId: 'snowflake-service-account',
+          secret: { type: 'token_service_account', apiToken: 'pat', domain: 'x' },
+        },
+        {
+          id: 'client-secret',
+          providerId: 'microsoft-app-service-account',
+          secret: { type: 'microsoft_app_credential_v1', config: { authType: 'client_secret' } },
+        },
+      ])
+    ).resolves.toBeUndefined()
+  })
+})

apps/sim/lib/credentials/workload-identity/subject.ts

@@ -9,17 +9,26 @@ import { env } from '@/lib/core/config/env'
 import type { ResourceScope } from '@/lib/core/resource-scope'
 import { resourceScopeCondition } from '@/lib/core/resource-scope.server'
 import { decryptSecret } from '@/lib/core/security/encryption'
+import {
+  SNOWFLAKE_SERVICE_ACCOUNT_PROVIDER_ID,
+  TOKEN_SERVICE_ACCOUNT_SECRET_TYPE,
+} from '@/lib/credentials/token-service-accounts/descriptors'
 import type { WorkloadIdentityProvider } from '@/lib/credentials/workload-identity/audiences'
 import type { WorkloadIdentityOwner } from '@/lib/credentials/workload-identity/issuer'
 import { acquireAdvisoryXactLock } from '@/lib/db/advisory-locks'
 import type { DbTransaction } from '@/lib/db/types'
 import {
   AWS_SERVICE_ACCOUNT_PROVIDER_ID,
   DATABRICKS_SERVICE_ACCOUNT_PROVIDER_ID,
+  GOOGLE_SERVICE_ACCOUNT_PROVIDER_ID,
+  MICROSOFT_APP_SERVICE_ACCOUNT_PROVIDER_ID,
 } from '@/lib/oauth/types'
 
 const logger = createLogger('WorkloadIdentitySubject')
 
+/** The `type` of a Google JSON key, stored verbatim. */
+const GOOGLE_SERVICE_ACCOUNT_KEY_TYPE = 'service_account'
+
 /**
  * Credential-scoped workload-identity subjects.
  *
@@ -179,18 +188,31 @@ export function bindWorkloadIdentitySubject(input: {
 const KEYLESS_PROVIDER_IDS = [
   AWS_SERVICE_ACCOUNT_PROVIDER_ID,
   DATABRICKS_SERVICE_ACCOUNT_PROVIDER_ID,
+  SNOWFLAKE_SERVICE_ACCOUNT_PROVIDER_ID,
+  MICROSOFT_APP_SERVICE_ACCOUNT_PROVIDER_ID,
+  GOOGLE_SERVICE_ACCOUNT_PROVIDER_ID,
 ]
 
-/** The part of an AWS or Databricks stored secret that can hold a bound subject. */
+/** The part of a keyless provider's stored secret that can hold a bound subject. */
 const storedSubjectSchema = z.object({
   config: z.object({ subject: z.string().optional() }),
 })
 
+/**
+ * Keyed secrets of those providers that have no `config` at all: a Google JSON
+ * key and a Snowflake programmatic access token. They hold no subject.
+ */
+const keyedSecretSchema = z.object({
+  type: z.enum([GOOGLE_SERVICE_ACCOUNT_KEY_TYPE, TOKEN_SERVICE_ACCOUNT_SECRET_TYPE]),
+})
+
 /** The subject a stored secret holds, `undefined` for a keyed mode, or `null` when unreadable. */
 async function readStoredSubject(encrypted: string): Promise<string | undefined | null> {
   try {
     const { decrypted } = await decryptSecret(encrypted)
-    const parsed = storedSubjectSchema.safeParse(JSON.parse(decrypted))
+    const blob: unknown = JSON.parse(decrypted)
+    if (keyedSecretSchema.safeParse(blob).success) return undefined
+    const parsed = storedSubjectSchema.safeParse(blob)
     return parsed.success ? parsed.data.config.subject : null
   } catch {
     return null