Skip to content

Commit f8228bf

Browse files
waleedlatif1waleedlatif1
committed
fix(credentials): close wave-1b audit findings and CI boundary failures
- token checks for the 59 new providers live in one module (validators/token-checks.ts) and their tool policies in tools/shared/saved-credentials.ts, so the tool-registry boundary stays within its baselines instead of adding ~60 modules to every graph - the host-steering probe builds URLs through the shared transport (new prepareToolRequestUrl) and also flags a host validated against a vendor allowlist when two accepted values reach different tenants - the AWS routing test reads typed metadata through getToolMetadata - Flint accepts only its documented JSON 'Task not found' 404; Intercom no longer treats a 403 (suspended workspace, plan without API) as valid; Fireflies keeps its error text in logs when a 5xx isn't auth_failed - Cursor help text, placeholder wording, Pulse intro, sorted secret fields
1 parent 834e8e9 commit f8228bf

1,631 files changed

Lines changed: 2529 additions & 2647 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎apps/docs/content/docs/integrations/pulse.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ import { ReferenceDetails } from "@/components/ui/reference-details"
1010

1111

1212
{/* MANUAL-CONTENT-START:intro */}
13-
Use [Pulse](https://www.runpulse.com) to extract text and structured content from PDFs, images, and Office files with optical character recognition (OCR). Supply a file URL or upload, select pages when needed, and choose the supported Markdown, text, or JSON output options.
13+
Use [Pulse](https://www.runpulse.com) to extract text and structured content from PDFs, images, and Office files with optical character recognition (OCR). Supply an uploaded file or a file reference, select pages when needed, and choose the supported Markdown, text, or JSON output options.
1414

1515
Optional figure and table extraction returns captions and descriptions. The result also includes processing metadata such as file type, page count, and processing time. Pass the extracted content to later steps for review or summarization.
1616
{/* MANUAL-CONTENT-END */}

‎apps/sim/blocks/utils.ts‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -52,15 +52,13 @@ export const SERVICE_ACCOUNT_SUBBLOCKS: SubBlockConfig[] = [
5252

5353
/** The inline secret fields (subblock and input ids) each saved-credential service replaces. */
5454
const INLINE_SECRET_FIELDS = {
55-
aws: ['accessKeyId', 'secretAccessKey', 'awsAccessKeyId', 'awsSecretAccessKey'],
56-
databricks: ['host', 'apiKey'],
57-
tavily: ['apiKey'],
5855
affinity: ['apiKey'],
5956
agentmail: ['apiKey'],
6057
agentphone: ['apiKey'],
6158
ahrefs: ['apiKey'],
6259
apify: ['apiKey'],
6360
apollo: ['apiKey'],
61+
aws: ['accessKeyId', 'secretAccessKey', 'awsAccessKeyId', 'awsSecretAccessKey'],
6462
brex: ['apiKey'],
6563
brightdata: ['apiKey'],
6664
browser_use: ['apiKey'],
@@ -69,25 +67,37 @@ const INLINE_SECRET_FIELDS = {
6967
clerk: ['secretKey'],
7068
cloudflare: ['apiKey'],
7169
crunchbase: ['apiKey'],
70+
cursor: ['apiKey'],
71+
databricks: ['host', 'apiKey'],
7272
daytona: ['apiKey'],
73+
discord: ['botToken'],
74+
dub: ['apiKey'],
7375
elevenlabs: ['apiKey'],
7476
enrich: ['apiKey'],
77+
extend: ['apiKey'],
78+
fireflies: ['apiKey'],
79+
flint: ['apiKey'],
7580
gamma: ['apiKey'],
7681
hex: ['apiKey'],
7782
huggingface: ['apiKey'],
7883
incidentio: ['apiKey'],
7984
instantly: ['apiKey'],
85+
intercom: ['accessToken'],
8086
langsmith: ['apiKey'],
8187
launchdarkly: ['apiKey'],
8288
linq: ['apiKey'],
8389
loops: ['apiKey'],
8490
luma: ['apiKey'],
8591
mailchimp: ['apiKey'],
92+
mem0: ['apiKey'],
8693
otter: ['apiKey'],
8794
persona: ['apiKey'],
8895
profound: ['apiKey'],
96+
pulse: ['apiKey'],
8997
quartr: ['apiKey'],
98+
quiver: ['apiKey'],
9099
rb2b: ['apiKey'],
100+
reducto: ['apiKey'],
91101
rippling: ['apiKey'],
92102
rocketlane: ['apiKey'],
93103
sendgrid: ['apiKey'],
@@ -97,22 +107,12 @@ const INLINE_SECRET_FIELDS = {
97107
sportmonks: ['apiKey'],
98108
square: ['apiKey'],
99109
tailscale: ['apiKey'],
110+
tavily: ['apiKey'],
100111
trigger_dev: ['apiKey'],
101112
uptimerobot: ['apiKey'],
102113
youcom: ['apiKey'],
103114
youtube: ['apiKey'],
104-
mem0: ['apiKey'],
105115
zep: ['apiKey'],
106-
discord: ['botToken'],
107-
cursor: ['apiKey'],
108-
dub: ['apiKey'],
109-
extend: ['apiKey'],
110-
fireflies: ['apiKey'],
111-
intercom: ['accessToken'],
112-
pulse: ['apiKey'],
113-
quiver: ['apiKey'],
114-
reducto: ['apiKey'],
115-
flint: ['apiKey'],
116116
} as const satisfies Record<string, readonly string[]>
117117

