chore: import upstream snapshot with attribution

apps/sim/lib/credentials/service-account-secret.ts

@@ -0,0 +1,142 @@
+import { getErrorMessage } from '@sim/utils/errors'
+import { serviceAccountJsonSchema } from '@/lib/api/contracts/credentials'
+import { getValidationErrorMessage } from '@/lib/api/server'
+import { encryptSecret } from '@/lib/core/security/encryption'
+import {
+  normalizeAtlassianDomain,
+  validateAtlassianServiceAccount,
+} from '@/lib/credentials/atlassian-service-account'
+import {
+  ATLASSIAN_SERVICE_ACCOUNT_PROVIDER_ID,
+  ATLASSIAN_SERVICE_ACCOUNT_SECRET_TYPE,
+  SLACK_CUSTOM_BOT_PROVIDER_ID,
+  SLACK_CUSTOM_BOT_SECRET_TYPE,
+} from '@/lib/oauth/types'
+import { fetchSlackTeamId } from '@/lib/webhooks/providers/slack'
+
+/** Provider-specific secret inputs a service-account credential can carry. */
+export interface ServiceAccountSecretFields {
+  signingSecret?: string
+  botToken?: string
+  apiToken?: string
+  domain?: string
+  serviceAccountJson?: string
+}
+
+export interface ServiceAccountSecretResult {
+  /** Canonical provider id for the resolved secret. */
+  providerId: string
+  encryptedServiceAccountKey: string
+  displayName: string
+  auditMetadata: Record<string, string>
+  /** Slack custom bot: the derived bot user id (for reaction self-drop). */
+  botUserId?: string
+}
+
+/** Thrown when a service-account secret is missing or fails provider verification. */
+export class ServiceAccountSecretError extends Error {
+  constructor(message: string) {
+    super(message)
+    this.name = 'ServiceAccountSecretError'
+  }
+}
+
+/**
+ * Verifies a service-account secret against its provider, derives the display
+ * name, and returns the encrypted blob ready to persist. Shared by credential
+ * create (POST) and in-place reconnect (PUT) so both paths verify + encrypt
+ * identically. Throws {@link ServiceAccountSecretError} on missing fields or a
+ * failed provider verification (callers map it to a 400).
+ */
+export async function verifyAndBuildServiceAccountSecret(
+  providerId: string,
+  fields: ServiceAccountSecretFields
+): Promise<ServiceAccountSecretResult> {
+  if (providerId === ATLASSIAN_SERVICE_ACCOUNT_PROVIDER_ID) {
+    const { apiToken, domain } = fields
+    if (!apiToken || !domain) {
+      throw new ServiceAccountSecretError(
+        'apiToken and domain are required for Atlassian service account credentials'
+      )
+    }
+    const normalizedDomain = normalizeAtlassianDomain(domain)
+    const validation = await validateAtlassianServiceAccount(apiToken, normalizedDomain)
+    const blob = JSON.stringify({
+      type: ATLASSIAN_SERVICE_ACCOUNT_SECRET_TYPE,
+      apiToken,
+      domain: normalizedDomain,
+      cloudId: validation.cloudId,
+      atlassianAccountId: validation.accountId,
+    })
+    const { encrypted } = await encryptSecret(blob)
+    return {
+      providerId: ATLASSIAN_SERVICE_ACCOUNT_PROVIDER_ID,
+      encryptedServiceAccountKey: encrypted,
+      displayName: validation.displayName,
+      auditMetadata: {
+        atlassianDomain: normalizedDomain,
+        atlassianCloudId: validation.cloudId,
+      },
+    }
+  }
+
+  if (providerId === SLACK_CUSTOM_BOT_PROVIDER_ID) {
+    const { signingSecret, botToken } = fields
+    if (!signingSecret || !botToken) {
+      throw new ServiceAccountSecretError(
+        'signingSecret and botToken are required for a custom Slack bot credential'
+      )
+    }
+    // Verify the token and derive the workspace/team identity (never trusted
+    // from the client) via auth.test.
+    let teamId: string
+    let botUserId: string | undefined
+    let teamName: string | undefined
+    try {
+      const auth = await fetchSlackTeamId(botToken)
+      teamId = auth.teamId
+      botUserId = auth.userId
+      teamName = auth.teamName
+    } catch (error) {
+      throw new ServiceAccountSecretError(
+        `Could not verify the Slack bot token: ${getErrorMessage(error)}`
+      )
+    }
+    const blob = JSON.stringify({
+      type: SLACK_CUSTOM_BOT_SECRET_TYPE,
+      signingSecret,
+      botToken,
+      teamId,
+      botUserId,
+      teamName,
+    })
+    const { encrypted } = await encryptSecret(blob)
+    return {
+      providerId: SLACK_CUSTOM_BOT_PROVIDER_ID,
+      encryptedServiceAccountKey: encrypted,
+      displayName: teamName || 'Slack bot',
+      auditMetadata: { slackTeamId: teamId },
+      botUserId,
+    }
+  }
+
+  const { serviceAccountJson } = fields
+  if (!serviceAccountJson) {
+    throw new ServiceAccountSecretError(
+      'serviceAccountJson is required for service account credentials'
+    )
+  }
+  const jsonParseResult = serviceAccountJsonSchema.safeParse(serviceAccountJson)
+  if (!jsonParseResult.success) {
+    throw new ServiceAccountSecretError(
+      getValidationErrorMessage(jsonParseResult.error, 'Invalid service account JSON')
+    )
+  }
+  const { encrypted } = await encryptSecret(serviceAccountJson)
+  return {
+    providerId: 'google-service-account',
+    encryptedServiceAccountKey: encrypted,
+    displayName: jsonParseResult.data.client_email,
+    auditMetadata: {},
+  }
+}