Skip to content

Commit 2d4c963

Browse files
Bill Leoutsakoswaleedlatif1
Bill Leoutsakos
authored and
waleedlatif1
committed
feat(oracle-fusion): add validated integration foundation
1 parent ba614dc commit 2d4c963

27 files changed

Lines changed: 2898 additions & 15 deletions

‎apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/client-credential-account-modal.tsx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -192,7 +192,7 @@ function ClientCredentialAccountModalForm({
192192
// stored on a credential whose grant never reads it.
193193
const secretFields: FieldValues = {}
194194
for (const field of visibleFields) {
195-
const value = values[field.id]?.trim()
195+
const value = field.preserveWhitespace ? values[field.id] : values[field.id]?.trim()
196196
if (value) secretFields[field.id] = value
197197
}
198198
if (credentialId) {

‎apps/sim/lib/api/contracts/credentials.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -156,7 +156,7 @@ export const createCredentialFieldsSchema = z.object({
156156
signingSecret: z.string().trim().min(1).optional(),
157157
botToken: z.string().trim().min(1).optional(),
158158
clientId: z.string().trim().min(1).max(512).optional(),
159-
clientSecret: z.string().trim().min(1).max(1024).optional(),
159+
clientSecret: z.string().min(1).max(1024).optional(),
160160
certificateId: z.string().trim().min(1).max(512).optional(),
161161
orgId: z.string().trim().min(1).max(255).optional(),
162162
/** Optional provider region selector (Zoho Desk data center). */
@@ -282,7 +282,7 @@ export const updateCredentialByIdBodySchema = z
282282
atlassianProduct: atlassianProductSchema.optional(),
283283
/** Client-credential service-account secret rotation (reconnect). */
284284
clientId: z.string().trim().min(1).max(512).optional(),
285-
clientSecret: z.string().trim().min(1).max(1024).optional(),
285+
clientSecret: z.string().min(1).max(1024).optional(),
286286
certificateId: z.string().trim().min(1).max(512).optional(),
287287
orgId: z.string().trim().min(1).max(255).optional(),
288288
dataCenter: z.string().trim().min(1).max(32).optional(),

‎apps/sim/lib/api/contracts/v2/credentials.ts‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -444,7 +444,6 @@ const v2ServiceAccountCredentialFieldsSchema = z
444444
clientId: z.string().trim().min(1).max(512).optional().describe('OAuth client identifier.'),
445445
clientSecret: z
446446
.string()
447-
.trim()
448447
.min(1)
449448
.max(1024)
450449
.optional()
@@ -710,7 +709,6 @@ const v2ServiceAccountSecretFieldsShape = {
710709
clientId: z.string().trim().min(1).max(512).optional().describe('OAuth client identifier.'),
711710
clientSecret: z
712711
.string()
713-
.trim()
714712
.min(1)
715713
.max(1024)
716714
.optional()

‎apps/sim/lib/credentials/client-credential-accounts/descriptors.test.ts‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ import {
33
BOX_SERVICE_ACCOUNT_PROVIDER_ID,
44
getClientCredentialAccountDescriptor,
55
normalizeNetSuiteSuiteTalkOrigin,
6+
normalizeOracleFusionApplicationOrigin,
67
partitionClientCredentialFields,
78
resolveClientCredentialAuthMethod,
89
resolveSalesforceAuthMethod,
@@ -70,6 +71,41 @@ describe('normalizeNetSuiteSuiteTalkOrigin', () => {
7071
})
7172
})
7273

