fix(credentials): decrypt Microsoft app secrets only on a token miss and scope the ADX operation

- Token cache key is named before decrypting, so a cached token skips the
  decrypt and parse; Azure Data Explorer authorization no longer decrypts,
  and its cluster key includes the resource's clouds.
- The ADX operation re-checks the credential against the run's workspace or
  organization, as the AWS operation path does.
- A credential in the wrong Microsoft cloud is refused as cloud_mismatch with
  its own message instead of "reconnect the credential"; ADX tool errors come
  from the refusal code, not log detail.
- The operation-minted service comes from the shared ADX credential config.
- Reconnect reopens a national-cloud credential on its stored cloud.
- China signs in at login.partner.microsoftonline.cn (Entra national-cloud
  reference) for both ADX auth paths; Kusto authorities derive from
  MICROSOFT_CLOUDS.
- Drop the one-line ADX operations passthrough; refresh TSDoc and the Power BI
  description.

Author: waleedlatif1

apps/docs/content/docs/integrations/microsoft-app-credentials.mdx

@@ -47,7 +47,7 @@ Every option resolves on Sim's servers at run time, and tokens never appear in b
 
 ## National clouds [#national-clouds]
 
-Choose the **Cloud** the app is registered in: **Global** (which includes Microsoft 365 GCC), **US Government (GCC High)**, **US Government (DoD)**, or **China (operated by 21Vianet)**. Each is a separate Microsoft Entra deployment, and tokens from one cloud don't work in another. Sim signs in at that cloud's endpoint (`login.microsoftonline.com`, `login.microsoftonline.us`, or `login.chinacloudapi.cn`) and checks the app against that cloud's Microsoft Graph when you save.
+Choose the **Cloud** the app is registered in: **Global** (which includes Microsoft 365 GCC), **US Government (GCC High)**, **US Government (DoD)**, or **China (operated by 21Vianet)**. Each is a separate Microsoft Entra deployment, and tokens from one cloud don't work in another. Sim signs in at that cloud's endpoint (`login.microsoftonline.com`, `login.microsoftonline.us`, or `login.partner.microsoftonline.cn`) and checks the app against that cloud's Microsoft Graph when you save.
 
 Only **Azure Data Explorer** runs outside the global cloud: a cluster in `kusto.usgovcloudapi.net` takes a US Government credential, and one in `kusto.chinacloudapi.cn` a China credential. The Azure AD, SharePoint, Intune, Power BI, Dataverse, and Dynamics 365 blocks call global-cloud endpoints, so they refuse a national-cloud credential, and a Dataverse environment URL can be saved only on a global credential.
 

apps/docs/content/docs/integrations/powerbi.mdx

@@ -29,7 +29,7 @@ Sim requests these scopes when someone connects a Power BI account. For a self-h
 
 ## Use the block [#usage-instructions]
 
-Connect a home-tenant organizational account through the Power BI Microsoft connection, or run as an app registration with a Microsoft app credential, to list named workspaces, inspect reports and semantic models, execute DAX queries, request standard refreshes, and read refresh history. Microsoft Graph connections cannot substitute for this delegated OAuth connection. An app credential needs the Power BI tenant setting that allows service principals to use Power BI APIs and its service principal added to each workspace as a Member or Admin; DAX queries do not run as a service principal against semantic models with row-level security or SSO. Self-hosted installations use the shared Microsoft app registration and register /api/auth/oauth2/callback/microsoft-powerbi as a Web redirect URI. Workspace listing supports a result limit, offset, and OData filter; reports and semantic models return flat lists. Read-only models may contain only their ID and name, and paginated reports may omit their semantic-model ID. Missing optional fields are null and do not establish permission or feature availability. Keep results small with summaries or TOPN: provider JSON reads are limited to 20 MiB, and workflow tool responses have a stricter 10 MiB inline budget. My Workspace, cross-tenant guest configuration, Credential Groups, impersonation, enhanced refresh, report exports, dashboards, and triggers are outside this version.
+Connect a home-tenant organizational account through the Power BI Microsoft connection, or run as an app registration with a Microsoft app credential, to list named workspaces, inspect reports and semantic models, execute DAX queries, request standard refreshes, and read refresh history. A Microsoft Graph connection cannot substitute for the Power BI connection or app credential. An app credential needs the Power BI tenant setting that allows service principals to use Power BI APIs and its service principal added to each workspace as a Member or Admin; DAX queries do not run as a service principal against semantic models with row-level security or SSO. Self-hosted installations use the shared Microsoft app registration and register /api/auth/oauth2/callback/microsoft-powerbi as a Web redirect URI. Workspace listing supports a result limit, offset, and OData filter; reports and semantic models return flat lists. Read-only models may contain only their ID and name, and paginated reports may omit their semantic-model ID. Missing optional fields are null and do not establish permission or feature availability. Keep results small with summaries or TOPN: provider JSON reads are limited to 20 MiB, and workflow tool responses have a stricter 10 MiB inline budget. My Workspace, cross-tenant guest configuration, Credential Groups, impersonation, enhanced refresh, report exports, dashboards, and triggers are outside this version.
 
