fix(credentials): review round 3 — transient DNS and runtime host-error mapping

- EAI_AGAIN (temporary resolver failure) stays provider_unavailable; only
  ENOTFOUND maps to site_not_found
- Token route surfaces site_not_found with its code (400) so runtime
  consumers can distinguish a dead stored host from bad credentials

Author: waleedlatif1

apps/sim/app/api/auth/oauth/token/route.ts

@@ -188,15 +188,26 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
         )
       } catch (error) {
         logger.error(`[${requestId}] Service account token error:`, error)
-        // Classified provider outages are infra failures, not bad credentials.
-        if (
-          error instanceof TokenServiceAccountValidationError &&
-          error.code === 'provider_unavailable'
-        ) {
-          return NextResponse.json(
-            { error: 'Credential provider is temporarily unavailable' },
-            { status: 502 }
-          )
+        if (error instanceof TokenServiceAccountValidationError) {
+          // Classified provider outages are infra failures, not bad credentials.
+          if (error.code === 'provider_unavailable') {
+            return NextResponse.json(
+              { error: 'Credential provider is temporarily unavailable' },
+              { status: 502 }
+            )
+          }
+          // A stored host that no longer resolves is a configuration failure —
+          // surface the code so runtime consumers can say "check the host"
+          // instead of a generic auth error.
+          if (error.code === 'site_not_found') {
+            return NextResponse.json(
+              {
+                code: error.code,
+                error: 'Credential host not found — reconnect the credential with a valid host',
+              },
+              { status: 400 }
+            )
+          }
         }
         return NextResponse.json({ error: 'Failed to get service account token' }, { status: 401 })
       }

apps/sim/lib/credentials/token-service-accounts/errors.ts

@@ -63,7 +63,9 @@ export async function fetchProvider(
     return await fetch(url, { ...init, signal: AbortSignal.timeout(PROVIDER_FETCH_TIMEOUT_MS) })
   } catch (error) {
     const causeCode = (error as { cause?: { code?: unknown } })?.cause?.code
-    if (options?.dnsFailureCode && (causeCode === 'ENOTFOUND' || causeCode === 'EAI_AGAIN')) {
+    // Only ENOTFOUND proves the host doesn't exist; EAI_AGAIN is a transient
+    // resolver failure and stays provider_unavailable.
+    if (options?.dnsFailureCode && causeCode === 'ENOTFOUND') {
       throw new TokenServiceAccountValidationError(options.dnsFailureCode, 400, {
         step,
         reason: options.dnsFailureReason ?? 'host does not resolve',