fix(jira): reject select/multiselect option objects that set both value and id

Round 8 (Greptile): an option object like { id: '10', value: 'High' } passed the
{ value } / { id } union, but toSelectOption keeps only one and silently discards
the other. Require an option object to set exactly one of value or id (mirrors
the cascading parent/value alias rule). Adds a route test.

Author: mzxchandra

apps/sim/app/api/tools/jira/update/route.test.ts

@@ -119,6 +119,15 @@ describe('Jira update route custom-field serialization', () => {
     expect(response.status).toBe(400)
   })
 
+  it('rejects a select option object that sets both value and id', async () => {
+    const { response } = await update({
+      customFields: [
+        { fieldId: 'customfield_10001', type: 'select', value: { value: 'High', id: '10' } },
+      ],
+    })
+    expect(response.status).toBe(400)
+  })
+
   it('rejects a cascading object that sets both parent and value aliases', async () => {
     const { response } = await update({
       customFields: [

apps/sim/lib/api/contracts/selectors/jira.ts

@@ -104,12 +104,20 @@ export const jiraCustomFieldTypeSchema = z.enum([
 
 const customFieldIdSchema = z.string().min(1, 'fieldId is required')
 
-/** A non-empty option value/id — as a scalar or a `{ value }` / `{ id }` object. */
+/**
+ * A non-empty option value/id — a scalar, or an object that sets exactly one of
+ * `value` / `id`. Setting both is rejected: `toSelectOption` would keep one and
+ * silently discard the other, so Jira could store an option the caller didn't
+ * unambiguously request.
+ */
 const optionScalar = z.union([z.string().min(1, 'option value cannot be empty'), z.number()])
 const optionInputSchema = z.union([
   optionScalar,
-  z.object({ value: optionScalar }),
-  z.object({ id: optionScalar }),
+  z
+    .object({ value: optionScalar.optional(), id: optionScalar.optional() })
+    .refine((o) => (o.value !== undefined) !== (o.id !== undefined), {
+      message: 'option object must set exactly one of value or id',
+    }),
 ])
 
 /** An accountId string or a `{ accountId }` object for a user picker. */