revert(credentials): defer platform-wide provider enforcement

Author: Bill Leoutsakos

apps/sim/lib/oauth/token-resolution.test.ts

@@ -6,11 +6,8 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 const {
   mockAuthorizeCredentialUseForAuth,
   mockCaptureServerEvent,
-  mockCredentialProviderMatchesService,
   mockExecuteManagedToken,
   mockGetCredential,
-  mockGetServiceConfigByProviderId,
-  mockGetServiceConfigByServiceId,
   mockGetToolMetadata,
   mockRecordAudit,
   mockRefreshTokenIfNeeded,
@@ -19,11 +16,8 @@ const {
 } = vi.hoisted(() => ({
   mockAuthorizeCredentialUseForAuth: vi.fn(),
   mockCaptureServerEvent: vi.fn(),
-  mockCredentialProviderMatchesService: vi.fn(),
   mockExecuteManagedToken: vi.fn(),
   mockGetCredential: vi.fn(),
-  mockGetServiceConfigByProviderId: vi.fn(),
-  mockGetServiceConfigByServiceId: vi.fn(),
   mockGetToolMetadata: vi.fn(),
   mockRecordAudit: vi.fn(),
   mockRefreshTokenIfNeeded: vi.fn(),
@@ -84,10 +78,7 @@ vi.mock('@/tools/metadata', () => ({
 }))
 
 vi.mock('@/lib/oauth/utils', () => ({
-  credentialProviderMatchesService: mockCredentialProviderMatchesService,
   getCanonicalScopesForProvider: vi.fn().mockReturnValue([]),
-  getServiceConfigByProviderId: mockGetServiceConfigByProviderId,
-  getServiceConfigByServiceId: mockGetServiceConfigByServiceId,
 }))
 
 import { OrchestrationError } from '@/lib/core/orchestration/types'
@@ -355,12 +346,6 @@ describe('resolveCredentialAccessToken', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockResolveOAuthAccountId.mockResolvedValue(null)
-    mockCredentialProviderMatchesService.mockReturnValue(true)
-    mockGetServiceConfigByServiceId.mockReturnValue({
-      providerId: 'google',
-      serviceAccountProviderId: 'google-service-account',
-    })
-    mockGetServiceConfigByProviderId.mockReturnValue(null)
     authenticate.mockResolvedValue(INTERNAL_AUTH)
     resolveManagedPrincipal.mockResolvedValue(EXECUTOR_PRINCIPAL)
     mockGetToolMetadata.mockReturnValue({
@@ -426,160 +411,6 @@ describe('resolveCredentialAccessToken', () => {
     })
   })
 
