fix(credentials): verify Databricks through the organization's egress, keep keyless reconnects on their mode, and harden held-subject renewal

Author: waleedlatif1

apps/docs/content/docs/cli/credentials.mdx

@@ -97,7 +97,7 @@ The printed audience is the default. To have Sim sign tokens for your own audien
 
 Step 2: add those values to keylessConfig and pass it to `sim credentials create <providerId> --credentials @file`.
 
-The proof expires after 24 hours and works only for the user who requested it, with the same providerId. Sim holds the subject for you for 30 days until a credential saves it, so a trust configuration that takes longer to apply still works: renew the proof with `sim credentials keyless-subject <providerId> --subject <subject>`. The subject stays the same, and each renewal restarts the 30 days. Sim holds your 20 newest unsaved subjects per provider in a workspace; issuing more drops the oldest.
+The proof expires after 24 hours and works only for the user who requested it, with the same providerId. Sim holds the subject for you for 30 days until a credential saves it, so a trust configuration that takes longer to apply still works: renew the proof with `sim credentials keyless-subject <providerId> --subject <subject>`. The subject stays the same, and each renewal restarts the 30 days. Sim holds up to 20 unsaved subjects per person and provider in a workspace; issuing more drops the one shown least recently.
 
 If creation reports WORKLOAD_IDENTITY_PROOF_EXPIRED, renew the proof and retry. If it reports WORKLOAD_IDENTITY_PROOF_INVALID, WORKLOAD_IDENTITY_SUBJECT_REQUIRED, WORKLOAD_IDENTITY_SUBJECT_IN_USE, run step 1 again, trust the new subject, and retry.
 
@@ -384,7 +384,7 @@ The printed audience is the default. To have Sim sign tokens for your own audien
 
 Step 2: add those values to keylessConfig and pass it to `sim credentials create <providerId> --credentials @file`.
 
-The proof expires after 24 hours and works only for the user who requested it, with the same providerId. Sim holds the subject for you for 30 days until a credential saves it, so a trust configuration that takes longer to apply still works: renew the proof with `sim credentials keyless-subject <providerId> --subject <subject>`. The subject stays the same, and each renewal restarts the 30 days. Sim holds your 20 newest unsaved subjects per provider in a workspace; issuing more drops the oldest.
+The proof expires after 24 hours and works only for the user who requested it, with the same providerId. Sim holds the subject for you for 30 days until a credential saves it, so a trust configuration that takes longer to apply still works: renew the proof with `sim credentials keyless-subject <providerId> --subject <subject>`. The subject stays the same, and each renewal restarts the 30 days. Sim holds up to 20 unsaved subjects per person and provider in a workspace; issuing more drops the one shown least recently.
 
 If creation reports WORKLOAD_IDENTITY_PROOF_EXPIRED, renew the proof and retry. If it reports WORKLOAD_IDENTITY_PROOF_INVALID, WORKLOAD_IDENTITY_SUBJECT_REQUIRED, WORKLOAD_IDENTITY_SUBJECT_IN_USE, run step 1 again, trust the new subject, and retry.
 

apps/docs/content/docs/cli/reference.mdx

@@ -784,7 +784,7 @@ The printed audience is the default. To have Sim sign tokens for your own audien
 
 Step 2: add those values to keylessConfig and pass it to `sim credentials create <providerId> --credentials @file`.
 
-The proof expires after 24 hours and works only for the user who requested it, with the same providerId. Sim holds the subject for you for 30 days until a credential saves it, so a trust configuration that takes longer to apply still works: renew the proof with `sim credentials keyless-subject <providerId> --subject <subject>`. The subject stays the same, and each renewal restarts the 30 days. Sim holds your 20 newest unsaved subjects per provider in a workspace; issuing more drops the oldest.
+The proof expires after 24 hours and works only for the user who requested it, with the same providerId. Sim holds the subject for you for 30 days until a credential saves it, so a trust configuration that takes longer to apply still works: renew the proof with `sim credentials keyless-subject <providerId> --subject <subject>`. The subject stays the same, and each renewal restarts the 30 days. Sim holds up to 20 unsaved subjects per person and provider in a workspace; issuing more drops the one shown least recently.
 
