fix(credentials): address review round 1

Azure DevOps tools build every project-scoped URL through one traversal-safe
helper, so a project or build id can't climb into another organization with a
saved token; Tinybird and Upstash restricted-token replies are covered by
tests.

Author: waleedlatif1

apps/sim/lib/credentials/token-service-accounts/validators/token-checks.test.ts

@@ -392,3 +392,41 @@ describe('saved credentials for a host the user chose', () => {
     }
   )
 })
+
+describe('saved credentials whose vendor answers a restricted token in its error', () => {
+  const secureFetch = inputValidationMockFns.mockSecureFetchWithValidation
+
+  it.each([
+    [
+      'rejects an unknown Tinybird token',
+      validateTinybirdServiceAccount,
+      jsonResponse({ error: 'invalid authentication token. Token tok not found' }, 403),
+      'invalid_credentials',
+    ],
+    [
+      'accepts a Tinybird token without read access',
+      validateTinybirdServiceAccount,
+      jsonResponse({ error: 'Not enough permissions to read from datasources' }, 403),
+      null,
+    ],
+    [
+      'accepts an Upstash token whose ACL refuses PING',
+      validateUpstashServiceAccount,
+      jsonResponse({ error: 'NOPERM this user has no permissions to run the ping command' }, 400),
+      null,
+    ],
+    [
+      'rejects an unknown Upstash token',
+      validateUpstashServiceAccount,
+      jsonResponse({ error: 'WRONGPASS invalid or missing auth token' }, 401),
+      'invalid_credentials',
+    ],
+  ])('%s', async (_, validate, reply, code) => {
+    secureFetch.mockReset().mockResolvedValue(reply)
+
+    const result = validate({ apiToken: 'tok', domain: 'https://instance.example.com' })
+
+    if (code) await expect(result).rejects.toMatchObject({ code })
+    else await expect(result).resolves.toMatchObject({ principal: null })
+  })
+})

apps/sim/tools/azure_devops/add_comment.ts

@@ -4,7 +4,7 @@ import type {
   AzureDevOpsComment,
 } from '@/tools/azure_devops/types'
 import type { AzureDevOpsRawComment } from '@/tools/azure_devops/utils'
-import { formatComment, mapComment } from '@/tools/azure_devops/utils'
+import { azureDevOpsProjectUrl, formatComment, mapComment } from '@/tools/azure_devops/utils'
 import { AZURE_DEVOPS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials'
 import type { ToolConfig } from '@/tools/types'
 
@@ -51,7 +51,7 @@ export const addCommentTool: ToolConfig<AddCommentParams, AddCommentResponse> =
   request: {
     url: (params) => {
       const url = new URL(
-        `https://dev.azure.com/${params.organization.trim()}/${params.project.trim()}/_apis/wit/workitems/${Number(params.workItemId)}/comments`
+        `${azureDevOpsProjectUrl(params)}/_apis/wit/workitems/${Number(params.workItemId)}/comments`
       )
       url.searchParams.set('api-version', '7.0-preview.3')
       return url.toString()

apps/sim/tools/azure_devops/azure-devops.test.ts

@@ -554,3 +554,20 @@ describe('Azure DevOps trigger event matching', () => {
     expect(azureDevOpsHandler.extractIdempotencyId!(null)).toBeNull()
   })
 })
+
+describe('Azure DevOps project-scoped URLs', () => {
+  const base = { accessToken: 'pat', organization: 'contoso', workItemId: 7 }
+
+  it('keeps a project name with spaces in its own path segment, as before', () => {
+    const url = new URL(buildUrl(getWorkItemTool, { ...base, project: 'My Project' } as never))
+
+    expect(url.pathname).toBe('/contoso/My%20Project/_apis/wit/workitems/7')
+  })
+
+  it.each(['../../other-org/proj', '..', 'proj/../../other-org'])(
+    'refuses a project that would climb into another organization (%s)',
+    (project) => {
+      expect(() => buildUrl(getWorkItemTool, { ...base, project } as never)).toThrow(/project/)
+    }
+  )
+})

