feat(integrations): add Snowflake OAuth block

Author: Bill Leoutsakos

apps/docs/components/ui/icon-mapping.ts

@@ -210,6 +210,7 @@ import {
   SlackIcon,
   SmartleadIcon,
   SmtpIcon,
+  SnowflakeIcon,
   SportmonksIcon,
   SQSIcon,
   SquareIcon,
@@ -494,6 +495,7 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   slack: SlackIcon,
   smartlead: SmartleadIcon,
   smtp: SmtpIcon,
+  snowflake: SnowflakeIcon,
   sportmonks: SportmonksIcon,
   sqs: SQSIcon,
   square: SquareIcon,

apps/docs/content/docs/en/integrations/meta.json

@@ -221,6 +221,7 @@
     "slack",
     "smartlead",
     "smtp",
+    "snowflake",
     "sportmonks",
     "sqs",
     "square",

apps/docs/content/docs/en/integrations/snowflake.mdx

@@ -0,0 +1,168 @@
+---
+title: Snowflake
+description: Query and inspect data in Snowflake
+---
+
+import { BlockInfoCard } from "@/components/ui/block-info-card"
+
+<BlockInfoCard
+  type="snowflake"
+  color="#FFFFFF"
+/>
+
+{/* MANUAL-CONTENT-START:intro */}
+### Configure Snowflake OAuth
+
+An administrator with permission to create account integrations must create a custom Snowflake OAuth security integration for Sim. Replace the callback host and public key below with the values for your Sim deployment:
+
+```sql
+CREATE SECURITY INTEGRATION sim_oauth
+  TYPE = OAUTH
+  ENABLED = TRUE
+  OAUTH_CLIENT = CUSTOM
+  OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
+  OAUTH_REDIRECT_URI = 'https://<your-sim-host>/api/auth/oauth2/callback/snowflake'
+  OAUTH_ENFORCE_PKCE = TRUE
+  OAUTH_ISSUE_REFRESH_TOKENS = TRUE
+  OAUTH_CLIENT_RSA_PUBLIC_KEY = '<sim-oauth-public-key>';
+```
+
+Run `DESC SECURITY INTEGRATION sim_oauth` to find the generated OAuth client ID and public-key fingerprint. When connecting in Sim, provide:
+
+- Your account URL, such as `https://myorg-myaccount.snowflakecomputing.com`
+- Your account locator (not the account name)
+- The generated OAuth client ID
+
+The Sim deployment must configure the matching unencrypted PKCS#8 private key as `SNOWFLAKE_OAUTH_PRIVATE_KEY`. The private key is deployment-wide; only its public key is registered in each customer security integration. Sim uses an RS256 client assertion, PKCE, and refresh tokens, so customer OAuth client secrets are not collected or stored.
+
+Sim requests the `refresh_token` scope without a role scope. Snowflake therefore uses the connecting user's default role. Assign that role only the warehouses, databases, schemas, and operations workflows should be able to access. Snowflake blocks privileged roles by default.
+
+For key rotation, register the next public key in `OAUTH_CLIENT_RSA_PUBLIC_KEY_2`, update the Sim deployment to use the matching private key, verify connections, and then replace the old public key. Snowflake supports two active OAuth client public keys so this can be done without interruption.
+
+See Snowflake's [custom OAuth guide](https://docs.snowflake.com/en/user-guide/oauth-custom) and [`CREATE SECURITY INTEGRATION` reference](https://docs.snowflake.com/en/sql-reference/sql/create-security-integration-oauth-snowflake) for the authoritative setup and policy options.
+
+### Result handling
+
+Query, Execute, and Introspect submit exactly one statement and request Snowflake's minimum 16 MB result chunks. If Snowflake returns a pending statement, use **Get Statement** with its handle. Each operation returns at most one result partition; when `hasMore` is true, call **Get Statement** with the next zero-based partition number. Column metadata and the total row count are returned with the first partition and may be absent from later partitions. Sim does not automatically load all partitions into workflow memory.
+
+There is no Snowflake trigger. Snowflake does not document a compatible event or webhook trigger for this integration, so workflows should use schedules when polling is appropriate.
+{/* MANUAL-CONTENT-END */}
+
+## Usage Instructions
+
+Connect a Snowflake account with OAuth to run SQL, inspect database schemas, and retrieve asynchronous or partitioned statement results through the Snowflake SQL API.
+
+
+
+## Actions
+
+### Snowflake Query
+
+Run a SQL query in Snowflake and return the first bounded result partition
+
+#### Input
+
+| Parameter | Type | Required | Description |
+| --------- | ---- | -------- | ----------- |
+| `idToken` | string | No | Snowflake account URL stored with the OAuth credential |
+| `statement` | string | Yes | A single SQL query to run |
+| `warehouse` | string | No | Warehouse to use instead of the user default |
+| `database` | string | No | Database to use instead of the user default |
