fix(credentials): close round-1 CI and review findings on alt auth

- Knowledge connector tests expect the service now passed with Google
  service-account token requests; a new test proves a JSON-key mint signs the
  same request with or without it.
- Re-record the tool-registry-boundary baseline: the keyless Snowflake,
  Microsoft app, and Google modules add 5 modules behind credential-service,
  which tipped credit-usage past its allowance on top of staging's drift.
- Docs compatibility baseline: record the new code examples in the Google and
  Snowflake service account pages.
- Generate the Microsoft certificate test fixture at run time instead of
  committing a PEM key and certificate.
- A Microsoft app credential reconnect opens on keyless only when the stored
  credential is federated (the prepare step now reports it), like Snowflake;
  new connections still default to keyless.
- TSDoc on the Google project number, pool/provider ID, and service account
  email validators.

Author: waleedlatif1

apps/docs/scripts/fixtures/content-baseline.json

@@ -67021,7 +67021,15 @@
           "line": 122
         }
       ],
-      "codeFences": [],
+      "codeFences": [
+        {
+          "lang": "bash",
+          "meta": null,
+          "sha256": "b867716c5b178cc345e9ec091ffd5db588c778b02f244e3e51513c9266fbaf8a",
+          "bytes": 733,
+          "line": 199
+        }
+      ],
       "links": [
         "https://console.cloud.google.com/",
         "#scopes-reference",
@@ -141488,12 +141496,19 @@
       ],
       "expressions": [],
       "codeFences": [
+        {
+          "lang": "sql",
+          "meta": null,
+          "sha256": "96716701cef0ce8a3205217105b932f669acc115ec2faed939bf81704eb83ed2",
+          "bytes": 169,
+          "line": 29
+        },
         {
           "lang": "sql",
           "meta": null,
           "sha256": "0fbd73d76ccb6a73e3f2f817a592bff15a0d1ffb45b4425fbfc91cc7ac0a48da",
           "bytes": 134,
-          "line": 46
+          "line": 94
         }
       ],
       "links": [

apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/microsoft-app-account-modal.tsx

@@ -89,9 +89,16 @@ function MicrosoftAppAccountForm({
   const [displayName, setDisplayName] = useState(initialDisplayName ?? '')
   const [description, setDescription] = useState(initialDescription ?? '')
 
-  // Keyless is the default wherever this deployment supports it.
-  const authType: MicrosoftAuthType =
-    selectedAuthType ?? (keyless.available ? 'federated' : 'client_secret')
+  // A reconnect opens on keyless only for a keyless credential, which has a subject to keep; a
+  // new connection defaults to keyless wherever this deployment supports it.
+  const defaultAuthType: MicrosoftAuthType = credentialId
+    ? keyless.reconnectsKeyless
+      ? 'federated'
+      : 'client_secret'
+    : keyless.available
+      ? 'federated'
+      : 'client_secret'
+  const authType: MicrosoftAuthType = selectedAuthType ?? defaultAuthType
   const disabled =
     isPending ||
     !tenantId.trim() ||

apps/sim/lib/api/contracts/credentials.ts

@@ -583,7 +583,7 @@ export const prepareWorkloadIdentityContract = defineRouteContract({
         /** Opaque proof submitted with the credential; binds the subject to its creator. */
         subjectProof: z.string(),
         expiresAt: z.string(),
-        /** The reconnected credential is keyless (Snowflake and Google only). */
+        /** The reconnected credential is keyless (Snowflake, Microsoft app, and Google only). */
         reconnectsKeyless: z.literal(true).optional(),
       }),
     ]),

apps/sim/lib/credentials/application/prepare-workload-identity.test.ts

@@ -59,7 +59,7 @@ function reconnecting(
   encryptionMockFns.mockDecryptSecret.mockResolvedValue({ decrypted: JSON.stringify(secret) })
 }
 
