fix(snowflake): list the key-pair connection in the credential provider catalog

Author: waleedlatif1

apps/sim/lib/credentials/application/provider-catalog-contract.test.ts

@@ -145,10 +145,12 @@ describe('v2 credential provider catalog contract', () => {
     const snowflake = keyless.find(
       (provider) => provider.providerId === 'snowflake-service-account'
     )
-    expect(snowflake?.fields.find((field) => field.id === 'serviceAccountJson')).toMatchObject({
-      required: false,
-      secret: true,
-    })
+    const snowflakeConfiguration = snowflake?.fields.find(
+      (field) => field.id === 'serviceAccountJson'
+    )
+    expect(snowflakeConfiguration).toMatchObject({ required: false, secret: true })
+    expect(snowflakeConfiguration?.hint).toContain('"key_pair"')
+    expect(snowflakeConfiguration?.hint).toContain('Keyless')
   })
 
   it('offers no keyless mode where this deployment cannot sign', async () => {
@@ -169,7 +171,32 @@ describe('v2 credential provider catalog contract', () => {
       (provider) =>
         provider.type === 'service_account' && provider.providerId === 'snowflake-service-account'
     )
-    expect(snowflake?.fields.map((field) => field.id)).toEqual(['domain', 'apiToken'])
+    expect(snowflake?.fields.map((field) => field.id)).toEqual([
+      'domain',
+      'apiToken',
+      'serviceAccountJson',
+    ])
+    const configuration = snowflake?.fields.find((field) => field.id === 'serviceAccountJson')
+    expect(configuration).toMatchObject({ required: false, secret: true, multiline: true })
+    expect(configuration?.hint).toContain('"key_pair"')
+    expect(configuration?.hint).not.toContain('Keyless')
+  })
+
+  it('offers the Snowflake key pair to organization credentials, which have no keyless mode', async () => {
+    Reflect.set(env, 'WORKLOAD_IDENTITY_SIGNING_KEY', SIGNING_KEY)
+    Reflect.set(env, 'WORKLOAD_IDENTITY_ISSUER', 'https://sim.example.com/oidc/workload')
+    const catalog = await listCredentialProviderCatalog(createSessionPrincipal(), {
+      organizationId: 'org-1',
+    })
+    const snowflake = catalog.find(
+      (provider) =>
+        provider.type === 'service_account' && provider.providerId === 'snowflake-service-account'
+    )
+
+    expect(snowflake?.type === 'service_account' && snowflake.keyless).toBeFalsy()
+    const configuration = snowflake?.fields.find((field) => field.id === 'serviceAccountJson')
+    expect(configuration?.hint).toContain('"key_pair"')
+    expect(configuration?.hint).not.toContain('Keyless')
   })
 
   it('lists the native Claude Platform provider when filtered', async () => {

apps/sim/lib/credentials/application/provider-catalog.ts

@@ -6,6 +6,7 @@ import {
   type ClientCredentialAccountField,
 } from '@/lib/credentials/client-credential-accounts/descriptors'
 import {
+  SNOWFLAKE_SERVICE_ACCOUNT_PROVIDER_ID,
   TOKEN_SERVICE_ACCOUNT_DESCRIPTORS,
   type TokenServiceAccountField,
 } from '@/lib/credentials/token-service-accounts/descriptors'
@@ -164,8 +165,8 @@ function keylessModeFor(providerId: string): KeylessCatalogMode | undefined {
 /**
  * Adds a provider's keyless mode to its key-based descriptor, the same way for
  * every keyless provider: one description suffix, and a hint on the
- * `serviceAccountJson` field — which a token provider such as Snowflake gains
- * as an optional alternative to its token fields.
+ * `serviceAccountJson` field, which is added as an optional alternative to the
+ * other fields when the descriptor has none.
  */
 function withKeylessMode(
   descriptor: ServiceAccountDescriptor,
@@ -441,6 +442,29 @@ function getServiceAccountDescriptor(providerId: string): ServiceAccountDescript
     }
   }
 
+  if (providerId === SNOWFLAKE_SERVICE_ACCOUNT_PROVIDER_ID) {
+    const tokenDescriptor = TOKEN_SERVICE_ACCOUNT_DESCRIPTORS[SNOWFLAKE_SERVICE_ACCOUNT_PROVIDER_ID]
+    return {
+      name: 'Snowflake connection',
+      description: 'Connect Snowflake with a programmatic access token or an RSA key pair.',
+      docsUrl: tokenDescriptor.docsUrl,
+      helpText: tokenDescriptor.helpText,
+      fields: [
+        ...tokenDescriptor.fields.map(providerField),
+        {
+          id: 'serviceAccountJson',
+          label: 'Connection configuration',
+          placeholder:
+            '{"authType":"key_pair","host":"myorg-myaccount.snowflakecomputing.com","user":"SIM_SERVICE","privateKey":"-----BEGIN PRIVATE KEY-----..."}',
+          required: false,
+          secret: true,
+          multiline: true,
+          hint: 'Send instead of the other fields. Key pair: JSON object with authType: "key_pair", host, user, and privateKey (an unencrypted RSA private key as PEM, 2048 to 4096 bits, whose public key is set on the user).',
+        },
+      ],
+    }
+  }
+
   const tokenDescriptor = Object.hasOwn(TOKEN_SERVICE_ACCOUNT_DESCRIPTORS, providerId)
     ? TOKEN_SERVICE_ACCOUNT_DESCRIPTORS[
         providerId as keyof typeof TOKEN_SERVICE_ACCOUNT_DESCRIPTORS