fix(credentials): reopen a Platform reconnect on the credential's stored auth mode (#9878's reconnectAuthType)

Author: waleedlatif1

apps/sim/app/(product)/_components/service-account-modal/service-account-modal.dom.test.tsx

@@ -48,7 +48,9 @@ let container: HTMLDivElement
 let root: Root
 let requests: RecordedRequest[]
 /** The workload-identity setup; Google's has no fixed audience. */
-let keyless: (Omit<typeof TRUST, 'audience'> & { audience?: string }) | { available: false }
+let keyless:
+  | (Omit<typeof TRUST, 'audience'> & { audience?: string; reconnectAuthType?: string })
+  | { available: false; reconnectAuthType?: string }
 let createFailure: { status: number; body: unknown } | null
 let createdIds: string[]
 
@@ -381,6 +383,7 @@ it("shows the server's verification failure in the dialog", async () => {
 })
 
 it('reconnects in place, keeps the trusted subject by default and prefills no secret', async () => {
+  keyless = { ...TRUST, reconnectAuthType: 'oidc_role' }
   const dialog = await open('aws-service-account', 'AWS', {
     replacedAccount: { credentialId: 'cred-old', displayName: 'Prod role' },
   })
@@ -402,6 +405,16 @@ it('reconnects in place, keeps the trusted subject by default and prefills no se
   expect(createdIds).toEqual(['cred-old'])
 })
 
+it('reopens a reconnect on the stored keyed mode even where keyless is offered', async () => {
+  keyless = { ...TRUST, reconnectAuthType: 'access_keys' }
+  const dialog = await open('aws-service-account', 'AWS', {
+    replacedAccount: { credentialId: 'cred-old', displayName: 'Prod keys' },
+  })
+
+  expect(authTypeTrigger(dialog).textContent).toContain('Access keys')
+  expect(labelled(dialog, 'Role ARN')).toBeNull()
+})
+
 it('adds a keyless Snowflake service user: shows the CREATE USER statement and submits a bare host', async () => {
   keyless = { ...TRUST, audience: 'snowflakecomputing.com' }
   const dialog = await open('snowflake-service-account', 'Snowflake')

apps/sim/lib/credentials/config-service-accounts/descriptors.ts

@@ -75,11 +75,6 @@ export interface ConfigServiceAccountDescriptor {
   keyedDefault: string
   /** A new credential starts on `keyedDefault` even where keyless is offered (Google). */
   keyedFirst?: boolean
-  /**
-   * The workload-identity setup reports whether a reconnected credential is keyless, so a
-   * reconnect opens on keyless only for one that is (Snowflake, Microsoft, Google).
-   */
-  reconnectReportsMode?: boolean
   fields: readonly ConfigServiceAccountField[]
   /** Whether the keyless fields are complete enough to verify, beyond each being filled in. */
   keylessReady?: (values: Readonly<Record<string, string>>) => boolean
@@ -302,7 +297,6 @@ const SNOWFLAKE: ConfigServiceAccountDescriptor = {
     },
   ],
   keyedDefault: 'programmatic_access_token',
-  reconnectReportsMode: true,
   fields: [
     {
       id: 'host',
@@ -360,7 +354,6 @@ const MICROSOFT_APP: ConfigServiceAccountDescriptor = {
     { value: 'certificate', label: 'Certificate' },
   ],
   keyedDefault: 'client_secret',
-  reconnectReportsMode: true,
   fields: [
     {
       id: 'tenantId',
@@ -442,7 +435,6 @@ const GOOGLE_KEYLESS_DESCRIPTOR: ConfigServiceAccountDescriptor = {
   ],
   keyedDefault: 'json_key',
   keyedFirst: true,
-  reconnectReportsMode: true,
   fields: [
     {
       id: 'projectNumber',

apps/sim/platform/lib/data/credentials/config-service-account.ts

@@ -64,14 +64,15 @@ export function useConfigServiceAccountForm({
       ? DEPLOYMENT_KEYLESS_REASON
       : undefined
   const keylessType = descriptor.authTypes.find((type) => type.keyless)?.value
-  const reconnectsKeyless = Boolean(setup.data?.available && setup.data.reconnectsKeyless)
-  const startsKeyless =
-    reconnectCredentialId && descriptor.reconnectReportsMode
-      ? reconnectsKeyless
-      : !descriptor.keyedFirst || reconnectsKeyless
-  const authType =
-    selectedAuthType ??
-    (keylessAvailable && keylessType && startsKeyless ? keylessType : descriptor.keyedDefault)
+  const storedAuthType = descriptor.authTypes.find(
+    (type) => type.value === setup.data?.reconnectAuthType && (keylessAvailable || !type.keyless)
+  )?.value
+  const startingAuthType = reconnectCredentialId
+    ? (storedAuthType ?? descriptor.keyedDefault)
+    : keylessAvailable && keylessType && !descriptor.keyedFirst
+      ? keylessType
+      : descriptor.keyedDefault
+  const authType = selectedAuthType ?? startingAuthType
   const chosen = descriptor.authTypes.find((type) => type.value === authType)
   const keyless = Boolean(chosen?.keyless)
   const trust = setup.data?.available && subjectChoice === 'new' ? setup.data : undefined