fix(release): keep bare secretKey redacted, leave the proxy every-address rule to the transport, and report unknown GitLab hosts as input errors

Author: waleedlatif1

apps/sim/lib/core/security/redaction.test.ts

@@ -31,6 +31,7 @@ describe('isSensitiveKey', () => {
     'exa_api_key',
     'secretAccessKey',
     'awsSecretAccessKey',
+    'secretKey',
     'bedrockSecretKey',
     'apiSecretKey',
     'clerkSecretKey',
@@ -45,7 +46,6 @@ describe('isSensitiveKey', () => {
   it.concurrent.each([
     'tokenCount',
     'tokenizer',
-    'secretKey',
     'deployKeyName',
     'passwordStrength',
     'authMethod',

apps/sim/lib/core/security/redaction.ts

@@ -29,10 +29,10 @@ const SENSITIVE_KEY_PATTERNS: RegExp[] = [
   /^.*api[_-]?key$/i,
   // AWS's `secretAccessKey` / `awsSecretAccessKey`, which no suffix above covers.
   /^.*secret[_-]?access[_-]?key$/i,
-  // Prefixed secret keys such as Bedrock's `bedrockSecretKey` and Clerk's `clerkSecretKey`.
-  // The prefix is required: Infisical returns each secret's name in a bare `secretKey`
-  // field, and redacting it would hide every listed name.
-  /^.+secret[_-]?key$/i,
+  // Secret keys, bare or prefixed: Clerk and Amplitude take their credential in a bare
+  // `secretKey`, Bedrock in `bedrockSecretKey`. This also masks the secret names Infisical
+  // returns under `secretKey` in display copies; a hidden name is safer than a leaked key.
+  /^.*secret[_-]?key$/i,
   // Convex's `deployKey`.
   /^.*deploy[_-]?key$/i,
   /^passphrase$/i,

apps/sim/lib/core/utils/route-cache.ts

@@ -28,7 +28,7 @@ export async function clearRouteCacheFromOtherBuild(nextDirectory: string): Prom
     await writeFile(join(routeCache, BUILD_MARKER), buildId)
   } catch (error) {
     if ((error as NodeJS.ErrnoException).code === 'ENOENT') return
-    logger.warn('Could not clear the route cache from an earlier build', {
+    logger.error('Could not clear the route cache from an earlier build', {
       error: getErrorMessage(error),
     })
   }

apps/sim/lib/credentials/gitlab-personal-token.test.ts

@@ -106,6 +106,19 @@ describe('GitLab personal token verification', () => {
       message: expect.stringContaining("can't connect to that address"),
     })
   })
+  it('reports a GitLab host that does not resolve as the user input', async () => {
+    mocks.fetch.mockReset().mockRejectedValue(
+      Object.assign(new Error('getaddrinfo ENOTFOUND gitlab.example.invalid'), {
+        code: 'ENOTFOUND',
+      })
+    )
+    await expect(
+      verifyGitLabPersonalToken('secret', 'gitlab.example.invalid')
+    ).rejects.toMatchObject({
+      code: 'validation',
+      message: expect.stringContaining("couldn't find that GitLab host"),
+    })
+  })
   it('binds organization tokens independently of the execution workspace', async () => {
     mocks.encrypt.mockResolvedValue({ encrypted: 'ciphertext' })
     const { workspaceId: _workspaceId, ...identity } = envelope

apps/sim/lib/credentials/gitlab-personal-token.ts

@@ -4,6 +4,7 @@ import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { resourceScopeFromOwner, sameResourceScope } from '@/lib/core/resource-scope'
 import { decryptSecret, encryptSecret } from '@/lib/core/security/encryption'
 import { secureFetchWithValidation } from '@/lib/core/security/input-validation.server'
+import { isHostNotFound } from '@/lib/credentials/token-service-accounts/errors'
 import { normalizeGitLabHost } from '@/tools/gitlab/utils'
 
