fix(knowledge): keep long-lived saved AWS keys per run and gate saved-credential edits on rollout

- Reuse a saved AWS credential without a session token for the whole run instead of reloading it on every page and hydration
- Hide the edit form's saved-credential replacement while saved-credential setup is disabled, matching the server gate
- Classify a connector whose credential service has no config as internal, not caller-fixable
- State in the v2 catalog that apiKey connectors with savedCredential accept credentialId

Author: waleedlatif1

apps/docs/openapi-v2-resources.json

@@ -21700,7 +21700,7 @@
                   "mode": {
                     "type": "string",
                     "const": "apiKey",
-                    "description": "Authenticates with a stored API key; pass `apiKey`, and no `credentialId`, when creating the connector."
+                    "description": "Authenticates with a stored API key; pass `apiKey` when creating the connector, or a saved `credentialId` instead when `savedCredential` is present."
                   },
                   "label": {
                     "description": "Label shown above the key field.",

apps/sim/app/workspace/[workspaceId]/knowledge/[id]/base.tsx

@@ -1516,6 +1516,7 @@ export function KnowledgeBase({
             isLoading={isLoadingConnectors}
             canEdit={userPermissions.canEdit}
             className='mt-0'
+            savedCredentialSetupEnabled={savedCredentialSetupEnabled}
           />
         </ChipModalBody>
       </ChipModal>

apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/connectors-section/connectors-section.tsx

@@ -31,6 +31,7 @@ interface ConnectorsSectionProps {
   isLoading: boolean
   canEdit: boolean
   className?: string
+  savedCredentialSetupEnabled?: boolean
 }
 
 const STATUS_CONFIG = {
@@ -51,6 +52,7 @@ export function ConnectorsSection({
   isLoading,
   canEdit,
   className,
+  savedCredentialSetupEnabled = false,
 }: ConnectorsSectionProps) {
   const scope = explicitScope ?? resourceScopeFromOwner({ workspaceId })
   const [editingConnector, setEditingConnector] = useState<ConnectorData | null>(null)
@@ -84,6 +86,7 @@ export function ConnectorsSection({
           knowledgeBaseId={knowledgeBaseId}
           isSearchIndex={isSearchIndex}
           connector={editingConnector}
+          savedCredentialSetupEnabled={savedCredentialSetupEnabled}
         />
       )}
     </div>

apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/edit-connector-modal/edit-connector-modal.tsx

@@ -26,6 +26,7 @@ interface EditConnectorModalProps {
   knowledgeBaseId: string
   isSearchIndex?: boolean
   connector: ConnectorData
+  savedCredentialSetupEnabled?: boolean
 }
 
 export function EditConnectorModal({
@@ -35,6 +36,7 @@ export function EditConnectorModal({
   isSearchIndex = false,
   connector,
   scope,
+  savedCredentialSetupEnabled = false,
 }: EditConnectorModalProps) {
   const [activeTab, setActiveTab] = useState('settings')
   const [documentFilter, setDocumentFilter] = useState<ConnectorDocumentFilter>('active')
@@ -44,6 +46,7 @@ export function EditConnectorModal({
     isSearchIndex,
     connector,
     onSaved: () => onOpenChange(false),
+    savedCredentialSetupEnabled,
   })
 
   return (

apps/sim/app/workspace/[workspaceId]/knowledge/[id]/components/edit-connector-modal/use-connector-settings-form.ts

@@ -127,6 +127,8 @@ interface UseConnectorSettingsFormOptions {
   connector: ConnectorData
   onSaved: (connector: ConnectorData) => void
   syncing?: boolean
+  /** Whether a key connector's saved credential may be replaced; the server refuses it while setup is off. */
+  savedCredentialSetupEnabled?: boolean
 }
 
 /** Editable connector settings shared by the source page and knowledge-base modal. */
@@ -137,6 +139,7 @@ export function useConnectorSettingsForm({
   connector,
   onSaved,
   syncing = isConnectorSyncingOrPending(connector),
+  savedCredentialSetupEnabled = false,
 }: UseConnectorSettingsFormOptions) {
   const liveSearch = isSearchIndex
   const connectorConfig = liveSearchSourceMeta(
@@ -236,7 +239,8 @@ export function useConnectorSettingsForm({
 
