chore: import upstream snapshot with attribution

apps/sim/app/api/tools/brex/upload-receipt/route.test.ts

@@ -0,0 +1,251 @@
+/**
+ * @vitest-environment node
+ */
+import {
+  createMockRequest,
+  hybridAuthMockFns,
+  inputValidationMock,
+  inputValidationMockFns,
+} from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockProcessFilesToUserFiles, mockDownloadFileFromStorage, mockAssertToolFileAccess } =
+  vi.hoisted(() => ({
+    mockProcessFilesToUserFiles: vi.fn(),
+    mockDownloadFileFromStorage: vi.fn(),
+    mockAssertToolFileAccess: vi.fn(),
+  }))
+
+vi.mock('@/lib/core/security/input-validation.server', () => inputValidationMock)
+vi.mock('@/lib/uploads/utils/file-utils', () => ({
+  processFilesToUserFiles: mockProcessFilesToUserFiles,
+}))
+vi.mock('@/lib/uploads/utils/file-utils.server', () => ({
+  downloadServableFileFromStorage: mockDownloadFileFromStorage,
+}))
+vi.mock('@/app/api/files/authorization', () => ({
+  assertToolFileAccess: mockAssertToolFileAccess,
+}))
+
+import { POST } from '@/app/api/tools/brex/upload-receipt/route'
+
+const mockFetch = vi.fn()
+
+const PINNED_IP = '52.216.0.1'
+
+const baseBody = {
+  apiKey: 'bxt_test_token',
+  expenseId: 'expense_123',
+  file: { key: 'uploads/receipt.pdf', name: 'receipt.pdf', size: 5, type: 'application/pdf' },
+}
+
+function jsonResponse(body: unknown, status = 200) {
+  return {
+    ok: status >= 200 && status < 300,
+    status,
+    text: async () => JSON.stringify(body),
+    json: async () => body,
+  }
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  vi.stubGlobal('fetch', mockFetch)
+  hybridAuthMockFns.mockCheckInternalAuth.mockResolvedValue({
+    success: true,
+    userId: 'user-1',
+    authType: 'internal_jwt',
+  })
+  inputValidationMockFns.mockValidateUrlWithDNS.mockResolvedValue({
+    isValid: true,
+    resolvedIP: PINNED_IP,
+  })
+  inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValue(jsonResponse({}))
+  mockProcessFilesToUserFiles.mockReturnValue([
+    { key: 'uploads/receipt.pdf', name: 'receipt.pdf', size: 5, type: 'application/pdf' },
+  ])
+  mockAssertToolFileAccess.mockResolvedValue(null)
+  mockDownloadFileFromStorage.mockResolvedValue({
+    buffer: Buffer.from('receipt-bytes'),
+    contentType: 'application/pdf',
+  })
+})
+
+describe('POST /api/tools/brex/upload-receipt', () => {
+  it('rejects unauthenticated requests', async () => {
+    hybridAuthMockFns.mockCheckInternalAuth.mockResolvedValueOnce({
+      success: false,
+      error: 'unauthorized',
+    })
+
+    const response = await POST(createMockRequest('POST', baseBody))
+    expect(response.status).toBe(401)
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
+  it('creates a receipt upload for an expense and PUTs the file to the pre-signed URL', async () => {
+    mockFetch.mockResolvedValueOnce(
+      jsonResponse({ id: 'receipt_1', uri: 'https://s3.example.com/presigned' })
+    )
+
+    const response = await POST(createMockRequest('POST', baseBody))
+    expect(response.status).toBe(200)
+    const data = await response.json()
+    expect(data).toEqual({
+      success: true,
+      output: { receiptId: 'receipt_1', receiptName: 'receipt.pdf', expenseId: 'expense_123' },
+    })
+
+    expect(mockFetch).toHaveBeenCalledTimes(1)
+    const [createUrl, createInit] = mockFetch.mock.calls[0]
+    expect(createUrl).toBe('https://api.brex.com/v1/expenses/card/expense_123/receipt_upload')
+    expect(createInit.method).toBe('POST')
+    expect(createInit.headers.Authorization).toBe('Bearer bxt_test_token')
+    expect(JSON.parse(createInit.body)).toEqual({ receipt_name: 'receipt.pdf' })
+
+    expect(inputValidationMockFns.mockValidateUrlWithDNS).toHaveBeenCalledWith(
