fix(salesforce): handle the Government Cloud JWT audience and unassigned-profile errors

waleedlatif1 · waleedlatif1 · commit 48ffd467d2e7 · 2026-08-10T17:42:56.000-07:00
Verification against Salesforce's own sfdx-core surfaced two gaps: - `gs1` Government Cloud orgs have ordinary *.my.salesforce.com hosts, but Salesforce requires `https://gs1.salesforce.com` as the JWT audience. The host regex accepted them, so they would have failed with an opaque audience error. The token still posts to the org's own host; only `aud` differs. - `invalid_app_access` — Permitted Users is set to admin-pre-authorized but the run-as user's profile was never assigned to the app — is the likeliest misconfiguration and had no hint at all. Also sends `iat`, matching sfdx-core and every mainstream implementation, and softens two TSDoc claims that were stronger than the evidence: Salesforce does not hard-reject a far-future `exp` (its own CLI ships one), and My Domain is the right audience for commercial orgs rather than universally.
diff --git a/apps/sim/lib/credentials/client-credential-accounts/minters/salesforce.test.ts b/apps/sim/lib/credentials/client-credential-accounts/minters/salesforce.test.ts
@@ -364,7 +364,7 @@ describe('mintSalesforceServiceAccountToken (JWT bearer)', () => {
   /** Pulls the posted assertion apart and verifies its RS256 signature. */
   function readPostedAssertion(): {
     header: { alg: string; typ: string }
-    claims: { aud: string; iss: string; sub: string; exp: number }
+    claims: { aud: string; iss: string; sub: string; exp: number; iat: number }
     verified: boolean
   } {
     const [url, init] = mockFetch.mock.calls[0]
@@ -422,6 +422,49 @@ describe('mintSalesforceServiceAccountToken (JWT bearer)', () => {
     expect(claims.sub).toBe('integration.user@yourorg.com')
   })
 
+  it('audiences a Government Cloud org at gs1.salesforce.com, not its My Domain', async () => {
+    // Salesforce's own sfdx-core substitutes this audience for gs1 orgs, whose
+    // hosts are otherwise ordinary *.my.salesforce.com.
+    mockFetch
+      .mockResolvedValueOnce(jsonResponse(200, { access_token: 'sf-jwt-token' }))
+      .mockResolvedValueOnce(jsonResponse(403, {}))
+
+    await mintSalesforceServiceAccountToken({ ...JWT_FIELDS, orgId: 'gs1-acme.my.salesforce.com' })
+
+    const [url, init] = mockFetch.mock.calls[0]
+    const assertion = new URLSearchParams(init.body as string).get('assertion') as string
+    const claims = JSON.parse(Buffer.from(assertion.split('.')[1], 'base64url').toString())
+    expect(claims.aud).toBe('https://gs1.salesforce.com')
+    // The token still POSTs to the org's own host — only the audience differs.
+    expect(url).toBe('https://gs1-acme.my.salesforce.com/services/oauth2/token')
+  })
+
+  it('carries an iat claim, matching every mainstream Salesforce implementation', async () => {
+    mockFetch
+      .mockResolvedValueOnce(jsonResponse(200, { access_token: 'sf-jwt-token' }))
+      .mockResolvedValueOnce(jsonResponse(403, {}))
+
+    await mintSalesforceServiceAccountToken(JWT_FIELDS)
+
+    const { claims } = readPostedAssertion()
+    expect(claims.iat).toBeLessThanOrEqual(Math.floor(Date.now() / 1000))
+    expect(claims.exp).toBeGreaterThan(claims.iat)
+  })
+
+  it('maps an unassigned profile to a permission-set hint', async () => {
+    mockFetch.mockResolvedValueOnce(
+      jsonResponse(400, {
+        error: 'invalid_app_access',
+        error_description: 'user is not admin approved to access this app',
+      })
+    )
+
+    await expect(mintSalesforceServiceAccountToken(JWT_FIELDS)).rejects.toMatchObject({
+      code: 'invalid_credentials',
+      logDetail: { hint: expect.stringContaining('profile or permission set is not assigned') },
+    })
+  })
+
   it('sets a short expiry inside the 5-minute window Salesforce allows', async () => {
     mockFetch
       .mockResolvedValueOnce(jsonResponse(200, { access_token: 'sf-jwt-token' }))
diff --git a/apps/sim/lib/credentials/client-credential-accounts/minters/salesforce.ts b/apps/sim/lib/credentials/client-credential-accounts/minters/salesforce.ts
@@ -36,10 +36,10 @@ const IDENTITY_STEP = 'salesforce_identity'
 const TOKEN_MINT_STEP = 'salesforce_token_mint'
 
