chore: import upstream snapshot with attribution

apps/sim/providers/azure-anthropic/index.test.ts

@@ -0,0 +1,124 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ProviderRequest } from '@/providers/types'
+
+const {
+  mockAnthropic,
+  anthropicArgs,
+  mockValidate,
+  mockCreatePinnedFetch,
+  mockExecuteAnthropic,
+  sentinelFetch,
+  envState,
+} = vi.hoisted(() => {
+  const anthropicArgs: Array<Record<string, unknown>> = []
+  const sentinelFetch = vi.fn()
+  class MockAnthropic {
+    constructor(opts: Record<string, unknown>) {
+      anthropicArgs.push(opts)
+    }
+  }
+  return {
+    mockAnthropic: MockAnthropic,
+    anthropicArgs,
+    mockValidate: vi.fn(),
+    mockCreatePinnedFetch: vi.fn(() => sentinelFetch),
+    mockExecuteAnthropic: vi.fn(),
+    sentinelFetch,
+    envState: {
+      AZURE_ANTHROPIC_ENDPOINT: undefined as string | undefined,
+      AZURE_ANTHROPIC_API_VERSION: undefined as string | undefined,
+    },
+  }
+})
+
+vi.mock('@anthropic-ai/sdk', () => ({ default: mockAnthropic }))
+vi.mock('@/lib/core/config/env', () => ({ env: envState }))
+vi.mock('@/lib/core/security/input-validation.server', () => ({
+  validateUrlWithDNS: mockValidate,
+  createPinnedFetch: mockCreatePinnedFetch,
+}))
+vi.mock('@/providers/anthropic/core', () => ({
+  executeAnthropicProviderRequest: mockExecuteAnthropic,
+}))
+vi.mock('@/providers/models', () => ({
+  getProviderFileAttachment: vi
+    .fn()
+    .mockReturnValue({ maxBytes: 10 * 1024 * 1024, strategy: 'inline' }),
+  INLINE_ATTACHMENT_MAX_BYTES: 10 * 1024 * 1024,
+  getProviderModels: vi.fn(() => []),
+  getProviderDefaultModel: vi.fn(() => 'azure-anthropic/claude'),
+}))
+
+import { azureAnthropicProvider } from '@/providers/azure-anthropic/index'
+
+function request(overrides: Partial<ProviderRequest>): ProviderRequest {
+  return { model: 'azure-anthropic/claude-3-5-sonnet', apiKey: 'k', messages: [], ...overrides }
+}
+
+/** Invokes the createClient factory handed to the Anthropic core and returns the SDK options it built. */
+function buildClientOptions(): Record<string, unknown> {
+  const config = mockExecuteAnthropic.mock.calls[0][1]
+  config.createClient('k', false)
+  return anthropicArgs[0]
+}
+
+describe('azureAnthropicProvider — SSRF pinning', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    anthropicArgs.length = 0
+    envState.AZURE_ANTHROPIC_ENDPOINT = undefined
+    envState.AZURE_ANTHROPIC_API_VERSION = undefined
+    mockExecuteAnthropic.mockResolvedValue({ content: 'ok' })
+  })
+
+  it('validates and pins the connection to the resolved IP for a user-supplied endpoint', async () => {
+    mockValidate.mockResolvedValue({ isValid: true, resolvedIP: '203.0.113.10' })
+
+    await azureAnthropicProvider.executeRequest(
+      request({ azureEndpoint: 'https://rebind.attacker.tld' })
+    )
+
+    expect(mockValidate).toHaveBeenCalledWith('https://rebind.attacker.tld', 'azureEndpoint')
+    expect(mockCreatePinnedFetch).toHaveBeenCalledWith('203.0.113.10')
+    expect(buildClientOptions()).toMatchObject({ fetch: sentinelFetch })
+  })
+
+  it('does not pin when the endpoint comes from trusted server env', async () => {
+    envState.AZURE_ANTHROPIC_ENDPOINT = 'https://trusted.services.ai.azure.com'
+
+    await azureAnthropicProvider.executeRequest(request({ azureEndpoint: undefined }))
+
+    expect(mockValidate).not.toHaveBeenCalled()
+    expect(mockCreatePinnedFetch).not.toHaveBeenCalled()
+    expect(buildClientOptions()).not.toHaveProperty('fetch')
+  })
+
+  it('throws and never builds a client when validation blocks the endpoint', async () => {
+    mockValidate.mockResolvedValue({ isValid: false, error: 'resolves to a blocked IP address' })
+
+    await expect(
+      azureAnthropicProvider.executeRequest(
+        request({ azureEndpoint: 'https://rebind.attacker.tld' })
+      )
+    ).rejects.toThrow('Invalid Azure Anthropic endpoint')
+
+    expect(mockCreatePinnedFetch).not.toHaveBeenCalled()
+    expect(mockExecuteAnthropic).not.toHaveBeenCalled()
+  })
+
+  it('fails closed when validation passes but yields no resolvable IP to pin', async () => {
+    mockValidate.mockResolvedValue({ isValid: true })
+
+    await expect(
+      azureAnthropicProvider.executeRequest(
+        request({ azureEndpoint: 'https://rebind.attacker.tld' })
+      )
+    ).rejects.toThrow('could not resolve a pinnable IP address')
+
+    expect(mockCreatePinnedFetch).not.toHaveBeenCalled()
+    expect(mockExecuteAnthropic).not.toHaveBeenCalled()
+  })
+})

