fix(credentials): keep an encryption failure on a verified database connection a server error

Author: waleedlatif1

apps/sim/lib/credentials/database-connections/server.ts

@@ -150,11 +150,24 @@ function secretSchemaFor(spec: DatabaseConnectionSpec) {
   return z.object({ type: z.literal(spec.secretType), connection: spec.schema }).strict()
 }
 
+/**
+ * A submitted connection that could not be parsed or did not answer `SELECT 1`:
+ * the user's input is at fault, unlike a failure to encrypt a verified one.
+ */
+export class DatabaseConnectionVerificationError extends Error {
+  constructor(message: string) {
+    super(message)
+    this.name = 'DatabaseConnectionVerificationError'
+  }
+}
+
 /**
  * Parses a submitted connection, proves it with `SELECT 1` through the block's
  * own guarded connection path (host validation and IP pinning included), and
  * encrypts it only after the database answered. Driver errors are never
  * surfaced: a server can echo anything, including the login it rejected.
+ * Input and verification failures throw `DatabaseConnectionVerificationError`;
+ * an encryption failure propagates unchanged.
  */
 export async function verifyAndEncryptDatabaseConnection(
   providerId: DatabaseConnectionProviderId,
@@ -163,13 +176,13 @@ export async function verifyAndEncryptDatabaseConnection(
   const spec = SPECS[providerId]
   const { label } = spec.descriptor
   if (Buffer.byteLength(serialized, 'utf8') > MAX_SERIALIZED_CONNECTION_BYTES) {
-    throw new Error(`${label} connection must be at most 64 KiB`)
+    throw new DatabaseConnectionVerificationError(`${label} connection must be at most 64 KiB`)
   }
   let parsed: ReturnType<DatabaseConnectionSpec['parse']>
   try {
     parsed = spec.parse(JSON.parse(serialized))
   } catch {
-    throw new Error(`Invalid ${label} connection configuration`)
+    throw new DatabaseConnectionVerificationError(`Invalid ${label} connection configuration`)
   }
   const { connection } = parsed
   try {
@@ -179,7 +192,7 @@ export async function verifyAndEncryptDatabaseConnection(
       throw new Error('Invalid verification response')
     }
   } catch {
-    throw new Error(`Could not verify the ${label} connection`)
+    throw new DatabaseConnectionVerificationError(`Could not verify the ${label} connection`)
   }
   const { encrypted } = await encryptSecret(JSON.stringify({ type: spec.secretType, connection }))
   return {

apps/sim/lib/credentials/service-account-secret.test.ts

@@ -11,12 +11,14 @@ const {
   mockNormalizeDomain,
   mockClientCredentialMinter,
   mockVerifyAndEncryptOci,
+  mockPostgresqlQuery,
 } = vi.hoisted(() => ({
   mockFetchSlackTeamId: vi.fn(),
   mockValidateAtlassian: vi.fn(),
   mockNormalizeDomain: vi.fn((raw: string) => raw.trim().toLowerCase()),
   mockClientCredentialMinter: vi.fn(),
   mockVerifyAndEncryptOci: vi.fn(),
+  mockPostgresqlQuery: vi.fn(),
 }))
 
 vi.mock('@/lib/core/security/encryption', () => encryptionMock)
@@ -59,6 +61,9 @@ vi.mock('@/lib/credentials/oci-api-key-service-account.server', () => ({
   },
   verifyAndEncryptOciApiKeyCredential: mockVerifyAndEncryptOci,
 }))
+vi.mock('@/lib/internal/postgresql/operations', () => ({
+  executePostgresqlQuery: mockPostgresqlQuery,
+}))
 vi.mock('@/lib/api/contracts/credentials', () => ({
   serviceAccountJsonSchema: {
     safeParse: (value: string) => {
@@ -93,6 +98,7 @@ import {
 } from '@/lib/credentials/service-account-secret'
 import {
   ATLASSIAN_SERVICE_ACCOUNT_PROVIDER_ID,
+  POSTGRESQL_SERVICE_ACCOUNT_PROVIDER_ID,
   SLACK_CUSTOM_BOT_PROVIDER_ID,
 } from '@/lib/oauth/types'
 
@@ -1010,3 +1016,35 @@ describe('a token provider whose region or host defaults to the one it always us
     }
   )
 })
+
+describe('a saved database connection', () => {
+  const serviceAccountJson = JSON.stringify({
+    host: 'db.example.com',
+    port: 5432,
+    database: 'app',
+    username: 'app_user',
+    password: 'secret',
+  })
+
+  it('asks the user to fix the connection when the database does not answer', async () => {
+    mockPostgresqlQuery.mockRejectedValue(new Error('ECONNREFUSED'))
+
+    await expect(
+      verifyAndBuildServiceAccountSecret(POSTGRESQL_SERVICE_ACCOUNT_PROVIDER_ID, {
+        serviceAccountJson,
+      })
+    ).rejects.toBeInstanceOf(ServiceAccountSecretError)
+  })
+
+  it('keeps an encryption failure on a verified connection a server error', async () => {
+    mockPostgresqlQuery.mockResolvedValue({ rows: [{ sim_connection_ok: 1 }] })
+    mockEncryptSecret.mockRejectedValue(new Error('KMS unavailable'))
+
+    const saving = verifyAndBuildServiceAccountSecret(POSTGRESQL_SERVICE_ACCOUNT_PROVIDER_ID, {
+      serviceAccountJson,
+    })
+
+    await expect(saving).rejects.toThrow('KMS unavailable')
+    await expect(saving).rejects.not.toBeInstanceOf(ServiceAccountSecretError)
+  })
+})

apps/sim/lib/credentials/service-account-secret.ts

@@ -30,7 +30,10 @@ import {
   DATABASE_CONNECTION_DESCRIPTORS,
   type DatabaseConnectionProviderId,
 } from '@/lib/credentials/database-connections/descriptors'
-import { verifyAndEncryptDatabaseConnection } from '@/lib/credentials/database-connections/server'
+import {
+  DatabaseConnectionVerificationError,
+  verifyAndEncryptDatabaseConnection,
+} from '@/lib/credentials/database-connections/server'
 import {
   DatabricksCredentialError,
   verifyAndEncryptDatabricksCredential,
@@ -558,7 +561,8 @@ function databaseConnectionSecretBuilder(
     let result
     try {
       result = await verifyAndEncryptDatabaseConnection(providerId, fields.serviceAccountJson)
-    } catch {
+    } catch (error) {
+      if (!(error instanceof DatabaseConnectionVerificationError)) throw error
       throw new ServiceAccountSecretError(
         `Could not verify the ${label} connection. Check the connection details, network access, and database permissions.`
       )