chore: import upstream snapshot with attribution

apps/sim/app/api/tools/agiloft/attach/route.test.ts

@@ -0,0 +1,147 @@
+/**
+ * @vitest-environment node
+ */
+import {
+  createMockRequest,
+  hybridAuthMockFns,
+  inputValidationMock,
+  inputValidationMockFns,
+} from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockProcessFilesToUserFiles, mockDownloadFileFromStorage, mockAssertToolFileAccess } =
+  vi.hoisted(() => ({
+    mockProcessFilesToUserFiles: vi.fn(),
+    mockDownloadFileFromStorage: vi.fn(),
+    mockAssertToolFileAccess: vi.fn(),
+  }))
+
+vi.mock('@/lib/core/security/input-validation.server', () => inputValidationMock)
+vi.mock('@/lib/uploads/utils/file-utils', () => ({
+  processFilesToUserFiles: mockProcessFilesToUserFiles,
+}))
+vi.mock('@/lib/uploads/utils/file-utils.server', () => ({
+  downloadServableFileFromStorage: mockDownloadFileFromStorage,
+}))
+vi.mock('@/app/api/files/authorization', () => ({
+  assertToolFileAccess: mockAssertToolFileAccess,
+}))
+
+import { POST } from '@/app/api/tools/agiloft/attach/route'
+
+const PINNED_IP = '93.184.216.34'
+
+const baseBody = {
+  instanceUrl: 'https://example.agiloft.com',
+  knowledgeBase: 'demo',
+  login: 'admin',
+  password: 'secret',
+  table: 'contracts',
+  recordId: '42',
+  fieldName: 'attachments',
+  file: { key: 's3://bucket/file.txt', name: 'file.txt', size: 5, type: 'text/plain' },
+  fileName: 'file.txt',
+}
+
+function mockSecureFetchResponse(body: {
+  ok?: boolean
+  status?: number
+  json?: unknown
+  text?: string
+}) {
+  return {
+    ok: body.ok ?? true,
+    status: body.status ?? 200,
+    statusText: '',
+    headers: new Headers(),
+    body: null,
+    text: async () => body.text ?? '',
+    json: async () => body.json ?? {},
+    arrayBuffer: async () => new ArrayBuffer(0),
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  hybridAuthMockFns.mockCheckInternalAuth.mockResolvedValue({
+    success: true,
+    userId: 'user-1',
+    authType: 'internal_jwt',
+  })
+  inputValidationMockFns.mockValidateUrlWithDNS.mockResolvedValue({
+    isValid: true,
+    resolvedIP: PINNED_IP,
+    originalHostname: 'example.agiloft.com',
+  })
+  mockProcessFilesToUserFiles.mockReturnValue([
+    { key: 's3://bucket/file.txt', name: 'file.txt', size: 5, type: 'text/plain' },
+  ])
+  mockAssertToolFileAccess.mockResolvedValue(null)
+  mockDownloadFileFromStorage.mockResolvedValue({
+    buffer: Buffer.from('hello'),
+    contentType: 'application/octet-stream',
+  })
+})
+
+describe('POST /api/tools/agiloft/attach', () => {
+  it('rejects unauthenticated requests', async () => {
+    hybridAuthMockFns.mockCheckInternalAuth.mockResolvedValueOnce({
+      success: false,
+      error: 'unauthorized',
+    })
+
+    const response = await POST(createMockRequest('POST', baseBody))
+    expect(response.status).toBe(401)
+    expect(inputValidationMockFns.mockSecureFetchWithPinnedIP).not.toHaveBeenCalled()
+  })
+
+  it('blocks SSRF when the instance URL fails DNS validation', async () => {
+    inputValidationMockFns.mockValidateUrlWithDNS.mockResolvedValueOnce({
+      isValid: false,
+      error: 'instanceUrl resolves to a blocked IP address',
+    })
+
+    const response = await POST(
+      createMockRequest('POST', { ...baseBody, instanceUrl: 'https://attacker.example.com' })
+    )
+
+    expect(response.status).toBe(400)
+    expect(inputValidationMockFns.mockSecureFetchWithPinnedIP).not.toHaveBeenCalled()
+  })
+
+  it('pins the resolved IP for login, attach, and logout (TOCTOU fix)', async () => {
+    inputValidationMockFns.mockSecureFetchWithPinnedIP
