Skip to content

Commit 2434652

Browse files
Bill LeoutsakosBill Leoutsakos
Bill Leoutsakos
authored and
Bill Leoutsakos
committed
fix(selectors): harden authorized context resolution
1 parent d329cc2 commit 2434652

52 files changed

Lines changed: 1446 additions & 417 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎apps/sim/app/api/tools/cloudwatch/selector-log-groups/route.ts‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,18 +6,28 @@ import {
66
} from '@/lib/api/contracts/selectors/cloudwatch'
77
import { parseRequest } from '@/lib/api/server'
88
import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
9-
import { resolveAuthorizedSelectorContext } from '@/lib/selectors/server/resolve-authorized-context'
9+
import {
10+
authenticateSelectorRequest,
11+
resolveAuthorizedSelectorContext,
12+
} from '@/lib/selectors/server/resolve-authorized-context'
1013
import { createCloudWatchLogsClient, describeLogGroups } from '@/app/api/tools/cloudwatch/utils'
1114

1215
const logger = createLogger('CloudWatchSelectorLogGroupsAPI')
1316

1417
export const POST = withRouteHandler(async (request: NextRequest) => {
1518
try {
19+
const authentication = await authenticateSelectorRequest(request)
20+
if (!authentication.ok) {
21+
return NextResponse.json({ error: authentication.error }, { status: authentication.status })
22+
}
1623
const parsed = await parseRequest(cloudwatchSelectorLogGroupsContract, request, {})
1724
if (!parsed.success) return parsed.response
1825

1926
const { workflowId, prefix, limit, ...context } = parsed.data.body
20-
const resolution = await resolveAuthorizedSelectorContext(request, { workflowId, context })
27+
const resolution = await resolveAuthorizedSelectorContext(authentication.principal, {
28+
workflowId,
29+
context,
30+
})
2131
if (!resolution.ok) {
2232
return NextResponse.json({ error: resolution.error }, { status: resolution.status })
2333
}
@@ -40,7 +50,9 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
4050
prefix: validated.data.prefix,
4151
limit: validated.data.limit,
4252
})
43-
return NextResponse.json(result)
53+
return NextResponse.json({
54+
logGroups: result.logGroups.map(({ logGroupName }) => ({ logGroupName })),
55+
})
4456
} finally {
4557
client.destroy()
4658
}

‎apps/sim/app/api/tools/cloudwatch/selector-log-streams/route.ts‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,18 +6,28 @@ import {
66
} from '@/lib/api/contracts/selectors/cloudwatch'
77
import { parseRequest } from '@/lib/api/server'
88
import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
9-
import { resolveAuthorizedSelectorContext } from '@/lib/selectors/server/resolve-authorized-context'
9+
import {
10+
authenticateSelectorRequest,
11+
resolveAuthorizedSelectorContext,
12+
} from '@/lib/selectors/server/resolve-authorized-context'
1013
import { createCloudWatchLogsClient, describeLogStreams } from '@/app/api/tools/cloudwatch/utils'
1114

1215
const logger = createLogger('CloudWatchSelectorLogStreamsAPI')
1316

1417
export const POST = withRouteHandler(async (request: NextRequest) => {
1518
try {
19+
const authentication = await authenticateSelectorRequest(request)
20+
if (!authentication.ok) {
21+
return NextResponse.json({ error: authentication.error }, { status: authentication.status })
22+
}
1623
const parsed = await parseRequest(cloudwatchSelectorLogStreamsContract, request, {})
1724
if (!parsed.success) return parsed.response
1825

1926
const { workflowId, prefix, limit, logGroupName, ...context } = parsed.data.body
20-
const resolution = await resolveAuthorizedSelectorContext(request, { workflowId, context })
27+
const resolution = await resolveAuthorizedSelectorContext(authentication.principal, {
28+
workflowId,
29+
context,
30+
})
2131
if (!resolution.ok) {
2232
return NextResponse.json({ error: resolution.error }, { status: resolution.status })
2333
}
@@ -41,7 +51,9 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
4151
prefix: validated.data.prefix,
4252
limit: validated.data.limit,
4353
})
44-
return NextResponse.json(result)
54+
return NextResponse.json({
55+
logStreams: result.logStreams.map(({ logStreamName }) => ({ logStreamName })),
56+
})
4557
} finally {
4658
client.destroy()
4759
}