 If creation reports WORKLOAD_IDENTITY_PROOF_EXPIRED, renew the proof and retry. If it reports WORKLOAD_IDENTITY_PROOF_INVALID, WORKLOAD_IDENTITY_SUBJECT_REQUIRED, WORKLOAD_IDENTITY_SUBJECT_IN_USE, run step 1 again, trust the new subject, and retry.
 
@@ -834,7 +834,7 @@ The printed audience is the default. To have Sim sign tokens for your own audien
 
 Step 2: add those values to keylessConfig and pass it to `sim credentials create <providerId> --credentials @file`.
 
-The proof expires after 24 hours and works only for the user who requested it, with the same providerId. Sim holds the subject for you for 30 days until a credential saves it, so a trust configuration that takes longer to apply still works: renew the proof with `sim credentials keyless-subject <providerId> --subject <subject>`. The subject stays the same, and each renewal restarts the 30 days. Sim holds your 20 newest unsaved subjects per provider in a workspace; issuing more drops the oldest.
+The proof expires after 24 hours and works only for the user who requested it, with the same providerId. Sim holds the subject for you for 30 days until a credential saves it, so a trust configuration that takes longer to apply still works: renew the proof with `sim credentials keyless-subject <providerId> --subject <subject>`. The subject stays the same, and each renewal restarts the 30 days. Sim holds up to 20 unsaved subjects per person and provider in a workspace; issuing more drops the one shown least recently.
 
 If creation reports WORKLOAD_IDENTITY_PROOF_EXPIRED, renew the proof and retry. If it reports WORKLOAD_IDENTITY_PROOF_INVALID, WORKLOAD_IDENTITY_SUBJECT_REQUIRED, WORKLOAD_IDENTITY_SUBJECT_IN_USE, run step 1 again, trust the new subject, and retry.
 

apps/docs/openapi-v2-resources.json

@@ -4382,7 +4382,7 @@
       "post": {
         "operationId": "createCredentialWorkloadIdentitySubject",
         "summary": "Create workload identity subject",
-        "description": "Start a keyless credential. Returns the issuer, audience, and a fresh subject to configure in the cloud's trust policy, plus `keylessConfig`: a prefilled `serviceAccountJson` whose `subjectProof` is valid for 24 hours and only for the requesting user. Sim holds the subject for you until `subjectHeldUntil` (30 days, restarted by each renewal) unless a credential saves it first; pass it back as `subject` to renew the proof without changing the subject, so a trust policy that takes days to apply still matches. Sim holds your 20 newest unsaved subjects per provider in a workspace; issuing more drops the oldest. Add the `requiredConfigFields`, then call Create service-account credential with the same `providerId`; Sim verifies the trust while saving. The returned `audience` is the default; set `audience` in `keylessConfig` to have Sim sign tokens for your own value instead, and trust that value in the cloud. Google Cloud has no fixed default: it is the credential's own pool provider. Without keyless support the deployment returns `400` with `details.code` `WORKLOAD_IDENTITY_NOT_CONFIGURED`. Workspace API keys return `403`; use a personal API key or scoped OAuth token.\n\nOAuth scope: `api:write`.",
+        "description": "Start a keyless credential. Returns the issuer, audience, and a new subject to configure in the cloud's trust policy (or, when `subject` names one Sim is holding for you, that same subject with a renewed proof), plus `keylessConfig`: a prefilled `serviceAccountJson` whose `subjectProof` is valid for 24 hours and only for the requesting user. Sim holds the subject for you until `subjectHeldUntil` (30 days, restarted by each renewal) unless a credential saves it first; pass it back as `subject` to renew the proof without changing the subject, so a trust policy that takes days to apply still matches. Sim holds up to 20 unsaved subjects per person and provider in a workspace; issuing more drops the one shown least recently. Add the `requiredConfigFields`, then call Create service-account credential with the same `providerId`; Sim verifies the trust while saving. The returned `audience` is the default; set `audience` in `keylessConfig` to have Sim sign tokens for your own value instead, and trust that value in the cloud. Google Cloud has no fixed default: it is the credential's own pool provider. Without keyless support the deployment returns `400` with `details.code` `WORKLOAD_IDENTITY_NOT_CONFIGURED`. Workspace API keys return `403`; use a personal API key or scoped OAuth token.\n\nOAuth scope: `api:write`.",
         "x-sim-operation": "credentials.workload_identity.prepare",
         "x-oauth-scope": "api:write",
         "tags": ["Credentials"],

apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/keyless-connection.tsx

@@ -98,7 +98,7 @@ export function useKeylessSetup<P extends WorkloadIdentityProvider>({
   const storedAuthType = providerAuthType(provider, setup.data?.reconnectAuthType)
   // A keyless credential reopens on keyless only where this deployment can still sign.
   const reconnectAuthType =
-    storedAuthType === WORKLOAD_IDENTITY_KEYLESS_CONFIGS[provider].authType && !trust
+    storedAuthType === WORKLOAD_IDENTITY_KEYLESS_CONFIGS[provider].authType && !heldTrust
       ? undefined
       : storedAuthType
   return {

apps/sim/lib/api/contracts/v2/openapi/resources.ts

@@ -1842,7 +1842,7 @@ const declaredRoutes = [
       applicationOperation: credentialOperations.prepareWorkloadIdentity,
       operationId: 'createCredentialWorkloadIdentitySubject',
       summary: 'Create workload identity subject',
-      description: `Start a keyless credential. Returns the issuer, audience, and a fresh subject to configure in the cloud's trust policy, plus \`keylessConfig\`: a prefilled \`serviceAccountJson\` whose \`subjectProof\` is valid for 24 hours and only for the requesting user. Sim holds the subject for you until \`subjectHeldUntil\` (30 days, restarted by each renewal) unless a credential saves it first; pass it back as \`subject\` to renew the proof without changing the subject, so a trust policy that takes days to apply still matches. Sim holds your 20 newest unsaved subjects per provider in a workspace; issuing more drops the oldest. Add the \`requiredConfigFields\`, then call Create service-account credential with the same \`providerId\`; Sim verifies the trust while saving. The returned \`audience\` is the default; set \`audience\` in \`keylessConfig\` to have Sim sign tokens for your own value instead, and trust that value in the cloud. Google Cloud has no fixed default: it is the credential's own pool provider. Without keyless support the deployment returns \`400\` with \`details.code\` \`WORKLOAD_IDENTITY_NOT_CONFIGURED\`. ${WORKSPACE_API_KEY_DENIED}`,
+      description: `Start a keyless credential. Returns the issuer, audience, and a new subject to configure in the cloud's trust policy (or, when \`subject\` names one Sim is holding for you, that same subject with a renewed proof), plus \`keylessConfig\`: a prefilled \`serviceAccountJson\` whose \`subjectProof\` is valid for 24 hours and only for the requesting user. Sim holds the subject for you until \`subjectHeldUntil\` (30 days, restarted by each renewal) unless a credential saves it first; pass it back as \`subject\` to renew the proof without changing the subject, so a trust policy that takes days to apply still matches. Sim holds up to 20 unsaved subjects per person and provider in a workspace; issuing more drops the one shown least recently. Add the \`requiredConfigFields\`, then call Create service-account credential with the same \`providerId\`; Sim verifies the trust while saving. The returned \`audience\` is the default; set \`audience\` in \`keylessConfig\` to have Sim sign tokens for your own value instead, and trust that value in the cloud. Google Cloud has no fixed default: it is the credential's own pool provider. Without keyless support the deployment returns \`400\` with \`details.code\` \`WORKLOAD_IDENTITY_NOT_CONFIGURED\`. ${WORKSPACE_API_KEY_DENIED}`,
       errors: RESOURCE_ERRORS,
       success: { description: 'A subject and proof for one new keyless credential.' },
     }),

