fix(bedrock): decide the AWS auth mode with one rule for fields and signing

A block signs with a saved AWS credential only when bedrockAuthMode is
'credential', the same rule that shows and serializes the picker. The
agent test no longer leaks a persistent mock rejection.

Author: waleedlatif1

apps/sim/blocks/blocks/agent.ts

@@ -565,7 +565,8 @@ Return ONLY the JSON array.`,
     },
     bedrockCredential: {
       type: 'string',
-      description: 'Saved AWS credential ID for Bedrock, used instead of access keys',
+      description:
+        "Saved AWS credential ID for Bedrock, used instead of access keys when bedrockAuthMode is 'credential'",
     },
     responseFormat: {
       type: 'json',

apps/sim/blocks/utils.test.ts

@@ -163,6 +163,24 @@ describe('getSelectedBedrockCredential', () => {
     ).toBeUndefined()
     expect(getSelectedBedrockCredential({})).toBeUndefined()
   })
+
+  it('signs with a credential exactly when the block shows and serializes the credential picker', () => {
+    const picker = getProviderCredentialSubBlocks().find(
+      (subBlock) => subBlock.id === 'bedrockCredential'
+    )
+    const cases: Record<string, unknown>[] = [
+      { bedrockCredential: 'cred-1' },
+      { bedrockAuthMode: '', bedrockCredential: 'cred-1' },
+      { bedrockAuthMode: 'access_keys', bedrockCredential: 'cred-1' },
+      { bedrockAuthMode: 'credential', bedrockCredential: 'cred-1' },
+    ]
+    for (const values of cases) {
+      const withModel = { model: 'bedrock/my-inference-profile', ...values }
+      expect(getSelectedBedrockCredential(values) !== undefined, JSON.stringify(values)).toBe(
+        evaluateSubBlockCondition(picker?.condition, withModel)
+      )
+    }
+  })
 })
 
 describe('getApiKeyCondition / shouldRequireApiKeyForModel', () => {

apps/sim/blocks/utils.ts

@@ -513,47 +513,49 @@ function getModelProviderCondition(...providerIds: ProviderId[]) {
 }
 
 /**
- * Bedrock fields shown for one AWS authentication mode. A block saved before
- * the mode existed has no `bedrockAuthMode` and keeps its access keys. Like
- * {@link getModelProviderCondition}, the answer is folded into a single `model`
- * clause, so blocks that wrap these fields in their own condition still can.
+ * Whether a block's Bedrock call signs with a saved AWS credential. The one rule
+ * behind both the fields a block shows and serializes and the credential its
+ * call uses: only an explicit `bedrockAuthMode: 'credential'` selects one, so a
+ * block saved before the mode existed (no `bedrockAuthMode`) keeps its access keys.
+ */
+function usesSavedBedrockCredential(values: { bedrockAuthMode?: unknown } | undefined): boolean {
+  return values?.bedrockAuthMode === 'credential'
+}
+
+/**
+ * Bedrock fields shown for one AWS authentication mode, decided by
+ * {@link usesSavedBedrockCredential}. Like {@link getModelProviderCondition}, the
+ * answer is folded into a single `model` clause.
  */
 function getBedrockAuthModeCondition(mode: 'access_keys' | 'credential') {
   return (values?: Record<string, unknown>) => {
     const model = typeof values?.model === 'string' ? values.model : ''
-    const usesCredential = values?.bedrockAuthMode === 'credential'
     return buildModelVisibilityCondition(
       model,
       findProviderFromModel(model.trim()) === 'bedrock' &&
-        usesCredential === (mode === 'credential')
+        usesSavedBedrockCredential(values) === (mode === 'credential')
     )
   }
 }
 
 /**
  * The saved AWS credential ID a block's Bedrock call signs with, or undefined
- * when the block uses access keys. A block saved before the auth mode existed
- * has no `bedrockAuthMode` and uses a credential only when one is set. A block
- * set to a saved credential whose ID resolves blank (an empty reference) is
- * refused, so its call never falls back to inline keys or the deployment's own
- * AWS credentials.
+ * when the block uses access keys (see {@link usesSavedBedrockCredential}). A
+ * block set to a saved credential whose ID resolves blank (an empty reference)
+ * is refused, so its call never falls back to inline keys or the deployment's
+ * own AWS credentials.
  */
-export function getSelectedBedrockCredential({
-  bedrockAuthMode,
-  bedrockCredential,
-}: {
+export function getSelectedBedrockCredential(values: {
   bedrockAuthMode?: unknown
   bedrockCredential?: unknown
 }): string | undefined {
-  if (bedrockAuthMode === 'access_keys') return undefined
-  const credentialId = typeof bedrockCredential === 'string' ? bedrockCredential.trim() : ''
+  if (!usesSavedBedrockCredential(values)) return undefined
+  const credentialId =
+    typeof values.bedrockCredential === 'string' ? values.bedrockCredential.trim() : ''
   if (credentialId) return credentialId
-  if (bedrockAuthMode === 'credential') {
-    throw new Error(
-      'Select an AWS credential for Bedrock, or switch AWS Authentication to access keys'
-    )
-  }
-  return undefined
+  throw new Error(
+    'Select an AWS credential for Bedrock, or switch AWS Authentication to access keys'
+  )
 }
 
