fix(security): stop queued Twilio recordings fetches on cancel, type token-route auth mocks, bump chart

- Twilio list calls takes the run's signal: queued recordings requests stop once it aborts, and fetch receives it
- Token route tests type the hybrid-auth mock through the real AuthResult and pass a route context
- Chart version 1.11.13 for the README and helper comment changes

Author: waleedlatif1

apps/sim/app/api/auth/oauth/token/route.test.ts

@@ -7,6 +7,7 @@ import {
   createMockRequest,
   hybridAuthMockFns,
 } from '@sim/testing'
+import { createRouteContext } from '@sim/testing/helpers/http'
 import { NextRequest } from 'next/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
@@ -36,11 +37,13 @@ vi.mock('@/lib/credentials/application/resolve-managed-oauth-token', () => ({
   resolveManagedOAuthCredentialToken: { execute: mockResolveManagedOAuthCredentialToken },
 }))
 
+import { AuthType, checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
 import { createQuickBooksAccountId } from '@/lib/oauth/quickbooks'
 import { GET, POST } from '@/app/api/auth/oauth/token/route'
 import { getToolMetadata } from '@/tools/metadata'
 
 const mockGetToolMetadata = vi.mocked(getToolMetadata)
+const mockCheckSessionOrInternalAuth = vi.mocked(checkSessionOrInternalAuth)
 
 describe('OAuth Token API Routes', () => {
   beforeEach(() => {
@@ -318,9 +321,9 @@ describe('OAuth Token API Routes', () => {
       })
 
       it('refuses to release the secret to a session caller', async () => {
-        hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
+        mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
           success: true,
-          authType: 'session',
+          authType: AuthType.SESSION,
           userId: 'test-user-id',
         })
         mockAuthorizeCredentialUse.mockResolvedValueOnce(authorized)
@@ -329,7 +332,8 @@ describe('OAuth Token API Routes', () => {
           createMockRequest('POST', {
             credentialId: 'saved-credential-id',
             toolId: 'vanta_list_tests',
-          })
+          }),
+          createRouteContext({})
         )
 
         expect(response.status).toBe(403)
@@ -340,9 +344,9 @@ describe('OAuth Token API Routes', () => {
       })
 
       it('resolves the secret for an internal-JWT execution caller', async () => {
-        hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
+        mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
           success: true,
-          authType: 'internal_jwt',
+          authType: AuthType.INTERNAL_JWT,
           userId: 'test-user-id',
         })
         mockAuthorizeCredentialUse.mockResolvedValueOnce(authorized)
@@ -352,7 +356,8 @@ describe('OAuth Token API Routes', () => {
             credentialId: 'saved-credential-id',
             toolId: 'vanta_list_tests',
             workflowId: 'workflow-id',
-          })
+          }),
+          createRouteContext({})
         )
 
         expect(response.status).toBe(200)
@@ -364,9 +369,9 @@ describe('OAuth Token API Routes', () => {
     })
 
     it('still returns an OAuth token to a session caller', async () => {
-      hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
+      mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
         success: true,
-        authType: 'session',
+        authType: AuthType.SESSION,
         userId: 'test-user-id',
       })
       mockAuthorizeCredentialUse.mockResolvedValueOnce({
@@ -386,7 +391,10 @@ describe('OAuth Token API Routes', () => {
         refreshed: false,
       })
 