+      'https://s3.example.com/presigned',
+      'uri'
+    )
+    const [uploadUrl, pinnedIP, uploadInit] =
+      inputValidationMockFns.mockSecureFetchWithPinnedIP.mock.calls[0]
+    expect(uploadUrl).toBe('https://s3.example.com/presigned')
+    expect(pinnedIP).toBe(PINNED_IP)
+    expect(uploadInit.method).toBe('PUT')
+  })
+
+  it('rejects a whitespace-only expense ID instead of falling back to receipt match', async () => {
+    const response = await POST(createMockRequest('POST', { ...baseBody, expenseId: '   ' }))
+    expect(response.status).toBe(400)
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
+  it('trims a padded expense ID before building the upload URL', async () => {
+    mockFetch.mockResolvedValueOnce(
+      jsonResponse({ id: 'receipt_5', uri: 'https://s3.example.com/presigned' })
+    )
+
+    const response = await POST(
+      createMockRequest('POST', { ...baseBody, expenseId: '  expense_123  ' })
+    )
+    expect(response.status).toBe(200)
+    const [createUrl] = mockFetch.mock.calls[0]
+    expect(createUrl).toBe('https://api.brex.com/v1/expenses/card/expense_123/receipt_upload')
+    const data = await response.json()
+    expect(data.output.expenseId).toBe('expense_123')
+  })
+
+  it('rejects a whitespace-only receipt name', async () => {
+    const response = await POST(createMockRequest('POST', { ...baseBody, receiptName: '   ' }))
+    expect(response.status).toBe(400)
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
+  it('rejects an API key containing header-breaking characters', async () => {
+    const response = await POST(
+      createMockRequest('POST', { ...baseBody, apiKey: 'bxt_test\r\nX-Injected: 1' })
+    )
+    expect(response.status).toBe(400)
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
+  it('uses receipt match when no expense ID is provided', async () => {
+    mockFetch.mockResolvedValueOnce(
+      jsonResponse({ id: 'receipt_2', uri: 'https://s3.example.com/presigned' })
+    )
+
+    const response = await POST(
+      createMockRequest('POST', { apiKey: 'bxt_test_token', file: baseBody.file })
+    )
+    expect(response.status).toBe(200)
+    const data = await response.json()
+    expect(data.output).toEqual({
+      receiptId: 'receipt_2',
+      receiptName: 'receipt.pdf',
+      expenseId: null,
+    })
+
+    const [createUrl] = mockFetch.mock.calls[0]
+    expect(createUrl).toBe('https://api.brex.com/v1/expenses/card/receipt_match')
+  })
+
+  it('honors a receipt name override', async () => {
+    mockFetch.mockResolvedValueOnce(
+      jsonResponse({ id: 'receipt_3', uri: 'https://s3.example.com/presigned' })
+    )
+
+    const response = await POST(
+      createMockRequest('POST', { ...baseBody, receiptName: 'march-dinner.pdf' })
+    )
+    expect(response.status).toBe(200)
+    const [, createInit] = mockFetch.mock.calls[0]
+    expect(JSON.parse(createInit.body)).toEqual({ receipt_name: 'march-dinner.pdf' })
+  })
+
+  it('propagates Brex API errors', async () => {
+    mockFetch.mockResolvedValueOnce(jsonResponse({ message: 'Expense not found' }, 404))
+
+    const response = await POST(createMockRequest('POST', baseBody))
+    expect(response.status).toBe(404)
+    const data = await response.json()
+    expect(data.success).toBe(false)
+    expect(data.error).toContain('Expense not found')
+    expect(mockFetch).toHaveBeenCalledTimes(1)
+    expect(inputValidationMockFns.mockSecureFetchWithPinnedIP).not.toHaveBeenCalled()
+  })
+
+  it('rejects files over the 50 MB limit', async () => {
+    mockDownloadFileFromStorage.mockResolvedValueOnce({
+      buffer: Buffer.alloc(50 * 1024 * 1024 + 1),
+      contentType: 'application/pdf',
+    })
+
+    const response = await POST(createMockRequest('POST', baseBody))