apps/sim/lib/api/mcp/generated/v2-operations.ts

@@ -665,7 +665,7 @@ export const V2_MCP_OPERATIONS = {
     contract: v2CreateCredentialWorkloadIdentitySubjectContract,
     summary: 'Create workload identity subject',
     description:
-      "Start a keyless credential. Returns the issuer, audience, and a fresh subject to configure in the cloud's trust policy, plus `keylessConfig`: a prefilled `serviceAccountJson` whose `subjectProof` is valid for 24 hours and only for the requesting user. Sim holds the subject for you until `subjectHeldUntil` (30 days, restarted by each renewal) unless a credential saves it first; pass it back as `subject` to renew the proof without changing the subject, so a trust policy that takes days to apply still matches. Sim holds your 20 newest unsaved subjects per provider in a workspace; issuing more drops the oldest. Add the `requiredConfigFields`, then call Create service-account credential with the same `providerId`; Sim verifies the trust while saving. The returned `audience` is the default; set `audience` in `keylessConfig` to have Sim sign tokens for your own value instead, and trust that value in the cloud. Google Cloud has no fixed default: it is the credential's own pool provider. Without keyless support the deployment returns `400` with `details.code` `WORKLOAD_IDENTITY_NOT_CONFIGURED`. Workspace API keys return `403`; use a personal API key or scoped OAuth token.\n\nOAuth scope: `api:write`.",
+      "Start a keyless credential. Returns the issuer, audience, and a new subject to configure in the cloud's trust policy (or, when `subject` names one Sim is holding for you, that same subject with a renewed proof), plus `keylessConfig`: a prefilled `serviceAccountJson` whose `subjectProof` is valid for 24 hours and only for the requesting user. Sim holds the subject for you until `subjectHeldUntil` (30 days, restarted by each renewal) unless a credential saves it first; pass it back as `subject` to renew the proof without changing the subject, so a trust policy that takes days to apply still matches. Sim holds up to 20 unsaved subjects per person and provider in a workspace; issuing more drops the one shown least recently. Add the `requiredConfigFields`, then call Create service-account credential with the same `providerId`; Sim verifies the trust while saving. The returned `audience` is the default; set `audience` in `keylessConfig` to have Sim sign tokens for your own value instead, and trust that value in the cloud. Google Cloud has no fixed default: it is the credential's own pool provider. Without keyless support the deployment returns `400` with `details.code` `WORKLOAD_IDENTITY_NOT_CONFIGURED`. Workspace API keys return `403`; use a personal API key or scoped OAuth token.\n\nOAuth scope: `api:write`.",
     workspaceKeyUnsupported: true,
     handler: () =>
       import('@/app/api/v2/credentials/workload-identity/subjects/route').then(

apps/sim/lib/credentials/__integration__/workload-identity-pending-subject.integration.ts

@@ -26,6 +26,31 @@ vi.mock('@/lib/credentials/workload-identity/issuer', async (importOriginal) =>
   isWorkloadIdentityConfigured: async () => true,
   mintWorkloadIdentityToken: async ({ subject }: { subject: string }) => `token-for:${subject}`,
 }))
+/** The identity check goes through the egress guard, not global fetch; serve its fixture there. */
+vi.mock('@/lib/core/security/input-validation.server', async (importOriginal) => {
+  const actual =
+    await importOriginal<typeof import('@/lib/core/security/input-validation.server')>()
+  return {
+    ...actual,
+    secureFetchWithValidation: async (
+      ...args: Parameters<typeof actual.secureFetchWithValidation>
+    ) => {
+      if (args[0] !== 'https://dbc-5678abcd-1234.cloud.databricks.com/api/2.0/preview/scim/v2/Me')
+        return actual.secureFetchWithValidation(...args)
+      const body = JSON.stringify({ userName: 'service-principal@example.com' })
+      return {
+        ok: true,
+        status: 200,
+        statusText: 'OK',
+        headers: new actual.SecureFetchHeaders({ 'content-type': 'application/json' }),
+        body: null,
+        text: async () => body,
+        json: async () => JSON.parse(body),
+        arrayBuffer: async () => new TextEncoder().encode(body).buffer,
+      }
+    },
+  }
+})
 
