fix(oci): enforce credential and endpoint boundaries

Author: Bill Leoutsakos

apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/connect-service-account-modal.tsx

@@ -393,6 +393,9 @@ function OciApiKeyServiceAccountModal({
           }}
           placeholder='-----BEGIN PRIVATE KEY-----'
           minHeight={120}
+          className={
+            privateKey ? '[&_textarea:not(:focus)]:[-webkit-text-security:disc]' : undefined
+          }
           mono
           required
         />

apps/sim/lib/credentials/oci-api-key-service-account.server.test.ts

@@ -111,12 +111,12 @@ describe('OCI API-key credential setup', () => {
 
     await expect(
       verifyAndEncryptOciApiKeyCredential(fields({ privateKey: encryptedPrivateKey }))
-    ).rejects.toThrow('private key or passphrase')
+    ).rejects.toEqual(new OciCredentialVerificationError('invalid_credentials'))
     await expect(
       verifyAndEncryptOciApiKeyCredential(
         fields({ privateKey: encryptedPrivateKey, privateKeyPassphrase: passphrase.trim() })
       )
-    ).rejects.toThrow('private key or passphrase')
+    ).rejects.toEqual(new OciCredentialVerificationError('invalid_credentials'))
   })
 
   it('rejects malformed, non-RSA, and undersized keys before network or encryption', async () => {
@@ -134,7 +134,9 @@ describe('OCI API-key credential setup', () => {
       }),
     ]
     for (const invalid of cases) {
-      await expect(verifyAndEncryptOciApiKeyCredential(invalid)).rejects.toThrow()
+      await expect(verifyAndEncryptOciApiKeyCredential(invalid)).rejects.toEqual(
+        new OciCredentialVerificationError('invalid_credentials')
+      )
     }
     expect(dependencies.verifySetup).not.toHaveBeenCalled()
     expect(dependencies.encryptSecret).not.toHaveBeenCalled()
@@ -153,7 +155,9 @@ describe('OCI API-key credential setup', () => {
       fields({ tenancyOcid: `ocid1.tenancy.oc1..${'a'.repeat(240)}` }),
     ]
     for (const invalid of invalidCases) {
-      await expect(verifyAndEncryptOciApiKeyCredential(invalid)).rejects.toThrow()
+      await expect(verifyAndEncryptOciApiKeyCredential(invalid)).rejects.toEqual(
+        new OciCredentialVerificationError('invalid_credentials')
+      )
     }
     expect(dependencies.verifySetup).not.toHaveBeenCalled()
     expect(dependencies.encryptSecret).not.toHaveBeenCalled()

apps/sim/lib/credentials/oci-api-key-service-account.server.ts

@@ -170,7 +170,12 @@ export async function verifyAndEncryptOciApiKeyCredential(
   fields: OciApiKeyCredentialFields,
   signal?: AbortSignal
 ): Promise<{ encryptedServiceAccountKey: string; userOcid: string }> {
-  const secret = buildSecret(fields)
+  let secret: OciApiKeyServiceAccountSecret
+  try {
+    secret = buildSecret(fields)
+  } catch {
+    throw new OciCredentialVerificationError('invalid_credentials')
+  }
   let responseBody: Uint8Array
   try {
     responseBody = await verifyOciApiKeyCredentialForSetup(JSON.stringify(secret), signal)

apps/sim/lib/credentials/service-account-secret.test.ts

@@ -242,6 +242,29 @@ describe('verifyAndBuildServiceAccountSecret', () => {
     }
   )
 