apps/sim/tools/azure_devops/create_work_item.ts

@@ -7,6 +7,7 @@ import type { AzureDevOpsJsonPatchOp, AzureDevOpsRawWorkItem } from '@/tools/azu
 import {
   appendEffortPatchOp,
   appendFieldPatchOp,
+  azureDevOpsProjectUrl,
   formatWorkItem,
   mapWorkItem,
 } from '@/tools/azure_devops/utils'
@@ -134,7 +135,7 @@ export const createWorkItemTool: ToolConfig<CreateWorkItemParams, CreateWorkItem
 
   request: {
     url: (params) =>
-      `https://dev.azure.com/${params.organization.trim()}/${params.project.trim()}/_apis/wit/workitems/$${encodeURIComponent(params.workItemType)}?api-version=7.2-preview.3`,
+      `${azureDevOpsProjectUrl(params)}/_apis/wit/workitems/$${encodeURIComponent(params.workItemType)}?api-version=7.2-preview.3`,
     method: 'POST',
     headers: (params) => ({
       'Content-Type': 'application/json-patch+json',

apps/sim/tools/azure_devops/get_build_log.ts

@@ -1,6 +1,8 @@
 import type { GetBuildLogParams, GetBuildLogResponse } from '@/tools/azure_devops/types'
+import { azureDevOpsProjectUrl } from '@/tools/azure_devops/utils'
 import { AZURE_DEVOPS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const getBuildLogTool: ToolConfig<GetBuildLogParams, GetBuildLogResponse> = {
   id: 'azure_devops_get_build_log',
@@ -58,7 +60,7 @@ export const getBuildLogTool: ToolConfig<GetBuildLogParams, GetBuildLogResponse>
   request: {
     url: (params) => {
       const url = new URL(
-        `https://dev.azure.com/${params.organization.trim()}/${params.project.trim()}/_apis/build/builds/${params.buildId}/logs/${params.logId}`
+        `${azureDevOpsProjectUrl(params)}/_apis/build/builds/${safeUrlPathSegment(params.buildId, 'buildId')}/logs/${safeUrlPathSegment(params.logId, 'logId')}`
       )
       url.searchParams.set('api-version', '7.2-preview.2')
       if (params.startLine !== undefined)

apps/sim/tools/azure_devops/get_build_timeline.ts

@@ -3,6 +3,7 @@ import type {
   GetBuildTimelineParams,
   GetBuildTimelineResponse,
 } from '@/tools/azure_devops/types'
+import { azureDevOpsProjectUrl } from '@/tools/azure_devops/utils'
 import { AZURE_DEVOPS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials'
 import type { ToolConfig } from '@/tools/types'
 
@@ -43,7 +44,7 @@ export const getBuildTimelineTool: ToolConfig<GetBuildTimelineParams, GetBuildTi
 
   request: {
     url: (params) =>
-      `https://dev.azure.com/${params.organization.trim()}/${params.project.trim()}/_apis/build/builds/${Number(params.buildId)}/timeline?api-version=7.2-preview.3`,
+      `${azureDevOpsProjectUrl(params)}/_apis/build/builds/${Number(params.buildId)}/timeline?api-version=7.2-preview.3`,
     method: 'GET',
     headers: (params) => ({
       'Content-Type': 'application/json',

apps/sim/tools/azure_devops/get_comments.ts

@@ -4,7 +4,7 @@ import type {
   GetCommentsResponse,
 } from '@/tools/azure_devops/types'
 import type { AzureDevOpsRawComment } from '@/tools/azure_devops/utils'
-import { formatComment, mapComment } from '@/tools/azure_devops/utils'
+import { azureDevOpsProjectUrl, formatComment, mapComment } from '@/tools/azure_devops/utils'
 import { AZURE_DEVOPS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials'
 import type { ToolConfig } from '@/tools/types'
 