 /**
@@ -727,7 +729,8 @@ export const PROVIDER_CREDENTIAL_INPUTS = {
   },
   bedrockCredential: {
     type: 'string',
-    description: 'Saved AWS credential ID for Bedrock, used instead of access keys',
+    description:
+      "Saved AWS credential ID for Bedrock, used instead of access keys when bedrockAuthMode is 'credential'",
   },
 } as const
 

apps/sim/executor/handlers/agent/handler.test.ts

@@ -1156,6 +1156,7 @@ describe('AgentBlockHandler', () => {
       await handler.execute(mockContext, mockBlock, {
         ...baseInputs,
         model: 'bedrock/claude',
+        bedrockAuthMode: 'credential',
         bedrockCredential: 'aws-cred',
         bedrockRegion: 'us-west-2',
       })
@@ -1175,19 +1176,19 @@ describe('AgentBlockHandler', () => {
     })
 
     it('fails a Bedrock call whose AWS credential cannot be used instead of sending it', async () => {
-      mockResolveBedrockCredentialSession.mockRejectedValue(
+      mockResolveBedrockCredentialSession.mockRejectedValueOnce(
         new Error('Not authorized to use this AWS credential')
       )
 
       await expect(
         handler.execute(mockContext, mockBlock, {
           ...baseInputs,
           model: 'bedrock/claude',
+          bedrockAuthMode: 'credential',
           bedrockCredential: 'aws-cred',
         })
       ).rejects.toThrow('Not authorized to use this AWS credential')
       expect(mockExecuteProviderRequest).not.toHaveBeenCalled()
-      mockResolveBedrockCredentialSession.mockReset()
     })
 
     it('fails a Bedrock call set to a saved AWS credential when the credential resolves blank', async () => {
@@ -1215,6 +1216,7 @@ describe('AgentBlockHandler', () => {
       await handler.execute(mockContext, mockBlock, {
         ...baseInputs,
         model: 'bedrock/claude',
+        bedrockAuthMode: 'credential',
         bedrockCredential: 'aws-cred',
         fallbackModels: [{ model: 'gpt-4o-mini' }],
       })

apps/sim/executor/handlers/evaluator/handler.test.ts

@@ -197,6 +197,7 @@ describe('EvaluatorBlockHandler', () => {
     await handler.execute(mockContext, mockBlock, {
       ...admissionInputs,
       model: 'bedrock/claude',
+      bedrockAuthMode: 'credential',
       bedrockCredential: 'aws-cred',
     })
 
@@ -240,6 +241,7 @@ describe('EvaluatorBlockHandler', () => {
     await handler.execute(mockContext, mockBlock, {
       ...admissionInputs,
       model: 'bedrock/claude',
+      bedrockAuthMode: 'credential',
       bedrockCredential: 'aws-cred',
       fallbackModels: [{ model: 'claude-sonnet-5' }],
     })
@@ -261,6 +263,7 @@ describe('EvaluatorBlockHandler', () => {
       handler.execute(mockContext, mockBlock, {
         ...admissionInputs,
         model: 'bedrock/claude',
+        bedrockAuthMode: 'credential',
         bedrockCredential: 'aws-cred',
       })
     ).rejects.toThrow('Not authorized to use this AWS credential')

apps/sim/executor/handlers/router/handler.test.ts

@@ -199,6 +199,7 @@ describe('RouterBlockHandler', () => {
     await handler.execute(mockContext, mockBlock, {
       prompt: 'Pick a destination',
       model: 'bedrock/claude',
+      bedrockAuthMode: 'credential',
       bedrockCredential: 'aws-cred',
     })
 
@@ -578,6 +579,7 @@ describe('RouterBlockHandler V2', () => {
       context: 'Help me',
       model: 'bedrock/claude',
       routes: [{ id: 'route-support', title: 'Support', value: 'Needs help' }],
+      bedrockAuthMode: 'credential',
       bedrockCredential: 'aws-cred',
     })