118118
/** The saved-credential picker; {@link withSavedCredential} completes the standard fields. */

‎apps/sim/lib/credentials/token-service-accounts/descriptors.ts‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1368,10 +1368,10 @@ export const TOKEN_SERVICE_ACCOUNT_DESCRIPTORS: Record<
13681368
tokenNoun: 'API key',
13691369
connectNoun: 'API key',
13701370
fields: [
1371-
{ id: 'apiToken', label: 'API key', placeholder: 'Enter your Cursor API key', secret: true },
1371+
{ id: 'apiToken', label: 'API key', placeholder: 'Paste your Cursor API key', secret: true },
13721372
],
13731373
docsUrl: 'https://docs.sim.ai/integrations/cursor',
1374-
helpText: 'Create a user API key in the Cursor dashboard under Integrations.',
1374+
helpText: 'Create an API key in the Cursor dashboard under API Keys.',
13751375
},
13761376
[DUB_SERVICE_ACCOUNT_PROVIDER_ID]: {
13771377
providerId: DUB_SERVICE_ACCOUNT_PROVIDER_ID,
@@ -1396,7 +1396,7 @@ export const TOKEN_SERVICE_ACCOUNT_DESCRIPTORS: Record<
13961396
tokenNoun: 'API key',
13971397
connectNoun: 'API key',
13981398
fields: [
1399-
{ id: 'apiToken', label: 'API key', placeholder: 'Enter your Extend API key', secret: true },
1399+
{ id: 'apiToken', label: 'API key', placeholder: 'Paste your Extend API key', secret: true },
14001400
],
14011401
docsUrl: 'https://docs.sim.ai/integrations/extend',
14021402
},
@@ -1409,7 +1409,7 @@ export const TOKEN_SERVICE_ACCOUNT_DESCRIPTORS: Record<
14091409
{
14101410
id: 'apiToken',
14111411
label: 'API key',
1412-
placeholder: 'Enter your Fireflies API key',
1412+
placeholder: 'Paste your Fireflies API key',
14131413
secret: true,
14141414
},
14151415
],
@@ -1424,7 +1424,7 @@ export const TOKEN_SERVICE_ACCOUNT_DESCRIPTORS: Record<
14241424
{
14251425
id: 'apiToken',
14261426
label: 'Access token',
1427-
placeholder: 'Enter your Intercom access token',
1427+
placeholder: 'Paste your Intercom access token',
14281428
secret: true,
14291429
},
14301430
],
@@ -1437,7 +1437,7 @@ export const TOKEN_SERVICE_ACCOUNT_DESCRIPTORS: Record<
14371437
tokenNoun: 'API key',
14381438
connectNoun: 'API key',
14391439
fields: [
1440-
{ id: 'apiToken', label: 'API key', placeholder: 'Enter your Pulse API key', secret: true },
1440+
{ id: 'apiToken', label: 'API key', placeholder: 'Paste your Pulse API key', secret: true },
14411441
],
14421442
docsUrl: 'https://docs.sim.ai/integrations/pulse',
14431443
helpText: 'Get your key from the Pulse Platform at platform.runpulse.com.',
@@ -1451,7 +1451,7 @@ export const TOKEN_SERVICE_ACCOUNT_DESCRIPTORS: Record<
14511451
{
14521452
id: 'apiToken',
14531453
label: 'API key',
1454-
placeholder: 'Enter your QuiverAI API key',
1454+
placeholder: 'Paste your QuiverAI API key',
14551455
secret: true,
14561456
},
14571457
],
@@ -1463,7 +1463,7 @@ export const TOKEN_SERVICE_ACCOUNT_DESCRIPTORS: Record<
14631463
tokenNoun: 'API key',
14641464
connectNoun: 'API key',
14651465
fields: [
1466-
{ id: 'apiToken', label: 'API key', placeholder: 'Enter your Reducto API key', secret: true },
1466+
{ id: 'apiToken', label: 'API key', placeholder: 'Paste your Reducto API key', secret: true },
14671467
],
14681468
docsUrl: 'https://docs.sim.ai/integrations/reducto',
14691469
},

