fix(agiloft): repoint the block at the alrest surface and fix EWLogin

The native block could not authenticate against any instance. A customer
reported it, and production traces for their workspace confirm every failure
mode verbatim.

EWLogin was sending only $KB, $login, and $password as query parameters. A live
instance rejects that:

  EWWrongDataException has occurred: One has to specify $table, $KB, $lang
  parameters or use $genhotlink/$genproject pair ...

$table is required even though only $KB/$login/$password/$lang are documented.
Credentials now go in a form-encoded body, which Agiloft's docs allow and which
keeps the password out of URLs and access logs.

Because login failed, no data call was ever reached — which hid the fact that
the record operations were pointed at a surface that cannot use the token
EWLogin issues. /ewws/EW* authenticates from inline $login/$password and rejects
a bearer token; /ewws/alrest/{KB} is the surface that accepts it.

- Record create, read, update, delete, search, and attachment retrieval now go
  through /ewws/alrest/{KB} with the bearer token, using the authentication
  scheme returned by the login response (Agiloft sends it with a trailing space,
  so it is trimmed rather than concatenated blind)
- alrest reports failures as HTTP 200 with {"success": false, errors: [...]}, so
  readAlrestJson is the single sanctioned reader; checking response.ok alone
  turned refusals into successful empty results
- Operations with no documented alrest equivalent stay on /ewws/EW* but now
  authenticate inline instead of sending a token that surface rejects
- Optional string inputs accept null. A blank Page field resolved to null and
  failed validation with "expected string, received null" before any request
- Reads with a named field list go through the search projection; an unfiltered
  contract record is roughly 184KB and swamps downstream agent context

Author: waleedlatif1

apps/sim/app/api/tools/agiloft/attach/route.test.ts

@@ -55,7 +55,7 @@ function mockSecureFetchResponse(body: {
     statusText: '',
     headers: new Headers(),
     body: null,
-    text: async () => body.text ?? '',
+    text: async () => body.text ?? JSON.stringify(body.json ?? {}),
     json: async () => body.json ?? {},
     arrayBuffer: async () => new ArrayBuffer(0),
   }

apps/sim/app/api/tools/agiloft/attach/route.ts

@@ -99,7 +99,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       return NextResponse.json({ success: false, error: toError(error).message }, { status: 400 })
     }
 
-    const token = await agiloftLoginPinned(data, resolvedIP)
+    const session = await agiloftLoginPinned(data, resolvedIP)
     const base = data.instanceUrl.replace(/\/$/, '')
 
     try {
@@ -111,7 +111,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
         method: 'PUT',
         headers: {
           'Content-Type': 'application/octet-stream',
-          Authorization: `Bearer ${token}`,
+          Authorization: session.authorization,
         },
         body: new Uint8Array(fileBuffer),
       })
@@ -151,7 +151,12 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
         },
       })
     } finally {
-      await agiloftLogoutPinned(data.instanceUrl, data.knowledgeBase, token, resolvedIP)
+      await agiloftLogoutPinned(
+        data.instanceUrl,
+        data.knowledgeBase,
+        session.authorization,
+        resolvedIP
+      )
     }
   } catch (error) {
     logger.error(`[${requestId}] Error attaching file to Agiloft:`, error)

apps/sim/app/api/tools/agiloft/attachment_info/route.ts

@@ -8,7 +8,7 @@ import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import type { AgiloftAttachmentInfoResponse } from '@/tools/agiloft/types'
 import { buildAttachmentInfoUrl } from '@/tools/agiloft/utils'
-import { executeAgiloftRequest } from '@/tools/agiloft/utils.server'
+import { executeEwRequest } from '@/tools/agiloft/utils.server'
 
 export const dynamic = 'force-dynamic'
 
@@ -51,7 +51,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     if (!parsed.success) return parsed.response
     const params = parsed.data.body
 
