fix(credentials): keep the provider-reported name when identity lookup degrades

Box and Salesforce returned early on a missing user id, discarding a `name` or
`login` the response did carry and relabeling the credential to the enterprise
or host fallback. Only the principal should degrade; the human label still
beats an id-derived string.

Also notes the Salesforce `openid` scope in the connect help text. The client
credentials minter sends no scope parameter — effective scopes come from the
customer's Connected App — so without `openid` the userinfo lookup can 403 and
the run-as user silently never reaches the audit record.

Author: waleedlatif1

apps/sim/lib/credentials/client-credential-accounts/descriptors.ts

@@ -274,7 +274,7 @@ export const CLIENT_CREDENTIAL_ACCOUNT_DESCRIPTORS: Record<
     ],
     docsUrl: 'https://docs.sim.ai/integrations/salesforce-service-account',
     helpText:
-      'The Connected App must have "Enable Client Credentials Flow" checked with a "Run As" integration user set under Edit Policies — every call executes with that user\'s permissions, and deactivating or freezing the user stops all runs.',
+      'The Connected App must have "Enable Client Credentials Flow" checked with a "Run As" integration user set under Edit Policies — every call executes with that user\'s permissions, and deactivating or freezing the user stops all runs. Selecting the "openid" scope lets Sim record which run-as user the credential authenticates as; without it the connection still works but the identity is not captured.',
   },
   [ZOHO_DESK_SERVICE_ACCOUNT_PROVIDER_ID]: {
     providerId: ZOHO_DESK_SERVICE_ACCOUNT_PROVIDER_ID,

apps/sim/lib/credentials/client-credential-accounts/minters/box.test.ts

@@ -122,6 +122,9 @@ describe('mintBoxServiceAccountToken', () => {
       kind: 'lookup_failed',
       reason: 'response missing user id',
     })
+    // Only the principal degrades — a name that did come back still beats the
+    // Enterprise-ID fallback, so the credential does not lose its label.
+    expect(result.identity?.displayName).toBe('Sim Automation')
   })
 
   it('still succeeds when the identity request itself throws', async () => {

apps/sim/lib/credentials/client-credential-accounts/minters/box.ts

@@ -75,8 +75,14 @@ async function fetchBoxServiceAccountIdentity(
   accessToken: string,
   orgId: string
 ): Promise<ClientCredentialAccountIdentity> {
-  const degraded = (reason: string): ClientCredentialAccountIdentity => ({
-    displayName: `Box enterprise ${orgId}`,
+  /**
+   * `label` keeps whatever human name the lookup did return. A response can
+   * carry `name`/`login` but no `id` — the principal is then unusable, but the
+   * label still beats the Enterprise-ID fallback, so only the principal
+   * degrades and the credential does not silently lose its name.
+   */
+  const degraded = (reason: string, label?: string): ClientCredentialAccountIdentity => ({
+    displayName: label ?? `Box enterprise ${orgId}`,
     principal: { kind: 'lookup_failed', reason },
     auditMetadata: { boxEnterpriseId: orgId },
     storedMetadata: { enterpriseId: orgId },
@@ -105,7 +111,7 @@ async function fetchBoxServiceAccountIdentity(
         status: res.status,
         enterpriseId: orgId,
       })
-      return degraded('response missing user id')
+      return degraded('response missing user id', name ?? login)
     }
     return {
       displayName: name ?? login ?? `Box enterprise ${orgId}`,

apps/sim/lib/credentials/client-credential-accounts/minters/salesforce.test.ts

@@ -294,6 +294,9 @@ describe('mintSalesforceServiceAccountToken', () => {
       kind: 'lookup_failed',
       reason: 'response missing user_id',
     })
+    // Only the principal degrades — a name that did come back still beats the
+    // host fallback, so the credential does not lose its label.
+    expect(result.identity?.displayName).toBe('Integration User')
   })
 
   it('ignores a non-Salesforce instance_url and falls back to the validated host', async () => {

apps/sim/lib/credentials/client-credential-accounts/minters/salesforce.ts

@@ -118,8 +118,14 @@ async function fetchSalesforceIdentity(
   instanceUrl: string,
   host: string
 ): Promise<ClientCredentialAccountIdentity> {
-  const degraded = (reason: string): ClientCredentialAccountIdentity => ({
-    displayName: `Salesforce ${host}`,
+  /**
+   * `label` keeps whatever human name userinfo did return. A response can carry
+   * `name`/`preferred_username` but no `user_id` — the principal is then
+   * unusable, but the label still beats the host fallback, so only the
+   * principal degrades and the credential does not silently lose its name.
+   */
+  const degraded = (reason: string, label?: string): ClientCredentialAccountIdentity => ({
+    displayName: label ?? `Salesforce ${host}`,
     principal: { kind: 'lookup_failed', reason },
     auditMetadata: { salesforceMyDomainHost: host },
     storedMetadata: { myDomainHost: host, instanceUrl },
@@ -155,7 +161,7 @@ async function fetchSalesforceIdentity(
         status: res.status,
         host,
       })
-      return degraded('response missing user_id')
+      return degraded('response missing user_id', name ?? username)
     }
     return {
       displayName: name ?? username ?? `Salesforce ${host}`,