+    expect(response.status).toBe(400)
+    const data = await response.json()
+    expect(data.error).toContain('50 MB')
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
+  it('blocks pre-signed URLs that fail SSRF validation', async () => {
+    mockFetch.mockResolvedValueOnce(
+      jsonResponse({ id: 'receipt_6', uri: 'https://169.254.169.254/latest/meta-data' })
+    )
+    inputValidationMockFns.mockValidateUrlWithDNS.mockResolvedValueOnce({
+      isValid: false,
+      error: 'uri resolves to a blocked IP address',
+    })
+
+    const response = await POST(createMockRequest('POST', baseBody))
+    expect(response.status).toBe(502)
+    const data = await response.json()
+    expect(data.error).toContain('invalid upload URL')
+    expect(inputValidationMockFns.mockSecureFetchWithPinnedIP).not.toHaveBeenCalled()
+  })
+
+  it('fails when the pre-signed upload fails', async () => {
+    mockFetch.mockResolvedValueOnce(
+      jsonResponse({ id: 'receipt_4', uri: 'https://s3.example.com/presigned' })
+    )
+    inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValueOnce(jsonResponse({}, 403))
+
+    const response = await POST(createMockRequest('POST', baseBody))
+    expect(response.status).toBe(502)
+    const data = await response.json()
+    expect(data.success).toBe(false)
+  })
+
+  it('denies access to files the caller cannot read', async () => {
+    const deniedResponse = new Response(
+      JSON.stringify({ success: false, error: 'File not found' }),
+      {
+        status: 404,
+      }
+    )
+    mockAssertToolFileAccess.mockResolvedValueOnce(deniedResponse)
+
+    const response = await POST(createMockRequest('POST', baseBody))
+    expect(response.status).toBe(404)
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+})

apps/sim/app/api/tools/brex/upload-receipt/route.ts

@@ -0,0 +1,160 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import { brexUploadReceiptContract } from '@/lib/api/contracts/tools/brex'
+import { parseRequest } from '@/lib/api/server'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import {
+  secureFetchWithPinnedIP,
+  validateUrlWithDNS,
+} from '@/lib/core/security/input-validation.server'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { processFilesToUserFiles, type RawFileInput } from '@/lib/uploads/utils/file-utils'
+import { downloadServableFileFromStorage } from '@/lib/uploads/utils/file-utils.server'
+import { docNotReadyResponse } from '@/lib/uploads/utils/servable-file-response'
+import { assertToolFileAccess } from '@/app/api/files/authorization'
+import { BREX_API_BASE, buildBrexHeaders } from '@/tools/brex/utils'
+
+export const dynamic = 'force-dynamic'
+
+const logger = createLogger('BrexUploadReceiptAPI')
+
+const MAX_RECEIPT_SIZE_BYTES = 50 * 1024 * 1024
+
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  const requestId = generateRequestId()
+
+  try {
+    const authResult = await checkInternalAuth(request, { requireWorkflowId: false })
+
+    if (!authResult.success || !authResult.userId) {
+      logger.warn(`[${requestId}] Unauthorized Brex receipt upload attempt: ${authResult.error}`)
+      return NextResponse.json(
+        { success: false, error: authResult.error || 'Authentication required' },
+        { status: 401 }
+      )
+    }
+
+    const parsed = await parseRequest(brexUploadReceiptContract, request, {})
+    if (!parsed.success) return parsed.response
+    const { apiKey, expenseId, file, receiptName } = parsed.data.body
+
+    const userFiles = processFilesToUserFiles([file as RawFileInput], requestId, logger)
+    if (userFiles.length === 0) {
+      return NextResponse.json({ success: false, error: 'Invalid file input' }, { status: 400 })
+    }
+