+  it('classifies local OCI field validation as rejected credentials', async () => {
+    const { OciCredentialVerificationError } = await import(
+      '@/lib/credentials/oci-api-key-service-account.server'
+    )
+    mockVerifyAndEncryptOci.mockRejectedValue(
+      new OciCredentialVerificationError('invalid_credentials')
+    )
+
+    await expect(
+      verifyAndBuildServiceAccountSecret('oci-api-key-service-account', {
+        tenancyOcid: 'ocid1.tenancy.oc1..tenant',
+        userOcid: 'ocid1.user.oc1..principal',
+        fingerprint: 'invalid-fingerprint',
+        privateKey: 'invalid-key',
+        region: 'us-ashburn-1',
+      })
+    ).rejects.toMatchObject({
+      name: 'ServiceAccountSecretError',
+      message: 'OCI rejected the API-key credential',
+      providerErrorCode: 'invalid_credentials',
+    })
+  })
+
   it('does not misclassify an internal OCI credential failure as rejected credentials', async () => {
     const internalFailure = new Error('internal encryption failure')
     mockVerifyAndEncryptOci.mockRejectedValue(internalFailure)

apps/sim/lib/internal/oci/client.server.test.ts

@@ -78,7 +78,10 @@ import { OCI_SERVICE_ID } from '@/lib/oauth/types'
 // Fixed test material. The expected signatures were generated independently with
 // OpenSSL 3 against Oracle's Request Signatures specification (retrieved 2026-09-03):
 // https://docs.oracle.com/en-us/iaas/Content/API/Concepts/signingrequests.htm
-// The canonical header order is cross-checked against oci-common 2.140.0.
+// The Identity hostname is cross-checked against Oracle's API endpoint catalog:
+// https://docs.oracle.com/en-us/iaas/api/
+// The canonical header order and hostname template are cross-checked against
+// oci-common and oci-identity 2.140.1.
 // Keep the synthetic fixture's PEM delimiters split so secret scanners do not
 // mistake checked-in conformance material for a deployable credential.
 const PRIVATE_KEY = `${['-----BEGIN', 'PRIVATE KEY-----'].join(' ')}
@@ -128,6 +131,7 @@ const SECRET = JSON.stringify({
 const STATIC_POLICY = createOciStaticEndpointPolicy({
   serviceId: OCI_SERVICE_ID,
   serviceName: 'identity',
+  hostnameTemplate: 'regional-oci',
 })
 
 function secureResponse(params: {
@@ -239,6 +243,7 @@ describe('credential-bound OCI client', () => {
     const wrongPolicy = createOciStaticEndpointPolicy({
       serviceId: 'slack',
       serviceName: 'identity',
+      hostnameTemplate: 'regional-oci',
     })
     await expect(client.prepareStaticEndpoint(wrongPolicy)).rejects.toMatchObject({
       code: 'invalid_endpoint',
@@ -252,7 +257,7 @@ describe('credential-bound OCI client', () => {
       code: 'invalid_endpoint',
     })
     expect((await createPreparedClient({ region: 'eu-frankfurt-1' })).endpoint.origin).toBe(
-      'https://identity.eu-frankfurt-1.oraclecloud.com'
+      'https://identity.eu-frankfurt-1.oci.oraclecloud.com'
     )
   })
 