-  it('rejects a service-account credential with no provider before authentication', async () => {
-    mockResolveOAuthAccountId.mockResolvedValue({
-      credentialType: 'service_account',
-      credentialId: 'service-account-1',
-      workspaceId: 'ws-1',
-      accountId: '',
-      usedCredentialTable: true,
-    })
-    mockGetToolMetadata.mockReturnValue({
-      oauth: {
-        required: true,
-        provider: 'google',
-        credentialKind: 'service-account',
-      },
-    })
-
-    await expect(
-      resolveCredentialAccessToken({
-        requestId: 'req-1',
-        credentialId: 'service-account-1',
-        toolId: 'google_service_account_tool',
-        authenticate,
-      })
-    ).resolves.toEqual({
-      ok: false,
-      status: 403,
-      code: 'CREDENTIAL_PROVIDER_MISMATCH',
-      error: 'Credential belongs to another service',
-    })
-    expect(authenticate).not.toHaveBeenCalled()
-    expect(mockResolveServiceAccountToken).not.toHaveBeenCalled()
-  })
-
-  it('rejects a service-account credential from another provider before authentication', async () => {
-    mockResolveOAuthAccountId.mockResolvedValue({
-      credentialType: 'service_account',
-      credentialId: 'service-account-1',
-      providerId: 'atlassian-service-account',
-      workspaceId: 'ws-1',
-      accountId: '',
-      usedCredentialTable: true,
-    })
-    mockGetToolMetadata.mockReturnValue({
-      oauth: {
-        required: true,
-        provider: 'google',
-        credentialKind: 'service-account',
-      },
-    })
-    mockCredentialProviderMatchesService.mockReturnValue(false)
-
-    await expect(
-      resolveCredentialAccessToken({
-        requestId: 'req-1',
-        credentialId: 'service-account-1',
-        toolId: 'google_service_account_tool',
-        authenticate,
-      })
-    ).resolves.toEqual({
-      ok: false,
-      status: 403,
-      code: 'CREDENTIAL_PROVIDER_MISMATCH',
-      error: 'Credential belongs to another service',
-    })
-    expect(authenticate).not.toHaveBeenCalled()
-    expect(mockResolveServiceAccountToken).not.toHaveBeenCalled()
-  })
-
-  it('accepts a non-Oracle service account whose provider matches the tool service', async () => {
-    mockResolveOAuthAccountId.mockResolvedValue({
-      credentialType: 'service_account',
-      credentialId: 'service-account-1',
-      providerId: 'google-service-account',
-      workspaceId: 'ws-1',
-      accountId: '',
-      usedCredentialTable: true,
-    })
-    mockGetToolMetadata.mockReturnValue({
-      oauth: {
-        required: true,
-        provider: 'google-email',
-        requiredScopes: ['scope-a'],
-        credentialKind: 'service-account',
-      },
-    })
-    mockGetServiceConfigByServiceId.mockReturnValue(null)
-    mockGetServiceConfigByProviderId.mockReturnValue({
-      providerId: 'google-email',
-      serviceAccountProviderId: 'google-service-account',
-    })
-    mockAuthorizeCredentialUseForAuth.mockResolvedValue({
-      ok: true,
-      requesterUserId: 'user-1',
-      workspaceId: 'ws-1',
-    })
-    mockResolveServiceAccountToken.mockResolvedValue({ accessToken: 'service-account-token' })
-
-    await expect(
-      resolveCredentialAccessToken({
-        requestId: 'req-1',
-        credentialId: 'service-account-1',
-        toolId: 'gmail_read',
-        scopes: ['scope-a'],
-        authenticate,
-      })
-    ).resolves.toMatchObject({
-      ok: true,
-      token: { accessToken: 'service-account-token', credentialType: 'service_account' },
-    })
-    expect(mockGetServiceConfigByProviderId).toHaveBeenCalledWith('google-email')
-    expect(mockResolveServiceAccountToken).toHaveBeenCalledWith(
-      'service-account-1',
-      'google-service-account',
-      ['scope-a'],
-      undefined
-    )
-  })
-
-  it.each([
-    ['an OAuth credential for a service-account-only tool', undefined, 'service-account'],
-    ['a service account for an OAuth-only tool', 'service_account', 'oauth'],
-  ])('rejects %s before authentication', async (_label, credentialType, requiredKind) => {
-    mockResolveOAuthAccountId.mockResolvedValue({
-      ...(credentialType ? { credentialType } : {}),
-      credentialId: 'credential-1',
-      providerId: credentialType ? 'google-service-account' : undefined,
-      workspaceId: 'ws-1',
-      accountId: credentialType ? '' : 'account-1',
-      usedCredentialTable: true,
-    })
-    mockGetToolMetadata.mockReturnValue({
-      oauth: {
-        required: true,
-        provider: 'google',
-        credentialKind: requiredKind,
-      },
-    })
-
-    const result = await resolveCredentialAccessToken({
-      requestId: 'req-1',
-      credentialId: 'credential-1',
-      toolId: 'kind_restricted_tool',
-      authenticate,
-    })
-
-    expect(result).toEqual({
-      ok: false,
-      status: 403,
-      code: 'CREDENTIAL_PROVIDER_MISMATCH',
-      error: 'Credential belongs to another service',
-    })
-    expect(authenticate).not.toHaveBeenCalled()
-  })
-
   it('rejects a managed credential when no delegation resolver is wired', async () => {
     mockResolveOAuthAccountId.mockResolvedValue(MANAGED_RESOLVED)
 

