refactor(credentials): derive stored database connection fields and credential-supplied params from one list

The stored v1 schema now picks exactly the descriptor's login and TLS fields
out of each operation schema instead of extending the whole schema, and the
tools' credentialSuppliedParams come from the same list. An operation field
added later can no longer change the stored blob, get pinned on every run,
or stay visible on the credential-only block.

Author: waleedlatif1

apps/sim/lib/credentials/database-connections/descriptors.ts

@@ -55,10 +55,7 @@ function optionsFrom<Value extends string>(labels: Record<Value, string>) {
   return Object.entries<string>(labels).map(([value, label]) => ({ value, label }))
 }
 
-export const DATABASE_CONNECTION_DESCRIPTORS: Record<
-  DatabaseConnectionProviderId,
-  DatabaseConnectionDescriptor
-> = {
+export const DATABASE_CONNECTION_DESCRIPTORS = {
   [POSTGRESQL_SERVICE_ACCOUNT_PROVIDER_ID]: {
     providerId: POSTGRESQL_SERVICE_ACCOUNT_PROVIDER_ID,
     service: 'postgresql',
@@ -125,6 +122,35 @@ export const DATABASE_CONNECTION_DESCRIPTORS: Record<
     ],
     docsUrl: 'https://docs.sim.ai/integrations/mssql',
   },
+} as const satisfies Record<DatabaseConnectionProviderId, DatabaseConnectionDescriptor>
+
+const DATABASE_LOGIN_FIELD_IDS = ['host', 'port', 'database', 'username', 'password'] as const
+
+export type DatabaseConnectionFieldId<P extends DatabaseConnectionProviderId> =
+  | (typeof DATABASE_LOGIN_FIELD_IDS)[number]
+  | (typeof DATABASE_CONNECTION_DESCRIPTORS)[P]['tls'][number]['id']
+
+/**
+ * Every field a saved connection of this provider stores: the login, then its
+ * transport-security settings. The stored schema keeps exactly these fields
+ * and the tools declare exactly these as credential-supplied, so what a blob
+ * persists, what a run replaces, and what the block hides share one list.
+ * Changing a provider's list changes its stored blob, so it needs a new
+ * secret type.
+ */
+export function databaseConnectionFieldIds<P extends DatabaseConnectionProviderId>(
+  providerId: P
+): DatabaseConnectionFieldId<P>[] {
+  return [
+    ...DATABASE_LOGIN_FIELD_IDS,
+    ...tlsFieldIds(DATABASE_CONNECTION_DESCRIPTORS[providerId].tls),
+  ]
+}
+
+function tlsFieldIds<Fields extends readonly DatabaseTlsField[]>(
+  fields: Fields
+): Fields[number]['id'][] {
+  return fields.map((field) => field.id)
 }
 
 export function isDatabaseConnectionProviderId(

apps/sim/lib/credentials/database-connections/server.test.ts

@@ -24,6 +24,11 @@ import {
   verifyAndEncryptDatabaseConnection,
   withSavedDatabaseConnection,
 } from '@/lib/credentials/database-connections/server'
+import {
+  MSSQL_CREDENTIAL_OAUTH,
+  MYSQL_CREDENTIAL_OAUTH,
+  POSTGRESQL_CREDENTIAL_OAUTH,
+} from '@/tools/shared/saved-credentials'
 
 const connection = {
   host: 'db.example.com',
@@ -59,6 +64,7 @@ const inlineInput = {
   ssl: 'disabled',
   query: 'SELECT 2',
 }
+const { ssl: _inlineSsl, ...inlineInputWithoutTls } = inlineInput
 
 function call(overrides: Partial<InternalToolOperationCall> = {}): InternalToolOperationCall {
   return {
@@ -234,6 +240,69 @@ describe('saved database connections', () => {
       expect(await response.json()).toEqual({ ...connection, query: 'SELECT 2' })
     })
 