   /**
    * A key connector that syncs with its saved credential, or did until the credential was
-   * removed: its credential stays replaceable here, and its key-only settings do not apply.
+   * removed: its credential stays replaceable here while saved-credential setup is enabled,
+   * and its key-only settings do not apply.
    */
   const usesSavedCredential =
     connectorConfig?.auth.mode === 'apiKey' &&
@@ -293,7 +297,7 @@ export function useConnectorSettingsForm({
     accessDirty && !accessModeChanged && isContentEngineAccessMode(access.accessMode)
   /** Exposes credential selection for mode changes and administrator credential recovery. */
   const needsWorkspaceCredential =
-    usesSavedCredential ||
+    (usesSavedCredential && savedCredentialSetupEnabled) ||
     (connectorConfig?.auth.mode === 'oauth' &&
       isContentEngineAccessMode(access.accessMode) &&
       (persistedAccess.accessMode === 'members' ||

apps/sim/lib/api/contracts/v2/catalog.ts

@@ -737,7 +737,7 @@ export const v2ConnectorTypeSchema = z
           mode: z
             .literal('apiKey')
             .describe(
-              'Authenticates with a stored API key; pass `apiKey`, and no `credentialId`, when creating the connector.'
+              'Authenticates with a stored API key; pass `apiKey` when creating the connector, or a saved `credentialId` instead when `savedCredential` is present.'
             ),
           label: z.string().optional().describe('Label shown above the key field.'),
           placeholder: z.string().optional().describe('Placeholder shown in the key field.'),

apps/sim/lib/knowledge/connectors/access-token.test.ts

@@ -536,6 +536,23 @@ describe('createConnectorRunToken', () => {
     expect(runToken.current().accessToken).toBe('fresh-oauth-token')
   })
 
+  it('keeps long-lived saved AWS keys for the whole run instead of reloading them on every page', async () => {
+    const resolve = vi.fn()
+    const runToken = createConnectorRunToken({
+      token: {
+        accessToken: '',
+        awsSession: { accessKeyId: 'AKIA1', secretAccessKey: 'AKIA1-secret' },
+      },
+      syncContext: {},
+      resolve,
+    })
+
+    await runToken.refresh()
+
+    expect(resolve).not.toHaveBeenCalled()
+    expect(runToken.current().awsSession?.accessKeyId).toBe('AKIA1')
+  })
+
   it('never re-resolves a stored key', async () => {
     const resolve = vi.fn()
     const runToken = createConnectorRunToken({

apps/sim/lib/knowledge/connectors/access-token.ts

@@ -345,7 +345,7 @@ const TOKEN_REUSE_MARGIN_MS = 5 * 60 * 1000
 /** A run's connector token, kept usable for the length of the run. */
 export interface ConnectorRunToken {
   current(): ConnectorAccessToken
-  /** Re-resolves the token before a later call, unless it states an expiry still well ahead. */
+  /** Re-resolves the token before a later call, unless it is long-lived or states an expiry still well ahead. */
   refresh(): Promise<void>
 }
 
@@ -354,8 +354,9 @@ export interface ConnectorRunToken {
  * outlives a short-lived token, and re-seeds what the token binds into the run's
  * `syncContext`, so a connector reading its credential's site or AWS session from there signs
  * with the current one. A token that states its expiry (an AWS STS session) is kept until
- * shortly before it rather than exchanged again on every page. `resolve` is absent for a
- * stored key, which never changes during a run.
+ * shortly before it rather than exchanged again on every page. Long-lived saved AWS keys (an
+ * AWS session with no session token) are kept for the whole run, like a stored key, for which
+ * `resolve` is absent.
  */
 export function createConnectorRunToken(input: {
   token: ConnectorAccessToken
@@ -367,6 +368,7 @@ export function createConnectorRunToken(input: {
     current: () => token,
     async refresh() {
       if (!input.resolve) return
+      if (token.awsSession && !token.awsSession.sessionToken) return
       if (token.expiresAt && token.expiresAt.getTime() - Date.now() > TOKEN_REUSE_MARGIN_MS) return
       token = await input.resolve()
       Object.assign(input.syncContext, syncContextForToken(token))

apps/sim/lib/knowledge/connectors/credential-service.ts

@@ -11,7 +11,9 @@ import type { ConnectorMeta } from '@/connectors/types'
  * The OAuth service a connector's credential must belong to. Setting up a key
  * connector on its saved credential and every access update resolve it here, so
  * a connector whose declared service has no config is refused instead of
- * skipping the provider check.
+ * skipping the provider check. Callers reach it only for a connector that takes
+ * a credential, so a missing service is a connector-definition fault, not one
+ * the caller can fix.
  */
 export function requireConnectorCredentialService(
   connectorMeta: Pick<ConnectorMeta, 'name' | 'auth'>
@@ -23,7 +25,7 @@ export function requireConnectorCredentialService(
     : null
   if (!service) {
     throw new OrchestrationError(
-      'validation',
+      'internal',
       `${connectorMeta.name} has no OAuth service to validate the credential against`
     )
   }