apps/sim/lib/oauth/token-resolution.ts

@@ -24,12 +24,7 @@ import {
   MICROSOFT_DATAVERSE_PROVIDER_ID,
 } from '@/lib/oauth/microsoft-dataverse'
 import { extractSalesforceInstanceUrl, isSalesforceOAuthProviderId } from '@/lib/oauth/salesforce'
-import {
-  credentialProviderMatchesService,
-  getCanonicalScopesForProvider,
-  getServiceConfigByProviderId,
-  getServiceConfigByServiceId,
-} from '@/lib/oauth/utils'
+import { getCanonicalScopesForProvider } from '@/lib/oauth/utils'
 import { captureServerEvent } from '@/lib/posthog/server'
 import { getToolMetadata } from '@/tools/metadata'
 import { extractZohoDeskBaseFromScope } from '@/tools/zoho_desk/host-allowlist'
@@ -337,46 +332,6 @@ export interface ResolveCredentialAccessTokenInput
   resolveManagedPrincipal?: (credentialId: string) => Promise<DelegatedPrincipal>
 }
 
-function credentialProviderMismatch(): ResolveCredentialTokenResult {
-  return {
-    ok: false,
-    status: 403,
-    code: 'CREDENTIAL_PROVIDER_MISMATCH',
-    error: 'Credential belongs to another service',
-  }
-}
-
-function validateToolCredentialBinding(
-  resolved: ResolvedCredential | null,
-  toolId: string | undefined,
-  toolMetadata: ReturnType<typeof getToolMetadata>
-): ResolveCredentialTokenResult | null {
-  if (!resolved || !toolId) return null
-
-  const oauth = toolMetadata?.oauth
-  const isServiceAccount = resolved.credentialType === 'service_account'
-  if (
-    oauth?.credentialKind === 'service-account'
-      ? !isServiceAccount
-      : oauth?.credentialKind === 'oauth' && isServiceAccount
-  ) {
-    return credentialProviderMismatch()
-  }
-  if (!isServiceAccount) return null
-
-  const service = oauth?.required
-    ? (getServiceConfigByServiceId(oauth.provider) ?? getServiceConfigByProviderId(oauth.provider))
-    : null
-  if (
-    !resolved.providerId ||
-    !service ||
-    !credentialProviderMatchesService(resolved.providerId, service)
-  ) {
-    return credentialProviderMismatch()
-  }
-  return null
-}
-
 /**
  * Authorized application dispatch behind `POST /api/auth/oauth/token`. Every server
  * surface that needs a credential token — the route and the in-process tool
@@ -388,10 +343,7 @@ export async function resolveCredentialAccessToken(
 ): Promise<ResolveCredentialTokenResult> {
   const { requestId, credentialId, toolId, auditRequest } = input
 
-  const toolMetadata = toolId ? getToolMetadata(toolId) : undefined
   const resolved = credentialId ? await resolveOAuthAccountId(credentialId) : null
-  const bindingError = validateToolCredentialBinding(resolved, toolId, toolMetadata)
-  if (bindingError) return bindingError
 
   if (resolved?.credentialType !== 'managed_oauth' || !resolved.credentialId) {
     const auth = await input.authenticate()
@@ -443,6 +395,7 @@ export async function resolveCredentialAccessToken(
     }
   }
 
+  const toolMetadata = getToolMetadata(toolId)
   if (!toolMetadata?.oauth?.required) {
     logger.error(`[${requestId}] Tool is not configured for managed OAuth`, { toolId })
     return {

apps/sim/lib/selectors/server/credentials.test.ts

@@ -125,83 +125,6 @@ describe('authorizeSelectorCredential', () => {
     expect(mocks.authorizeCredentialUse).not.toHaveBeenCalled()
   })
 