 ## Actions
 

apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/keyless-connection.tsx

@@ -73,6 +73,8 @@ export function useKeylessSetup<P extends WorkloadIdentityProvider>({
     available: workspaceScoped ? setup.data?.available : false,
     /** The stored mode of the credential being reconnected; a reconnect reopens on it. */
     reconnectAuthType,
+    /** A reconnected Microsoft app credential's national cloud; a reconnect reopens on it. */
+    reconnectCloud: setup.data?.reconnectCloud,
     isReconnect: Boolean(credentialId),
     subjectChoice,
     setSubjectChoice,

apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/microsoft-app-account-modal.tsx

@@ -90,7 +90,7 @@ function MicrosoftAppAccountForm({
     onClose: () => onOpenChange(false),
   })
   const [selectedAuthType, setSelectedAuthType] = useState<MicrosoftAuthType | null>(null)
-  const [cloud, setCloud] = useState<MicrosoftCloudId>('global')
+  const [selectedCloud, setSelectedCloud] = useState<MicrosoftCloudId | null>(null)
   const [tenantId, setTenantId] = useState('')
   const [clientId, setClientId] = useState('')
   const [environmentUrl, setEnvironmentUrl] = useState('')
@@ -108,6 +108,8 @@ function MicrosoftAppAccountForm({
       ? 'federated'
       : 'client_secret'
   const authType: MicrosoftAuthType = selectedAuthType ?? defaultAuthType
+  // A reconnect also opens on the credential's stored cloud.
+  const cloud: MicrosoftCloudId = selectedCloud ?? keyless.reconnectCloud ?? 'global'
   const disabled =
     isPending ||
     !tenantId.trim() ||
@@ -172,7 +174,7 @@ function MicrosoftAppAccountForm({
           title='Cloud'
           value={cloud}
           onChange={(value) => {
-            setCloud(value as MicrosoftCloudId)
+            setSelectedCloud(value as MicrosoftCloudId)
             clearError()
           }}
           options={CLOUD_OPTIONS}

apps/sim/blocks/blocks/powerbi.ts

@@ -25,7 +25,7 @@ export const PowerBIBlock: BlockConfig = {
   type: 'powerbi',
   name: 'Power BI',
   description: 'Query semantic models and manage reports and refreshes',
-  longDescription: `Connect a home-tenant organizational account through the Power BI Microsoft connection, or run as an app registration with a Microsoft app credential, to list named workspaces, inspect reports and semantic models, execute DAX queries, request standard refreshes, and read refresh history. Microsoft Graph connections cannot substitute for this delegated OAuth connection. An app credential needs the Power BI tenant setting that allows service principals to use Power BI APIs and its service principal added to each workspace as a Member or Admin; DAX queries do not run as a service principal against semantic models with row-level security or SSO. Self-hosted installations use the shared Microsoft app registration and register /api/auth/oauth2/callback/microsoft-powerbi as a Web redirect URI. Workspace listing supports a result limit, offset, and OData filter; reports and semantic models return flat lists. Read-only models may contain only their ID and name, and paginated reports may omit their semantic-model ID. Missing optional fields are null and do not establish permission or feature availability. Keep results small with summaries or TOPN: provider JSON reads are limited to 20 MiB, and workflow tool responses have a stricter 10 MiB inline budget. My Workspace, cross-tenant guest configuration, Credential Groups, impersonation, enhanced refresh, report exports, dashboards, and triggers are outside this version.`,
+  longDescription: `Connect a home-tenant organizational account through the Power BI Microsoft connection, or run as an app registration with a Microsoft app credential, to list named workspaces, inspect reports and semantic models, execute DAX queries, request standard refreshes, and read refresh history. A Microsoft Graph connection cannot substitute for the Power BI connection or app credential. An app credential needs the Power BI tenant setting that allows service principals to use Power BI APIs and its service principal added to each workspace as a Member or Admin; DAX queries do not run as a service principal against semantic models with row-level security or SSO. Self-hosted installations use the shared Microsoft app registration and register /api/auth/oauth2/callback/microsoft-powerbi as a Web redirect URI. Workspace listing supports a result limit, offset, and OData filter; reports and semantic models return flat lists. Read-only models may contain only their ID and name, and paginated reports may omit their semantic-model ID. Missing optional fields are null and do not establish permission or feature availability. Keep results small with summaries or TOPN: provider JSON reads are limited to 20 MiB, and workflow tool responses have a stricter 10 MiB inline budget. My Workspace, cross-tenant guest configuration, Credential Groups, impersonation, enhanced refresh, report exports, dashboards, and triggers are outside this version.`,
   docsLink: 'https://docs.sim.ai/integrations/powerbi',
   category: 'tools',
   integrationType: IntegrationType.Analytics,

