fix(credentials): fail Databricks verification on an oversized identity reply, cite the CLI docs

Author: waleedlatif1

apps/sim/lib/compare/data/sim.ts

@@ -143,6 +143,11 @@ export const simProfile: CompetitorProfile = {
             label: 'Sim Docs: Introduction (visual, natural-language, and API building)',
             asOf: '2026-11-10',
           },
+          {
+            url: 'https://docs.sim.ai/cli',
+            label: 'Sim Docs: CLI',
+            asOf: '2026-11-10',
+          },
         ],
       },
       learningCurve: {

apps/sim/lib/credentials/databricks-service-account.server.test.ts

@@ -48,6 +48,20 @@ describe('saving a Databricks connection', () => {
     )
   })
 
+  it('refuses an identity reply over the size cap instead of saving the host as the identity', async () => {
+    fetch.mockResolvedValue(
+      jsonResponse({ userName: 'me@example.com', groups: 'g'.repeat(1024 * 1024) })
+    )
+
+    await expect(
+      verifyAndEncryptDatabricksCredential(
+        patConfig('dbc-1234abcd-5678.cloud.databricks.com'),
+        owner
+      )
+    ).rejects.toThrow(/Could not verify/)
+    expect(encryptionMockFns.mockEncryptSecret).not.toHaveBeenCalled()
+  })
+
   it.each([
     'attacker.example.com',
     'https://attacker.example.com',

apps/sim/lib/credentials/databricks-service-account.server.ts

@@ -246,10 +246,15 @@ async function verifyWorkspaceIdentity(
       signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
     })
     if (!response.ok) throw new Error(`workspace returned HTTP ${response.status}`)
+    // A malformed body only loses the display name; an oversized one must fail
+    // verification rather than save the host as the identity.
     const me = (await readResponseJsonWithLimit(response, {
       maxBytes: MAX_RESPONSE_BYTES,
       label: 'Databricks identity response',
-    }).catch(() => ({}))) as {
+    }).catch((error: unknown) => {
+      if (error instanceof SyntaxError) return {}
+      throw error
+    })) as {
       userName?: unknown
       displayName?: unknown
     }