Skip to content

fix(credentials): offer keyless Google delegation only for services that can be delegated - #9992

Merged
waleedlatif1 merged 2 commits into
stagingfrom
fix/google-keyless-nondelegable-copy
Nov 13, 2026
Merged

fix(credentials): offer keyless Google delegation only for services that can be delegated#9992
waleedlatif1 merged 2 commits into
stagingfrom
fix/google-keyless-nondelegable-copy

Conversation

@waleedlatif1

@waleedlatif1 waleedlatif1 commented Nov 13, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • The problem: when a keyless Google credential was refused, the advice said "reconnect the credential to delegate this service" even for Google services that can never be delegated. Those are Google Ads, Forms, Contacts, Tasks, Vault, Groups and Meet, plus impersonation on BigQuery/Vertex. These services list keyless credentials in their pickers, but the connect dialog only offers delegation for Gmail, Drive, Docs, Sheets and Calendar, so following the advice could never work.
  • The fix: both refusals (impersonation without delegation, and a service keyless doesn't serve) now branch on whether the service can be delegated, using the same googleDelegationServiceFor check the function already uses for delegation.
    • Delegable services keep the reconnect advice and their steps (google_keyless_delegation, google_keyless_service).
    • Every other service is pointed to a JSON key credential, under new steps google_keyless_delegation_unavailable and google_keyless_service_unsupported.
  • Unchanged: the order of the checks, and refusing before Google is contacted.

Type of Change

  • Bug fix

Testing

  • google-workload-identity.server.test.ts: delegable services, including a service named by its OAuth provider id, keep the reconnect steps. Ads, BigQuery/Vertex impersonation and an unknown service get the non-delegable steps. The four non-delegable cases fail on the previous code.
  • 769 tests across lib/credentials (Google), lib/oauth and lib/credentials/application pass.
  • bun run lint, check:test-patterns, check:comment-hygiene, check:explicit-any, check:boundaries and check:test-types pass.

Checklist

  • Code follows project style guidelines
  • Self-reviewed my changes
  • Tests added/updated and passing (new tests pass the test-audit authoring gate)
  • No new warnings introduced
  • I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

@vercel

vercel Bot commented Nov 13, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated
docs Skipped Skipped Nov 13, 2026 6:14am UTC

Request Review

@greptile-apps

greptile-apps Bot commented Nov 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

RetriggerView in GreptileConfidence Score: 5/5

[Low impact] This PR appears safe to merge; the changed advice preserves the existing refusal checks.

Summary

Updates keyless Google credential errors so reconnect advice appears only for services that support delegation.

  • Keyless Google errors recommend delegation only where it is available.

No actionable issues found. Tests were inspected, not run.

Reviews (2) · Last reviewed commit: "fix(credentials): send unsupported Googl..." · Reviewed by Greptile

cubic-dev-ai[bot]
cubic-dev-ai Bot reviewed Nov 13, 2026
View reviewed changes

@cubic-dev-ai cubic-dev-ai Bot left a comment •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

1 issue found across 2 files

Confidence score: 4/5

  • In google-workload-identity.server.ts, clearing the Impersonated Account won’t make unsupported services like google-ads work. Reserve that advice for supported Google Cloud services and direct unsupported services to a JSON key.
Prompt for AI agents (unresolved issues) 

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/sim/lib/credentials/google-workload-identity.server.ts">

<violation number="1" location="apps/sim/lib/credentials/google-workload-identity.server.ts:956">
P3: For unsupported services such as `google-ads`, clearing `Impersonated Account` still leaves the service unsupported. Reserve that remedy for supported Google Cloud services and direct unsupported services to a JSON key.</violation>
</file>

Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic

Comment thread apps/sim/lib/credentials/google-workload-identity.server.ts Resolved
@waleedlatif1
waleedlatif1 force-pushed the fix/google-keyless-nondelegable-copy branch from 5d659bf to 96868f8 Compare November 13, 2026 06:13
@waleedlatif1

waleedlatif1 commented Nov 13, 2026

Copy link
Copy Markdown
Collaborator Author

@greptile

@waleedlatif1

waleedlatif1 commented Nov 13, 2026

Copy link
Copy Markdown
Collaborator Author

@cubic-dev-ai review this PR

@cubic-dev-ai

cubic-dev-ai Bot commented Nov 13, 2026

Copy link
Copy Markdown
Contributor

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai[bot]
cubic-dev-ai Bot reviewed Nov 13, 2026
View reviewed changes

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 2 files

Confidence score: 5/5

  • Automated review surfaced no issues in the provided summaries.
  • No files require special attention.

Turn on auto-fix | Re-trigger cubic

@waleedlatif1
waleedlatif1 merged commit 990ea3a into staging Nov 13, 2026
80 checks passed
@waleedlatif1
waleedlatif1 deleted the fix/google-keyless-nondelegable-copy branch November 13, 2026 08:03

This branch was previously deployed

1 inactive deployment
Preview — 96868f83 Deployed Nov 13, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cubic-dev-ai cubic-dev-ai[bot] cubic-dev-ai[bot] left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@waleedlatif1