@@ -274,15 +279,15 @@ describe('credential-bound OCI client', () => {
 
     const authorization = authorizationFromLastRequest()
     expect(authorization).toBe(
-      'Signature version="1",keyId="ocid1.tenancy.oc1..aaaaaaaafixedvector/ocid1.user.oc1..aaaaaaaafixedvector/25:53:22:62:aa:db:ff:ef:f5:77:08:d1:a2:ed:8b:e6",algorithm="rsa-sha256",headers="x-date (request-target) host",signature="pcMhip57/dPnKl/dfg5usN7oT/illXEGUp9Oj2d9bpGb0aRMBJclgVFKRYdYXciUGPM/9vKluD5/eGPBO1Oh7w/6NCB8UX2Ejh/lw8merU1QalZ/OfHyj+wKNVOpqwQjNqettRUzSVMhCqImDnvgx8ygmVCvdc0CeLXf2ZF9iT1bYlDjOiuxOcWreN2rs1ZmfLCfal204nAjrNAvoBSgHCPVquAYnfsT2auOWP4QeHN/Hd/v7TvNqsWBFIaLCyWZOvRzpsw/ZLgLzB+jkuPTdL7l4hOZATUd7xy1QPFTJ0P1RlLHjZE1sH7hbrqVGORNXrVhA1LaArObz6GWPOOghA=="'
+      'Signature version="1",keyId="ocid1.tenancy.oc1..aaaaaaaafixedvector/ocid1.user.oc1..aaaaaaaafixedvector/25:53:22:62:aa:db:ff:ef:f5:77:08:d1:a2:ed:8b:e6",algorithm="rsa-sha256",headers="x-date (request-target) host",signature="szHTszQxwI2ewdVaeTurJY0ObT7qSjjTpXKLDRhnBp8g2hT1r2yxs4IaxN+wcrebh4i5tQYq5aBIuM3f5jOe4ng/e9+HCV+J8kHyRMxwk1b3nkqtImf8sPetp1ohD1XeWdT1gw5MSavC/C2mdHdDNlOrYAKD2vwxsKRbS6/C6ngRRcTispz6UU/ydmeYq3JjuFJezFPGWXRdqndM0dC+/ew19x08X/M6quZcxn9JZVw1E2YzSjq8xquLQYyISesVtpN81HEZ9KE9UOhbALNQAJcLCt6R3Su78aOR0S0vh19YkrwxCLbbTmPrVubksXsfZPcotbZmtXVIzNdLW0JpNg=="'
     )
 
     const signature = /signature="([^"]+)"/.exec(authorization)?.[1]
     expect(signature).toBeDefined()
     expect(
       verify(
         'RSA-SHA256',
-        'x-date: Thu, 03 Sep 2026 19:00:00 GMT\n(request-target): get /20160918/users?limit=10&name=Team%20X\nhost: identity.us-ashburn-1.oraclecloud.com',
+        'x-date: Thu, 03 Sep 2026 19:00:00 GMT\n(request-target): get /20160918/users?limit=10&name=Team%20X\nhost: identity.us-ashburn-1.oci.oraclecloud.com',
         createPublicKey(PRIVATE_KEY),
         Buffer.from(signature!, 'base64')
       )
@@ -304,7 +309,7 @@ describe('credential-bound OCI client', () => {
     })
 