-      const response = await POST(createMockRequest('POST', { credentialId: 'credential-id' }))
+      const response = await POST(
+        createMockRequest('POST', { credentialId: 'credential-id' }),
+        createRouteContext({})
+      )
 
       expect(response.status).toBe(200)
       await expect(response.json()).resolves.toMatchObject({

apps/sim/tools/twilio_voice/list_calls.test.ts

@@ -26,12 +26,13 @@ function callsPage(recordingsPaths: string[]) {
   })
 }
 
-async function listCalls(recordingsPaths: string[]) {
+async function listCalls(recordingsPaths: string[], signal?: AbortSignal) {
   if (!listCallsTool.transformResponse) throw new Error('Missing response transform')
-  return listCallsTool.transformResponse(callsPage(recordingsPaths), {
-    accountSid: 'AC123',
-    authToken: 'secret',
-  })
+  return listCallsTool.transformResponse(
+    callsPage(recordingsPaths),
+    { accountSid: 'AC123', authToken: 'secret' },
+    { signal }
+  )
 }
 
 describe('Twilio list calls recordings lookup', () => {
@@ -75,4 +76,22 @@ describe('Twilio list calls recordings lookup', () => {
     expect(fetchMock).toHaveBeenCalledTimes(35)
     expect(peak).toBe(10)
   })
+
+  it('starts no queued recordings requests once the run is cancelled', async () => {
+    const controller = new AbortController()
+    fetchMock.mockImplementation(async (_url: unknown, init?: RequestInit) => {
+      controller.abort()
+      expect(init?.signal).toBe(controller.signal)
+      return jsonResponse({ recordings: [] })
+    })
+
+    await expect(
+      listCalls(
+        Array.from({ length: 35 }, (_, i) => `/Calls/CA${i}/Recordings.json`),
+        controller.signal
+      )
+    ).rejects.toThrow()
+
+    expect(fetchMock.mock.calls.length).toBeLessThanOrEqual(10)
+  })
 })

apps/sim/tools/twilio_voice/list_calls.ts

@@ -2,7 +2,7 @@ import { createLogger } from '@sim/logger'
 import { mapWithConcurrency } from '@/lib/core/utils/concurrency'
 import { TWILIO_CREDENTIAL_OAUTH } from '@/tools/shared/saved-credentials'
 import type { TwilioListCallsOutput, TwilioListCallsParams } from '@/tools/twilio_voice/types'
-import type { ToolConfig } from '@/tools/types'
+import type { ToolConfig, ToolResponseContext } from '@/tools/types'
 
 const logger = createLogger('TwilioVoiceListCallsTool')
 
@@ -133,7 +133,7 @@ export const listCallsTool: ToolConfig<TwilioListCallsParams, TwilioListCallsOut
     },
   },
 
-  transformResponse: async (response, params) => {
+  transformResponse: async (response, params, context?: ToolResponseContext) => {
     const data = await response.json()
 
     logger.info('Twilio List Calls Response:', { total: data.calls?.length || 0 })
@@ -156,13 +156,15 @@ export const listCallsTool: ToolConfig<TwilioListCallsParams, TwilioListCallsOut
       (data.calls || []) as TwilioCallRecord[],
       RECORDINGS_FETCH_CONCURRENCY,
       async (call) => {
+        context?.signal?.throwIfAborted()
         let recordingSids: string[] = []
         const recordingsUrl = twilioApiUrl(call.subresource_uris?.recordings)
         if (recordingsUrl) {
           try {
             const recordingsResponse = await fetch(recordingsUrl, {
               method: 'GET',
               headers: { Authorization: `Basic ${authToken}` },
+              signal: context?.signal,
             })
 
             if (recordingsResponse.ok) {
@@ -171,6 +173,7 @@ export const listCallsTool: ToolConfig<TwilioListCallsParams, TwilioListCallsOut
               recordingSids = (recordingsData.recordings || []).map((rec) => rec.sid)
             }
           } catch (error) {
+            context?.signal?.throwIfAborted()
             logger.warn('Failed to fetch recordings for call', { callSid: call.sid, error })
           }
         }

helm/sim/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: sim
 description: A Helm chart for Sim - the open-source AI workspace where teams build, deploy, and manage AI agents
 type: application
-version: 1.11.12
+version: 1.11.13
 appVersion: "v0.8.26"
 kubeVersion: ">=1.25.0-0"
 home: https://sim.ai