-function prepare(provider: 'snowflake' | 'google' = 'snowflake') {
+function prepare(provider: 'snowflake' | 'google' | 'microsoft' = 'snowflake') {
   return prepareWorkloadIdentity.execute({
     principal,
     input: { workspaceId: 'workspace-1', provider, credentialId: 'cred-1' },
@@ -154,3 +154,47 @@ describe('preparing a Google service account reconnect', () => {
     expect(encryptionMockFns.mockDecryptSecret).not.toHaveBeenCalled()
   })
 })
+
+describe('preparing a Microsoft app credential reconnect', () => {
+  const microsoft = { providerId: 'microsoft-app-service-account' }
+  const appConfig = {
+    tenantId: '11111111-2222-3333-4444-555555555555',
+    clientId: 'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee',
+  }
+
+  beforeEach(() => {
+    workspaceContextMockFns.mockLoadActiveWorkspaceApplicationContext.mockResolvedValue({
+      workspaceId: 'workspace-1',
+      workspaceOrganizationId: null,
+      allowPersonalApiKeys: true,
+      billedAccountUserId: 'user-1',
+    })
+    workspaceAuthzMockFns.mockResolveEffectiveWorkspacePermission.mockResolvedValue('write')
+  })
+
+  it('opens a federated credential on keyless', async () => {
+    reconnecting(
+      {
+        type: 'microsoft_app_credential_v1',
+        config: {
+          ...appConfig,
+          authType: 'federated',
+          subject: 'sim:workspace:workspace-1:credential:abcdef0123456789',
+        },
+      },
+      microsoft
+    )
+    await expect(prepare('microsoft')).resolves.toMatchObject({ reconnectsKeyless: true })
+  })
+
+  it.each([
+    { authType: 'client_secret', clientSecret: 'value' },
+    { authType: 'certificate', privateKey: 'key', certificate: 'cert' },
+  ])('opens a $authType credential on its keyed mode', async (mode) => {
+    reconnecting(
+      { type: 'microsoft_app_credential_v1', config: { ...appConfig, ...mode } },
+      microsoft
+    )
+    expect(await prepare('microsoft')).not.toHaveProperty('reconnectsKeyless')
+  })
+})

apps/sim/lib/credentials/application/prepare-workload-identity.ts

@@ -5,6 +5,7 @@ import { decryptSecret } from '@/lib/core/security/encryption'
 import { getCredentialActorContext } from '@/lib/credentials/access'
 import { credentialOperations } from '@/lib/credentials/application/operations'
 import { isGoogleWorkloadIdentitySecret } from '@/lib/credentials/google-workload-identity'
+import { isKeylessMicrosoftAppSecret } from '@/lib/credentials/microsoft-app-service-account.server'
 import { isKeylessSnowflakeSecret } from '@/lib/credentials/snowflake-service-account.server'
 import { SNOWFLAKE_SERVICE_ACCOUNT_PROVIDER_ID } from '@/lib/credentials/token-service-accounts/descriptors'
 import {
@@ -16,7 +17,10 @@ import {
   isWorkloadIdentityConfigured,
 } from '@/lib/credentials/workload-identity/issuer'
 import { issueWorkloadIdentitySubject } from '@/lib/credentials/workload-identity/subject'
-import { GOOGLE_SERVICE_ACCOUNT_PROVIDER_ID } from '@/lib/oauth/types'
+import {
+  GOOGLE_SERVICE_ACCOUNT_PROVIDER_ID,
+  MICROSOFT_APP_SERVICE_ACCOUNT_PROVIDER_ID,
+} from '@/lib/oauth/types'
 import { loadActiveWorkspaceApplicationContext } from '@/lib/workspaces/application/context'
 
 export interface PrepareWorkloadIdentityInput {
@@ -51,14 +55,18 @@ const MIXED_MODE_PROVIDERS: Partial<
     providerId: SNOWFLAKE_SERVICE_ACCOUNT_PROVIDER_ID,
     isKeyless: isKeylessSnowflakeSecret,
   },
+  microsoft: {
+    providerId: MICROSOFT_APP_SERVICE_ACCOUNT_PROVIDER_ID,
+    isKeyless: isKeylessMicrosoftAppSecret,
+  },
   google: {
     providerId: GOOGLE_SERVICE_ACCOUNT_PROVIDER_ID,
     isKeyless: isGoogleWorkloadIdentitySecret,
   },
 }
 