+| `schema` | string | No | Schema to use instead of the user default |
+| `timeout` | number | No | Statement timeout in seconds \(1-604800\) |
+
+#### Output
+
+| Parameter | Type | Description |
+| --------- | ---- | ----------- |
+| `status` | string | Statement status \(succeeded or running\) |
+| `message` | string | Snowflake status message |
+| `statementHandle` | string | Handle for later status/result requests |
+| `columns` | json | Result columns \(\[\{name, type, nullable\}\]\) |
+| `rows` | json | One bounded result partition as a 2D value array |
+| `rowCount` | number | Total rows reported by Snowflake |
+| `partitionCount` | number | Number of available result partitions |
+| `partition` | number | Partition returned by this operation |
+| `hasMore` | boolean | Whether another result partition is available |
+### Snowflake Execute
+
+Execute one SQL statement in Snowflake and return its status and bounded results
+
+#### Input
+
+| Parameter | Type | Required | Description |
+| --------- | ---- | -------- | ----------- |
+| `idToken` | string | No | Snowflake account URL stored with the OAuth credential |
+| `statement` | string | Yes | A single SQL statement to execute |
+| `warehouse` | string | No | Warehouse to use instead of the user default |
+| `database` | string | No | Database to use instead of the user default |
+| `schema` | string | No | Schema to use instead of the user default |
+| `timeout` | number | No | Statement timeout in seconds \(1-604800\) |
+
+#### Output
+
+| Parameter | Type | Description |
+| --------- | ---- | ----------- |
+| `status` | string | Statement status \(succeeded or running\) |
+| `message` | string | Snowflake status message |
+| `statementHandle` | string | Handle for later status/result requests |
+| `columns` | json | Result columns \(\[\{name, type, nullable\}\]\) |
+| `rows` | json | One bounded result partition as a 2D value array |
+| `rowCount` | number | Total rows reported by Snowflake |
+| `partitionCount` | number | Number of available result partitions |
+| `partition` | number | Partition returned by this operation |
+| `hasMore` | boolean | Whether another result partition is available |
+
+### Snowflake Introspect
+
+List tables, views, and columns from a Snowflake database information schema
+
+#### Input
+
+| Parameter | Type | Required | Description |
+| --------- | ---- | -------- | ----------- |
+| `idToken` | string | No | Snowflake account URL stored with the OAuth credential |
+| `database` | string | Yes | Database whose information schema should be inspected |
+| `schema` | string | No | Optional exact schema name to inspect |
+| `warehouse` | string | No | Warehouse to use instead of the user default |
+| `timeout` | number | No | Statement timeout in seconds \(1-604800\) |
+
+#### Output
+
+| Parameter | Type | Description |
+| --------- | ---- | ----------- |
+| `status` | string | Statement status \(succeeded or running\) |
+| `message` | string | Snowflake status message |
+| `statementHandle` | string | Handle for later status/result requests |
+| `columns` | json | Result columns \(\[\{name, type, nullable\}\]\) |
+| `rows` | json | One bounded result partition as a 2D value array |
+| `rowCount` | number | Total rows reported by Snowflake |
+| `partitionCount` | number | Number of available result partitions |
+| `partition` | number | Partition returned by this operation |
+| `hasMore` | boolean | Whether another result partition is available |
+
+### Snowflake Get Statement
+
+Check a statement and retrieve one bounded result partition by handle
+
+#### Input
+
+| Parameter | Type | Required | Description |
+| --------- | ---- | -------- | ----------- |
+| `idToken` | string | No | Snowflake account URL stored with the OAuth credential |
+| `statementHandle` | string | Yes | Statement handle returned by Query, Execute, or Introspect |
+| `partition` | number | No | Zero-based result partition to retrieve \(default: 0\) |
+
+#### Output
+
+| Parameter | Type | Description |
+| --------- | ---- | ----------- |
+| `status` | string | Statement status \(succeeded or running\) |
+| `message` | string | Snowflake status message |
+| `statementHandle` | string | Handle for later status/result requests |
+| `columns` | json | Result columns \(\[\{name, type, nullable\}\]\) |
+| `rows` | json | One bounded result partition as a 2D value array |
+| `rowCount` | number | Total rows reported by Snowflake |
+| `partitionCount` | number | Number of available result partitions |
+| `partition` | number | Partition returned by this operation |
+| `hasMore` | boolean | Whether another result partition is available |