‎apps/sim/lib/credentials/token-service-accounts/server.ts‎

Lines changed: 61 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -84,86 +84,88 @@ import {
8484
YOUTUBE_SERVICE_ACCOUNT_PROVIDER_ID,
8585
ZEP_SERVICE_ACCOUNT_PROVIDER_ID,
8686
} from '@/lib/credentials/token-service-accounts/descriptors'
87-
import { validateAffinityServiceAccount } from '@/lib/credentials/token-service-accounts/validators/affinity'
88-
import { validateAgentMailServiceAccount } from '@/lib/credentials/token-service-accounts/validators/agentmail'
89-
import { validateAgentPhoneServiceAccount } from '@/lib/credentials/token-service-accounts/validators/agentphone'
90-
import { validateAhrefsServiceAccount } from '@/lib/credentials/token-service-accounts/validators/ahrefs'
9187
import { validateAirtableServiceAccount } from '@/lib/credentials/token-service-accounts/validators/airtable'
92-
import { validateApifyServiceAccount } from '@/lib/credentials/token-service-accounts/validators/apify'
93-
import { validateApolloServiceAccount } from '@/lib/credentials/token-service-accounts/validators/apollo'
9488
import { validateAsanaServiceAccount } from '@/lib/credentials/token-service-accounts/validators/asana'
9589
import { validateAttioServiceAccount } from '@/lib/credentials/token-service-accounts/validators/attio'
96-
import { validateBrexServiceAccount } from '@/lib/credentials/token-service-accounts/validators/brex'
97-
import { validateBrightDataServiceAccount } from '@/lib/credentials/token-service-accounts/validators/brightdata'
98-
import { validateBrowserUseServiceAccount } from '@/lib/credentials/token-service-accounts/validators/browser-use'
99-
import { validateBufferServiceAccount } from '@/lib/credentials/token-service-accounts/validators/buffer'
10090
import { validateCalcomServiceAccount } from '@/lib/credentials/token-service-accounts/validators/calcom'
101-
import { validateCirclebackServiceAccount } from '@/lib/credentials/token-service-accounts/validators/circleback'
10291
import { validateClaudePlatformServiceAccount } from '@/lib/credentials/token-service-accounts/validators/claude-platform'
103-
import { validateClerkServiceAccount } from '@/lib/credentials/token-service-accounts/validators/clerk'
10492
import { validateClickupServiceAccount } from '@/lib/credentials/token-service-accounts/validators/clickup'
105-
import { validateCloudflareServiceAccount } from '@/lib/credentials/token-service-accounts/validators/cloudflare'
10693
import { validateCodaServiceAccount } from '@/lib/credentials/token-service-accounts/validators/coda'
107-
import { validateCrunchbaseServiceAccount } from '@/lib/credentials/token-service-accounts/validators/crunchbase'
108-
import { validateCursorServiceAccount } from '@/lib/credentials/token-service-accounts/validators/cursor'
109-
import { validateDaytonaServiceAccount } from '@/lib/credentials/token-service-accounts/validators/daytona'
110-
import { validateDiscordServiceAccount } from '@/lib/credentials/token-service-accounts/validators/discord'
111-
import { validateDubServiceAccount } from '@/lib/credentials/token-service-accounts/validators/dub'
112-
import { validateElevenLabsServiceAccount } from '@/lib/credentials/token-service-accounts/validators/elevenlabs'
113-
import { validateEnrichServiceAccount } from '@/lib/credentials/token-service-accounts/validators/enrich'
114-
import { validateExtendServiceAccount } from '@/lib/credentials/token-service-accounts/validators/extend'
115-
import { validateFirefliesServiceAccount } from '@/lib/credentials/token-service-accounts/validators/fireflies'
116-
import { validateFlintServiceAccount } from '@/lib/credentials/token-service-accounts/validators/flint'
11794
import { validateFlowServiceAccount } from '@/lib/credentials/token-service-accounts/validators/flow'
118-
import { validateGammaServiceAccount } from '@/lib/credentials/token-service-accounts/validators/gamma'
11995
import { validateGaugeServiceAccount } from '@/lib/credentials/token-service-accounts/validators/gauge'
12096
import { validateHarmonicServiceAccount } from '@/lib/credentials/token-service-accounts/validators/harmonic'
121-
