fix(api): treat every provider-outage code as unavailable on create and update

Author: TheodoreSpeaks

apps/sim/app/api/v2/credentials/[id]/route.test.ts

@@ -36,10 +36,14 @@ vi.mock('@/lib/credentials/access', () => ({
   getCredentialActorContext: mockGetCredentialActorContext,
 }))
 
-vi.mock('@/lib/credentials/orchestration', () => ({
-  performUpdateCredential: mockPerformUpdateCredential,
-  performDeleteCredential: mockPerformDeleteCredential,
-}))
+vi.mock('@/lib/credentials/orchestration', async () => {
+  const actual = await import('@/lib/credentials/orchestration/credential-create')
+  return {
+    isProviderOutageCode: actual.isProviderOutageCode,
+    performUpdateCredential: mockPerformUpdateCredential,
+    performDeleteCredential: mockPerformDeleteCredential,
+  }
+})
 
 vi.mock('@/app/api/v2/lib/gate', () => ({
   v2ApiGateError: vi.fn().mockResolvedValue(null),
@@ -295,6 +299,29 @@ describe('PATCH /api/v2/credentials/[id]', () => {
     expect(mockPerformUpdateCredential).toHaveBeenCalled()
   })
 
+  it('503s on an Atlassian outage too, not just a token-provider one', async () => {
+    mockPerformUpdateCredential.mockResolvedValue({
+      success: false,
+      error: 'atlassian_unavailable',
+      errorCode: 'validation',
+      providerErrorCode: 'atlassian_unavailable',
+    })
+    const res = await callPatch({ workspaceId: WORKSPACE_ID, apiToken: 'tok' })
+    expect(res.status).toBe(503)
+    expect((await res.json()).error.code).toBe('SERVICE_UNAVAILABLE')
+  })
+
+  it('keeps a rejected secret a 400, not a 503', async () => {
+    mockPerformUpdateCredential.mockResolvedValue({
+      success: false,
+      error: 'invalid_credentials',
+      errorCode: 'validation',
+      providerErrorCode: 'invalid_credentials',
+    })
+    const res = await callPatch({ workspaceId: WORKSPACE_ID, apiToken: 'tok' })
+    expect(res.status).toBe(400)
+  })
+
   it('rotates a secret without echoing it back', async () => {
     const res = await callPatch({ workspaceId: WORKSPACE_ID, apiToken: 'brand-new-token' })
     const body = await res.json()

apps/sim/app/api/v2/credentials/[id]/route.ts

@@ -10,7 +10,11 @@ import { parseRequest } from '@/lib/api/server'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { getCredentialActorContext } from '@/lib/credentials/access'
-import { performDeleteCredential, performUpdateCredential } from '@/lib/credentials/orchestration'
+import {
+  isProviderOutageCode,
+  performDeleteCredential,
+  performUpdateCredential,
+} from '@/lib/credentials/orchestration'
 import { getWorkspaceCredential } from '@/lib/credentials/queries'
 import { checkRateLimit, resolveWorkspaceAccess } from '@/app/api/v1/middleware'
 import { toV2CredentialRow, v2CredentialOrchestrationError } from '@/app/api/v2/credentials/utils'
@@ -140,7 +144,7 @@ export const PATCH = withRouteHandler(async (request: NextRequest, context: Rout
       return v2CredentialOrchestrationError(
         result.errorCode,
         result.error ?? 'Failed to update credential',
-        { providerUnavailable: result.providerErrorCode === 'provider_unavailable' }
+        { providerUnavailable: isProviderOutageCode(result.providerErrorCode) }
       )
     }
 

apps/sim/lib/credentials/orchestration/credential-create.ts

@@ -512,7 +512,10 @@ export async function performCreateCredential(
         upstreamStatus: error.status,
         ...error.logDetail,
       })
-      return failure(error.code, 'validation', { providerErrorCode: error.code })
+      return failure(error.code, 'validation', {
+        providerErrorCode: error.code,
+        providerUnavailable: isProviderOutageCode(error.code),
+      })
     }
     if (error instanceof TokenServiceAccountValidationError) {
       logger.warn(`Token service-account credential rejected: ${error.code}`, {
@@ -523,7 +526,7 @@ export async function performCreateCredential(
       // A provider outage is an infra failure, not a bad request.
       return failure(error.code, 'validation', {
         providerErrorCode: error.code,
-        providerUnavailable: error.code === 'provider_unavailable',
+        providerUnavailable: isProviderOutageCode(error.code),
       })
     }
     if (error instanceof DuplicateCredentialError) {
@@ -557,6 +560,20 @@ export async function performCreateCredential(
   }
 }
 
+/**
+ * Provider error codes that mean the upstream service could not be reached,
+ * rather than that the caller's secret was rejected. Each provider family names
+ * its own — Atlassian raises `atlassian_unavailable`, the token service accounts
+ * raise `provider_unavailable` — and both must map to 503, not 400. Kept as one
+ * set so a new provider family is added in a single place instead of being
+ * missed on whichever call path nobody re-checked.
+ */
+const PROVIDER_OUTAGE_CODES = new Set(['provider_unavailable', 'atlassian_unavailable'])
+
+export function isProviderOutageCode(code: string | undefined): boolean {
+  return code !== undefined && PROVIDER_OUTAGE_CODES.has(code)
+}
+
 /** HTTP status for a credential orchestration failure, shared by every route surface. */
 export function statusForCredentialOrchestrationError(
   code: CredentialOrchestrationErrorCode | undefined,

apps/sim/lib/credentials/orchestration/index.ts

@@ -23,6 +23,7 @@ import { captureServerEvent } from '@/lib/posthog/server'
 const logger = createLogger('CredentialOrchestration')
 
 export {
+  isProviderOutageCode,
   type PerformCreateCredentialParams,
   type PerformCreateCredentialResult,
   performCreateCredential,