refactor(oracle-fusion): narrow shared infrastructure footprint

Author: Bill Leoutsakos

apps/docs/components/icons.tsx

@@ -9287,9 +9287,6 @@ export function NetSuiteIcon(props: SVGProps<SVGSVGElement>) {
   )
 }
 
-/** Oracle's red oval, shared by Oracle product integrations. */
-export const OracleIcon = NetSuiteIcon
-
 export function WizaIcon(props: SVGProps<SVGSVGElement>) {
   return (
     <svg {...props} viewBox='0 0 51 49' fill='none' xmlns='http://www.w3.org/2000/svg'>

apps/sim/components/icons.tsx

@@ -9287,9 +9287,6 @@ export function NetSuiteIcon(props: SVGProps<SVGSVGElement>) {
   )
 }
 
-/** Oracle's red oval, shared by Oracle product integrations. */
-export const OracleIcon = NetSuiteIcon
-
 export function WizaIcon(props: SVGProps<SVGSVGElement>) {
   return (
     <svg {...props} viewBox='0 0 51 49' fill='none' xmlns='http://www.w3.org/2000/svg'>

apps/sim/lib/credentials/service-account-secret.test.ts

@@ -282,7 +282,6 @@ describe('verifyAndBuildServiceAccountSecret', () => {
       clientId: ' integration-user ',
       clientSecret: ' password ',
       certificateId: 'discard-me',
-      dataCenter: 'discard-me',
       authMethod: 'discard-me',
       privateKey: 'discard-me',
       username: 'discard-me',

apps/sim/lib/credentials/service-account-secret.ts

@@ -299,7 +299,7 @@ async function buildClientCredentialAccountSecret(
       ? fields.certificateId?.trim() || undefined
       : undefined,
     orgId: fields.orgId?.trim() ?? '',
-    dataCenter: usesField('dataCenter') ? fields.dataCenter?.trim() || undefined : undefined,
+    dataCenter: fields.dataCenter?.trim() || undefined,
     authMethod: resolvedAuthMethod,
     clientSecret: usesField('clientSecret') ? fields.clientSecret?.trim() || undefined : undefined,
     privateKey: usesField('privateKey') ? fields.privateKey?.trim() || undefined : undefined,

apps/sim/lib/oauth/credential-service.test.ts

@@ -7,8 +7,6 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const mocks = vi.hoisted(() => ({
   coalesceLocally: vi.fn(),
-  clientCredentialMinter: vi.fn(),
-  decryptSecret: vi.fn(),
   getFreshestSlackChain: vi.fn(),
   getRecentTerminalError: vi.fn(),
   logger: {
@@ -35,15 +33,6 @@ vi.mock('@/lib/concurrency/leader-lock', () => ({
   withLeaderLock: mocks.withLeaderLock,
 }))
 
-vi.mock('@/lib/core/security/encryption', () => ({
-  decryptSecret: mocks.decryptSecret,
-}))
-
-vi.mock('@/lib/credentials/client-credential-accounts/server', () => ({
-  getClientCredentialAccountMinter: () => mocks.clientCredentialMinter,
-  parseClientCredentialAccountSecretBlob: (decrypted: string) => JSON.parse(decrypted),
-}))
-
 vi.mock('@/lib/oauth/instagram', () => ({
   isInstagramProvider: vi.fn(() => false),
   shouldProactivelyRefreshInstagramToken: vi.fn(() => false),
@@ -75,10 +64,7 @@ vi.mock('@/lib/oauth/terminal-errors', () => ({
   markCredentialDead: vi.fn(),
 }))
 
-import {
-  resolveCredentialTokenBundle,
-  resolveServiceAccountToken,
-} from '@/lib/oauth/credential-service'
+import { resolveCredentialTokenBundle } from '@/lib/oauth/credential-service'
 
