fix(oci): accept Oracle API key download markers

Author: Bill Leoutsakos

apps/sim/lib/credentials/oci-api-key-service-account.server.test.ts

@@ -101,6 +101,56 @@ describe('OCI API-key credential setup', () => {
     )
   })
 
+  it.each(['\n', '\r\n'])(
+    'accepts the exact Oracle download marker with %j line endings',
+    async (newline) => {
+      for (const [pem, keyPassphrase] of [
+        [privateKey, undefined],
+        [encryptedPrivateKey, passphrase],
+      ]) {
+        await verifyAndEncryptOciApiKeyCredential(
+          fields({
+            privateKey: `${pem}OCI_API_KEY\n`.replaceAll('\n', newline),
+            privateKeyPassphrase: keyPassphrase,
+          })
+        )
+        const serialized = dependencies.verifySetup.mock.lastCall![0]
+        expect(JSON.parse(serialized).privateKey).toBe(pem)
+        expect(dependencies.encryptSecret).toHaveBeenLastCalledWith(serialized)
+      }
+    }
+  )
+
+  it('rejects malformed download trailers before provider verification', async () => {
+    for (const suffix of [
+      'OCI_API_KEY_EXTRA',
+      'oci_api_key',
+      'OCI_API_KEY\nextra',
+      'extra\nOCI_API_KEY',
+      'OCI_API_KEY\nOCI_API_KEY',
+      '\u0000OCI_API_KEY',
+    ]) {
+      await expect(
+        verifyAndEncryptOciApiKeyCredential(fields({ privateKey: `${privateKey}${suffix}` }))
+      ).rejects.toEqual(new OciCredentialVerificationError('invalid_credentials'))
+    }
+    await expect(
+      verifyAndEncryptOciApiKeyCredential(
+        fields({ privateKey: `${privateKey}${' '.repeat(65536)}\nOCI_API_KEY` })
+      )
+    ).rejects.toEqual(new OciCredentialVerificationError('invalid_credentials'))
+    await expect(
+      verifyAndEncryptOciApiKeyCredential(
+        fields({
+          privateKey: `${privateKey}OCI_API_KEY`,
+          fingerprint: '00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00',
+        })
+      )
+    ).rejects.toEqual(new OciCredentialVerificationError('invalid_credentials'))
+    expect(dependencies.verifySetup).not.toHaveBeenCalled()
+    expect(dependencies.encryptSecret).not.toHaveBeenCalled()
+  })
+
   it('accepts encrypted RSA keys only with the exact preserved passphrase', async () => {
     await verifyAndEncryptOciApiKeyCredential(
       fields({ privateKey: encryptedPrivateKey, privateKeyPassphrase: passphrase })

apps/sim/lib/credentials/oci-api-key-service-account.server.ts

@@ -94,10 +94,17 @@ function normalizeFingerprint(value: unknown): string {
 function normalizePrivateKey(value: unknown): string {
   assertBoundedText(value, 'private key', MAX_PRIVATE_KEY_BYTES, PEM_CONTROL_CHARACTER_PATTERN)
   const normalized = value.replace(/\r\n?/g, '\n').trim()
-  if (!normalized.startsWith('-----BEGIN ') || !normalized.endsWith('-----')) {
+  const pem = normalized.endsWith('\nOCI_API_KEY')
+    ? normalized.slice(0, -'\nOCI_API_KEY'.length).trimEnd()
+    : normalized
+  if (
+    !/^-----BEGIN (PRIVATE KEY|RSA PRIVATE KEY|ENCRYPTED PRIVATE KEY)-----\n[\s\S]+\n-----END \1-----$/.test(
+      pem
+    )
+  ) {
     throw new Error('OCI private key must be PEM encoded')
   }
-  return `${normalized}\n`
+  return `${pem}\n`
 }
 
 function validatePassphrase(value: unknown): string | undefined {

apps/sim/lib/credentials/orchestration/credential-create.ts

@@ -545,7 +545,7 @@ export async function createCredentialRecord(
       return failure(
         providerUnavailable
           ? 'OCI is temporarily unavailable for credential verification'
-          : 'OCI rejected the API-key credential',
+          : 'OCI API-key credential could not be verified',
         'validation',
         { providerErrorCode, providerUnavailable }
       )

apps/sim/lib/credentials/orchestration/index.test.ts

@@ -230,7 +230,7 @@ describe('performUpdateCredential — service-account secret rotation', () => {
   })
 
   it.each([
-    ['invalid_credentials', 'invalid_credentials', 'OCI rejected the API-key credential'],
+    ['invalid_credentials', 'invalid_credentials', 'OCI API-key credential could not be verified'],
     [
       'service_unavailable',
       'provider_unavailable',
@@ -724,7 +724,12 @@ describe('createServiceAccountCredential', () => {
   })
 
   it.each([
-    ['invalid_credentials', 'invalid_credentials', false, 'OCI rejected the API-key credential'],
+    [
+      'invalid_credentials',
+      'invalid_credentials',
+      false,
+      'OCI API-key credential could not be verified',
+    ],
     [
       'service_unavailable',
       'provider_unavailable',

apps/sim/lib/credentials/orchestration/index.ts

@@ -412,7 +412,7 @@ export async function updateCredentialRecord(
             success: false,
             error: providerUnavailable
               ? 'OCI is temporarily unavailable for credential verification'
-              : 'OCI rejected the API-key credential',
+              : 'OCI API-key credential could not be verified',
             errorCode: 'validation',
             providerErrorCode: providerUnavailable ? 'provider_unavailable' : 'invalid_credentials',
           }