‎apps/sim/app/api/tools/confluence/selector-page/route.ts‎

Lines changed: 32 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,16 @@ import { validateJiraCloudId } from '@/lib/core/security/input-validation'
66
import { generateRequestId } from '@/lib/core/utils/request'
77
import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
88
import { resolveAtlassianSelectorCredential } from '@/lib/selectors/application/atlassian-credential'
9-
import { resolveAuthorizedSelectorContext } from '@/lib/selectors/server/resolve-authorized-context'
9+
import {
10+
resolveSelectorProviderValue,
11+
SELECTOR_ATLASSIAN_DISCOVERY_OPTIONS,
12+
selectorProviderFailure,
13+
} from '@/lib/selectors/server/provider-errors'
14+
import {
15+
authenticateSelectorRequest,
16+
resolveAuthorizedSelectorContext,
17+
} from '@/lib/selectors/server/resolve-authorized-context'
1018
import { getConfluenceCloudId } from '@/tools/confluence/utils'
11-
import { parseAtlassianErrorMessage } from '@/tools/jira/utils'
1219

1320
const logger = createLogger('ConfluenceSelectorPageAPI')
1421

@@ -21,11 +28,15 @@ interface ConfluencePageResponse {
2128

2229
export const POST = withRouteHandler(async (request: NextRequest) => {
2330
try {
31+
const authentication = await authenticateSelectorRequest(request)
32+
if (!authentication.ok) {
33+
return NextResponse.json({ error: authentication.error }, { status: authentication.status })
34+
}
2435
const parsed = await parseRequest(confluenceSelectorPageContract, request, {})
2536
if (!parsed.success) return parsed.response
2637

2738
const { credential, workflowId, domain: domainReference, pageId } = parsed.data.body
28-
const resolution = await resolveAuthorizedSelectorContext(request, {
39+
const resolution = await resolveAuthorizedSelectorContext(authentication.principal, {
2940
workflowId,
3041
credentialId: credential,
3142
context: { domain: domainReference },
@@ -42,13 +53,27 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
4253
credentialId: credential,
4354
credentialOwnerUserId,
4455
requestId: generateRequestId(),
56+
serviceId: 'confluence',
4557
})
4658
if (!bundle) {
4759
return NextResponse.json({ error: 'Could not retrieve access token' }, { status: 401 })
4860
}
4961

5062
const domain = resolution.context.domain as string
51-
const cloudId = bundle.cloudId || (await getConfluenceCloudId(domain, bundle.accessToken))
63+
const cloudIdResolution = await resolveSelectorProviderValue('Confluence', async () =>
64+
bundle.cloudId
65+
? bundle.cloudId
66+
: getConfluenceCloudId(domain, bundle.accessToken, SELECTOR_ATLASSIAN_DISCOVERY_OPTIONS)
67+
)
68+
if (!cloudIdResolution.ok) {
69+
logger.warn('Confluence selector discovery failed', {
70+
status: cloudIdResolution.upstreamStatus ?? 'unknown',
71+
})
72+
return NextResponse.json(cloudIdResolution.failure, {
73+
status: cloudIdResolution.failure.status,
74+
})
75+
}
76+
const cloudId = cloudIdResolution.value
5277
const cloudIdValidation = validateJiraCloudId(cloudId, 'cloudId')
5378
if (!cloudIdValidation.isValid) {
5479
return NextResponse.json({ error: cloudIdValidation.error }, { status: 400 })
@@ -60,10 +85,9 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
6085
headers: { Accept: 'application/json', Authorization: `Bearer ${bundle.accessToken}` },
6186
})
6287
if (!response.ok) {
63-
const errorText = await response.text()
64-
const message = parseAtlassianErrorMessage(response.status, response.statusText, errorText)
65-
logger.error('Confluence selector page request failed', { status: response.status })
66-
return NextResponse.json({ error: message }, { status: response.status })
88+
logger.warn('Confluence selector page request failed', { status: response.status })
89+
const failure = selectorProviderFailure('Confluence', response.status)
90+
return NextResponse.json(failure, { status: failure.status })
6791
}
6892

6993
const page = (await response.json()) as ConfluencePageResponse

‎apps/sim/app/api/tools/confluence/selector-pages/route.ts‎

Lines changed: 32 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,16 @@ import { validateJiraCloudId } from '@/lib/core/security/input-validation'
66
import { generateRequestId } from '@/lib/core/utils/request'
77
import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
88
import { resolveAtlassianSelectorCredential } from '@/lib/selectors/application/atlassian-credential'
9-
import { resolveAuthorizedSelectorContext } from '@/lib/selectors/server/resolve-authorized-context'
9+
import {
10+
resolveSelectorProviderValue,
11+
SELECTOR_ATLASSIAN_DISCOVERY_OPTIONS,
12+
selectorProviderFailure,
13+
} from '@/lib/selectors/server/provider-errors'
14+
import {
15+
authenticateSelectorRequest,
16+
resolveAuthorizedSelectorContext,
17+
} from '@/lib/selectors/server/resolve-authorized-context'
1018
import { getConfluenceCloudId } from '@/tools/confluence/utils'
11-
import { parseAtlassianErrorMessage } from '@/tools/jira/utils'
1219