 /**
- * Whether a Snowflake or Google credential in this workspace, which this person
+ * Whether a Snowflake, Microsoft app, or Google credential in this workspace, which this person
  * administers, is keyless. Only that one bit leaves the stored secret, and only
  * for someone allowed to reconnect the credential.
  */

apps/sim/lib/credentials/google-workload-identity.ts

@@ -56,14 +56,27 @@ const POOL_OR_PROVIDER_ID_PATTERN = /^(?!gcp-)[a-z0-9-]{4,32}$/
 const SERVICE_ACCOUNT_EMAIL_PATTERN =
   /^[a-z][-a-z0-9]{4,28}[a-z0-9]@[a-z][-a-z0-9]{4,28}[a-z0-9]\.iam\.gserviceaccount\.com$/
 
+/**
+ * A Google Cloud project number: digits only, no leading zero, up to 20 digits
+ * (`123456789012`). The project ID (`my-project`) is not accepted.
+ */
 export function isGoogleProjectNumber(value: string): boolean {
   return PROJECT_NUMBER_PATTERN.test(value)
 }
 
+/**
+ * A workload identity pool or provider ID: 4-32 lowercase letters, digits, or
+ * hyphens, not starting with the reserved `gcp-` prefix.
+ */
 export function isGoogleWorkloadIdentityId(value: string): boolean {
   return POOL_OR_PROVIDER_ID_PATTERN.test(value)
 }
 
+/**
+ * A user-managed service account email, `<account-id>@<project-id>.iam.gserviceaccount.com`,
+ * where both IDs are 6-30 characters of lowercase letters, digits, and hyphens,
+ * start with a letter, and end with a letter or digit.
+ */
 export function isGoogleServiceAccountEmail(value: string): boolean {
   return SERVICE_ACCOUNT_EMAIL_PATTERN.test(value)
 }

apps/sim/lib/credentials/microsoft-app-service-account.server.test.ts

@@ -2,7 +2,13 @@
  * @vitest-environment node
  */
 
-import { createHash, createPublicKey, generateKeyPairSync, X509Certificate } from 'node:crypto'
+import {
+  createHash,
+  createPublicKey,
+  createSign,
+  generateKeyPairSync,
+  X509Certificate,
+} from 'node:crypto'
 import { queueTableRows, resetDbChainMock } from '@sim/testing'
 import { jsonResponse } from '@sim/testing/helpers/http'
 import { encryptionMock, encryptionMockFns } from '@sim/testing/mocks/encryption.mock'
@@ -24,57 +30,70 @@ import {
 import { issueWorkloadIdentitySubject } from '@/lib/credentials/workload-identity/subject'
 import { MICROSOFT_APP_SERVICE_ACCOUNT_PROVIDER_ID } from '@/lib/oauth/types'
 
