refactor(credentials): read a reconnect's stored mode and cloud through one per-provider map

Author: waleedlatif1

apps/sim/lib/credentials/application/prepare-workload-identity.ts

@@ -7,10 +7,7 @@ import { credentialOperations } from '@/lib/credentials/application/operations'
 import { storedAwsAuthType } from '@/lib/credentials/aws-service-account.server'
 import { storedDatabricksAuthType } from '@/lib/credentials/databricks-service-account.server'
 import { isGoogleWorkloadIdentitySecret } from '@/lib/credentials/google-workload-identity'
-import {
-  storedMicrosoftAppAuthType,
-  storedMicrosoftAppCloud,
-} from '@/lib/credentials/microsoft-app-service-account.server'
+import { storedMicrosoftAppReconnectFields } from '@/lib/credentials/microsoft-app-service-account.server'
 import type { MicrosoftCloudId } from '@/lib/credentials/microsoft-clouds'
 import { storedSnowflakeAuthType } from '@/lib/credentials/snowflake-service-account.server'
 import {
@@ -55,22 +52,38 @@ export type PrepareWorkloadIdentityResult =
       expiresAt: string
     } & ReconnectAuthTypeField)
 
+/** What a reconnect reopens on, read from a credential's stored secret. */
+interface StoredReconnectFields<P extends WorkloadIdentityProvider> {
+  authType?: WorkloadIdentityProviderAuthType<P>
+  /** A Microsoft app credential's national cloud; absent for a global one and other providers. */
+  cloud?: MicrosoftCloudId
+}
+
+function authTypeOnly<A extends string>(
+  readAuthType: (decrypted: string) => A | undefined
+): (decrypted: string) => { authType?: A } {
+  return (decrypted) => {
+    const authType = readAuthType(decrypted)
+    return authType ? { authType } : {}
+  }
+}
+
 /**
  * Every keyless provider also has key-based modes under the same provider ID, so a
- * reconnect reads the stored secret's mode and the dialog reopens on it rather than
- * on a default that would drop the credential's role, secret, or certificate.
+ * reconnect reads the stored secret's mode (and a Microsoft app credential's cloud) and
+ * the dialog reopens on it rather than on a default that would drop the credential's
+ * role, secret, certificate, or cloud.
  */
-const STORED_AUTH_TYPE: {
-  [P in WorkloadIdentityProvider]: (
-    decrypted: string
-  ) => WorkloadIdentityProviderAuthType<P> | undefined
+const STORED_RECONNECT_FIELDS: {
+  [P in WorkloadIdentityProvider]: (decrypted: string) => StoredReconnectFields<P>
 } = {
-  aws: storedAwsAuthType,
-  databricks: storedDatabricksAuthType,
-  snowflake: storedSnowflakeAuthType,
-  microsoft: storedMicrosoftAppAuthType,
-  google: (decrypted) =>
-    isGoogleWorkloadIdentitySecret(decrypted) ? 'workload_identity' : 'json_key',
+  aws: authTypeOnly(storedAwsAuthType),
+  databricks: authTypeOnly(storedDatabricksAuthType),
+  snowflake: authTypeOnly(storedSnowflakeAuthType),
+  microsoft: storedMicrosoftAppReconnectFields,
+  google: (decrypted) => ({
+    authType: isGoogleWorkloadIdentitySecret(decrypted) ? 'workload_identity' : 'json_key',
+  }),
 }
 
 /**
@@ -99,11 +112,10 @@ async function storedReconnectFields(
     return {}
   }
   const { decrypted } = await decryptSecret(row.encryptedServiceAccountKey)
-  const reconnectAuthType = STORED_AUTH_TYPE[provider](decrypted)
-  const reconnectCloud = provider === 'microsoft' ? storedMicrosoftAppCloud(decrypted) : undefined
+  const { authType, cloud } = STORED_RECONNECT_FIELDS[provider](decrypted)
   return {
-    ...(reconnectAuthType ? { reconnectAuthType } : {}),
-    ...(reconnectCloud ? { reconnectCloud } : {}),
+    ...(authType ? { reconnectAuthType: authType } : {}),
+    ...(cloud ? { reconnectCloud: cloud } : {}),
   }
 }
 

apps/sim/lib/credentials/microsoft-app-service-account.server.ts

@@ -497,25 +497,21 @@ async function verifyDataverseApplicationUser(environmentUrl: string, token: str
   )
 }
 
-/** The auth mode a decrypted Microsoft app credential secret holds, or undefined when it is not one. */
-export function storedMicrosoftAppAuthType(
-  decrypted: string
-): 'federated' | 'client_secret' | 'certificate' | undefined {
-  try {
-    const parsed = storedSecretSchema.safeParse(JSON.parse(decrypted))
-    return parsed.success ? parsed.data.config.authType : undefined
-  } catch {
-    return undefined
-  }
-}
-
-/** The stored national cloud, for a reconnect to reopen on; absent for a global credential. */
-export function storedMicrosoftAppCloud(decrypted: string): MicrosoftCloudId | undefined {
+/**
+ * The auth mode and national cloud a decrypted Microsoft app credential secret holds, for a
+ * reconnect to reopen on: empty when it is not one, and no cloud for a global credential.
+ */
+export function storedMicrosoftAppReconnectFields(decrypted: string): {
+  authType?: MicrosoftAppConfig['authType']
+  cloud?: MicrosoftCloudId
+} {
   try {
     const parsed = storedSecretSchema.safeParse(JSON.parse(decrypted))
-    return parsed.success ? parsed.data.config.cloud : undefined
+    if (!parsed.success) return {}
+    const { authType, cloud } = parsed.data.config
+    return cloud ? { authType, cloud } : { authType }
   } catch {
-    return undefined
+    return {}
   }
 }