     expect(authorizationFromLastRequest()).toBe(
-      'Signature version="1",keyId="ocid1.tenancy.oc1..aaaaaaaafixedvector/ocid1.user.oc1..aaaaaaaafixedvector/25:53:22:62:aa:db:ff:ef:f5:77:08:d1:a2:ed:8b:e6",algorithm="rsa-sha256",headers="x-date (request-target) host content-type content-length x-content-sha256",signature="vyhrwd21evtwFet82VT1FvKEeZV+JSa3VZuS5p4Pj8K2zeU88GO+tGx/voUK9TFHijF7eG5gGS6WWc6tigrByTocbVOHpLtPNgBo2+1NbTbGHGUZIzCOR5CZ1ite74Ak43xZjyKBm+vZHrvS22leVOJe43V/HjqCxqyPn3WkKd7npqo9eFM1sibdj1h3Cmi79b5nXSPFe5KE+rnMRPTOB4nl7iFELvubg/Y7Y8w5hRYEe13w09zw9tTBdGJtZIuMoYwZYzPdZo5wbrN5WM6ylHC2euVh2PSazZZU99q55uhxiR6OaCQWLM0buytCqja8FeiEY8Iw3GuEbKUECKaM8Q=="'
+      'Signature version="1",keyId="ocid1.tenancy.oc1..aaaaaaaafixedvector/ocid1.user.oc1..aaaaaaaafixedvector/25:53:22:62:aa:db:ff:ef:f5:77:08:d1:a2:ed:8b:e6",algorithm="rsa-sha256",headers="x-date (request-target) host content-type content-length x-content-sha256",signature="W2/OGoa2XuOin6+CQt32/+/lAXG5PWoamkAHr/k84oCYGUuub2mEYw1z9p4gc6/GPgeZ30wVp4DNVLzOjup3nJir1WsEsYzAk27XAIRVjxiQ7oBzCccnSnB88KLeNz1NDz7r4QPQGxZ50MBQEe0C+DEH2P+utpfFN73o7GCUhIN9hb27COg4l7ffdSLgjBWPN/B4AiZXpjz3I/GRHo29otGAhZ3MiX10gJTjy+qeAchAfmXmTx/nJqNhF0Aj255+B2lepCrHdkpcBpiTs5E+ppE6VvML0ByQ9ZLzBISB4MBljuFyey6tnTkueT73fqjQyM/OT+aO9HrAlemc3HSAXA=="'
     )
     expect(mocks.secureFetch.mock.calls[0][1].headers).toMatchObject({
       'content-length': '0',
@@ -337,7 +342,7 @@ describe('credential-bound OCI client', () => {
       { body: Uint8Array; headers: Record<string, string> },
     ]
     expect(url).toBe(
-      'https://identity.us-ashburn-1.oraclecloud.com/v1/%E2%98%83?z=last&a=&a=%20%21%27%28%29%2A'
+      'https://identity.us-ashburn-1.oci.oraclecloud.com/v1/%E2%98%83?z=last&a=&a=%20%21%27%28%29%2A'
     )
     expect([...options.body]).toEqual([...body])
     expect(options.body).not.toBe(body)
@@ -666,6 +671,7 @@ describe('credential-bound OCI client', () => {
     const policy = createOciDiscoveredEndpointPolicy({
       serviceId: OCI_SERVICE_ID,
       serviceName: 'database',
+      hostnameTemplate: 'regional',
       responsePolicy: STATIC_POLICY,
       source: { kind: 'json', path: ['endpoint'] },
     })
@@ -694,6 +700,7 @@ describe('credential-bound OCI client', () => {
     const otherPolicy = createOciStaticEndpointPolicy({
       serviceId: OCI_SERVICE_ID,
       serviceName: 'compute',
+      hostnameTemplate: 'regional',
     })
     const otherEndpoint = await first.client.prepareStaticEndpoint(otherPolicy)
     mocks.secureFetch.mockResolvedValueOnce(

apps/sim/lib/internal/oci/client.server.ts

@@ -875,6 +875,7 @@ export async function verifyOciApiKeyCredentialForSetup(
   const policy = createOciStaticEndpointPolicy({
     serviceId: OCI_SERVICE_ID,
     serviceName: 'objectstorage',
+    hostnameTemplate: 'regional',
   })
   const endpoint = resolveStaticOciEndpoint(policy, resolveEffectiveOciRegion(material.region))
   const url = buildRequestUrl(endpoint, '/n/', [])

apps/sim/lib/internal/oci/endpoints.test.ts

@@ -17,10 +17,12 @@ import { OCI_SERVICE_ID } from '@/lib/oauth/types'
 const staticPolicy = createOciStaticEndpointPolicy({
   serviceId: OCI_SERVICE_ID,
   serviceName: 'identity',
+  hostnameTemplate: 'regional-oci',
 })
 const discoveryPolicy = createOciDiscoveredEndpointPolicy({
   serviceId: OCI_SERVICE_ID,
   serviceName: 'database',
+  hostnameTemplate: 'regional',
   responsePolicy: staticPolicy,
   source: { kind: 'json', path: ['endpoint'] },
 })
@@ -33,7 +35,12 @@ describe('OCI region registry', () => {
       expect(region.id).toBe(id)
       expect(region.realm.id).toMatch(/^oc\d+$/)
       expect(region.realm.domain).toMatch(/^(?:oraclecloud|oraclegovcloud)/)
-      expect(regionalOciHostname('identity', region)).toBe(`identity.${id}.${region.realm.domain}`)
+      expect(regionalOciHostname('identity', region, 'regional-oci')).toBe(
+        `identity.${id}.oci.${region.realm.domain}`
+      )
+      expect(regionalOciHostname('objectstorage', region, 'regional')).toBe(
+        `objectstorage.${id}.${region.realm.domain}`
+      )
     }
   })
 