-/** A throwaway self-signed test certificate (CN=sim-test-app) and its key; not used anywhere real. */
-const TEST_CERTIFICATE = [
-  '-----BEGIN CERTIFICATE-----',
-  'MIIC8DCCAdigAwIBAgIUQscAay/pQghX1nRRknLCHHuel/EwDQYJKoZIhvcNAQEL',
-  'BQAwFzEVMBMGA1UEAwwMc2ltLXRlc3QtYXBwMCAXDTI2MTExMDIzNDY1NVoYDzIx',
-  'MjYxMDE3MjM0NjU1WjAXMRUwEwYDVQQDDAxzaW0tdGVzdC1hcHAwggEiMA0GCSqG',
-  'SIb3DQEBAQUAA4IBDwAwggEKAoIBAQCWiZIqbXoaCMuDVJK8lAWogeXpcfbmlCAm',
-  'MnPJNSz751gOsfbHMOBLRaQp5fPqjqNodFw72R4Dpa4aETco5l4JlLUrRToK+y4m',
-  'BCDMN6vwyS+4GTJmO2nX1yvEEhYtHphqg/htnVxRoSzB08G0Bb/64CHe0X+DWs6M',
-  'CHtfyC9YTG+oc8S8N6Cw1BKV4o+v1C0yEDTjK77qS6YdulAVMjBfhz1cIBLzU/Uy',
-  '0Fzm7TAE/9h6gHODYxLW2POJeLPQ7uZBzT6uBDL4wYDWrk1iUK2TuTO+6GouKvoU',
-  'tYv2N4i7KKXur5wpbxDlNWUzBp0B4ozgR0K83Qteq02RShAoiyElAgMBAAGjMjAw',
-  'MB0GA1UdDgQWBBTVLn0q75C2SHJFPqk4VfXcvH9YWjAPBgNVHRMBAf8EBTADAQH/',
-  'MA0GCSqGSIb3DQEBCwUAA4IBAQBw3E87CJJs23t9GKlsh35nuVoHzXyJQXwjn32G',
-  'B6W87h58n/RnrBRRbCzwrGjXHlu6XsT2pwlBKdEezikaajmJhmYAVOSPbvHalnXt',
-  'TqpY9uvRl/RLnyEe36Y+BrYlr2MoWdsR8etj4aepBzJ8gxq6/tpHiq8ijqR2peCV',
-  'QZ/9UuoT8fub9DDxMMrwMmGT8hHGOvTh6342yl6EQkKLgV0klUDtfJLA5wPiitTZ',
-  'pdq7nWlDBGpX5MF1WumpW4CM30s7VAi+HuJZSI1AGg0akTfvcyirDUS/GtUoTwq0',
-  '/l8LVPe6TsEitCqMpetndCmQ1Y/2TN56MV5Ce1YSkqtYZxi3',
-  '-----END CERTIFICATE-----',
-].join('\n')
-const TEST_PRIVATE_KEY = [
-  '-----BEGIN PRIVATE KEY-----',
-  'MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQCWiZIqbXoaCMuD',
-  'VJK8lAWogeXpcfbmlCAmMnPJNSz751gOsfbHMOBLRaQp5fPqjqNodFw72R4Dpa4a',
-  'ETco5l4JlLUrRToK+y4mBCDMN6vwyS+4GTJmO2nX1yvEEhYtHphqg/htnVxRoSzB',
-  '08G0Bb/64CHe0X+DWs6MCHtfyC9YTG+oc8S8N6Cw1BKV4o+v1C0yEDTjK77qS6Yd',
-  'ulAVMjBfhz1cIBLzU/Uy0Fzm7TAE/9h6gHODYxLW2POJeLPQ7uZBzT6uBDL4wYDW',
-  'rk1iUK2TuTO+6GouKvoUtYv2N4i7KKXur5wpbxDlNWUzBp0B4ozgR0K83Qteq02R',
-  'ShAoiyElAgMBAAECggEASV7H1NIC/wlmV54y3qKul1CohD09f2iWusdAU8MNJ8G7',
-  '0329r5wM1eMdfiZL2fingFOmWK0byd9Imf/mCJMvJjBKlMpq3ctK1NCSQ7amoPcN',
-  'wQbW36j5j2+aLzg5gsg0tUWZIaPeyRJrRBU3hcx/o4D2QSmOorDxlqLTrv1cxgXL',
-  'SlnXPZqAHG6oJl8xLjWnb57ju3Y/qCGLCKAEkiCwVXosEOtxpTZmQc5a7SVVoFI0',
-  'oZCZyL8vhp96tKPg/Lm3BmontxS+B58QCfMRJs+6SXIZzUa07NjlHjz8PnXVqzVK',
-  'pf510iOW+yO+rtBb0CA6oHai5MN39c4xNxR0mvFryQKBgQDTc6Wr6pQFQ9NN/INf',
-  'sJIjRrF6wy2iIscjyUjymyhsKxAFtxs0iVVhZUqxCpfPLH80S6qYodVDf+S9KSN9',
-  'EI1Yjda4Py9MWtfWYB5smPMprcqQS/UsM0tsRZImmT7r1cES5vVUiN5SQrSqV5cb',
-  'GbhHfSRnYiwzDci81SHXBE4iewKBgQC2QJfn70t/amJVB1YeXrRL8urHL5KxWYAn',
-  '6JtiPHXg8ZajUav/zBugUeKaFqUmEedlXe9UlDChf4PzRxk0PwFE3a1Z+XaX0KsC',
-  '0rx6ZNsofbllX51z+CpxI930SFtuUsd2FmKmg6+PPz7BeQJDsbrpQ0Khr8ELaAed',
-  'ydk8DDHI3wKBgQCiudYeZmlBYAAGfTSQ+G6ObUH6SqgcpY0BUk8sPRGvpLgw3cg2',
-  '9xVY3b3MX22SxxihozWHPsvDpXHfzP/9qDZOluFOa3m31hVSaigfxNklExTXVU05',
-  'lcQOb7/YqoiMr7RlGo5kXuxQ+/rTOJMWDQYPJhRU521CYPJBt/fR5ANJbwKBgQCk',
-  'IcXsRdBbPmayJrpC/Y0n/Ou9WLWmbHEC//O347VRUKEWEj5xTtLubfBCTvSKNYOM',