apps/sim/lib/api/contracts/credentials.ts

@@ -1,6 +1,7 @@
 import { z } from 'zod'
 import { organizationIdSchema, workspaceIdSchema } from '@/lib/api/contracts/primitives'
 import { defineRouteContract } from '@/lib/api/contracts/types'
+import { MICROSOFT_CLOUD_IDS } from '@/lib/credentials/microsoft-clouds'
 import {
   ATLASSIAN_PRODUCTS,
   getMissingServiceAccountFields,
@@ -574,6 +575,8 @@ export const createWorkspaceCredentialContract = defineRouteContract({
  */
 /** The reconnected credential's stored auth mode, so the dialog reopens on it. */
 const reconnectAuthTypeSchema = z.enum(WORKLOAD_IDENTITY_AUTH_TYPE_LIST).optional()
+/** A reconnected Microsoft app credential's national cloud, absent for the global cloud. */
+const reconnectCloudSchema = z.enum(MICROSOFT_CLOUD_IDS).optional()
 
 export const workloadIdentitySubjectGrantShape = {
   issuer: z
@@ -613,11 +616,16 @@ export const prepareWorkloadIdentityContract = defineRouteContract({
     mode: 'json',
     schema: z.discriminatedUnion('available', [
       /** This deployment has no workload-identity signing key; offer key-based modes only. */
-      z.object({ available: z.literal(false), reconnectAuthType: reconnectAuthTypeSchema }),
+      z.object({
+        available: z.literal(false),
+        reconnectAuthType: reconnectAuthTypeSchema,
+        reconnectCloud: reconnectCloudSchema,
+      }),
       z.object({
         available: z.literal(true),
         ...workloadIdentitySubjectGrantShape,
         reconnectAuthType: reconnectAuthTypeSchema,
+        reconnectCloud: reconnectCloudSchema,
       }),
     ]),
   },

apps/sim/lib/credentials/application/prepare-workload-identity.test.ts

@@ -235,6 +235,27 @@ describe('preparing a reconnect', () => {
     }
   })
 
+  it('reports a national-cloud Microsoft credential’s cloud, so the dialog reopens on it', async () => {
+    reconnecting(
+      {
+        type: 'microsoft_app_credential_v1',
+        config: { ...appConfig, authType: 'client_secret', clientSecret: 'value', cloud: 'usgov' },
+      },
+      { providerId: 'microsoft-app-service-account' }
+    )
+    await expect(prepare('microsoft')).resolves.toMatchObject({
+      reconnectAuthType: 'client_secret',
+      reconnectCloud: 'usgov',
+    })
+  })
+
+  it('reports no cloud for a global Microsoft credential or another provider', async () => {
+    reconnecting(STORED_MODES[9].secret, { providerId: 'microsoft-app-service-account' })
+    expect(await prepare('microsoft')).not.toHaveProperty('reconnectCloud')
+    reconnecting(keylessSecret)
+    expect(await prepare()).not.toHaveProperty('reconnectCloud')
+  })
+
   it('gives Google no fixed audience', async () => {
     reconnecting(STORED_MODES[11].secret, { providerId: 'google-service-account' })
     expect(await prepare('google')).not.toHaveProperty('audience')

