refactor(credentials): drop the principal abstraction, keep the identity fixes

[waleedlatif1]

Summary

• fix(credentials): capture the correct provider identity on connect and rotate #6201 added a ServiceAccountPrincipal union mirrored centrally into audit + blob metadata, and replaced 21 provider-named audit keys with uniform principalId/principalKind/principalLabel. Nothing reads any of it. It was built for an identity UI that was deliberately not shipped, and the key rename is a breaking change for anything consuming those audit rows
• The gap it was meant to close needed far less: Atlassian already resolved its accountId at connect time, it just wasn't recorded where every other provider records its identifier
• Removes principal.ts, the required-nullable field on all three registry result types, and the central mirroring. Restores the per-provider audit keys, so fix(credentials): capture the correct provider identity on connect and rotate #6201's only breaking change is undone
• Net 41 files, +154/−448 — deletes ~300 more lines than it adds

What's byte-identical to main again

14 validators, both registry server.ts files, errors.ts, Zoom, Zoho Desk, and 12 test files. I diffed each one first to confirm it was a pure principal swap with no fix hidden inside, rather than assuming.

Bug fixes kept

• Atlassian — atlassianAccountId + atlassianAccountEmail in auditMetadata (the customer's actual gap); emailAddress no longer discarded
• Google / Slack — googleClientEmail, googleProjectId, slackBotUserId, alongside the existing keys
• Box / Salesforce — identity-lookup failures now logged. Neither file had a logger at all, so a degraded connect left no trace anywhere
• Shopify — a partial-scope ACCESS_DENIED alongside a populated shop no longer rejects a working credential. Test re-added since main doesn't have it
• Rotation — Google/Slack re-label and reconnect audit metadata unchanged
• Also drops providerFailureReason, which became dead code once the minters were rebuilt on main's shape

Type of Change

• Refactor (removes complexity; no functional change beyond reverting the audit-key rename)

Testing

9,440 tests pass across the affected surface. Typecheck, biome, lint:check, check:api-validation:strict, check:utils and check:boundaries all clean. Zero principal references remain outside unrelated AWS IAM code.

Not live-tested against real provider accounts — unchanged from #6201, and none of the kept fixes alter a provider request.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 3, 2026 5:13pm

[cursor]

PR Summary

Medium Risk
Large refactor across credential connect/audit paths; restores prior audit key names (reverts a breaking rename) but changes what is stored in encrypted blob metadata for new connects. Connect-time verification behavior is largely unchanged aside from metadata shape and added Box/Salesforce identity failure logging.

Overview
Removes the ServiceAccountPrincipal abstraction (principal.ts, principalKind / principalId / principalLabel on connect results and encrypted blobs). Validators and client-credential minters again emit provider-specific auditMetadata and storedMetadata only; verifyAndBuildServiceAccountSecret no longer mirrors a central principal into audit or blob metadata.

Client-credential minters (Box, Salesforce, Zoom, Zoho Desk) drop user/tenant principals and lookup_failed degradation. Box/Salesforce identity lookups still succeed on failure but only with fallback display names and enterprise/host metadata; warn logs were added when those lookups fail. Successful connects record identifiers such as boxServiceAccountLogin, salesforceRunAsUsername, zoomAccountId, and zohoDeskSoid.

Token validators across Airtable, Asana, Attio, HubSpot, Shopify, etc. follow the same pattern: user/workspace IDs live in named audit keys (e.g. airtableUserId, shopifyShopDomain) and blob metadata, not uniform principal fields.

Bespoke builders (Atlassian, Google, Slack) record atlassianAccountId / atlassianAccountEmail, googleClientEmail / googleProjectId, and slackBotUserId in audit metadata without principal metadata in blobs. providerFailureReason is removed as unused after minter changes.

^{Reviewed by Cursor Bugbot for commit d9d55c2. Configure here.}

[greptile-apps]

Greptile Summary

The PR removes the unused service-account principal abstraction while restoring provider-specific identity metadata and retaining targeted credential-validation improvements.

• Restores provider-specific audit and encrypted-blob metadata for token and client-credential accounts.
• Adds Atlassian, Google, Slack, Box, and Salesforce identity details under provider-specific keys.
• Removes generic principal types, metadata mirroring, and lookup-failure serialization.
• Preserves credential creation and rotation through the shared secret builder.

Confidence Score: 5/5

The PR appears safe to merge with no concrete production regressions identified.

Provider-specific metadata contracts are restored, existing credential consumers remain satisfied, creation and rotation share consistent metadata behavior, and the investigated security and validation paths do not expose reachable failures.

Important Files Changed

Filename	Overview
apps/sim/lib/credentials/service-account-secret.ts	Removes central principal mirroring and emits provider-specific audit metadata while preserving existing credential blob contracts.
apps/sim/lib/credentials/token-service-accounts/server.ts	Restores the validation-result interface to provider-owned audit and stored metadata.
apps/sim/lib/credentials/client-credential-accounts/server.ts	Removes the required principal field from client-credential identity results.
apps/sim/lib/credentials/client-credential-accounts/minters/box.ts	Records the Box service-account login when available and logs best-effort identity lookup failures.
apps/sim/lib/credentials/client-credential-accounts/minters/salesforce.ts	Records the Salesforce run-as username and organization while retaining fallback identity behavior.
apps/sim/lib/credentials/token-service-accounts/validators/shopify.ts	Maintains strict rejection of errored Shopify responses while distinguishing credential failures from provider failures.

_{Reviews (1): Last reviewed commit: "refactor(credentials): drop the principa..." | Re-trigger Greptile}