-  it('rejects a fixed token for a service-account-only selector', async () => {
-    await expect(
-      authorizeSelectorCredential({
-        principal,
-        context: { oauthCredential: 'xoxb-a' },
-        scope: { kind: 'workspace', workspaceId: 'workspace-1' },
-        workspaceId: 'workspace-1',
-        policy: {
-          kind: 'stored-or-fixed-token',
-          field: 'oauthCredential',
-          serviceIds: ['slack'],
-          tokenPrefixes: ['xoxb-'],
-          credentialKind: 'service-account',
-        },
-        protectedValues: createSelectorProtectedValues(),
-        references: new Map(),
-      })
-    ).rejects.toEqual(new SelectorConnectionUnavailableError())
-    expect(mocks.authorizeCredentialUse).not.toHaveBeenCalled()
-  })
-
-  it.each([
-    ['oauth', 'service-account'],
-    ['service_account', 'oauth'],
-  ] as const)(
-    'rejects a %s credential for a %s-only selector before provider resolution',
-    async (credentialType, credentialKind) => {
-      mocks.authorizeCredentialUse.mockResolvedValue({
-        ok: true,
-        workspaceId: 'workspace-1',
-        credentialOwnerUserId: 'owner-1',
-        resolvedCredentialId: 'credential-1',
-        credentialType,
-      })
-
-      await expect(
-        authorizeSelectorCredential({
-          principal,
-          context: { oauthCredential: 'credential-1' },
-          scope: { kind: 'workspace', workspaceId: 'workspace-1' },
-          workspaceId: 'workspace-1',
-          policy: { ...policy, credentialKind },
-          protectedValues: createSelectorProtectedValues(),
-          references: new Map(),
-        })
-      ).rejects.toEqual(new SelectorConnectionUnavailableError())
-      expect(mocks.credentialProviderMatchesService).not.toHaveBeenCalled()
-    }
-  )
-
-  it.each([
-    ['oauth', 'oauth'],
-    ['service_account', 'service-account'],
-  ] as const)('accepts a matching %s credential kind', async (credentialType, credentialKind) => {
-    mocks.authorizeCredentialUse.mockResolvedValue({
-      ok: true,
-      workspaceId: 'workspace-1',
-      credentialOwnerUserId: 'owner-1',
-      resolvedCredentialId: 'credential-1',
-      credentialType,
-    })
-    queueTableRows(credential, [{ accountId: 'account-1', providerId: 'google' }])
-    mocks.credentialProviderMatchesService.mockReturnValue(true)
-
-    await expect(
-      authorizeSelectorCredential({
-        principal,
-        context: { oauthCredential: 'credential-1' },
-        scope: { kind: 'workspace', workspaceId: 'workspace-1' },
-        workspaceId: 'workspace-1',
-        policy: { ...policy, credentialKind },
-        protectedValues: createSelectorProtectedValues(),
-        references: new Map(),
-      })
-    ).resolves.toMatchObject({ access: { credentialType } })
-  })
-
   it('conceals a stored credential whose trusted provider does not match the selector service', async () => {
     mocks.authorizeCredentialUse.mockResolvedValue({
       ok: true,

apps/sim/lib/selectors/server/credentials.ts

@@ -111,9 +111,6 @@ export async function authorizeSelectorCredential(input: {
     input.policy.kind === 'stored-or-fixed-token' &&
     input.policy.tokenPrefixes.some((prefix) => suppliedId.startsWith(prefix))
   ) {
-    if (input.policy.credentialKind === 'service-account') {
-      throw new SelectorConnectionUnavailableError()
-    }
     const reference = input.references.get(input.policy.field)
     if (reference && !reference.visible) {
       input.protectedValues.add(suppliedId, 'secret')
@@ -136,13 +133,6 @@ export async function authorizeSelectorCredential(input: {
   if (!access.ok || access.workspaceId !== input.workspaceId) {
     throw new SelectorConnectionUnavailableError()
   }
-  if (
-    input.policy.credentialKind === 'service-account'
-      ? access.credentialType !== 'service_account'
-      : input.policy.credentialKind === 'oauth' && access.credentialType === 'service_account'
-  ) {
-    throw new SelectorConnectionUnavailableError()
-  }
   input.protectedValues.add(access.resolvedCredentialId, 'reference')
 
   const providerId = await requireCredentialProviderBinding(