@@ -58,8 +65,8 @@ describe('OCI endpoint policies', () => {
     expect(Object.isFrozen(staticPolicy)).toBe(true)
     const endpoint = resolveStaticOciEndpoint(staticPolicy, region)
     expect(endpoint).toMatchObject({
-      origin: 'https://identity.us-ashburn-1.oraclecloud.com',
-      hostname: 'identity.us-ashburn-1.oraclecloud.com',
+      origin: 'https://identity.us-ashburn-1.oci.oraclecloud.com',
+      hostname: 'identity.us-ashburn-1.oci.oraclecloud.com',
       serviceId: OCI_SERVICE_ID,
       serviceName: 'identity',
       provenance: 'static',
@@ -69,7 +76,7 @@ describe('OCI endpoint policies', () => {
     expect(Object.isFrozen(endpoint.region.realm)).toBe(true)
     expect(Reflect.set(endpoint, 'origin', 'https://attacker.example')).toBe(false)
     expect(Reflect.set(endpoint.region, 'id', 'attacker-region-1')).toBe(false)
-    expect(endpoint.origin).toBe('https://identity.us-ashburn-1.oraclecloud.com')
+    expect(endpoint.origin).toBe('https://identity.us-ashburn-1.oci.oraclecloud.com')
     expect(endpoint.region.id).toBe('us-ashburn-1')
   })
 
@@ -104,6 +111,7 @@ describe('OCI endpoint policies', () => {
     const policy = createOciDiscoveredEndpointPolicy({
       serviceId: OCI_SERVICE_ID,
       serviceName: 'database',
+      hostnameTemplate: 'regional',
       responsePolicy: staticPolicy,
       source: { kind: 'header', name: 'Endpoint' },
       allowRegionalHost: true,
@@ -118,8 +126,19 @@ describe('OCI endpoint policies', () => {
 
   it('rejects malformed policy declarations and forged region mappings', () => {
     expect(() =>
-      createOciStaticEndpointPolicy({ serviceId: OCI_SERVICE_ID, serviceName: 'bad.name' })
+      createOciStaticEndpointPolicy({
+        serviceId: OCI_SERVICE_ID,
+        serviceName: 'bad.name',
+        hostnameTemplate: 'regional',
+      })
     ).toThrow('service name')
+    expect(() =>
+      createOciStaticEndpointPolicy({
+        serviceId: OCI_SERVICE_ID,
+        serviceName: 'identity',
+        hostnameTemplate: 'arbitrary' as never,
+      })
+    ).toThrow('hostname template')
     expect(() =>
       resolveStaticOciEndpoint(staticPolicy, {
         id: region.id,
@@ -130,9 +149,11 @@ describe('OCI endpoint policies', () => {
       createOciDiscoveredEndpointPolicy({
         serviceId: OCI_SERVICE_ID,
         serviceName: 'database',
+        hostnameTemplate: 'regional',
         responsePolicy: createOciStaticEndpointPolicy({
           serviceId: 'slack',
           serviceName: 'identity',
+          hostnameTemplate: 'regional-oci',
         }),
         source: { kind: 'json', path: ['endpoint'] },
       })

apps/sim/lib/internal/oci/endpoints.ts

@@ -2,6 +2,7 @@ import { isIpLiteral, unwrapIpv6Brackets } from '@sim/security/ssrf'
 import type { OAuthService } from '@/lib/oauth/types'
 
 export type OciDestinationProvenance = 'static' | 'authenticated-discovery'
+export type OciHostnameTemplate = 'regional' | 'regional-oci'
 
 export interface OciRealm {
   readonly id: string
@@ -32,6 +33,7 @@ export interface OciStaticEndpointPolicy {
   readonly kind: 'static'
   readonly serviceId: OAuthService
   readonly serviceName: string
+  readonly hostnameTemplate: OciHostnameTemplate
   readonly [ociEndpointPolicyBrand]: true
 }
 
