fix(snowflake): migrate renamed subblock IDs and authenticate before parsing

- add SUBBLOCK_ID_MIGRATIONS entries so the renamed object fields map onto
  their pickers and the removed host/apiKey values are parked
- authenticate the caller before contract validation in the selector route,
  per the API route convention

Author: waleedlatif1

apps/sim/app/api/tools/snowflake/objects/route.ts

@@ -4,6 +4,7 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { snowflakeObjectsSelectorContract } from '@/lib/api/contracts/selectors/snowflake'
 import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
 import { authorizeCredentialUse } from '@/lib/auth/credential-access'
+import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { resolveCredentialAccessToken } from '@/app/api/auth/oauth/utils'
@@ -69,6 +70,14 @@ function parseAvailableRoles(cellValue: string | null | undefined): SnowflakeObj
 export const POST = withRouteHandler(async (request: NextRequest) => {
   const requestId = generateRequestId()
 
+  // Authenticate the caller before touching the body: contract validation must
+  // never run for an unauthenticated request. This reads headers and the
+  // session only, so it is safe ahead of parsing.
+  const auth = await checkSessionOrInternalAuth(request, { requireWorkflowId: true })
+  if (!auth.success || !auth.userId) {
+    return NextResponse.json({ error: auth.error || 'Authentication required' }, { status: 401 })
+  }
+
   const parsed = await parseRequest(
     snowflakeObjectsSelectorContract,
     request,
@@ -88,7 +97,11 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
   if (!parsed.success) return parsed.response
   const { credential, workflowId, kind, database, schema } = parsed.data.body
 
-  const authz = await authorizeCredentialUse(request, { credentialId: credential, workflowId })
+  const authz = await authorizeCredentialUse(request, {
+    credentialId: credential,
+    workflowId,
+    callerUserId: auth.userId,
+  })
   if (!authz.ok || !authz.credentialOwnerUserId) {
     return NextResponse.json({ error: authz.error || 'Unauthorized' }, { status: 403 })
   }

apps/sim/lib/workflows/migrations/subblock-migrations.ts

@@ -80,6 +80,25 @@ export const SUBBLOCK_ID_MIGRATIONS: Record<string, Record<string, string>> = {
     useAutoprompt: '_removed_useAutoprompt',
     livecrawl: '_removed_livecrawl',
   },
+  /**
+   * The Snowflake block moved from per-block `host` + `apiKey` fields to a
+   * stored credential, and gave every object field a basic picker paired with
+   * an advanced text input. The old free-text fields held the same object
+   * names the pickers now emit, so each maps onto its picker; the host and
+   * token have no in-block equivalent and are parked.
+   */
+  snowflake: {
+    database: 'databaseSelector',
+    schema: 'schemaSelector',
+    table: 'tableSelector',
+    fileFormat: 'fileFormatSelector',
+    warehouseName: 'warehouseNameSelector',
+    procedureName: 'procedureSelector',
+    warehouse: 'warehouseSelector',
+    role: 'roleSelector',
+    host: '_removed_host',
+    apiKey: '_removed_apiKey',
+  },
   rippling: {
     action: '_removed_action',
     candidateDepartment: '_removed_candidateDepartment',