From 9ea5bd6bd5e0af13f71de82e7bac139f515698a2 Mon Sep 17 00:00:00 2001 From: Waleed Latif Date: Fri, 13 Nov 2026 15:05:36 -0800 Subject: [PATCH] chore(credentials): move the IAM refusal TSDoc back onto iamFailureMessage --- .../lib/credentials/google-workload-identity.server.ts | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/apps/sim/lib/credentials/google-workload-identity.server.ts b/apps/sim/lib/credentials/google-workload-identity.server.ts index 4a54474cab6..31af85ea02f 100644 --- a/apps/sim/lib/credentials/google-workload-identity.server.ts +++ b/apps/sim/lib/credentials/google-workload-identity.server.ts @@ -380,10 +380,6 @@ async function exchangeSubjectToken( return payload.access_token } -/** - * Copy for an IAM Credentials refusal. Signing needs a role the impersonation - * role lacks, so a refused signature always names the token-creator role. - */ /** * Whether Google refused the call under a VPC Service Controls perimeter: the * error names a `vpcServiceControlsUniqueIdentifier` or a `VPC_SERVICE_CONTROLS` @@ -394,6 +390,10 @@ function isVpcServiceControlsDenial(payload: Record): boolean { return /vpcServiceControlsUniqueIdentifier|VPC_SERVICE_CONTROLS/.test(JSON.stringify(payload)) } +/** + * Copy for an IAM Credentials refusal. Signing needs a role the impersonation + * role lacks, so a refused signature always names the token-creator role. + */ function iamFailureMessage( status: number, payload: Record,