+      .mockResolvedValueOnce(mockSecureFetchResponse({ json: { access_token: 'tok-att' } }))
+      .mockResolvedValueOnce(mockSecureFetchResponse({ text: '1' }))
+      .mockResolvedValueOnce(mockSecureFetchResponse({}))
+
+    const response = await POST(createMockRequest('POST', baseBody))
+    expect(response.status).toBe(200)
+    const data = (await response.json()) as {
+      success: true
+      output: { totalAttachments: number; fileName: string }
+    }
+    expect(data.output.totalAttachments).toBe(1)
+    expect(data.output.fileName).toBe('file.txt')
+
+    const calls = inputValidationMockFns.mockSecureFetchWithPinnedIP.mock.calls
+    expect(calls).toHaveLength(3)
+    for (const call of calls) {
+      expect(call[1]).toBe(PINNED_IP)
+    }
+
+    expect(calls[0][0]).toContain('https://example.agiloft.com/ewws/EWLogin')
+    expect(calls[1][0]).toContain('https://example.agiloft.com/ewws/EWAttach')
+    expect(calls[1][2]).toMatchObject({
+      method: 'PUT',
+      headers: {
+        Authorization: 'Bearer tok-att',
+        'Content-Type': 'application/octet-stream',
+      },
+    })
+    expect(calls[2][0]).toContain('https://example.agiloft.com/ewws/EWLogout')
+
+    // DNS only resolved once.
+    expect(inputValidationMockFns.mockValidateUrlWithDNS).toHaveBeenCalledTimes(1)
+  })
+})

apps/sim/app/api/tools/agiloft/attach/route.ts

@@ -0,0 +1,161 @@
+import { createLogger } from '@sim/logger'
+import { toError } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { agiloftAttachContract } from '@/lib/api/contracts/tools/agiloft'
+import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { secureFetchWithPinnedIP } from '@/lib/core/security/input-validation.server'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import type { RawFileInput } from '@/lib/uploads/utils/file-schemas'
+import { processFilesToUserFiles } from '@/lib/uploads/utils/file-utils'
+import { downloadServableFileFromStorage } from '@/lib/uploads/utils/file-utils.server'
+import { docNotReadyResponse } from '@/lib/uploads/utils/servable-file-response'
+import { assertToolFileAccess } from '@/app/api/files/authorization'
+import { buildAttachFileUrl } from '@/tools/agiloft/utils'
+import {
+  agiloftLoginPinned,
+  agiloftLogoutPinned,
+  resolveAgiloftInstance,
+} from '@/tools/agiloft/utils.server'
+
+export const dynamic = 'force-dynamic'
+
+const logger = createLogger('AgiloftAttachAPI')
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  const requestId = generateRequestId()
+
+  try {
+    const authResult = await checkInternalAuth(request, { requireWorkflowId: false })
+
+    if (!authResult.success || !authResult.userId) {
+      logger.warn(`[${requestId}] Unauthorized Agiloft attach attempt: ${authResult.error}`)
+      return NextResponse.json(
+        { success: false, error: authResult.error || 'Authentication required' },
+        { status: 401 }
+      )
+    }
+
+    const parsed = await parseRequest(
+      agiloftAttachContract,
+      request,
+      {},
+      {
+        validationErrorResponse: (error) => {
+          logger.warn(`[${requestId}] Invalid request data`, { errors: error.issues })
+          return NextResponse.json(
+            {
+              success: false,
+              error: getValidationErrorMessage(error, 'Invalid request data'),
+              details: error.issues,
+            },
+            { status: 400 }
+          )
+        },
+      }
+    )
+    if (!parsed.success) return parsed.response
+    const data = parsed.data.body
+
+    if (!data.file) {