import { validateHexServiceAccount } from '@/lib/credentials/token-service-accounts/validators/hex'
12297
import { validateHiggsfieldServiceAccount } from '@/lib/credentials/token-service-accounts/validators/higgsfield'
12398
import { validateHubspotServiceAccount } from '@/lib/credentials/token-service-accounts/validators/hubspot'
124-
import { validateHuggingfaceServiceAccount } from '@/lib/credentials/token-service-accounts/validators/huggingface'
125-
import { validateIncidentioServiceAccount } from '@/lib/credentials/token-service-accounts/validators/incidentio'
126-
import { validateInstantlyServiceAccount } from '@/lib/credentials/token-service-accounts/validators/instantly'
127-
import { validateIntercomServiceAccount } from '@/lib/credentials/token-service-accounts/validators/intercom'
128-
import { validateLangsmithServiceAccount } from '@/lib/credentials/token-service-accounts/validators/langsmith'
129-
import { validateLaunchdarklyServiceAccount } from '@/lib/credentials/token-service-accounts/validators/launchdarkly'
13099
import { validateLinearServiceAccount } from '@/lib/credentials/token-service-accounts/validators/linear'
131-
import { validateLinqServiceAccount } from '@/lib/credentials/token-service-accounts/validators/linq'
132-
import { validateLoopsServiceAccount } from '@/lib/credentials/token-service-accounts/validators/loops'
133-
import { validateLumaServiceAccount } from '@/lib/credentials/token-service-accounts/validators/luma'
134-
import { validateMailchimpServiceAccount } from '@/lib/credentials/token-service-accounts/validators/mailchimp'
135-
import { validateMem0ServiceAccount } from '@/lib/credentials/token-service-accounts/validators/mem0'
136100
import { validateMondayServiceAccount } from '@/lib/credentials/token-service-accounts/validators/monday'
137101
import { validateNotionServiceAccount } from '@/lib/credentials/token-service-accounts/validators/notion'
138-
import { validateOtterServiceAccount } from '@/lib/credentials/token-service-accounts/validators/otter'
139-
import { validatePersonaServiceAccount } from '@/lib/credentials/token-service-accounts/validators/persona'
140102
import { validatePipedriveServiceAccount } from '@/lib/credentials/token-service-accounts/validators/pipedrive'
141-
import { validateProfoundServiceAccount } from '@/lib/credentials/token-service-accounts/validators/profound'
142-
import { validatePulseServiceAccount } from '@/lib/credentials/token-service-accounts/validators/pulse'
143-
import { validateQuartrServiceAccount } from '@/lib/credentials/token-service-accounts/validators/quartr'
144-
import { validateQuiverServiceAccount } from '@/lib/credentials/token-service-accounts/validators/quiver'
145-
import { validateRB2BServiceAccount } from '@/lib/credentials/token-service-accounts/validators/rb2b'
146-
import { validateReductoServiceAccount } from '@/lib/credentials/token-service-accounts/validators/reducto'
147-
import { validateRipplingServiceAccount } from '@/lib/credentials/token-service-accounts/validators/rippling'
148-
import { validateRocketlaneServiceAccount } from '@/lib/credentials/token-service-accounts/validators/rocketlane'
149-
import { validateSendGridServiceAccount } from '@/lib/credentials/token-service-accounts/validators/sendgrid'
150103
import { validateShopifyServiceAccount } from '@/lib/credentials/token-service-accounts/validators/shopify'
151-
import { validateSimilarwebServiceAccount } from '@/lib/credentials/token-service-accounts/validators/similarweb'
152-
import { validateSixtyfourServiceAccount } from '@/lib/credentials/token-service-accounts/validators/sixtyfour'
153-
import { validateSmartleadServiceAccount } from '@/lib/credentials/token-service-accounts/validators/smartlead'
154104
import { validateSnowflakeServiceAccount } from '@/lib/credentials/token-service-accounts/validators/snowflake'
155-
import { validateSportmonksServiceAccount } from '@/lib/credentials/token-service-accounts/validators/sportmonks'
156-
import { validateSquareServiceAccount } from '@/lib/credentials/token-service-accounts/validators/square'
157-
import { validateTailscaleServiceAccount } from '@/lib/credentials/token-service-accounts/validators/tailscale'