+    const userFile = userFiles[0]
+    const denied = await assertToolFileAccess(userFile.key, authResult.userId, requestId, logger)
+    if (denied) return denied
+
+    let fileBuffer: Buffer
+    try {
+      const resolved = await downloadServableFileFromStorage(userFile, requestId, logger)
+      fileBuffer = resolved.buffer
+    } catch (error) {
+      const notReady = docNotReadyResponse(error)
+      if (notReady) return notReady
+      logger.error(`[${requestId}] Failed to download receipt file:`, error)
+      return NextResponse.json(
+        { success: false, error: getErrorMessage(error, 'Unknown error') },
+        { status: 500 }
+      )
+    }
+    if (fileBuffer.length > MAX_RECEIPT_SIZE_BYTES) {
+      return NextResponse.json(
+        { success: false, error: 'Receipt file exceeds the 50 MB limit' },
+        { status: 400 }
+      )
+    }
+
+    const effectiveReceiptName = receiptName || userFile.name
+    const endpoint = expenseId
+      ? `${BREX_API_BASE}/v1/expenses/card/${encodeURIComponent(expenseId)}/receipt_upload`
+      : `${BREX_API_BASE}/v1/expenses/card/receipt_match`
+
+    logger.info(
+      `[${requestId}] Creating Brex ${expenseId ? 'receipt upload' : 'receipt match'}: ${effectiveReceiptName} (${fileBuffer.length} bytes)`
+    )
+
+    const createResponse = await fetch(endpoint, {
+      method: 'POST',
+      headers: buildBrexHeaders(apiKey),
+      body: JSON.stringify({ receipt_name: effectiveReceiptName }),
+    })
+
+    if (!createResponse.ok) {
+      const errorText = await createResponse.text()
+      logger.error(`[${requestId}] Brex API error:`, {
+        status: createResponse.status,
+        error: errorText,
+      })
+      let message = errorText
+      try {
+        message = JSON.parse(errorText).message ?? errorText
+      } catch {
+        message = errorText
+      }
+      return NextResponse.json(
+        { success: false, error: `Brex API error (${createResponse.status}): ${message}` },
+        { status: createResponse.status }
+      )
+    }
+
+    const createData = await createResponse.json()
+    if (!createData.uri || !createData.id) {
+      return NextResponse.json(
+        { success: false, error: 'Brex did not return an upload URL' },
+        { status: 502 }
+      )
+    }
+
+    const uriValidation = await validateUrlWithDNS(createData.uri, 'uri')
+    if (!uriValidation.isValid) {
+      logger.error(`[${requestId}] Pre-signed upload URL failed SSRF validation:`, {
+        error: uriValidation.error,
+      })
+      return NextResponse.json(
+        { success: false, error: 'Brex returned an invalid upload URL' },
+        { status: 502 }
+      )
+    }
+
+    const uploadResponse = await secureFetchWithPinnedIP(
+      createData.uri,
+      uriValidation.resolvedIP!,
+      {
+        method: 'PUT',
+        body: new Uint8Array(fileBuffer),
+      }
+    )
+
+    if (!uploadResponse.ok) {
+      logger.error(`[${requestId}] Receipt upload to pre-signed URL failed:`, {
+        status: uploadResponse.status,
+      })
+      return NextResponse.json(
+        { success: false, error: `Failed to upload receipt file (${uploadResponse.status})` },
+        { status: 502 }
+      )
+    }
+
+    logger.info(`[${requestId}] Receipt uploaded successfully (ID: ${createData.id})`)
+
+    return NextResponse.json({
+      success: true,
+      output: {
+        receiptId: createData.id,
+        receiptName: effectiveReceiptName,
+        expenseId: expenseId ?? null,
+      },
+    })
+  } catch (error) {
+    logger.error(`[${requestId}] Unexpected error:`, error)
+    return NextResponse.json(
+      { success: false, error: getErrorMessage(error, 'Unknown error') },
+      { status: 500 }
+    )
+  }
+})