apps/sim/app/api/auth/oauth/utils.test.ts

@@ -327,7 +327,9 @@ describe('OAuth Utils', () => {
         'oauth:refresh:slack:T08CM6ZNYBE'
       )
       expect(redisConfigMockFns.mockAcquireLock.mock.calls[0][2]).toBe(30)
-      expect(mockRefreshOAuthToken).toHaveBeenCalledWith('slack', 'live-rt')
+      expect(mockRefreshOAuthToken).toHaveBeenCalledWith('slack', 'live-rt', {
+        providerAccountId: SLACK_ACCOUNT_ID,
+      })
       expect(mockSet).toHaveBeenCalledWith(
         expect.objectContaining({ accessToken: 'new-at', refreshToken: 'new-rt' })
       )
@@ -365,7 +367,9 @@ describe('OAuth Utils', () => {
 
       expect(result).toEqual({ accessToken: 'new-at', refreshed: true })
       expect(redisConfigMockFns.mockAcquireLock.mock.calls[0][0]).toBe('oauth:refresh:row-1')
-      expect(mockRefreshOAuthToken).toHaveBeenCalledWith('slack', 'stale-rt')
+      expect(mockRefreshOAuthToken).toHaveBeenCalledWith('slack', 'stale-rt', {
+        providerAccountId: 'slack-bot-1764756583292',
+      })
     })
 
     it('dead-flags the installation, not the row, on terminal refresh errors', async () => {

apps/sim/app/api/auth/oauth/utils.ts

@@ -777,7 +777,10 @@ async function performCoalescedRefresh({
             refreshTokenToUse = freshest.refreshToken
           }
 
-          const result = await refreshOAuthToken(providerId, refreshTokenToUse)
+          const result =
+            providerAccountId != null
+              ? await refreshOAuthToken(providerId, refreshTokenToUse, { providerAccountId })
+              : await refreshOAuthToken(providerId, refreshTokenToUse)
 