74+
describe('normalizeOracleFusionApplicationOrigin', () => {
75+
it.each([
76+
[' https://VISION.fa.us2.oraclecloud.com/ ', 'https://vision.fa.us2.oraclecloud.com'],
77+
['https://acme-prod.fa.ocs.oraclecloud.com', 'https://acme-prod.fa.ocs.oraclecloud.com'],
78+
[
79+
'https://pod.fa.eu-frankfurt-1.oraclecloud.com',
80+
'https://pod.fa.eu-frankfurt-1.oraclecloud.com',
81+
],
82+
])('normalizes the supported application origin %j', (value, expected) => {
83+
expect(normalizeOracleFusionApplicationOrigin(value)).toBe(expected)
84+
})
85+
86+
it.each([
87+
'http://vision.fa.us2.oraclecloud.com',
88+
'https://vision.fa.us2.oraclecloud.com/path',
89+
'https://vision.fa.us2.oraclecloud.com/path/..',
90+
'https://vision.fa.us2.oraclecloud.com/./',
91+
'https://vision.fa.us2.oraclecloud.com/%2e%2e/',
92+
'https://vision.fa.us2.oraclecloud.com:443',
93+
'https://vision.fa.us2.oraclecloud.com:8443',
94+
'https://user@vision.fa.us2.oraclecloud.com',
95+
'https://user:password@vision.fa.us2.oraclecloud.com',
96+
'https://vision.fa.us2.oraclecloud.com?tenant=other',
97+
'https://vision.fa.us2.oraclecloud.com#fragment',
98+
'https://vision.fa.us2.oraclecloud.com.evil.example',
99+
'https://vision.fa.us2.oraclecloud.co',
100+
'https://fusion.example.com',
101+
'https://fa.us2.oraclecloud.com',
102+
'https://-vision.fa.us2.oraclecloud.com',
103+
'https://vision.fa.-us2.oraclecloud.com',
104+
])('rejects the noncanonical Fusion Applications URL %j', (value) => {
105+
expect(normalizeOracleFusionApplicationOrigin(value)).toBeUndefined()
106+
})
107+
})
108+
73109
describe('resolveClientCredentialAuthMethod', () => {
74110
it('returns undefined for a provider that declares no method selector', () => {
75111
expect(resolveClientCredentialAuthMethod(box, 'jwt_bearer')).toBeUndefined()

‎apps/sim/lib/credentials/client-credential-accounts/descriptors.ts‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,8 @@ export interface ClientCredentialAccountField {
4343
placeholder: string
4444
/** Rendered with SecretInput and never echoed back. */
4545
secret: boolean
46+
/** Preserve exact password bytes instead of normalizing surrounding whitespace. */
47+
preserveWhitespace?: boolean
4648
/**
4749
* Renders a multi-line control instead of a single-line one. Required for
4850
* PEM-encoded material (a private key spans ~28 newline-separated lines and
@@ -114,6 +116,7 @@ export const ZOHO_DESK_SERVICE_ACCOUNT_PROVIDER_ID = 'zoho-desk-service-account'
114116
export const RAMP_SERVICE_ACCOUNT_PROVIDER_ID = 'ramp-service-account' as const
115117
export const VANTA_SERVICE_ACCOUNT_PROVIDER_ID = 'vanta-service-account' as const
116118
export const NETSUITE_SERVICE_ACCOUNT_PROVIDER_ID = 'netsuite-service-account' as const
119+
export const ORACLE_FUSION_SERVICE_ACCOUNT_PROVIDER_ID = 'oracle-fusion-service-account' as const
117120

118121
/** Permissions requested when connecting a Manage Vanta application. */
119122
export const VANTA_PERMISSION_OPTIONS = [
@@ -133,6 +136,7 @@ export type ClientCredentialAccountProviderId =
133136
| typeof NETSUITE_SERVICE_ACCOUNT_PROVIDER_ID
134137
| typeof RAMP_SERVICE_ACCOUNT_PROVIDER_ID
135138
| typeof VANTA_SERVICE_ACCOUNT_PROVIDER_ID
139+
| typeof ORACLE_FUSION_SERVICE_ACCOUNT_PROVIDER_ID
136140

137141
/**
138142
* Exact account-specific SuiteTalk origin accepted by NetSuite's OAuth and
@@ -169,6 +173,40 @@ export function normalizeNetSuiteSuiteTalkOrigin(rawUrl: string): string | undef
169173
}
170174
}
171175