1320
const logger = createLogger('ConfluenceSelectorPagesAPI')
1421

@@ -25,11 +32,15 @@ interface ConfluencePagesResponse {
2532

2633
export const POST = withRouteHandler(async (request: NextRequest) => {
2734
try {
35+
const authentication = await authenticateSelectorRequest(request)
36+
if (!authentication.ok) {
37+
return NextResponse.json({ error: authentication.error }, { status: authentication.status })
38+
}
2839
const parsed = await parseRequest(confluenceSelectorPagesContract, request, {})
2940
if (!parsed.success) return parsed.response
3041

3142
const { credential, workflowId, domain: domainReference, title, limit } = parsed.data.body
32-
const resolution = await resolveAuthorizedSelectorContext(request, {
43+
const resolution = await resolveAuthorizedSelectorContext(authentication.principal, {
3344
workflowId,
3445
credentialId: credential,
3546
context: { domain: domainReference },
@@ -46,13 +57,27 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
4657
credentialId: credential,
4758
credentialOwnerUserId,
4859
requestId: generateRequestId(),
60+
serviceId: 'confluence',
4961
})
5062
if (!bundle) {
5163
return NextResponse.json({ error: 'Could not retrieve access token' }, { status: 401 })
5264
}
5365

5466
const domain = resolution.context.domain as string
55-
const cloudId = bundle.cloudId || (await getConfluenceCloudId(domain, bundle.accessToken))
67+
const cloudIdResolution = await resolveSelectorProviderValue('Confluence', async () =>
68+
bundle.cloudId
69+
? bundle.cloudId
70+
: getConfluenceCloudId(domain, bundle.accessToken, SELECTOR_ATLASSIAN_DISCOVERY_OPTIONS)
71+
)
72+
if (!cloudIdResolution.ok) {
73+
logger.warn('Confluence selector discovery failed', {
74+
status: cloudIdResolution.upstreamStatus ?? 'unknown',
75+
})
76+
return NextResponse.json(cloudIdResolution.failure, {
77+
status: cloudIdResolution.failure.status,
78+
})
79+
}
80+
const cloudId = cloudIdResolution.value
5681
const cloudIdValidation = validateJiraCloudId(cloudId, 'cloudId')
5782
if (!cloudIdValidation.isValid) {
5883
return NextResponse.json({ error: cloudIdValidation.error }, { status: 400 })
@@ -66,10 +91,9 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
6691
headers: { Accept: 'application/json', Authorization: `Bearer ${bundle.accessToken}` },
6792
})
6893
if (!response.ok) {
69-
const errorText = await response.text()
70-
const message = parseAtlassianErrorMessage(response.status, response.statusText, errorText)
71-
logger.error('Confluence selector pages request failed', { status: response.status })
72-
return NextResponse.json({ error: message }, { status: response.status })
94+
logger.warn('Confluence selector pages request failed', { status: response.status })
95+
const failure = selectorProviderFailure('Confluence', response.status)
96+
return NextResponse.json(failure, { status: failure.status })
7397
}
7498

7599
const data = (await response.json()) as ConfluencePagesResponse

‎apps/sim/app/api/tools/confluence/selector-spaces/route.ts‎

Lines changed: 35 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,16 @@ import { validateJiraCloudId } from '@/lib/core/security/input-validation'
66
import { generateRequestId } from '@/lib/core/utils/request'
77
import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
88
import { resolveAtlassianSelectorCredential } from '@/lib/selectors/application/atlassian-credential'
9-
import { resolveAuthorizedSelectorContext } from '@/lib/selectors/server/resolve-authorized-context'
9+
import {
10+
resolveSelectorProviderValue,
11+
SELECTOR_ATLASSIAN_DISCOVERY_OPTIONS,
12+
selectorProviderFailure,
13+
} from '@/lib/selectors/server/provider-errors'
14+
import {
15+
authenticateSelectorRequest,
16+
resolveAuthorizedSelectorContext,
17+
} from '@/lib/selectors/server/resolve-authorized-context'
1018
import { getConfluenceCloudId } from '@/tools/confluence/utils'
11-
import { parseAtlassianErrorMessage } from '@/tools/jira/utils'
1219