 const gitLabUserSchema = z.object({
@@ -63,6 +64,12 @@ export async function verifyGitLabPersonalToken(accessToken: string, rawHost?: s
           "Sim can't connect to that address. Use your GitLab instance's public https URL."
         )
       }
+      if (isHostNotFound(error)) {
+        throw new OrchestrationError(
+          'validation',
+          "Sim couldn't find that GitLab host. Check the address and try again."
+        )
+      }
       throw error
     })
     if (!response.ok) {

apps/sim/lib/credentials/token-service-accounts/validators/gitlab.test.ts

@@ -77,6 +77,7 @@ describe('GitLab saved token verification', () => {
     validateUrl.mockResolvedValue({
       isValid: false,
       error: 'url hostname could not be resolved',
+      refusal: 'dns',
       cause: Object.assign(new Error('getaddrinfo ENOTFOUND'), { code: 'ENOTFOUND' }),
     })
 

apps/sim/lib/credentials/token-service-accounts/validators/http.test.ts

@@ -5,16 +5,9 @@ import {
 } from '@sim/testing/mocks/input-validation.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockResolveHost } = vi.hoisted(() => ({ mockResolveHost: vi.fn() }))
-
 vi.mock('@/lib/core/security/input-validation.server', () => inputValidationMock)
-vi.mock('@sim/security/dns', async (importOriginal) => ({
-  ...(await importOriginal<typeof import('@sim/security/dns')>()),
-  resolveHostAddresses: mockResolveHost,
-}))
 
 import { EgressRefusedError } from '@/lib/core/network/transport.server'
-import type * as InputValidation from '@/lib/core/security/input-validation.server'
 import {
   normalizeHttpBaseUrl,
   refuseUnsafeTypedUrl,
@@ -217,24 +210,6 @@ describe('tokenCheckValidator with a typed host', () => {
   })
 
   describe('behind an environment proxy', () => {
-    it('refuses a host with a private record alongside its public one before sending the token', async () => {
-      vi.stubEnv('HTTPS_PROXY', 'http://proxy.internal:3128')
-      const actual = await vi.importActual<typeof InputValidation>(
-        '@/lib/core/security/input-validation.server'
-      )
-      validateUrl.mockImplementation(actual.validateUrlWithDNS)
-      mockResolveHost.mockResolvedValue({
-        addresses: ['93.184.216.34', '10.0.0.5'],
-        preferred: '93.184.216.34',
-      })
-      pinnedFetch.mockResolvedValue(jsonResponse({ ok: true }))
-
-      await expect(
-        validateHost({ apiToken: 'good', domain: 'split.example.com' })
-      ).rejects.toMatchObject({ code: 'host_not_allowed', status: 400 })
-      expect(pinnedFetch).not.toHaveBeenCalled()
-    })
-
     it("reports the proxy route's own refusal as the host, not an outage", async () => {
       pinnedFetch.mockRejectedValue(new EgressRefusedError('url resolves to a private address'))
 

apps/sim/lib/credentials/token-service-accounts/validators/http.ts

@@ -1,4 +1,3 @@
-import { resolveEnvironmentProxy } from '@sim/security/environment-proxy'
 import { truncate } from '@sim/utils/string'
 import { EgressRefusedError } from '@/lib/core/network/transport.server'
 import type { EgressProfile } from '@/lib/core/security/egress/profiles'
@@ -183,12 +182,9 @@ async function sendThroughEgress(
   profile: NonNullable<TokenCheck['egress']>,
   { url, method = 'GET', headers, body }: TokenCheckRequest
 ): Promise<ProviderResponse> {
-  // A forward proxy re-resolves the host, so the transport refuses one with any refused record.
-  // An unparseable URL skips the proxy lookup; validation then refuses it as the user's input.
-  const validation = await validateUrlWithDNS(url, 'url', profile, {
-    logDetails: false,
-    requireEveryAddress: URL.canParse(url) && resolveEnvironmentProxy(new URL(url)) !== null,
-  })
+  // The transport applies the stricter every-address rule itself when it routes through an
+  // environment proxy; its refusal is classified below, so a gateway route is not pre-judged.
+  const validation = await validateUrlWithDNS(url, 'url', profile, { logDetails: false })
   if (!validation.isValid) {
     if (validation.refusal !== 'dns') throw hostNotAllowed()
     const notFound = isHostNotFound(validation.cause)