@@ -43,6 +45,7 @@ export interface OciDiscoveredEndpointPolicy {
   readonly kind: 'authenticated-discovery'
   readonly serviceId: OAuthService
   readonly serviceName: string
+  readonly hostnameTemplate: OciHostnameTemplate
   readonly responsePolicy: OciEndpointPolicy
   readonly source: OciDiscoverySource
   readonly allowRegionalHost: boolean
@@ -203,6 +206,12 @@ function assertServiceName(value: string): void {
   }
 }
 
+function assertHostnameTemplate(value: OciHostnameTemplate): void {
+  if (value !== 'regional' && value !== 'regional-oci') {
+    throw new Error('OCI endpoint policy hostname template is invalid')
+  }
+}
+
 function assertDiscoverySource(source: OciDiscoverySource): void {
   if (source.kind === 'header') {
     if (!/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(source.name)) {
@@ -227,24 +236,29 @@ function assertDiscoverySource(source: OciDiscoverySource): void {
 export function createOciStaticEndpointPolicy(params: {
   serviceId: OAuthService
   serviceName: string
+  hostnameTemplate: OciHostnameTemplate
 }): OciStaticEndpointPolicy {
   assertServiceName(params.serviceName)
+  assertHostnameTemplate(params.hostnameTemplate)
   return Object.freeze({
     kind: 'static',
     serviceId: params.serviceId,
     serviceName: params.serviceName,
+    hostnameTemplate: params.hostnameTemplate,
   }) as OciStaticEndpointPolicy
 }
 
 /** Creates a frozen authenticated-discovery policy without executable hostname callbacks. */
 export function createOciDiscoveredEndpointPolicy(params: {
   serviceId: OAuthService
   serviceName: string
+  hostnameTemplate: OciHostnameTemplate
   responsePolicy: OciEndpointPolicy
   source: OciDiscoverySource
   allowRegionalHost?: boolean
 }): OciDiscoveredEndpointPolicy {
   assertServiceName(params.serviceName)
+  assertHostnameTemplate(params.hostnameTemplate)
   assertDiscoverySource(params.source)
   if (params.responsePolicy.serviceId !== params.serviceId) {
     throw new Error('OCI discovery source policy must have the same owning service')
@@ -257,15 +271,22 @@ export function createOciDiscoveredEndpointPolicy(params: {
     kind: 'authenticated-discovery',
     serviceId: params.serviceId,
     serviceName: params.serviceName,
+    hostnameTemplate: params.hostnameTemplate,
     responsePolicy: params.responsePolicy,
     source,
     allowRegionalHost: params.allowRegionalHost ?? false,
   }) as OciDiscoveredEndpointPolicy
 }
 
-export function regionalOciHostname(serviceName: string, region: OciRegion): string {
+export function regionalOciHostname(
+  serviceName: string,
+  region: OciRegion,
+  hostnameTemplate: OciHostnameTemplate
+): string {
   assertServiceName(serviceName)
-  return `${serviceName}.${region.id}.${region.realm.domain}`
+  assertHostnameTemplate(hostnameTemplate)
+  const ociLabel = hostnameTemplate === 'regional-oci' ? '.oci' : ''
+  return `${serviceName}.${region.id}${ociLabel}.${region.realm.domain}`
 }
 
 function validateOciOrigin(params: {
@@ -301,7 +322,11 @@ function validateOciOrigin(params: {
   ) {
     throw new Error('OCI destination must be an exact HTTPS origin with the default port')
   }
-  const regionalHostname = regionalOciHostname(params.policy.serviceName, knownRegion)
+  const regionalHostname = regionalOciHostname(
+    params.policy.serviceName,
+    knownRegion,
+    params.policy.hostnameTemplate
+  )
   const hostnameMatches =
     params.provenance === 'static'
       ? url.hostname === regionalHostname
@@ -327,7 +352,7 @@ export function resolveStaticOciEndpoint(
   policy: OciStaticEndpointPolicy,
   region: OciRegion
 ): OciPreparedEndpoint {
-  const hostname = regionalOciHostname(policy.serviceName, region)
+  const hostname = regionalOciHostname(policy.serviceName, region, policy.hostnameTemplate)
   return validateOciOrigin({
     origin: `https://${hostname}`,
     policy,