 import { updateCredentialRecord } from '@/lib/credentials/orchestration'
 import { createCredentialRecord } from '@/lib/credentials/orchestration/credential-create'
@@ -120,9 +145,6 @@ describe('holding an unsaved keyless subject', () => {
           ? jsonResponse({ access_token: `access-for:${subject}` })
           : jsonResponse({ error: 'invalid_client' }, 401)
       }
-      if (target === `https://${HOST}/api/2.0/preview/scim/v2/Me`) {
-        return jsonResponse({ userName: 'service-principal@example.com' })
-      }
       return originalFetch(input, init)
     })
   }, 60_000)
@@ -194,6 +216,7 @@ describe('holding an unsaved keyless subject', () => {
       userId,
       provider: 'databricks',
       subject: held.subject,
+      createdAt: new Date(),
       expiresAt: new Date(Date.now() + DAY_MS),
     })
 
@@ -266,6 +289,31 @@ describe('holding an unsaved keyless subject', () => {
     expect(await heldSubjects()).toContain(held.subject)
   })
 
+  it('keeps a subject shown recently when the cap drops older ones', async () => {
+    const capped = { ...issuer, provider: 'microsoft' as const }
+    const tenDaysAgo = new Date(Date.now() - 10 * DAY_MS)
+    const underReview = await resolvePendingWorkloadIdentitySubject(
+      capped,
+      { kind: 'new' },
+      tenDaysAgo
+    )
+    for (let index = 0; index < 19; index++) {
+      await resolvePendingWorkloadIdentitySubject(
+        capped,
+        { kind: 'new' },
+        new Date(tenDaysAgo.getTime() + (index + 1) * 60_000)
+      )
+    }
+    await resolvePendingWorkloadIdentitySubject(capped, {
+      kind: 'renew',
+      subject: underReview.subject,
+    })
+
+    await resolvePendingWorkloadIdentitySubject(capped, { kind: 'new' })
+
+    expect(await heldSubjects()).toContain(underReview.subject)
+  })
+
   it('keeps one person from piling up held subjects', async () => {
     const capped = { ...issuer, provider: 'snowflake' as const }
     for (let index = 0; index < 25; index++) {

apps/sim/lib/credentials/__integration__/workload-identity-subject-reuse.integration.ts

@@ -19,6 +19,31 @@ vi.mock('@/lib/credentials/workload-identity/issuer', async (importOriginal) =>
   isWorkloadIdentityConfigured: async () => true,
   mintWorkloadIdentityToken: async ({ subject }: { subject: string }) => `token-for:${subject}`,
 }))
+/** The identity check goes through the egress guard, not global fetch; serve its fixture there. */
+vi.mock('@/lib/core/security/input-validation.server', async (importOriginal) => {
+  const actual =
+    await importOriginal<typeof import('@/lib/core/security/input-validation.server')>()
+  return {
+    ...actual,
+    secureFetchWithValidation: async (
+      ...args: Parameters<typeof actual.secureFetchWithValidation>
+    ) => {
+      if (args[0] !== 'https://dbc-1234abcd-5678.cloud.databricks.com/api/2.0/preview/scim/v2/Me')
+        return actual.secureFetchWithValidation(...args)
+      const body = JSON.stringify({ userName: 'service-principal@example.com' })
+      return {
+        ok: true,
+        status: 200,
+        statusText: 'OK',
+        headers: new actual.SecureFetchHeaders({ 'content-type': 'application/json' }),
+        body: null,
+        text: async () => body,
+        json: async () => JSON.parse(body),
+        arrayBuffer: async () => new TextEncoder().encode(body).buffer,
+      }
+    },
+  }
+})
 
 import { encryptSecret } from '@/lib/core/security/encryption'
 import { updateCredentialRecord } from '@/lib/credentials/orchestration'
@@ -114,9 +139,6 @@ describe('reusing a keyless trust setup', () => {
           ? jsonResponse({ access_token: `access-for:${subject}` })
           : jsonResponse({ error: 'invalid_client' }, 401)
       }
-      if (target === `https://${HOST}/api/2.0/preview/scim/v2/Me`) {
-        return jsonResponse({ userName: 'service-principal@example.com' })
-      }
       return originalFetch(input, init)
     })
   }, 60_000)