158-
import { validateTavilyServiceAccount } from '@/lib/credentials/token-service-accounts/validators/tavily'
105+
import {
106+
validateAffinityServiceAccount,
107+
validateAgentMailServiceAccount,
108+
validateAgentPhoneServiceAccount,
109+
validateAhrefsServiceAccount,
110+
validateApifyServiceAccount,
111+
validateApolloServiceAccount,
112+
validateBrexServiceAccount,
113+
validateBrightDataServiceAccount,
114+
validateBrowserUseServiceAccount,
115+
validateBufferServiceAccount,
116+
validateCirclebackServiceAccount,
117+
validateClerkServiceAccount,
118+
validateCloudflareServiceAccount,
119+
validateCrunchbaseServiceAccount,
120+
validateCursorServiceAccount,
121+
validateDaytonaServiceAccount,
122+
validateDiscordServiceAccount,
123+
validateDubServiceAccount,
124+
validateElevenLabsServiceAccount,
125+
validateEnrichServiceAccount,
126+
validateExtendServiceAccount,
127+
validateFirefliesServiceAccount,
128+
validateFlintServiceAccount,
129+
validateGammaServiceAccount,
130+
validateHexServiceAccount,
131+
validateHuggingfaceServiceAccount,
132+
validateIncidentioServiceAccount,
133+
validateInstantlyServiceAccount,
134+
validateIntercomServiceAccount,
135+
validateLangsmithServiceAccount,
136+
validateLaunchdarklyServiceAccount,
137+
validateLinqServiceAccount,
138+
validateLoopsServiceAccount,
139+
validateLumaServiceAccount,
140+
validateMailchimpServiceAccount,
141+
validateMem0ServiceAccount,
142+
validateOtterServiceAccount,
143+
validatePersonaServiceAccount,
144+
validateProfoundServiceAccount,
145+
validatePulseServiceAccount,
146+
validateQuartrServiceAccount,
147+
validateQuiverServiceAccount,
148+
validateRB2BServiceAccount,
149+
validateReductoServiceAccount,
150+
validateRipplingServiceAccount,
151+
validateRocketlaneServiceAccount,
152+
validateSendGridServiceAccount,
153+
validateSimilarwebServiceAccount,
154+
validateSixtyfourServiceAccount,
155+
validateSmartleadServiceAccount,
156+
validateSportmonksServiceAccount,
157+
validateSquareServiceAccount,
158+
validateTailscaleServiceAccount,
159+
validateTavilyServiceAccount,
160+
validateTriggerDevServiceAccount,
161+
validateUptimeRobotServiceAccount,
162+
validateYouComServiceAccount,
163+
validateYouTubeServiceAccount,
164+
validateZepServiceAccount,
165+
} from '@/lib/credentials/token-service-accounts/validators/token-checks'
159166
import { validateTrelloServiceAccount } from '@/lib/credentials/token-service-accounts/validators/trello'
160-
import { validateTriggerDevServiceAccount } from '@/lib/credentials/token-service-accounts/validators/trigger-dev'
161-
import { validateUptimeRobotServiceAccount } from '@/lib/credentials/token-service-accounts/validators/uptimerobot'
162167
import { validateWealthboxServiceAccount } from '@/lib/credentials/token-service-accounts/validators/wealthbox'
163168
import { validateWebflowServiceAccount } from '@/lib/credentials/token-service-accounts/validators/webflow'
164-
import { validateYouComServiceAccount } from '@/lib/credentials/token-service-accounts/validators/youcom'
165-
import { validateYouTubeServiceAccount } from '@/lib/credentials/token-service-accounts/validators/youtube'
166-
import { validateZepServiceAccount } from '@/lib/credentials/token-service-accounts/validators/zep'
167169

168170
/** Raw fields a token service-account validator receives (already trimmed). */
169171
export interface TokenServiceAccountFields {

‎apps/sim/lib/credentials/token-service-accounts/validators/affinity.ts‎

Lines changed: 0 additions & 10 deletions
This file was deleted.

‎apps/sim/lib/credentials/token-service-accounts/validators/agentmail.ts‎

Lines changed: 0 additions & 10 deletions
This file was deleted.

‎apps/sim/lib/credentials/token-service-accounts/validators/agentphone.ts‎

Lines changed: 0 additions & 10 deletions
This file was deleted.

‎apps/sim/lib/credentials/token-service-accounts/validators/ahrefs.ts‎

Lines changed: 0 additions & 10 deletions
This file was deleted.

‎apps/sim/lib/credentials/token-service-accounts/validators/apify.ts‎

Lines changed: 0 additions & 11 deletions
This file was deleted.

0 commit comments

Comments
 (0)