-  'Aa3BIPgu6VTe6f/j0n4FFBLDPeu0y2LHVxwQqfXJIHivuA1n3G30mJWSIvvcfkZN',
-  'rdlIFr4rpoyQ1rbYWh53ZnCChnK3IAgD7T1rW5wWRwKBgQC2z0nf+2BAGkTYJcIr',
-  '7L36kA9k5jno2jWyYmtRmQJr3IN7BFLexor6n4Q/nLIrZrstOgq84Sh3rAhTTh+i',
-  'k4YG+ftqbkRwp7RKDpJ3s7mAC0qgNNKhnZAbDEDpmOV79sYch8v1UXw07q2mM5Hj',
-  'xS26LDt+YfIj/cwD+QkcBvZfwA==',
-  '-----END PRIVATE KEY-----',
-].join('\n')
+/** DER type-length-value, for the one self-signed certificate below. */
+function der(tag: number, ...parts: Buffer[]): Buffer {
+  const content = Buffer.concat(parts)
+  const length =
+    content.length < 0x80
+      ? Buffer.from([content.length])
+      : content.length < 0x100
+        ? Buffer.from([0x81, content.length])
+        : Buffer.from([0x82, content.length >> 8, content.length & 0xff])
+  return Buffer.concat([Buffer.from([tag]), length, content])
+}
+
+function derOid(oid: string): Buffer {
+  const [first, second, ...rest] = oid.split('.').map(Number)
+  const bytes = [first * 40 + second]
+  for (const arc of rest) {
+    const septets = [arc & 0x7f]
+    for (let value = arc >> 7; value > 0; value >>= 7) septets.unshift((value & 0x7f) | 0x80)
+    bytes.push(...septets)
+  }
+  return der(0x06, Buffer.from(bytes))
+}
+
+function derUtcTime(date: Date): Buffer {
+  const text = date.toISOString().replace(/[-:T]/g, '').slice(2, 14)
+  return der(0x17, Buffer.from(`${text}Z`))
+}
+
+/**
+ * A self-signed RSA certificate (CN=sim-test-app) generated for this test run,
+ * so no key material is committed.
+ */
+function generateTestCertificate(): { certificate: string; privateKey: string } {
+  const { privateKey, publicKey } = generateKeyPairSync('rsa', { modulusLength: 2048 })
+  const sha256WithRsa = der(0x30, derOid('1.2.840.113549.1.1.11'), der(0x05))
+  const name = der(
+    0x30,
+    der(0x31, der(0x30, derOid('2.5.4.3'), der(0x0c, Buffer.from('sim-test-app'))))
+  )
+  const now = Date.now()
+  const tbs = der(
+    0x30,
+    der(0xa0, der(0x02, Buffer.from([0x02]))),
+    der(0x02, Buffer.from([0x01])),
+    sha256WithRsa,
+    name,
+    der(0x30, derUtcTime(new Date(now - 86_400_000)), derUtcTime(new Date(now + 365 * 86_400_000))),
+    name,
+    publicKey.export({ type: 'spki', format: 'der' })
+  )
+  const signature = createSign('sha256').update(tbs).sign(privateKey)
+  const certificate = der(0x30, tbs, sha256WithRsa, der(0x03, Buffer.from([0x00]), signature))
+  const pem = (label: string, body: Buffer) =>
+    `-----BEGIN ${label}-----\n${body
+      .toString('base64')
+      .match(/.{1,64}/g)
+      ?.join('\n')}\n-----END ${label}-----`
+  return {
+    certificate: pem('CERTIFICATE', certificate),
+    privateKey: privateKey.export({ type: 'pkcs8', format: 'pem' }).toString(),
+  }
+}
+
+const { certificate: TEST_CERTIFICATE, privateKey: TEST_PRIVATE_KEY } = generateTestCertificate()
 