1320
const logger = createLogger('ConfluenceSelectorSpacesAPI')
1421

@@ -58,11 +65,15 @@ function parseCursor(raw: string | undefined): { status: SpaceStatus; inner?: st
5865
export const POST = withRouteHandler(async (request: NextRequest) => {
5966
const requestId = generateRequestId()
6067
try {
68+
const authentication = await authenticateSelectorRequest(request)
69+
if (!authentication.ok) {
70+
return NextResponse.json({ error: authentication.error }, { status: authentication.status })
71+
}
6172
const parsed = await parseRequest(confluenceSpacesSelectorContract, request, {})
6273
if (!parsed.success) return parsed.response
6374

6475
const { credential, workflowId, domain: domainReference, cursor, spaceKey } = parsed.data.body
65-
const resolution = await resolveAuthorizedSelectorContext(request, {
76+
const resolution = await resolveAuthorizedSelectorContext(authentication.principal, {
6677
workflowId,
6778
credentialId: credential,
6879
context: { domain: domainReference },
@@ -78,6 +89,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
7889
credentialId: credential,
7990
credentialOwnerUserId,
8091
requestId,
92+
serviceId: 'confluence',
8193
})
8294
if (!bundle) {
8395
return NextResponse.json(
@@ -87,7 +99,20 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
8799
}
88100
const domain = resolution.context.domain as string
89101
const accessToken = bundle.accessToken
90-
const cloudId = bundle.cloudId || (await getConfluenceCloudId(domain, accessToken))
102+
const cloudIdResolution = await resolveSelectorProviderValue('Confluence', async () =>
103+
bundle.cloudId
104+
? bundle.cloudId
105+
: getConfluenceCloudId(domain, accessToken, SELECTOR_ATLASSIAN_DISCOVERY_OPTIONS)
106+
)
107+
if (!cloudIdResolution.ok) {
108+
logger.warn('Confluence selector discovery failed', {
109+
status: cloudIdResolution.upstreamStatus ?? 'unknown',
110+
})
111+
return NextResponse.json(cloudIdResolution.failure, {
112+
status: cloudIdResolution.failure.status,
113+
})
114+
}
115+
const cloudId = cloudIdResolution.value
91116

92117
const cloudIdValidation = validateJiraCloudId(cloudId, 'cloudId')
93118
if (!cloudIdValidation.isValid) {
@@ -106,10 +131,12 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
106131
})
107132

108133
if (!response.ok) {
109-
const errorText = await response.text()
110-
const message = parseAtlassianErrorMessage(response.status, response.statusText, errorText)
111-
logger.error('Confluence API error response', { error: message, status: response.status })
112-
return { ok: false, response: NextResponse.json({ error: message }, { status: 502 }) }
134+
logger.warn('Confluence selector spaces request failed', { status: response.status })
135+
const failure = selectorProviderFailure('Confluence', response.status)
136+
return {
137+
ok: false,
138+
response: NextResponse.json(failure, { status: failure.status }),
139+
}
113140
}
114141

115142
return { ok: true, data: await response.json() }

‎apps/sim/app/api/tools/imap/mailboxes/route.ts‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,18 @@ import {
99
import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
1010
import { validateDatabaseHost } from '@/lib/core/security/input-validation.server'
1111
import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
12-
import { resolveAuthorizedSelectorContext } from '@/lib/selectors/server/resolve-authorized-context'
12+
import {
13+
authenticateSelectorRequest,
14+
resolveAuthorizedSelectorContext,
15+
} from '@/lib/selectors/server/resolve-authorized-context'
1316

1417
const logger = createLogger('ImapMailboxesAPI')
1518

1619
export const POST = withRouteHandler(async (request: NextRequest) => {
20+
const authentication = await authenticateSelectorRequest(request)
21+
if (!authentication.ok) {
22+
return NextResponse.json({ error: authentication.error }, { status: authentication.status })
23+
}
1724
const parsed = await parseRequest(
1825
imapMailboxesContract,
1926
request,
@@ -40,7 +47,10 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
4047
if (!parsed.success) return parsed.response
4148
const { workflowId, ...context } = parsed.data.body
4249

43-
const resolution = await resolveAuthorizedSelectorContext(request, { workflowId, context })
50+
const resolution = await resolveAuthorizedSelectorContext(authentication.principal, {
51+
workflowId,
52+
context,
53+
})
4454
if (!resolution.ok) {
4555
return NextResponse.json(
4656
{ success: false, message: resolution.error },

0 commit comments

Comments
 (0)