+      return NextResponse.json({ success: false, error: 'File is required' }, { status: 400 })
+    }
+
+    const userFiles = processFilesToUserFiles([data.file as RawFileInput], requestId, logger)
+
+    if (userFiles.length === 0) {
+      return NextResponse.json({ success: false, error: 'Invalid file input' }, { status: 400 })
+    }
+
+    const userFile = userFiles[0]
+    logger.info(
+      `[${requestId}] Downloading file for Agiloft attach: ${userFile.name} (${userFile.size} bytes)`
+    )
+
+    const denied = await assertToolFileAccess(userFile.key, authResult.userId, requestId, logger)
+    if (denied) return denied
+
+    let fileBuffer: Buffer
+    try {
+      const servable = await downloadServableFileFromStorage(userFile, requestId, logger)
+      fileBuffer = servable.buffer
+    } catch (error) {
+      const notReady = docNotReadyResponse(error)
+      if (notReady) return notReady
+      logger.error(`[${requestId}] Failed to download file from storage:`, error)
+      return NextResponse.json({ success: false, error: toError(error).message }, { status: 500 })
+    }
+
+    const resolvedFileName = data.fileName || userFile.name || 'attachment'
+
+    let resolvedIP: string
+    try {
+      resolvedIP = await resolveAgiloftInstance(data.instanceUrl)
+    } catch (error) {
+      logger.warn(`[${requestId}] SSRF attempt blocked for Agiloft instance URL`, {
+        instanceUrl: data.instanceUrl,
+      })
+      return NextResponse.json({ success: false, error: toError(error).message }, { status: 400 })
+    }
+
+    const token = await agiloftLoginPinned(data, resolvedIP)
+    const base = data.instanceUrl.replace(/\/$/, '')
+
+    try {
+      const url = buildAttachFileUrl(base, data, resolvedFileName)
+
+      logger.info(`[${requestId}] Uploading file to Agiloft: ${resolvedFileName}`)
+
+      const agiloftResponse = await secureFetchWithPinnedIP(url, resolvedIP, {
+        method: 'PUT',
+        headers: {
+          'Content-Type': 'application/octet-stream',
+          Authorization: `Bearer ${token}`,
+        },
+        body: new Uint8Array(fileBuffer),
+      })
+
+      if (!agiloftResponse.ok) {
+        const errorText = await agiloftResponse.text()
+        logger.error(
+          `[${requestId}] Agiloft attach error: ${agiloftResponse.status} - ${errorText}`
+        )
+        return NextResponse.json(
+          { success: false, error: `Agiloft error: ${agiloftResponse.status} - ${errorText}` },
+          { status: agiloftResponse.status }
+        )
+      }
+
+      let totalAttachments = 0
+      const responseText = await agiloftResponse.text()
+      try {
+        const responseData = JSON.parse(responseText)
+        const result = responseData.result ?? responseData
+        totalAttachments = typeof result === 'number' ? result : (result.count ?? result.total ?? 1)
+      } catch {
+        totalAttachments = Number(responseText) || 1
+      }
+
+      logger.info(
+        `[${requestId}] File attached successfully. Total attachments: ${totalAttachments}`
+      )
+
+      return NextResponse.json({
+        success: true,
+        output: {
+          recordId: data.recordId.trim(),
+          fieldName: data.fieldName.trim(),
+          fileName: resolvedFileName,
+          totalAttachments,
+        },
+      })
+    } finally {
+      await agiloftLogoutPinned(data.instanceUrl, data.knowledgeBase, token, resolvedIP)
+    }
+  } catch (error) {
+    logger.error(`[${requestId}] Error attaching file to Agiloft:`, error)
+
+    return NextResponse.json({ success: false, error: toError(error).message }, { status: 500 })
+  }
+})