176+
/** Canonical Oracle-assigned Fusion Applications origin used by product REST APIs. */
177+
const ORACLE_FUSION_APPLICATION_ORIGIN_REGEX =
178+
/^https:\/\/[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.fa\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.oraclecloud\.com$/
179+
const ORACLE_FUSION_APPLICATION_INPUT_REGEX =
180+
/^https:\/\/[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.fa\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.oraclecloud\.com\/?$/i
181+
182+
/**
183+
* Normalizes a Fusion Applications URL to its authoritative HTTPS origin.
184+
* Explicit ports are rejected even when they match HTTPS's default port so a
185+
* saved credential can never silently broaden the accepted endpoint shape.
186+
*/
187+
export function normalizeOracleFusionApplicationOrigin(rawUrl: string): string | undefined {
188+
try {
189+
const trimmed = rawUrl.trim()
190+
if (!ORACLE_FUSION_APPLICATION_INPUT_REGEX.test(trimmed)) return undefined
191+
const parsed = new URL(trimmed)
192+
if (
193+
parsed.protocol !== 'https:' ||
194+
parsed.port ||
195+
parsed.username ||
196+
parsed.password ||
197+
parsed.search ||
198+
parsed.hash ||
199+
(parsed.pathname !== '' && parsed.pathname !== '/') ||
200+
!ORACLE_FUSION_APPLICATION_ORIGIN_REGEX.test(parsed.origin)
201+
) {
202+
return undefined
203+
}
204+
return parsed.origin
205+
} catch {
206+
return undefined
207+
}
208+
}
209+
172210
/**
173211
* Allowed My Domain host shapes: one org label (optionally with a
174212
* `--sandboxName` suffix), an optional partition label (sandbox, develop,
@@ -605,6 +643,40 @@ export const CLIENT_CREDENTIAL_ACCOUNT_DESCRIPTORS: Record<
605643
helpText:
606644
'Use the account-specific SuiteTalk URL and the client ID, certificate ID, and private key from one OAuth 2.0 client-credentials mapping.',
607645
},
646+
[ORACLE_FUSION_SERVICE_ACCOUNT_PROVIDER_ID]: {
647+
providerId: ORACLE_FUSION_SERVICE_ACCOUNT_PROVIDER_ID,
648+
serviceLabel: 'Oracle Fusion',
649+
connectNoun: 'integration user',
650+
fields: [
651+
{
652+
id: 'orgId',
653+
label: 'Fusion Applications URL',
654+
placeholder: 'https://your-environment.fa.ocs.oraclecloud.com',
655+
secret: false,
656+
hintPattern: ORACLE_FUSION_APPLICATION_ORIGIN_REGEX,
657+
hintNormalize: (value) =>
658+
normalizeOracleFusionApplicationOrigin(value) ?? value.trim().toLowerCase(),
659+
hintMessage:
660+
'Expected the Oracle-assigned HTTPS application URL with no path, port, credentials, query, or fragment.',
661+
},
662+
{
663+
id: 'clientId',
664+
label: 'Integration username',
665+
placeholder: 'Paste the integration username',
666+
secret: false,
667+
},
668+
{
669+
id: 'clientSecret',
670+
label: 'Password',
671+
placeholder: 'Paste the password',
672+
secret: true,
673+
preserveWhitespace: true,
674+
},
675+
],
676+
docsUrl: 'https://docs.oracle.com/en/cloud/saas/applications-common/26b/farca/Quick_Start.html',
677+
helpText:
678+
'The application URL is validated when saved. Oracle authenticates the integration user on the first product request.',
679+
},
608680
}
609681