 const RAW_CREDENTIAL_ID = 'credential-raw-secret-id'
 const RAW_ACCOUNT_ID = 'account-raw-secret-id'
@@ -214,51 +200,3 @@ describe('resolveCredentialTokenBundle selector privacy', () => {
     expect(slack.logs).toContain(RAW_PROVIDER_ERROR)
   })
 })
-
-describe('resolveServiceAccountToken Oracle Fusion cache', () => {
-  beforeEach(() => {
-    vi.clearAllMocks()
-    resetDbChainMock()
-    mocks.coalesceLocally.mockImplementation(
-      async (_key: string, producer: () => Promise<unknown>) => producer()
-    )
-    mocks.decryptSecret.mockImplementation(async (encrypted: string) => ({
-      decrypted: JSON.stringify({
-        type: 'client_credential_account',
-        providerId: 'oracle-fusion-service-account',
-        clientId: 'integration-user',
-        clientSecret: encrypted,
-        orgId: 'https://vision.fa.us2.oraclecloud.com',
-      }),
-    }))
-    mocks.clientCredentialMinter.mockImplementation(async (fields: { clientSecret: string }) => ({
-      accessToken: `basic-${fields.clientSecret}`,
-      expiresInSeconds: 300,
-      instanceUrl: 'https://vision.fa.us2.oraclecloud.com',
-    }))
-  })
-
-  it('reuses Basic material for five minutes and invalidates it on encrypted-secret rotation', async () => {
-    const credentialId = 'oracle-fusion-cache-test'
-    const providerId = 'oracle-fusion-service-account'
-    const encryptedV1 = 'encrypted-v1-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
-    const encryptedV2 = 'encrypted-v2-bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'
-
-    queueTableRows(credential, [{ encryptedServiceAccountKey: encryptedV1 }])
-    await expect(resolveServiceAccountToken(credentialId, providerId)).resolves.toMatchObject({
-      accessToken: `basic-${encryptedV1}`,
-    })
-
-    queueTableRows(credential, [{ encryptedServiceAccountKey: encryptedV1 }])
-    await expect(resolveServiceAccountToken(credentialId, providerId)).resolves.toMatchObject({
-      accessToken: `basic-${encryptedV1}`,
-    })
-    expect(mocks.clientCredentialMinter).toHaveBeenCalledTimes(1)
-
-    queueTableRows(credential, [{ encryptedServiceAccountKey: encryptedV2 }])
-    await expect(resolveServiceAccountToken(credentialId, providerId)).resolves.toMatchObject({
-      accessToken: `basic-${encryptedV2}`,
-    })
-    expect(mocks.clientCredentialMinter).toHaveBeenCalledTimes(2)
-  })
-})

apps/sim/lib/oauth/credential-service.ts

@@ -8,10 +8,7 @@ import { withLeaderLock } from '@/lib/concurrency/leader-lock'
 import { coalesceLocally } from '@/lib/concurrency/singleflight'
 import { env } from '@/lib/core/config/env'
 import { decryptSecret } from '@/lib/core/security/encryption'
-import {
-  isClientCredentialAccountProviderId,
-  ORACLE_FUSION_SERVICE_ACCOUNT_PROVIDER_ID,
-} from '@/lib/credentials/client-credential-accounts/descriptors'
+import { isClientCredentialAccountProviderId } from '@/lib/credentials/client-credential-accounts/descriptors'
 import {
   getClientCredentialAccountMinter,
   parseClientCredentialAccountSecretBlob,
@@ -469,13 +466,11 @@ interface FailedClientCredentialMint {
 
 /**
  * Per-instance cache of minted client-credential access tokens (Zoom S2S,
- * Box CCG, Salesforce, NetSuite, Oracle Fusion), keyed by credential id. Entries are
+ * Box CCG, Salesforce, NetSuite), keyed by credential id. Entries are
  * served while more than {@link CLIENT_CREDENTIAL_TOKEN_MIN_TTL_MS} of
  * validity remains, so a hot credential mints roughly once per token TTL
  * (~1h for Zoom/Box/NetSuite; Salesforce reports a conservative 10-minute TTL
- * because its responses never carry an expiry) per instance. Oracle Fusion's
- * locally derived, non-expiring Basic value instead uses its complete
- * five-minute synthetic lifetime.
+ * because its responses never carry an expiry) per instance.
  *
  * Every resolution re-reads the credential row (a cheap indexed PK select —
  * the mint is the expensive part) and validates the cached entry's secret
@@ -555,10 +550,7 @@ async function resolveClientCredentialAccountToken(
     if (
       cached &&
       cached.secretFingerprint === secretFingerprint &&
-      cached.expiresAtMs - Date.now() >
-        (providerId === ORACLE_FUSION_SERVICE_ACCOUNT_PROVIDER_ID
-          ? 0
-          : CLIENT_CREDENTIAL_TOKEN_MIN_TTL_MS)
+      cached.expiresAtMs - Date.now() > CLIENT_CREDENTIAL_TOKEN_MIN_TTL_MS
     ) {
       return {
         accessToken: cached.accessToken,