fix(credentials): refuse a national-cloud Microsoft app credential for Dataverse as a cloud mismatch

Author: waleedlatif1

apps/sim/lib/credentials/microsoft-app-service-account.server.test.ts

@@ -742,8 +742,8 @@ describe('getting a Microsoft app token for a run', () => {
     expect(tokens[1]?.form.client_secret).toBe('rotated')
   })
 
-  it.each(['microsoft-ad', 'sharepoint', 'microsoft-intune'])(
-    'refuses a national-cloud credential for %s, whose tools call the global Graph, without minting',
+  it.each(['microsoft-ad', 'sharepoint', 'microsoft-intune', 'microsoft-dataverse'])(
+    'refuses a national-cloud credential for %s, whose tools call the global cloud, without minting',
     async (service) => {
       fakeMicrosoft(fetch)
       storeCredential(

apps/sim/lib/credentials/microsoft-app-service-account.server.ts

@@ -756,6 +756,7 @@ const MICROSOFT_APP_SERVICE_AUDIENCES: Record<string, MicrosoftAppAudience> = {
     // The environment is part of the stored secret, so one secret version has one environment.
     key: 'dataverse',
     select: (config) => {
+      requireCloud(config, ['global'], 'Dataverse')
       if (!config.environmentUrl) {
         throw new TokenServiceAccountValidationError('invalid_credentials', 400, {
           step: 'microsoft_app_environment',