610682
/**

‎apps/sim/lib/credentials/client-credential-accounts/minters/oracle-fusion.test.ts‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
/**
2+
* @vitest-environment node
3+
*/
4+
import { describe, expect, it, vi } from 'vitest'
5+
import { mintOracleFusionServiceAccountToken } from '@/lib/credentials/client-credential-accounts/minters/oracle-fusion'
6+
7+
const FIELDS = {
8+
orgId: 'https://vision.fa.us2.oraclecloud.com',
9+
clientId: 'integration-user',
10+
clientSecret: 'password-with-symbols-!@#',
11+
}
12+
13+
describe('mintOracleFusionServiceAccountToken', () => {
14+
it('derives an opaque Basic credential locally with a five-minute lifetime', async () => {
15+
const fetchSpy = vi.spyOn(globalThis, 'fetch')
16+
17+
await expect(mintOracleFusionServiceAccountToken(FIELDS)).resolves.toEqual({
18+
instanceUrl: FIELDS.orgId,
19+
accessToken: Buffer.from(`${FIELDS.clientId}:${FIELDS.clientSecret}`, 'utf8').toString(
20+
'base64'
21+
),
22+
expiresInSeconds: 300,
23+
identity: {
24+
displayName: 'Oracle Fusion vision',
25+
principal: null,
26+
auditMetadata: { oracleFusionApplicationOrigin: FIELDS.orgId },
27+
storedMetadata: { applicationOrigin: FIELDS.orgId },
28+
},
29+
})
30+
expect(fetchSpy).not.toHaveBeenCalled()
31+
fetchSpy.mockRestore()
32+
})
33+
34+
it('normalizes the origin and omits connect-time identity during resolution', async () => {
35+
await expect(
36+
mintOracleFusionServiceAccountToken(
37+
{ ...FIELDS, orgId: ' HTTPS://VISION.FA.OCS.ORACLECLOUD.COM/ ' },
38+
{ skipIdentity: true }
39+
)
40+
).resolves.toEqual({
41+
instanceUrl: 'https://vision.fa.ocs.oraclecloud.com',
42+
accessToken: Buffer.from(`${FIELDS.clientId}:${FIELDS.clientSecret}`, 'utf8').toString(
43+
'base64'
44+
),
45+
expiresInSeconds: 300,
46+
})
47+
})
48+
49+
it.each([
50+
'http://vision.fa.us2.oraclecloud.com',
51+
'https://vision.fa.us2.oraclecloud.com/path',
52+
'https://vision.fa.us2.oraclecloud.com/path/..',
53+
'https://vision.fa.us2.oraclecloud.com/%2e%2e/',
54+
'https://vision.fa.us2.oraclecloud.com:443',
55+
'https://user:password@vision.fa.us2.oraclecloud.com',
56+
'https://vision.fa.us2.oraclecloud.com?tenant=other',
57+
'https://vision.fa.us2.oraclecloud.com#fragment',
58+
'https://vision.fa.us2.oraclecloud.com.evil.example',
59+
'https://vanity.example.com',
60+
])('rejects the unsafe application URL %j without a network probe', async (orgId) => {
61+
const fetchSpy = vi.spyOn(globalThis, 'fetch')
62+
await expect(mintOracleFusionServiceAccountToken({ ...FIELDS, orgId })).rejects.toMatchObject({
63+
code: 'site_not_found',
64+
status: 400,
65+
})
66+
expect(fetchSpy).not.toHaveBeenCalled()
67+
fetchSpy.mockRestore()
68+
})
69+
70+
it.each([
71+
['', FIELDS.clientSecret],
72+
['user:name', FIELDS.clientSecret],
73+
['user\nname', FIELDS.clientSecret],
74+
['u'.repeat(256), FIELDS.clientSecret],
75+
[FIELDS.clientId, ''],
76+
[FIELDS.clientId, 'password\n'],
77+
[FIELDS.clientId, 'p'.repeat(1025)],
78+
])(
79+
'rejects malformed local credentials without exposing them',
80+
async (clientId, clientSecret) => {
81+
const error = await mintOracleFusionServiceAccountToken({
82+
...FIELDS,
83+
clientId,
84+
clientSecret,
85+
}).catch((caught: unknown) => caught)
86+
expect(error).toMatchObject({ code: 'invalid_credentials', status: 400 })
87+
const serialized = JSON.stringify(error)
88+
if (clientId) expect(serialized).not.toContain(clientId)
89+
if (clientSecret) expect(serialized).not.toContain(clientSecret)
90+
const encoded = Buffer.from(`${clientId}:${clientSecret}`, 'utf8').toString('base64')
91+
if (encoded) expect(serialized).not.toContain(encoded)
92+
}
93+
)
94+
})

