refactor(oracle-epm): narrow shared infrastructure changes

Author: Bill Leoutsakos

apps/sim/lib/credentials/orchestration/index.test.ts

@@ -286,9 +286,6 @@ describe('performUpdateCredential — service-account secret rotation', () => {
   it('carries the stored dataCenter forward for a client-credential reconnect', async () => {
     mockCredential({ providerId: 'zoho-desk-service-account', displayName: 'Acme Desk' })
     mockIsClientCredentialAccountProviderId.mockReturnValue(true)
-    mockGetClientCredentialAccountDescriptor.mockReturnValue({
-      fields: [{ id: 'dataCenter' }],
-    } as never)
     mockStoredBlob({ type: 'client_credential_account', dataCenter: 'eu' })
     mockVerifyAndBuildServiceAccountSecret.mockResolvedValue({
       providerId: 'zoho-desk-service-account',
@@ -334,7 +331,6 @@ describe('performUpdateCredential — service-account secret rotation', () => {
     mockIsClientCredentialAccountProviderId.mockReturnValue(true)
     mockGetClientCredentialAccountDescriptor.mockReturnValue({
       defaultAuthMethod: 'client_credentials',
-      fields: [],
     } as never)
     mockStoredBlob({
       type: 'client_credential_account',
@@ -418,42 +414,6 @@ describe('performUpdateCredential — service-account secret rotation', () => {
     )
   })
 
-  it('threads Oracle EPM integration-user fields through reconnect without reading old secrets', async () => {
-    mockCredential({
-      providerId: 'oracle-epm-service-account',
-      displayName: 'Production EPM',
-    })
-    mockIsClientCredentialAccountProviderId.mockReturnValue(true)
-    mockGetClientCredentialAccountDescriptor.mockReturnValue({
-      fields: [{ id: 'orgId' }, { id: 'clientId' }, { id: 'clientSecret' }],
-    } as never)
-    mockStoredBlob({ type: 'client_credential_account' })
-    mockVerifyAndBuildServiceAccountSecret.mockResolvedValue({
-      providerId: 'oracle-epm-service-account',
-      encryptedServiceAccountKey: 'new-cipher',
-      displayName: 'Production EPM',
-      auditMetadata: {},
-    })
-
-    await performUpdateCredential({
-      credentialId: 'cred-1',
-      userId: 'user-1',
-      orgId: 'https://epm.example.com/gateway',
-      clientId: 'integration.user@example.com',
-      clientSecret: 'rotated-password',
-    })
-
-    expect(mockDecryptSecret).not.toHaveBeenCalled()
-    expect(mockVerifyAndBuildServiceAccountSecret).toHaveBeenCalledWith(
-      'oracle-epm-service-account',
-      expect.objectContaining({
-        orgId: 'https://epm.example.com/gateway',
-        clientId: 'integration.user@example.com',
-        clientSecret: 'rotated-password',
-      })
-    )
-  })
-
   it('surfaces a rebuild failure as a validation error and writes nothing', async () => {
     mockCredential()
     mockStoredBlob({ type: 'service_account', client_email: OLD_EMAIL })

apps/sim/lib/credentials/orchestration/index.ts

@@ -292,16 +292,12 @@ export async function updateCredentialRecord(
       // credential back to the US accounts server. Carry the stored value forward
       // when the caller did not supply one.
       const isClientCredentialProvider = isClientCredentialAccountProviderId(providerId)
-      const clientCredentialDescriptor = isClientCredentialProvider
-        ? getClientCredentialAccountDescriptor(providerId)
-        : undefined
-      const storesDataCenter = Boolean(
-        clientCredentialDescriptor?.fields.some((field) => field.id === 'dataCenter')
-      )
-      const needsStoredDataCenter = params.dataCenter === undefined && storesDataCenter
+      const needsStoredDataCenter = params.dataCenter === undefined && isClientCredentialProvider
       // Only a multi-grant provider stores these, so single-grant ones must not
       // pay for a row read + decrypt that can only ever return undefined.
-      const isMultiGrantProvider = Boolean(clientCredentialDescriptor?.defaultAuthMethod)
+      const isMultiGrantProvider = Boolean(
+        getClientCredentialAccountDescriptor(providerId)?.defaultAuthMethod
+      )
       const needsStoredAuthMethod = params.authMethod === undefined && isMultiGrantProvider
       const needsStoredUsername = params.username === undefined && isMultiGrantProvider
 

