fix(salesforce): canonicalize connected provider ids in the copilot credential tool

A credential stored under an alternate authorization server was recorded in
`connectedProviderIds` under its own id, while the not-connected list compares
against the service's canonical id — so a sandbox-only Salesforce user was
reported as both connected and not connected. Record the canonical id instead.

Also types the JWT test's assertion decoder instead of returning `any`.

Author: waleedlatif1

apps/sim/lib/copilot/tools/server/user/get-credentials.test.ts

@@ -264,6 +264,50 @@ describe('getCredentialsServerTool', () => {
     ).not.toContain('claude-platform')
   })
 
+  it('does not list a service as not-connected when only an alternate provider is connected', async () => {
+    // A credential stored under an alternate authorization server
+    // (`salesforce-sandbox`) still connects the canonical service. Recording the
+    // raw id would list Salesforce as connected AND not connected at once.
+    getAllOAuthServicesMock.mockReturnValue([
+      {
+        serviceId: 'salesforce',
+        providerId: 'salesforce',
+        additionalProviderIds: ['salesforce-sandbox'],
+        serviceAccountProviderId: 'salesforce-service-account',
+        name: 'Salesforce',
+        description: 'Salesforce CRM',
+        baseProvider: 'salesforce',
+        authType: 'oauth',
+      },
+    ])
+    // beforeEach already queued the default Google row; replace the queue so
+    // the sandbox account is the only credential this case sees.
+    resetDbChainMock()
+    wireDb(
+      [
+        {
+          id: 'acct-sf-sandbox',
+          providerId: 'salesforce-sandbox',
+          accountId: 'sf-1',
+          idToken: null,
+          updatedAt: new Date('2026-04-17T02:26:05.546Z'),
+        },
+      ],
+      [{ email: 'brent@cellular.so' }]
+    )
+
+    const result = await getCredentialsServerTool.execute({}, { userId: 'user-1' })
+
+    expect(
+      result.oauth.connected.credentials.map((c: { provider: string }) => c.provider)
+    ).toContain('salesforce-sandbox')
+    expect(
+      result.oauth.notConnected.services.map(
+        (service: { providerId: string }) => service.providerId
+      )
+    ).not.toContain('salesforce')
+  })
+
   it('hides shared service-account credentials disallowed for the viewer', async () => {
     getUserPermissionConfigMock.mockResolvedValue({ allowedIntegrations: ['slack'] })
     getAccessibleOAuthCredentialsMock.mockResolvedValue([

apps/sim/lib/copilot/tools/server/user/get-credentials.ts

@@ -110,7 +110,11 @@ export const getCredentialsServerTool: BaseServerTool<GetCredentialsParams, any>
         credentialProviderMatchesService(providerId, candidate)
       )
       if (!credentialVisibility.isCredentialVisible({ providerId, type: 'oauth' })) continue
-      connectedProviderIds.add(providerId)
+      // The canonical id, not the credential's own: `notConnectedServices` below
+      // compares against `service.providerId`, so recording an alternate
+      // authorization server's id (`salesforce-sandbox`) verbatim would list the
+      // service as both connected and not connected.
+      connectedProviderIds.add(service?.providerId ?? providerId)
 
       const [baseProvider, featureType = 'default'] = providerId.split('-')
       let displayName = ''
@@ -163,7 +167,7 @@ export const getCredentialsServerTool: BaseServerTool<GetCredentialsParams, any>
         const service = allOAuthServices.find((candidate) =>
           credentialProviderMatchesService(cred.providerId, candidate)
         )
-        connectedProviderIds.add(cred.providerId)
+        connectedProviderIds.add(service?.providerId ?? cred.providerId)
         const [, featureType = 'default'] = cred.providerId.split('-')
         connectedCredentials.push({
           id: cred.id,

apps/sim/lib/credentials/client-credential-accounts/minters/salesforce.test.ts

@@ -362,7 +362,11 @@ describe('mintSalesforceServiceAccountToken (JWT bearer)', () => {
   }
 
   /** Pulls the posted assertion apart and verifies its RS256 signature. */
-  function readPostedAssertion(): { header: any; claims: any; verified: boolean } {
+  function readPostedAssertion(): {
+    header: { alg: string; typ: string }
+    claims: { aud: string; iss: string; sub: string; exp: number }
+    verified: boolean
+  } {
     const [url, init] = mockFetch.mock.calls[0]
     expect(url).toBe(TOKEN_URL)
     const body = new URLSearchParams(init.body as string)