fix(e2e): reap stale OAuth2 credential providers alongside API key providers (#1679)

* fix(e2e): reap stale OAuth2 credential providers in globalSetup

The e2e globalSetup already reaps stale API key credential providers, but
OAuth2 providers are a separate resource type with their own List/Delete
APIs — they do NOT appear in ListApiKeyCredentialProviders, so the existing
cleanup can never see them. The CUSTOM_JWT harness test registers a managed
OAuth2 provider (`<name>-oauth`) created outside the CloudFormation stack, so
teardown leaves it behind. These accumulate against the account's 50-provider
OAuth2 quota (L-431051DC) until every CUSTOM_JWT deploy fails with "The number
of agent identity Oauth2 credential providers in this account has reached its
limit", failing the E2E suite.

Add cleanupStaleOAuth2CredentialProviders (mirrors the API key reaper, using
ListOauth2CredentialProviders / DeleteOauth2CredentialProvider) and wire it
into globalSetup alongside the existing stack / API key / recommendation
cleanups.

* refactor(e2e): reap both provider types in one cleanupStaleCredentialProviders

Fold the OAuth2 reaping into cleanupStaleCredentialProviders rather than a
separate function + second globalSetup call. From the caller's view "reap
stale credential providers" is one job; splitting it by resource type is what
let OAuth2 providers go unreaped in the first place. The function now walks
both the API key and OAuth2 list APIs. globalSetup reverts to a single call
(no longer changed vs main).

Author: aidandaly24

e2e-tests/utils/credential-provider-cleanup.ts

@@ -2,7 +2,9 @@ import type { Logger } from './logger';
 import {
   BedrockAgentCoreControlClient,
   DeleteApiKeyCredentialProviderCommand,
+  DeleteOauth2CredentialProviderCommand,
   ListApiKeyCredentialProvidersCommand,
+  ListOauth2CredentialProvidersCommand,
 } from '@aws-sdk/client-bedrock-agentcore-control';
 
 export async function deleteCredentialProvider(
@@ -19,6 +21,31 @@ export async function deleteCredentialProvider(
   }
 }
 
+export async function deleteOAuth2CredentialProvider(
+  client: BedrockAgentCoreControlClient,
+  logger: Logger,
+  name: string
+): Promise<void> {
+  try {
+    await client.send(new DeleteOauth2CredentialProviderCommand({ name }));
+    logger.info(`Deleted OAuth2 credential provider: ${name}`);
+  } catch (error) {
+    const err = error as Error;
+    logger.warn(`Failed to delete OAuth2 credential provider ${name}: ${err.name}:${err.message}`);
+  }
+}
+
+/**
+ * Delete stale credential providers matching `prefix` and older than `minAgeMs`.
+ *
+ * Reaps BOTH provider types the e2e suite creates: API key providers and OAuth2 providers.
+ * These are distinct resource types with separate List/Delete APIs — an OAuth2 provider does
+ * NOT appear in ListApiKeyCredentialProviders — so both lists must be walked. The CUSTOM_JWT
+ * harness test registers a managed OAuth2 provider (`<name>-oauth`) created outside the
+ * CloudFormation stack, so teardown leaves it behind; without reaping it here, they accumulate
+ * against the account's 50-provider OAuth2 quota (L-431051DC) until every CUSTOM_JWT deploy
+ * fails with a limit-reached error.
+ */
 export async function cleanupStaleCredentialProviders(
   client: BedrockAgentCoreControlClient,
   logger: Logger,
@@ -28,15 +55,22 @@ export async function cleanupStaleCredentialProviders(
   }
 ): Promise<void> {
   const cutoff = new Date(Date.now() - options.minAgeMs);
+  const isStale = (p: { name?: string; createdTime?: Date }): boolean =>
+    !!p.name?.startsWith(options.prefix) && !!p.createdTime && p.createdTime < cutoff;
 
-  let nextToken: string | undefined;
+  let apiKeyNextToken: string | undefined;
   do {
-    const response = await client.send(new ListApiKeyCredentialProvidersCommand({ nextToken }));
-    const providers = response.credentialProviders ?? [];
-    const stale = providers.filter(p => p.name?.startsWith(options.prefix) && p.createdTime && p.createdTime < cutoff);
-
+    const response = await client.send(new ListApiKeyCredentialProvidersCommand({ nextToken: apiKeyNextToken }));
+    const stale = (response.credentialProviders ?? []).filter(isStale);
     await Promise.all(stale.map(p => deleteCredentialProvider(client, logger, p.name!)));
+    apiKeyNextToken = response.nextToken;
+  } while (apiKeyNextToken);
 
-    nextToken = response.nextToken;
-  } while (nextToken);
+  let oauth2NextToken: string | undefined;
+  do {
+    const response = await client.send(new ListOauth2CredentialProvidersCommand({ nextToken: oauth2NextToken }));
+    const stale = (response.credentialProviders ?? []).filter(isStale);
+    await Promise.all(stale.map(p => deleteOAuth2CredentialProvider(client, logger, p.name!)));
+    oauth2NextToken = response.nextToken;
+  } while (oauth2NextToken);
 }