@@ -76,7 +76,7 @@ export const getCommentsTool: ToolConfig<GetCommentsParams, GetCommentsResponse>
   request: {
     url: (params) => {
       const url = new URL(
-        `https://dev.azure.com/${params.organization.trim()}/${params.project.trim()}/_apis/wit/workitems/${Number(params.workItemId)}/comments`
+        `${azureDevOpsProjectUrl(params)}/_apis/wit/workitems/${Number(params.workItemId)}/comments`
       )
       url.searchParams.set('api-version', '7.2-preview.4')
       if (params.top) url.searchParams.set('$top', Number(params.top).toString())

apps/sim/tools/azure_devops/get_pipeline.ts

@@ -1,6 +1,8 @@
 import type { GetPipelineParams, GetPipelineResponse } from '@/tools/azure_devops/types'
+import { azureDevOpsProjectUrl } from '@/tools/azure_devops/utils'
 import { AZURE_DEVOPS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const getPipelineTool: ToolConfig<GetPipelineParams, GetPipelineResponse> = {
   id: 'azure_devops_get_pipeline',
@@ -46,7 +48,7 @@ export const getPipelineTool: ToolConfig<GetPipelineParams, GetPipelineResponse>
   request: {
     url: (params) => {
       const url = new URL(
-        `https://dev.azure.com/${params.organization.trim()}/${params.project.trim()}/_apis/pipelines/${params.pipelineId}`
+        `${azureDevOpsProjectUrl(params)}/_apis/pipelines/${safeUrlPathSegment(params.pipelineId, 'pipelineId')}`
       )
       url.searchParams.set('api-version', '7.2-preview.1')
       if (params.pipelineVersion)

apps/sim/tools/azure_devops/get_pipeline_run.ts

@@ -1,6 +1,8 @@
 import type { GetPipelineRunParams, GetPipelineRunResponse } from '@/tools/azure_devops/types'
+import { azureDevOpsProjectUrl } from '@/tools/azure_devops/utils'
 import { AZURE_DEVOPS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials'
 import type { ToolConfig } from '@/tools/types'
+import { safeUrlPathSegment } from '@/tools/url-path'
 
 export const getPipelineRunTool: ToolConfig<GetPipelineRunParams, GetPipelineRunResponse> = {
   id: 'azure_devops_get_pipeline_run',
@@ -46,7 +48,7 @@ export const getPipelineRunTool: ToolConfig<GetPipelineRunParams, GetPipelineRun
   request: {
     url: (params) => {
       const url = new URL(
-        `https://dev.azure.com/${params.organization.trim()}/${params.project.trim()}/_apis/pipelines/${params.pipelineId}/runs/${params.runId}`
+        `${azureDevOpsProjectUrl(params)}/_apis/pipelines/${safeUrlPathSegment(params.pipelineId, 'pipelineId')}/runs/${safeUrlPathSegment(params.runId, 'runId')}`
       )
       url.searchParams.set('api-version', '7.2-preview.1')
       return url.toString()

apps/sim/tools/azure_devops/get_work_item.ts

@@ -1,6 +1,6 @@
 import type { GetWorkItemParams, GetWorkItemResponse } from '@/tools/azure_devops/types'
 import type { AzureDevOpsRawWorkItem } from '@/tools/azure_devops/utils'
-import { formatWorkItem, mapWorkItem } from '@/tools/azure_devops/utils'
+import { azureDevOpsProjectUrl, formatWorkItem, mapWorkItem } from '@/tools/azure_devops/utils'
 import { AZURE_DEVOPS_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials'
 import type { ToolConfig } from '@/tools/types'
 
@@ -42,7 +42,7 @@ export const getWorkItemTool: ToolConfig<GetWorkItemParams, GetWorkItemResponse>
   request: {
     url: (params) => {
       const url = new URL(
-        `https://dev.azure.com/${params.organization.trim()}/${params.project.trim()}/_apis/wit/workitems/${Number(params.workItemId)}`
+        `${azureDevOpsProjectUrl(params)}/_apis/wit/workitems/${Number(params.workItemId)}`
       )
       url.searchParams.set('$expand', 'all')
       url.searchParams.set('api-version', '7.2-preview.3')