apps/sim/providers/azure-anthropic/index.ts

@@ -0,0 +1,104 @@
+import Anthropic from '@anthropic-ai/sdk'
+import { createLogger } from '@sim/logger'
+import { env } from '@/lib/core/config/env'
+import { createPinnedFetch, validateUrlWithDNS } from '@/lib/core/security/input-validation.server'
+import type { StreamingExecution } from '@/executor/types'
+import { executeAnthropicProviderRequest } from '@/providers/anthropic/core'
+import { getCachedProviderClient } from '@/providers/client-cache'
+import { getProviderDefaultModel, getProviderModels } from '@/providers/models'
+import type { ProviderConfig, ProviderRequest, ProviderResponse } from '@/providers/types'
+
+const logger = createLogger('AzureAnthropicProvider')
+
+export const azureAnthropicProvider: ProviderConfig = {
+  id: 'azure-anthropic',
+  name: 'Azure Anthropic',
+  description: 'Anthropic Claude models via Azure AI Foundry',
+  version: '1.0.0',
+  models: getProviderModels('azure-anthropic'),
+  defaultModel: getProviderDefaultModel('azure-anthropic'),
+
+  executeRequest: async (
+    request: ProviderRequest
+  ): Promise<ProviderResponse | StreamingExecution> => {
+    const userProvidedEndpoint = request.azureEndpoint
+    const azureEndpoint = userProvidedEndpoint || env.AZURE_ANTHROPIC_ENDPOINT
+    if (!azureEndpoint) {
+      throw new Error(
+        'Azure endpoint is required for Azure Anthropic. Please provide it via the azureEndpoint parameter or AZURE_ANTHROPIC_ENDPOINT environment variable.'
+      )
+    }
+
+    let pinnedFetch: typeof fetch | undefined
+    let pinnedIP: string | undefined
+    if (userProvidedEndpoint) {
+      const validation = await validateUrlWithDNS(userProvidedEndpoint, 'azureEndpoint')
+      if (!validation.isValid) {
+        logger.warn('Blocked SSRF attempt via azureEndpoint', {
+          endpoint: userProvidedEndpoint,
+          error: validation.error,
+        })
+        throw new Error(`Invalid Azure Anthropic endpoint: ${validation.error}`)
+      }
+      if (!validation.resolvedIP) {
+        throw new Error('Invalid Azure Anthropic endpoint: could not resolve a pinnable IP address')
+      }
+      pinnedIP = validation.resolvedIP
+      pinnedFetch = createPinnedFetch(pinnedIP)
+    }
+
+    const apiKey = request.apiKey
+    if (!apiKey) {
+      throw new Error('API key is required for Azure Anthropic.')
+    }
+
+    // Strip the azure-anthropic/ prefix from the model name if present
+    const modelName = request.model.replace(/^azure-anthropic\//, '')
+
+    // Azure AI Foundry hosts Anthropic models at {endpoint}/anthropic
+    // The SDK appends /v1/messages automatically
+    const baseURL = `${azureEndpoint.replace(/\/$/, '')}/anthropic`
+
+    const anthropicVersion =
+      request.azureApiVersion || env.AZURE_ANTHROPIC_API_VERSION || '2023-06-01'
+
+    return executeAnthropicProviderRequest(
+      {
+        ...request,
+        model: modelName,
+        apiKey,
+      },
+      {
+        providerId: 'azure-anthropic',
+        providerLabel: 'Azure Anthropic',
+        createClient: (apiKey, useNativeStructuredOutputs) => {
+          const cacheKey = [
+            'azure-anthropic',
+            apiKey,
+            baseURL,
+            anthropicVersion,
+            pinnedIP ?? 'no-pin',
+            useNativeStructuredOutputs ? 'beta' : 'default',
+          ].join('::')
+          return getCachedProviderClient(
+            cacheKey,
+            () =>
+              new Anthropic({
+                baseURL,
+                apiKey,
+                ...(pinnedFetch ? { fetch: pinnedFetch } : {}),
+                defaultHeaders: {
+                  'api-key': apiKey,
+                  'anthropic-version': anthropicVersion,
+                  ...(useNativeStructuredOutputs
+                    ? { 'anthropic-beta': 'structured-outputs-2025-11-13' }
+                    : {}),
+                },
+              })
+          )
+        },
+        logger,
+      }
+    )
+  },
+}