           if (!result.ok) {
             logger.error('Failed to refresh token', {

apps/sim/app/api/auth/oauth2/callback/snowflake/route.test.ts

@@ -0,0 +1,142 @@
+/**
+ * @vitest-environment node
+ */
+import { createMockRequest, resetEnvMock, setEnv } from '@sim/testing'
+import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const {
+  mockGetSession,
+  mockExchangeSnowflakeAuthorizationCode,
+  mockFindFirst,
+  mockUpdate,
+  mockSafeAccountInsert,
+  mockProcessCredentialDraft,
+} = vi.hoisted(() => ({
+  mockGetSession: vi.fn(),
+  mockExchangeSnowflakeAuthorizationCode: vi.fn(),
+  mockFindFirst: vi.fn(),
+  mockUpdate: vi.fn(),
+  mockSafeAccountInsert: vi.fn(),
+  mockProcessCredentialDraft: vi.fn(),
+}))
+
+vi.mock('@sim/db', () => ({
+  db: {
+    query: { account: { findFirst: mockFindFirst } },
+    update: vi.fn(() => ({ set: vi.fn(() => ({ where: mockUpdate })) })),
+  },
+}))
+vi.mock('@/lib/auth', () => ({ getSession: mockGetSession }))
+vi.mock('@/lib/credentials/draft-processor', () => ({
+  processCredentialDraft: mockProcessCredentialDraft,
+}))
+vi.mock('@/app/api/auth/oauth/utils', () => ({ safeAccountInsert: mockSafeAccountInsert }))
+vi.mock('@/lib/oauth/snowflake', () => ({
+  exchangeSnowflakeAuthorizationCode: mockExchangeSnowflakeAuthorizationCode,
+  parseSnowflakeOAuthMetadata: vi.fn(() => ({
+    accountUrl: 'https://myorg-myaccount.snowflakecomputing.com',
+    accountLocator: 'XY12345',
+    clientId: 'client-id',
+  })),
+  serializeSnowflakeOAuthMetadata: vi.fn(() => 'snowflake:v1:test-metadata'),
+}))
+
+import { serializeSnowflakeOAuthMetadata } from '@/lib/oauth/snowflake'
+import { GET } from '@/app/api/auth/oauth2/callback/snowflake/route'
+
+const BASE_URL = 'https://sim.test'
+const metadata = {
+  accountUrl: 'https://myorg-myaccount.snowflakecomputing.com',
+  accountLocator: 'XY12345',
+  clientId: 'client-id',
+}
+
+function callbackRequest(query: Record<string, string>, cookieState = 'expected-state') {
+  const url = new URL(`${BASE_URL}/api/auth/oauth2/callback/snowflake`)
+  for (const [key, value] of Object.entries(query)) url.searchParams.set(key, value)
+  const cookies = [
+    `snowflake_oauth_state=${cookieState}`,
+    'snowflake_oauth_verifier=verifier',
+    `snowflake_oauth_metadata=${serializeSnowflakeOAuthMetadata(metadata)}`,
+    `snowflake_return_url=${encodeURIComponent(`${BASE_URL}/workspace/ws-1`)}`,
+  ].join('; ')
+  return createMockRequest('GET', undefined, { Cookie: cookies }, url.toString())
+}
+
+describe('Snowflake OAuth callback route', () => {
+  afterAll(() => resetEnvMock())
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    setEnv({
+      NEXT_PUBLIC_APP_URL: BASE_URL,
+      SNOWFLAKE_OAUTH_PRIVATE_KEY: 'private-key',
+    })
+    mockGetSession.mockResolvedValue({ user: { id: 'user-1' } })
+    mockExchangeSnowflakeAuthorizationCode.mockResolvedValue({
+      accessToken: 'access-token',
+      refreshToken: 'refresh-token',
+      expiresIn: 600,
+      username: 'ADA',
+    })
+  })
+
+  it('rejects a state mismatch before exchanging the code', async () => {
+    const response = await GET(
+      callbackRequest({ code: 'authorization-code', state: 'wrong-state' })
+    )
+    expect(response.headers.get('location')).toBe(
+      `${BASE_URL}/workspace?error=snowflake_state_mismatch`
+    )
+    expect(mockExchangeSnowflakeAuthorizationCode).not.toHaveBeenCalled()
+  })
+
+  it('updates an existing account and processes its credential draft', async () => {
+    mockFindFirst.mockResolvedValue({ id: 'account-row-1' })
+    const response = await GET(
+      callbackRequest({ code: 'authorization-code', state: 'expected-state' })
+    )
+    expect(mockExchangeSnowflakeAuthorizationCode).toHaveBeenCalledWith(
+      expect.objectContaining({
+        code: 'authorization-code',
+        codeVerifier: 'verifier',
+        redirectUri: `${BASE_URL}/api/auth/oauth2/callback/snowflake`,
+      })
+    )
+    expect(mockUpdate).toHaveBeenCalled()
+    expect(mockProcessCredentialDraft).toHaveBeenCalledWith({
+      userId: 'user-1',
+      providerId: 'snowflake',
+      accountId: 'account-row-1',
+    })
+    expect(response.headers.get('location')).toContain('snowflake_connected=true')
+  })
+
+  it('inserts a new account and requires the requested refresh token', async () => {
+    mockFindFirst.mockResolvedValueOnce(undefined).mockResolvedValueOnce({ id: 'account-row-2' })
+    await GET(callbackRequest({ code: 'authorization-code', state: 'expected-state' }))
+    expect(mockSafeAccountInsert).toHaveBeenCalledWith(
+      expect.objectContaining({
+        providerId: 'snowflake',
+        idToken: metadata.accountUrl,
+        refreshToken: 'refresh-token',
+        scope: 'refresh_token',
+      }),
+      expect.objectContaining({ provider: 'Snowflake', identifier: 'ADA' })
+    )
+  })
+
+  it('does not persist an access token when Snowflake omits the refresh token', async () => {
+    mockExchangeSnowflakeAuthorizationCode.mockResolvedValue({
+      accessToken: 'access-token',
+      expiresIn: 600,
+    })
+    const response = await GET(
+      callbackRequest({ code: 'authorization-code', state: 'expected-state' })
+    )
+    expect(response.headers.get('location')).toBe(
+      `${BASE_URL}/workspace?error=snowflake_no_refresh_token`
+    )
+    expect(mockSafeAccountInsert).not.toHaveBeenCalled()
+  })
+})