+    it.each([
+      {
+        providerId: 'postgresql-service-account',
+        oauth: POSTGRESQL_CREDENTIAL_OAUTH,
+        saved: connection,
+        input: inlineInput,
+      },
+      {
+        providerId: 'mysql-service-account',
+        oauth: MYSQL_CREDENTIAL_OAUTH,
+        saved: connection,
+        input: inlineInput,
+      },
+      {
+        providerId: 'mssql-service-account',
+        oauth: MSSQL_CREDENTIAL_OAUTH,
+        saved: connectionWithoutTls,
+        input: {
+          ...inlineInputWithoutTls,
+          encrypt: 'disabled',
+          trustServerCertificate: 'enabled',
+          connectionTimeout: 30_000,
+        },
+      },
+    ] as const)(
+      'a saved $oauth.provider connection replaces exactly the params its tools declare it supplies',
+      async ({ providerId, oauth, saved, input }) => {
+        encryptionMockFns.mockEncryptSecret.mockImplementation(async (plain: string) => ({
+          encrypted: plain,
+          iv: 'iv',
+        }))
+        encryptionMockFns.mockDecryptSecret.mockImplementation(async (encrypted: string) => ({
+          decrypted: encrypted,
+        }))
+        const { encryptedServiceAccountKey } = await verifyAndEncryptDatabaseConnection(
+          providerId,
+          JSON.stringify(saved)
+        )
+        queueTableRows(credential, [{ ...row, providerId, encryptedServiceAccountKey }])
+
+        const response = await withSavedDatabaseConnection(
+          providerId,
+          echo
+        )(
+          call({
+            input,
+            context: {
+              ...savedConnectionContext,
+              authorizedServiceAccountCredential: {
+                credentialId: 'credential-1',
+                service: oauth.provider,
+              },
+            },
+          })
+        )
+
+        const ran: Record<string, unknown> = await response.json()
+        const inline: Record<string, unknown> = input
+        const replaced = Object.keys(ran).filter((key) => ran[key] !== inline[key])
+        expect(replaced.sort()).toEqual([...oauth.credentialSuppliedParams].sort())
+      }
+    )
+
     it.each([
       ['a credential for another engine', { providerId: 'mysql-service-account' }, stored],
       ['an organization credential', { organizationId: 'organization-1' }, stored],

apps/sim/lib/credentials/database-connections/server.ts

@@ -4,7 +4,9 @@ import { encryptSecret } from '@/lib/core/security/encryption'
 import {
   DATABASE_CONNECTION_DESCRIPTORS,
   type DatabaseConnectionDescriptor,
+  type DatabaseConnectionFieldId,
   type DatabaseConnectionProviderId,
+  databaseConnectionFieldIds,
 } from '@/lib/credentials/database-connections/descriptors'
 import {
   type CredentialOwnerScope,
@@ -43,13 +45,28 @@ const storedLoginBounds = {
   password: z.string().min(1).max(4096),
 }
 
+/**
+ * Picks exactly the provider's stored connection fields out of its operation
+ * schema. A field the operation adds later (as SQL Server's per-block
+ * connection timeout already is) stays out of the stored blob and is never
+ * pinned by a saved connection.
+ */
+function storedFieldMask<P extends DatabaseConnectionProviderId>(providerId: P) {
+  const mask: Partial<Record<DatabaseConnectionFieldId<P>, true>> = {}
+  for (const id of databaseConnectionFieldIds(providerId)) mask[id] = true
+  return mask as Record<DatabaseConnectionFieldId<P>, true>
+}
+
 const postgresqlStoredConnectionSchema = postgresqlConnectionInputSchema
+  .pick(storedFieldMask(POSTGRESQL_SERVICE_ACCOUNT_PROVIDER_ID))
+  .extend(storedLoginBounds)
+  .strict()
+const mysqlStoredConnectionSchema = mysqlConnectionInputSchema
+  .pick(storedFieldMask(MYSQL_SERVICE_ACCOUNT_PROVIDER_ID))
   .extend(storedLoginBounds)
   .strict()
-const mysqlStoredConnectionSchema = mysqlConnectionInputSchema.extend(storedLoginBounds).strict()
-/** The connection timeout stays a per-block setting; a saved connection does not pin it. */
 const mssqlStoredConnectionSchema = mssqlConnectionInputSchema
-  .omit({ connectionTimeout: true })
+  .pick(storedFieldMask(MSSQL_SERVICE_ACCOUNT_PROVIDER_ID))
   .extend(storedLoginBounds)
   .strict()
 

apps/sim/tools/shared/saved-credentials.ts

@@ -1,6 +1,7 @@
 import {
   DATABASE_CONNECTION_DESCRIPTORS,
   type DatabaseConnectionProviderId,
+  databaseConnectionFieldIds,
 } from '@/lib/credentials/database-connections/descriptors'
 import type { OAuthService } from '@/lib/oauth'
 import {
@@ -42,22 +43,15 @@ export const AWS_SESSION_SIGNED_TOOL_IDS: ReadonlySet<string> = new Set(['s3_get
  * inline connection fields working unchanged; with a saved connection
  * selected, the tool operation reads it server-side
  * (`withSavedDatabaseConnection`) and every connection field it stores
- * replaces the call's, so the credential supplies exactly those params.
+ * replaces the call's. The stored fields and the params declared here are the
+ * same list (`databaseConnectionFieldIds`).
  */
 function databaseConnectionOAuth(providerId: DatabaseConnectionProviderId) {
-  const { service, tls } = DATABASE_CONNECTION_DESCRIPTORS[providerId]
   return {
     required: false,
-    provider: service,
+    provider: DATABASE_CONNECTION_DESCRIPTORS[providerId].service,
     credentialKind: 'service-account',
-    credentialSuppliedParams: [
-      'host',
-      'port',
-      'database',
-      'username',
-      'password',
-      ...tls.map((field) => field.id),
-    ],
+    credentialSuppliedParams: databaseConnectionFieldIds(providerId),
   } as const satisfies OAuthConfig
 }