apps/sim/lib/oauth/token-resolution.test.ts

@@ -8,7 +8,6 @@ const {
   mockCaptureServerEvent,
   mockExecuteManagedToken,
   mockGetCredential,
-  mockGetServiceConfigByProviderId,
   mockGetToolMetadata,
   mockRecordAudit,
   mockRefreshTokenIfNeeded,
@@ -19,7 +18,6 @@ const {
   mockCaptureServerEvent: vi.fn(),
   mockExecuteManagedToken: vi.fn(),
   mockGetCredential: vi.fn(),
-  mockGetServiceConfigByProviderId: vi.fn(),
   mockGetToolMetadata: vi.fn(),
   mockRecordAudit: vi.fn(),
   mockRefreshTokenIfNeeded: vi.fn(),
@@ -80,14 +78,7 @@ vi.mock('@/tools/metadata', () => ({
 }))
 
 vi.mock('@/lib/oauth/utils', () => ({
-  credentialProviderMatchesService: (
-    credentialProviderId: string,
-    service: { providerId: string; serviceAccountProviderId?: string }
-  ) =>
-    credentialProviderId === service.providerId ||
-    credentialProviderId === service.serviceAccountProviderId,
   getCanonicalScopesForProvider: vi.fn().mockReturnValue([]),
-  getServiceConfigByProviderId: mockGetServiceConfigByProviderId,
 }))
 
 import { OrchestrationError } from '@/lib/core/orchestration/types'
@@ -360,10 +351,6 @@ describe('resolveCredentialAccessToken', () => {
     mockGetToolMetadata.mockReturnValue({
       oauth: { required: true, provider: 'google', requiredScopes: ['scope-a'] },
     })
-    mockGetServiceConfigByProviderId.mockReturnValue({
-      providerId: 'google',
-      serviceAccountProviderId: 'google-service-account',
-    })
   })
 
   it('authenticates and delegates non-managed credentials without a second account lookup', async () => {
@@ -424,212 +411,6 @@ describe('resolveCredentialAccessToken', () => {
     })
   })
 