 /**
- * Lifetime of the signed assertion, not of the access token it buys.
- * Salesforce rejects an `exp` more than 5 minutes ahead of *its* clock, so a
- * short window bounds replay while leaving room for clock skew between Sim and
- * Salesforce.
+ * Lifetime of the signed assertion, not of the access token it buys. Salesforce
+ * documents a 5-minute ceiling; a short window bounds replay while leaving room
+ * for clock skew. The binding constraint is the lower bound — a Sim clock more
+ * than this far behind Salesforce's fails every mint.
  */
 const JWT_ASSERTION_LIFETIME_SECONDS = 180
 
@@ -254,27 +254,43 @@ function loadSalesforcePrivateKey(privateKeyPem: string): KeyObject {
  * `test.salesforce.com`. Salesforce ended legacy hostname redirections in
  * Spring '26, and External Client Apps now reject the generic sandbox host
  * with `app_not_found` because it cannot identify which org the app is
- * installed in. The My Domain URL is valid for both Connected Apps and
- * External Client Apps, in production and in sandboxes, so it is the only
- * audience that works across all four combinations — and it means the stored
- * host alone determines the environment, with nothing left to infer.
- * Salesforce's own CLI recommends the My Domain login URL for the same reason.
+ * installed in. My Domain is valid for Connected Apps and External Client Apps
+ * alike, in production and in sandboxes, and is what Salesforce's own CLI
+ * recommends — so the stored host alone determines the environment, with
+ * nothing left to infer.
+ *
+ * Government Cloud is the documented exception: `sfdx-core` substitutes
+ * `https://gs1.salesforce.com` for `gs1` orgs, whose hosts are otherwise
+ * ordinary `*.my.salesforce.com`.
  *
  * @see https://help.salesforce.com/s/articleView?id=sf.remoteaccess_oauth_jwt_flow.htm&type=5
+ * @see https://github.com/forcedotcom/sfdx-core/blob/main/src/util/sfdcUrl.ts
  */
 function buildSalesforceJwtAssertion(
   consumerKey: string,
   username: string,
   host: string,
   privateKey: KeyObject
 ): Promise<string> {
-  return new SignJWT()
-    .setProtectedHeader({ alg: 'RS256', typ: 'JWT' })
-    .setIssuer(consumerKey)
-    .setSubject(username)
-    .setAudience(`https://${host}`)
-    .setExpirationTime(Math.floor(Date.now() / 1000) + JWT_ASSERTION_LIFETIME_SECONDS)
-    .sign(privateKey)
+  return (
+    new SignJWT()
+      .setProtectedHeader({ alg: 'RS256', typ: 'JWT' })
+      .setIssuer(consumerKey)
+      .setSubject(username)
+      .setAudience(salesforceJwtAudience(host))
+      // Optional per RFC 7523, but every mainstream Salesforce implementation
+      // (including `sfdx-core`) sends it; costs nothing to match them.
+      .setIssuedAt()
+      .setExpirationTime(Math.floor(Date.now() / 1000) + JWT_ASSERTION_LIFETIME_SECONDS)
+      .sign(privateKey)
+  )
+}
+
+/** Government Cloud orgs authenticate at a dedicated audience; everyone else uses My Domain. */
+function salesforceJwtAudience(host: string): string {
+  return host.startsWith('gs1.') || host.startsWith('gs1-')
+    ? 'https://gs1.salesforce.com'
+    : `https://${host}`
 }
 
 /**
@@ -290,6 +306,9 @@ function salesforceJwtErrorHint(body: string): string | undefined {
     if (parsed.error === 'app_not_found') {
       return 'the app is not installed in this org — check the My Domain host and that the consumer key belongs to that org'
     }
+    if (parsed.error === 'invalid_app_access' || description.includes('admin approved')) {
+      return "the run-as user's profile or permission set is not assigned to the app — assign it under the app's OAuth policies"
+    }
     if (description.includes('user hasn’t approved') || description.includes("hasn't approved")) {
       return 'the run-as user has not approved the app — set its OAuth policy to "Admin approved users are pre-authorized" and assign the user a permitted profile or permission set'
     }