 const TENANT = '11111111-2222-3333-4444-555555555555'
 const CLIENT_ID = 'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee'

apps/sim/lib/credentials/microsoft-app-service-account.server.ts

@@ -455,6 +455,16 @@ async function verifyDataverseApplicationUser(environmentUrl: string, token: str
   )
 }
 
+/** Whether a decrypted Microsoft app credential secret is a keyless (federated) one. */
+export function isKeylessMicrosoftAppSecret(decrypted: string): boolean {
+  try {
+    const parsed = storedSecretSchema.safeParse(JSON.parse(decrypted))
+    return parsed.success && parsed.data.config.authType === 'federated'
+  } catch {
+    return false
+  }
+}
+
 function readStoredSubject(storedSecret: Record<string, unknown> | null | undefined) {
   const parsed = storedSecretSchema.safeParse(storedSecret)
   return parsed.success && parsed.data.config.authType === 'federated'

apps/sim/lib/knowledge/application/connectors.test.ts

@@ -388,7 +388,8 @@ describe('knowledge connector application use cases', () => {
               'https://www.googleapis.com/auth/admin.directory.domain.readonly',
             ]
           : ['https://www.googleapis.com/auth/drive.readonly'],
-        'admin@corp.com'
+        'admin@corp.com',
+        { service: 'google-drive' }
       )
     }
   )
@@ -993,7 +994,8 @@ describe('organization connector credential authorization', () => {
       googleDriveConnectorMeta.auth.mode === 'oauth'
         ? googleDriveConnectorMeta.auth.adminServiceAccountScopes
         : undefined,
-      'admin@corp.com'
+      'admin@corp.com',
+      { service: 'google-drive' }
     )
   })
 

apps/sim/lib/oauth/credential-service.test.ts

@@ -1215,6 +1215,22 @@ describe('Google service-account token minting', () => {
     expect(JSON.stringify(loggedCalls('error'))).not.toContain('xxxx')
   })
 
+  it('signs the same JSON-key request whether or not the caller names its service', async () => {
+    queueTableRows(credential, [row])
+    await getServiceAccountToken('credential-1', [driveScope], 'member@example.com')
+    queueTableRows(credential, [row])
+    await getServiceAccountToken('credential-1', [driveScope], 'member@example.com', {
+      service: 'google-drive',
+    })
+
+    const [withoutService, withService] = fetchMock.mock.calls.map(([url, init]) => [
+      String(url),
+      String(init?.body),
+    ])
+    expect(fetchMock).toHaveBeenCalledTimes(2)
+    expect(withService).toEqual(withoutService)
+  })
+
   describe('a keyless credential', () => {
     const keylessSecret = {
       decrypted: JSON.stringify({