‎apps/sim/lib/credentials/client-credential-accounts/minters/oracle-fusion.ts‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
import { normalizeOracleFusionApplicationOrigin } from '@/lib/credentials/client-credential-accounts/descriptors'
2+
import type {
3+
ClientCredentialAccountFields,
4+
ClientCredentialAccountMintOptions,
5+
ClientCredentialAccountMintResult,
6+
} from '@/lib/credentials/client-credential-accounts/server'
7+
import { TokenServiceAccountValidationError } from '@/lib/credentials/token-service-accounts/errors'
8+
9+
const BASIC_CREDENTIAL_CACHE_TTL_SECONDS = 5 * 60
10+
const ORACLE_FUSION_CREDENTIAL_STEP = 'oracle_fusion_credential_validation'
11+
const USERNAME_MAX_LENGTH = 255
12+
const PASSWORD_MAX_LENGTH = 1024
13+
const CONTROL_CHARACTER = /[\u0000-\u001f\u007f]/
14+
15+
function invalidCredential(reason: string): TokenServiceAccountValidationError {
16+
return new TokenServiceAccountValidationError('invalid_credentials', 400, {
17+
step: ORACLE_FUSION_CREDENTIAL_STEP,
18+
reason,
19+
})
20+
}
21+
22+
/**
23+
* Resolves locally validated Oracle Basic credentials through the shared
24+
* client-credential minter contract. Oracle does not expose a documented,
25+
* privilege-neutral identity probe, so authentication occurs on first use.
26+
*/
27+
export async function mintOracleFusionServiceAccountToken(
28+
fields: ClientCredentialAccountFields,
29+
options?: ClientCredentialAccountMintOptions
30+
): Promise<ClientCredentialAccountMintResult> {
31+
const instanceUrl = normalizeOracleFusionApplicationOrigin(fields.orgId)
32+
if (!instanceUrl) {
33+
throw new TokenServiceAccountValidationError('site_not_found', 400, {
34+
step: ORACLE_FUSION_CREDENTIAL_STEP,
35+
reason: 'Fusion Applications URL must be a canonical Oracle-assigned HTTPS origin',
36+
})
37+
}
38+
39+
const username = fields.clientId.trim()
40+
const password = fields.clientSecret
41+
if (!username || username.length > USERNAME_MAX_LENGTH || CONTROL_CHARACTER.test(username)) {
42+
throw invalidCredential('integration username is invalid')
43+
}
44+
if (username.includes(':')) {
45+
throw invalidCredential('integration username must not contain a colon')
46+
}
47+
if (!password || password.length > PASSWORD_MAX_LENGTH || CONTROL_CHARACTER.test(password)) {
48+
throw invalidCredential('password is invalid')
49+
}
50+
51+
const accessToken = Buffer.from(`${username}:${password}`, 'utf8').toString('base64')
52+
const tenant = new URL(instanceUrl).hostname.split('.')[0]
53+
return {
54+
instanceUrl,
55+
accessToken,
56+
expiresInSeconds: BASIC_CREDENTIAL_CACHE_TTL_SECONDS,
57+
...(!options?.skipIdentity
58+
? {
59+
identity: {
60+
displayName: `Oracle Fusion ${tenant}`,
61+
principal: null,
62+
auditMetadata: { oracleFusionApplicationOrigin: instanceUrl },
63+
storedMetadata: { applicationOrigin: instanceUrl },
64+
},
65+
}
66+
: {}),
67+
}
68+
}

0 commit comments

Comments
 (0)