Repository navigation
fix(credentials): correct keyless setup instructions and enforce the saved-credential contract on every credential block - #9878
Merged
Conversation
…ential block, reopen key-based reconnects on their mode, and tighten fixtures and skills - check-block-registry runs the saved-credential contract for every block with a saved-credential picker, not only successors; the per-block contract moves to saved-credential-contract.ts with tests. The host probe gains a path-shaped id and a per-param shape so mixed-validation builders (Jama, Higgsfield) are probed, not guessed. - Blocks the widened check caught: Coda, Harmonic, and Oracle Database tools declare credentialKind 'service-account'; NetSuite pins instanceUrl in authoritativeParams; Vanta's assetExternalAccountId is a filter, not a host. - prepareWorkloadIdentity covers every keyless provider (AWS, Databricks added) and reuses audiences.ts for the provider-id mapping; the AWS and Databricks dialogs reopen a reconnect on the stored mode. - Snowflake keyless verification maps an egress refusal to host_not_allowed. - Neutral token fixtures in new credential tests; subject uniqueness TSDoc; skills describe native token blocks, the picker shape, keyless setup, and the successor naming exception.
- AWS: enter the Role ARN before setting the trust policy, so it never carries the <AWS_ACCOUNT_ID> placeholder IAM rejects (dialog hint and docs). - Databricks: the federation-policy command needs an account-level CLI login. - Google: a valid sample pool ID, ID format hints, user-managed service accounts only, skip the pool command when the pool exists, and the API list from Google's guide (adds Resource Manager). - Bitbucket: workspace and project access tokens need Premium; repository tokens do not. - Snowflake: rename SIM_WORKFLOWS if it exists; USERADMIN runs the statement. - Microsoft keyless dialog says where the federated credential goes. - Server errors name the trust values for API and CLI callers too; Google Workspace and Account ID wording; AWS catalog hint mentions stsRegion; the CLI keyless example uses aws-service-account throughout. - Self-hosting env vars list every keyless provider.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
 [Medium impact] The PR appears safe to merge; no new actionable failures remain. SummaryThis PR corrects keyless setup guidance and extends saved-credential checks to native blocks.
Reviews (2) · Last reviewed commit: "fix(credentials): reopen every keyless-c..." · Reviewed by Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 57 files
Reply with feedback, questions, or to request a fix.
Turn on auto-fix | Re-trigger cubic
…d auth mode and reject native credential tools without a policy - prepareWorkloadIdentity reports the reconnected credential's stored authType (reconnectAuthType), for an admin of a credential in the same workspace, whether or not this deployment can sign. reconnectsKeyless is removed from the contract and hook. The AWS, Databricks, Snowflake, Microsoft and Google dialogs reopen on that mode, so an assume_role, personal_access_token or certificate credential keeps its auth. - The saved-credential contract fails a native credential block whose tool has no oauth policy: the executor would never fill its token. - The Snowflake hint and docs say where to change SIM_WORKFLOWS; the DocuSign account_not_found message covers a credential with no Account ID; the docs baseline's reviewed CLI example entries carry their new byte length; the contract test fixtures use a real OAuth service id.
Collaborator
Author
Collaborator
Author
|
@cubic-dev-ai review this PR |
Contributor
@waleedlatif1 I have started the AI code review. It will take a few minutes to complete. |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-ups from the final release audit of the saved-credential and keyless work. The new auth methods worked end to end, but a first-time user following the setup instructions literally would get stuck. This PR fixes those instructions and closes a gap in the registry contract.
Setup instructions fixed (each checked against the vendor's docs):
<AWS_ACCOUNT_ID>until then, and IAM rejects that placeholder. The dialog says so too.databricks auth login --host <account console URL> --account-id …), not a workspace profile or the web terminal.sim, which is not a valid pool ID; it is nowsim-pool, and both ID fields have a format hint.SIM_WORKFLOWSwhen it already exists, and run the statement as a role that can create users.Other copy:
sim credentials keyless-subject.aws-service-accountthroughout.stsRegion.The registry contract now covers every credential block.
check-block-registry's saved-credential contract used to check only successor blocks, so a new native token+host block was never probed for host steering. It now runs for every block with a saved-credential picker. The per-block logic is insavedCredentialContractErrors, so it can be tested.credentialKind: 'service-account'. These providers only have service-account credentials, so nothing changes for users.instanceUrl. The executor already overwrote it.Reconnects: reconnecting an AWS or Databricks access-key credential opens on access keys, not keyless.
MIXED_MODE_PROVIDERSnow covers all keyless providers.Snowflake keyless: a host refused by egress policy is reported as
host_not_allowed, the same as the other token checks.Skills:
add-integrationcovers new integrations using the native saved-credential pattern: hiddenaccessTokenwithoauth: { required: true, credentialKind: 'service-account' }, host params pinned withauthoritativeParams, and the inline picker plusmanualCredentialtwin.add-integrationalso gains a keyless row and the API/CLI two-step flow.add-blockandadd-integrationnow agree that credential-only successors keep the legacy block's name.validate-integrationgains checks for native token blocks and keyless providers.Fixtures: test tokens that looked like real vendor tokens (Bitbucket
ATCTT…, GitLabglpat-…, AWSAKIA…, a JWT-shaped DocuSign token) are now neutral values, so secret scanners don't flag them.Type of Change
Testing
New contract-script tests:
Reverting the loop change or the placeholders turns them red.
prepare-workload-identityreports keyless only for each provider's keyless config. The old code fails the AWS and Databricks keyless cases.Snowflake egress refusal maps to
host_not_allowed; reverting the guard turns it red.Commands run, all passing:
bun run lint; type-check forapps/simandpackages/sim-cli.check-block-registry.ts origin/staging.check:test-patterns,check:comment-hygiene,check:tool-metadata,check:skills,check:docs,check:cli-docs.content:verify-compatibility.Targeted Vitest covered the contract script,
prepare-workload-identity, the validators, minters and subject check, the AWS/Databricks/Microsoft/Google servers,token-resolution,provider-catalog, the Coda/Harmonic/Oracle/NetSuite tools, and the sim-cli commands.Checklist
test-auditauthoring gate)