apps/sim/lib/credentials/application/prepare-workload-identity.ts

@@ -7,7 +7,11 @@ import { credentialOperations } from '@/lib/credentials/application/operations'
 import { storedAwsAuthType } from '@/lib/credentials/aws-service-account.server'
 import { storedDatabricksAuthType } from '@/lib/credentials/databricks-service-account.server'
 import { isGoogleWorkloadIdentitySecret } from '@/lib/credentials/google-workload-identity'
-import { storedMicrosoftAppAuthType } from '@/lib/credentials/microsoft-app-service-account.server'
+import {
+  storedMicrosoftAppAuthType,
+  storedMicrosoftAppCloud,
+} from '@/lib/credentials/microsoft-app-service-account.server'
+import type { MicrosoftCloudId } from '@/lib/credentials/microsoft-clouds'
 import { storedSnowflakeAuthType } from '@/lib/credentials/snowflake-service-account.server'
 import {
   fixedWorkloadIdentityAudience,
@@ -30,9 +34,13 @@ export interface PrepareWorkloadIdentityInput {
   credentialId?: string
 }
 
-/** The reconnected credential's stored mode; absent without one, or for anyone but its admin. */
+/**
+ * The reconnected credential's stored mode, and a Microsoft app credential's national cloud;
+ * absent without one, or for anyone but its admin.
+ */
 interface ReconnectAuthTypeField {
   reconnectAuthType?: WorkloadIdentityProviderAuthType
+  reconnectCloud?: MicrosoftCloudId
 }
 
 export type PrepareWorkloadIdentityResult =
@@ -66,16 +74,17 @@ const STORED_AUTH_TYPE: {
 }
 
 /**
- * The stored auth mode of a credential of this provider in this workspace, which
- * this person administers. Only the mode leaves the stored secret, and only for
- * someone allowed to reconnect the credential.
+ * The stored auth mode (and a Microsoft app credential's national cloud) of a
+ * credential of this provider in this workspace, which this person administers.
+ * Only these leave the stored secret, and only for someone allowed to reconnect
+ * the credential.
  */
-async function storedReconnectAuthType(
+async function storedReconnectFields(
   provider: WorkloadIdentityProvider,
   credentialId: string,
   workspaceId: string,
   userId: string
-): Promise<WorkloadIdentityProviderAuthType | undefined> {
+): Promise<ReconnectAuthTypeField> {
   const access = await getCredentialActorContext(credentialId, userId, { workspaceId })
   const row = access.credential
   if (
@@ -87,10 +96,15 @@ async function storedReconnectAuthType(
     workloadIdentityProviderFor(row.providerId) !== provider ||
     !row.encryptedServiceAccountKey
   ) {
-    return undefined
+    return {}
   }
   const { decrypted } = await decryptSecret(row.encryptedServiceAccountKey)
-  return STORED_AUTH_TYPE[provider](decrypted)
+  const reconnectAuthType = STORED_AUTH_TYPE[provider](decrypted)
+  const reconnectCloud = provider === 'microsoft' ? storedMicrosoftAppCloud(decrypted) : undefined
+  return {
+    ...(reconnectAuthType ? { reconnectAuthType } : {}),
+    ...(reconnectCloud ? { reconnectCloud } : {}),
+  }
 }
 
 /**
@@ -110,15 +124,14 @@ export const prepareWorkloadIdentity = defineAuthorizedWorkspaceUseCase({
   },
   authorizationOptions: {},
   execute: async ({ principal, input }): Promise<PrepareWorkloadIdentityResult> => {
-    const reconnectAuthType = input.credentialId
-      ? await storedReconnectAuthType(
+    const reconnect = input.credentialId
+      ? await storedReconnectFields(
           input.provider,
           input.credentialId,
           input.workspaceId,
           requirePrincipalSubjectUserId(principal)
         )
-      : undefined
-    const reconnect = reconnectAuthType ? { reconnectAuthType } : {}
+      : {}
     // A deployment without a signing key offers only key- and secret-based credentials.
     if (!(await isWorkloadIdentityConfigured())) return { available: false, ...reconnect }
     const userId = requirePrincipalSubjectUserId(principal)