-  it('rejects a credential whose provider does not match the tool service', async () => {
-    mockResolveOAuthAccountId.mockResolvedValue({
-      accountId: 'account-1',
-      credentialId: 'credential-1',
-      credentialType: 'service_account',
-      providerId: 'oracle-epm-service-account',
-      usedCredentialTable: true,
-    })
-    mockAuthorizeCredentialUseForAuth.mockResolvedValue({
-      ok: true,
-      requesterUserId: 'user-1',
-      credentialOwnerUserId: 'owner-1',
-      workspaceId: 'ws-1',
-      resolvedCredentialId: 'credential-1',
-    })
-
-    const result = await resolveCredentialAccessToken({
-      requestId: 'req-1',
-      credentialId: 'credential-1',
-      toolId: 'gmail_send',
-      authenticate,
-    })
-
-    expect(result).toEqual({
-      ok: false,
-      status: 403,
-      code: 'CREDENTIAL_PROVIDER_MISMATCH',
-      error: 'Credential does not match the tool service',
-    })
-    expect(mockGetServiceConfigByProviderId).toHaveBeenCalledWith('google')
-    expect(authenticate).toHaveBeenCalledTimes(1)
-    expect(mockResolveServiceAccountToken).not.toHaveBeenCalled()
-  })
-
-  it('does not reveal provider mismatches before credential authorization succeeds', async () => {
-    mockResolveOAuthAccountId.mockResolvedValue({
-      accountId: 'credential-1',
-      credentialId: 'credential-1',
-      credentialType: 'service_account',
-      providerId: 'oracle-epm-service-account',
-      usedCredentialTable: true,
-    })
-    mockAuthorizeCredentialUseForAuth.mockResolvedValue({ ok: false, error: 'Unauthorized' })
-
-    await expect(
-      resolveCredentialAccessToken({
-        requestId: 'req-1',
-        credentialId: 'credential-1',
-        toolId: 'gmail_send',
-        authenticate,
-      })
-    ).resolves.toEqual({ ok: false, status: 403, error: 'Unauthorized' })
-    expect(authenticate).toHaveBeenCalledTimes(1)
-    expect(mockResolveServiceAccountToken).not.toHaveBeenCalled()
-  })
-
-  it('accepts a shared service-account provider registered by the tool service', async () => {
-    mockResolveOAuthAccountId.mockResolvedValue({
-      accountId: 'credential-1',
-      credentialId: 'credential-1',
-      credentialType: 'service_account',
-      providerId: 'oracle-epm-service-account',
-      usedCredentialTable: true,
-    })
-    mockGetServiceConfigByProviderId.mockReturnValue({
-      providerId: 'synthetic-oracle-child',
-      serviceAccountProviderId: 'oracle-epm-service-account',
-    })
-    mockAuthorizeCredentialUseForAuth.mockResolvedValue({
-      ok: true,
-      requesterUserId: 'user-1',
-      credentialOwnerUserId: 'owner-1',
-      workspaceId: 'ws-1',
-      resolvedCredentialId: 'credential-1',
-    })
-    mockResolveServiceAccountToken.mockResolvedValue({
-      accessToken: 'basic-token',
-      instanceUrl: 'https://epm.example.com',
-    })
-
-    const result = await resolveCredentialAccessToken({
-      requestId: 'req-1',
-      credentialId: 'credential-1',
-      toolId: 'synthetic_oracle_tool',
-      authenticate,
-    })
-
-    expect(result).toEqual({
-      ok: true,
-      token: {
-        accessToken: 'basic-token',
-        credentialType: 'service_account',
-        instanceUrl: 'https://epm.example.com',
-      },
-    })
-  })
-
-  it('preserves an existing service-account tool without OAuth service metadata', async () => {
-    mockResolveOAuthAccountId.mockResolvedValue({
-      accountId: 'credential-1',
-      credentialId: 'credential-1',
-      credentialType: 'service_account',
-      providerId: 'claude-platform-service-account',
-      usedCredentialTable: true,
-    })
-    mockGetToolMetadata.mockReturnValue({ oauth: undefined })
-    mockAuthorizeCredentialUseForAuth.mockResolvedValue({
-      ok: true,
-      requesterUserId: 'user-1',
-      credentialOwnerUserId: 'owner-1',
-      workspaceId: 'ws-1',
-      resolvedCredentialId: 'credential-1',
-    })
-    mockResolveServiceAccountToken.mockResolvedValue({ accessToken: 'workspace-api-key' })
-
-    await expect(
-      resolveCredentialAccessToken({
-        requestId: 'req-1',
-        credentialId: 'credential-1',
-        toolId: 'managed_agent_run_session',
-        authenticate,
-      })
-    ).resolves.toEqual({
-      ok: true,
-      token: {
-        accessToken: 'workspace-api-key',
-        credentialType: 'service_account',
-        apiDomain: undefined,
-        authStyle: undefined,
-        cloudId: undefined,
-        domain: undefined,
-        instanceUrl: undefined,
-      },
-    })
-    expect(mockGetServiceConfigByProviderId).not.toHaveBeenCalled()
-    expect(mockResolveServiceAccountToken).toHaveBeenCalledWith(
-      'credential-1',
-      'claude-platform-service-account',
-      [],
-      undefined
-    )
-  })
-
-  it('fails closed when declared tool service metadata has no registered service', async () => {
-    mockResolveOAuthAccountId.mockResolvedValue({
-      accountId: 'credential-1',
-      credentialId: 'credential-1',
-      credentialType: 'service_account',
-      providerId: 'oracle-epm-service-account',
-      usedCredentialTable: true,
-    })
-    mockGetServiceConfigByProviderId.mockReturnValue(null)
-    mockAuthorizeCredentialUseForAuth.mockResolvedValue({
-      ok: true,
-      requesterUserId: 'user-1',
-      credentialOwnerUserId: 'owner-1',
-      workspaceId: 'ws-1',
-      resolvedCredentialId: 'credential-1',
-    })
-
-    await expect(
-      resolveCredentialAccessToken({
-        requestId: 'req-1',
-        credentialId: 'credential-1',
-        toolId: 'synthetic_oracle_tool',
-        authenticate,
-      })
-    ).resolves.toEqual({
-      ok: false,
-      status: 403,
-      code: 'CREDENTIAL_PROVIDER_MISMATCH',
-      error: 'Credential does not match the tool service',
-    })
-    expect(authenticate).toHaveBeenCalledTimes(1)
-    expect(mockResolveServiceAccountToken).not.toHaveBeenCalled()
-  })
-
-  it('rejects a mismatched OAuth account after loading its authoritative provider', async () => {
-    mockResolveOAuthAccountId.mockResolvedValue({
-      accountId: 'account-1',
-      usedCredentialTable: true,
-    })
-    mockAuthorizeCredentialUseForAuth.mockResolvedValue({
-      ok: true,
-      requesterUserId: 'user-1',
-      credentialOwnerUserId: 'owner-1',
-      resolvedCredentialId: 'account-1',
-    })
-    mockGetCredential.mockResolvedValue({ providerId: 'salesforce' })
-
-    const result = await resolveCredentialAccessToken({
-      requestId: 'req-1',
-      credentialId: 'credential-1',
-      toolId: 'gmail_send',
-      authenticate,
-    })
-
-    expect(result).toEqual({
-      ok: false,
-      status: 403,
-      code: 'CREDENTIAL_PROVIDER_MISMATCH',
-      error: 'Credential does not match the tool service',
-    })
-    expect(mockRefreshTokenIfNeeded).not.toHaveBeenCalled()
-  })
-
   it('rejects a managed credential when no delegation resolver is wired', async () => {
     mockResolveOAuthAccountId.mockResolvedValue(MANAGED_RESOLVED)