fix(credentials): allow encoded Oracle connection payloads (#8856)

* fix(credentials): allow encoded Oracle connection payloads

* fix(credentials): keep regression assertions at HTTP boundary

Author: waleedlatif1

apps/docs/openapi-v2-resources.json

@@ -13842,7 +13842,7 @@
           "credentials": {
             "type": "string",
             "minLength": 1,
-            "maxLength": 131072,
+            "maxLength": 4325376,
             "description": "Write-only JSON object string containing the fields declared by credential-provider discovery.",
             "writeOnly": true
           }

apps/sim/app/api/v2/credentials/route.test.ts

@@ -252,6 +252,95 @@ describe('POST /api/v2/credentials', () => {
     expect(body).not.toContain('exact passphrase')
   })
 
+  it.each(['multiline wallet', 'maximum-size JSON with escaped whitespace'])(
+    'accepts an Oracle connection with %s through the serialized credential envelope',
+    async (variant) => {
+      const connection = JSON.stringify({
+        host: 'database.example.com',
+        protocol: 'tcps',
+        serviceName: 'database',
+        username: 'sim',
+        password: 'write-only-password',
+        walletContent: `-----BEGIN CERTIFICATE-----\n${`${'A'.repeat(64)}\n`.repeat(4096)}-----END CERTIFICATE-----`,
+      })
+      const serviceAccountJson =
+        variant === 'multiline wallet' ? connection : connection.padEnd(2 * 1024 * 1024, '\n')
+      const response = await POST(
+        new NextRequest('http://localhost:3000/api/v2/credentials', {
+          method: 'POST',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify({
+            workspaceId: WORKSPACE_ID,
+            type: 'service_account',
+            providerId: 'oracledb-service-account',
+            credentials: JSON.stringify({ serviceAccountJson }),
+          }),
+        })
+      )
+
+      expect(response.status).toBe(201)
+      const body = await response.text()
+      expect(body).not.toContain('write-only-password')
+      expect(body).not.toContain('BEGIN CERTIFICATE')
+    }
+  )
+
+  it('rejects an oversized Oracle connection at the nested field limit', async () => {
+    const response = await POST(
+      new NextRequest('http://localhost:3000/api/v2/credentials', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          workspaceId: WORKSPACE_ID,
+          type: 'service_account',
+          providerId: 'oracledb-service-account',
+          credentials: JSON.stringify({
+            serviceAccountJson: '{}'.padEnd(2 * 1024 * 1024 + 1, ' '),
+          }),
+        }),
+      })
+    )
+
+    expect(response.status).toBe(400)
+    expect(await response.json()).toMatchObject({
+      error: {
+        code: 'BAD_REQUEST',
+        details: expect.arrayContaining([
+          expect.objectContaining({
+            path: ['credentials', 'serviceAccountJson'],
+            message: expect.stringContaining('2097152'),
+          }),
+        ]),
+      },
+    })
+  })
+
+  it('rejects excessive serialized envelope padding before credential verification', async () => {
+    const response = await POST(
+      new NextRequest('http://localhost:3000/api/v2/credentials', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          workspaceId: WORKSPACE_ID,
+          type: 'service_account',
+          providerId: 'oracledb-service-account',
+          credentials: JSON.stringify({ serviceAccountJson: '{}' }).padEnd(
+            4 * 1024 * 1024 + 128 * 1024 + 1,
+            ' '
+          ),
+        }),
+      })
+    )
+
+    expect(response.status).toBe(400)
+    expect(await response.json()).toMatchObject({
+      error: {
+        code: 'BAD_REQUEST',
+        details: expect.arrayContaining([expect.objectContaining({ path: ['credentials'] })]),
+      },
+    })
+  })
+
   /**
    * `credentials create slack-custom-bot` used to fail twice over: discovery
    * demanded a client-generated id, and a caller who then supplied a slug was

apps/sim/lib/api/contracts/v2/credentials.ts

@@ -402,12 +402,16 @@ export const v2CreateCredentialConnectionContract = defineRouteContract({
   },
 })
 
+const MAX_SERVICE_ACCOUNT_JSON_CHARS = 2 * 1024 * 1024
+// JSON escaping can double the configuration; retain room for the other credential fields.
+const MAX_CREDENTIALS_JSON_CHARS = 2 * MAX_SERVICE_ACCOUNT_JSON_CHARS + 128 * 1024
+
 const v2ServiceAccountCredentialFieldsSchema = z
   .object({
     serviceAccountJson: z
       .string()
       .min(1)
-      .max(2 * 1024 * 1024)
+      .max(MAX_SERVICE_ACCOUNT_JSON_CHARS)
       .optional()
       .describe(
         'Write-only provider service-account JSON configuration, including Oracle Database connection fields.'
@@ -501,7 +505,10 @@ type V2ServiceAccountCredentialFields = z.output<typeof v2ServiceAccountCredenti
 const v2ServiceAccountCredentialsJsonSchema = z
   .string({ error: missingFieldError('credentials is required') })
   .min(1, 'credentials cannot be empty')
-  .max(131_072, 'credentials must be at most 131072 characters')
+  .max(
+    MAX_CREDENTIALS_JSON_CHARS,
+    `credentials must be at most ${MAX_CREDENTIALS_JSON_CHARS} characters`
+  )
   .describe(
     'Write-only JSON object string containing the fields declared by credential-provider discovery.'
   )
@@ -674,7 +681,7 @@ const v2ServiceAccountSecretFieldsShape = {
   serviceAccountJson: z
     .string()
     .min(1)
-    .max(2 * 1024 * 1024)
+    .max(MAX_SERVICE_ACCOUNT_JSON_CHARS)
     .optional()
     .describe(
       'Write-only provider service-account JSON configuration, including Oracle Database connection fields.'