feat(integrations): add Snowflake OAuth block

[BillLeoutsakosvl346]

Summary

• add a Snowflake integration block with Query, Execute, Introspect, and Get Statement / Result Partition operations
• add customer-account-scoped Snowflake OAuth using PKCE and RS256 private-key JWT client assertions
• add bounded SQL API response handling, explicit partition retrieval, gzip decoding, status retries, and sanitized errors
• add generated catalog metadata and setup documentation
• intentionally omit triggers because Snowflake does not document a compatible event/webhook trigger

OAuth architecture

Customers provide their Snowflake account URL, account locator, and OAuth client ID. Sim uses one deployment-wide SNOWFLAKE_OAUTH_PRIVATE_KEY; customers register the matching public key on their Snowflake security integration. Versioned nonsecret connection metadata is stored in the existing OAuth account ID field, and refreshes reconstruct the account-specific token endpoint and client assertion.

Validation

• full test suite: 1,499 files; 20,613 tests passed; 30 skipped
• full lint and monorepo type-check
• API validation, tool request/registry boundaries, integration catalog, and tool metadata checks
• generated docs/tool metadata inspected
• independent gpt-5.6-sol high review using validate-integration and memory-load-check, iterated to explicit no actionable findings

Notes

No database migration, integration-availability exception, Better Auth provider, trigger, automatic all-partition fetch, role switching, multi-statement execution, or Snowflake-only framework is introduced.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 8, 2026 1:37am

[cursor]

PR Summary

Medium Risk
Introduces OAuth token handling and arbitrary SQL execution against customer Snowflake accounts; risk is moderated by bounded API handling and explicit partition retrieval, but misconfiguration or credential issues could still affect customer data access.

Overview
Adds a Snowflake workflow integration block with Query, Execute, Introspect, and Get Statement / Result Partition operations, wired through the Snowflake SQL API with bounded responses, explicit partition fetches, gzip decoding, status retries, and sanitized errors.

Auth is per-customer Snowflake account OAuth: customers supply account URL, locator, and client ID; Sim uses deployment-wide SNOWFLAKE_OAUTH_PRIVATE_KEY while customers register the matching public key on their security integration. Nonsecret connection metadata is versioned in the existing OAuth account ID field so token refresh can rebuild the account-specific token endpoint and RS256 private-key JWT client assertions (with PKCE).

Also adds generated catalog/tool metadata and setup docs. Triggers are intentionally omitted (no Snowflake-compatible webhook model in scope).

^{Reviewed by Cursor Bugbot for commit 1c5393a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

This PR adds a Snowflake integration backed by account-scoped OAuth, SQL API tools, bounded partition handling, catalog registration, and setup documentation.

• Adds Snowflake Query, Execute, Introspect, and Get Statement operations.
• Implements PKCE authorization and private-key JWT token exchange/refresh.
• Extends shared external-response handling with configurable limits and compressed-body decoding.
• The workspace integrations flow currently omits the workspace identity needed to bind a successful Snowflake account to a usable credential.

Confidence Score: 4/5

The PR should not merge until the Snowflake integrations-page flow preserves workspace identity so successful OAuth connections become usable workflow credentials.

The primary browser connection path persists a Snowflake provider account without creating the draft required to bind it to a workspace credential; the remaining accepted issue is a non-blocking type-safety violation in a test.

Files Needing Attention: apps/sim/hooks/queries/oauth/oauth-connections.ts, apps/sim/app/api/auth/snowflake/authorize/route.ts, apps/sim/tools/index.test.ts

Important Files Changed

Filename	Overview
apps/sim/hooks/queries/oauth/oauth-connections.ts	Adds custom OAuth redirects, but the browser flow does not propagate workspaceId and therefore cannot create a workspace-bound Snowflake credential.
apps/sim/app/api/auth/snowflake/authorize/route.ts	Implements authenticated account-specific OAuth setup and PKCE, while making credential-draft creation conditional on a workspaceId the primary UI flow omits.
apps/sim/app/api/auth/oauth2/callback/snowflake/route.ts	Validates state, exchanges the code, persists account metadata, and delegates workspace credential creation to the draft processor.
apps/sim/lib/oauth/snowflake.ts	Implements validated Snowflake origins and metadata, PKCE, RS256 assertions, and bounded token exchange and refresh handling.
apps/sim/tools/snowflake/utils.ts	Implements bounded SQL API parsing, status normalization, partition metadata, and result shaping without an accepted defect.
apps/sim/lib/core/security/input-validation.server.ts	Adds compressed-response decoding with wire and decoded-size bounds and covered stream lifecycle behavior.
apps/sim/tools/index.test.ts	Extends configurable response-cap coverage but introduces an explicit any cast contrary to the repository's TypeScript rule.

_{Reviews (1): Last reviewed commit: "feat(integrations): add Snowflake OAuth ..." | Re-trigger Greptile}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9f3ad46. Configure here.}