-    const result = await executeAgiloftRequest<AgiloftAttachmentInfoResponse>(
+    const result = await executeEwRequest<AgiloftAttachmentInfoResponse>(
       params,
       (base) => ({
         url: buildAttachmentInfoUrl(base, params),

apps/sim/app/api/tools/agiloft/create_record/route.test.ts

@@ -12,33 +12,38 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 vi.mock('@/lib/core/security/input-validation.server', () => inputValidationMock)
 
 import { POST } from '@/app/api/tools/agiloft/create_record/route'
+import { POST as READ } from '@/app/api/tools/agiloft/read_record/route'
 import { POST as SEARCH } from '@/app/api/tools/agiloft/search_records/route'
-import { POST as SELECT } from '@/app/api/tools/agiloft/select_records/route'
 
 const PINNED_IP = '93.184.216.34'
 
 const baseBody = {
   instanceUrl: 'https://example.agiloft.com',
-  knowledgeBase: 'Demo',
-  login: 'admin',
-  password: 'secret',
-  table: 'contacts.employees',
-  data: JSON.stringify({ first_name: 'John', last_name: 'Doe' }),
+  knowledgeBase: 'Russell Investments',
+  login: 'svc.user',
+  password: 's3cr3t',
+  table: 'contract',
 }
 
-function mockSecureFetchResponse(body: { ok?: boolean; json?: unknown; text?: string }) {
+function res(body: { ok?: boolean; status?: number; json?: unknown; text?: string }) {
+  const text = body.text ?? JSON.stringify(body.json ?? {})
   return {
     ok: body.ok ?? true,
-    status: body.ok === false ? 400 : 200,
+    status: body.status ?? 200,
     statusText: '',
     headers: new Headers(),
     body: null,
-    text: async () => body.text ?? '',
-    json: async () => body.json ?? {},
+    text: async () => text,
+    json: async () => JSON.parse(text),
     arrayBuffer: async () => new ArrayBuffer(0),
   }
 }
 
+/** Login envelope Agiloft returns — note the trailing space on the scheme. */
+const LOGIN_OK = res({
+  json: { access_token: 'tok-123', authentication_scheme: 'Bearer ' },
+})
+
 beforeEach(() => {
   vi.clearAllMocks()
   hybridAuthMockFns.mockCheckInternalAuth.mockResolvedValue({
@@ -53,124 +58,149 @@ beforeEach(() => {
   })
 })
 
-describe('POST /api/tools/agiloft/create_record', () => {
-  it("reads the record ID out of EWCreate's EWREST_id assignment", async () => {
-    inputValidationMockFns.mockSecureFetchWithPinnedIP
-      .mockResolvedValueOnce(mockSecureFetchResponse({ json: { access_token: 'tok-c' } }))
-      .mockResolvedValueOnce(mockSecureFetchResponse({ text: "EWREST_id='353';" }))
-      .mockResolvedValueOnce(mockSecureFetchResponse({}))
-
-    const response = await POST(createMockRequest('POST', baseBody))
-    const data = (await response.json()) as {
-      success: boolean
-      output: { id: string | null }
-    }
-
-    expect(data.success).toBe(true)
-    expect(data.output.id).toBe('353')
+function arrange(operationResponse: ReturnType<typeof res>) {
+  inputValidationMockFns.mockSecureFetchWithPinnedIP
+    .mockResolvedValueOnce(LOGIN_OK)
+    .mockResolvedValueOnce(operationResponse)
+    .mockResolvedValueOnce(res({}))
+}
 
-    const operationCall = inputValidationMockFns.mockSecureFetchWithPinnedIP.mock.calls[1]
-    expect(operationCall[0]).toContain('/ewws/EWCreate?')
-    expect(operationCall[0]).toContain('&first_name=John')
-    expect(operationCall[2]).toMatchObject({ method: 'POST' })
+describe('EWLogin', () => {
+  it('sends $table and $lang alongside $KB in a form body, which the live server requires', async () => {
+    arrange(res({ json: { success: true, result: { id: 6342 } } }))
+
+    await POST(createMockRequest('POST', { ...baseBody, data: '{"a":"b"}' }))
+
+    const [url, ip, init] = inputValidationMockFns.mockSecureFetchWithPinnedIP.mock.calls[0]
+    expect(url).toBe('https://example.agiloft.com/ewws/EWLogin')
+    expect(ip).toBe(PINNED_IP)
+    expect(init.method).toBe('POST')
+    expect(init.headers['Content-Type']).toBe('application/x-www-form-urlencoded')
+
+    const sent = new URLSearchParams(init.body as string)
+    expect(sent.get('$KB')).toBe('Russell Investments')
+    expect(sent.get('$table')).toBe('contract')
+    expect(sent.get('$lang')).toBe('en')
+    expect(sent.get('$login')).toBe('svc.user')
+    expect(sent.get('$password')).toBe('s3cr3t')
+    // Credentials must not leak into the URL.
+    expect(url).not.toContain('s3cr3t')
   })
 
-  it('fails loudly when Agiloft answers 200 with something that is not an EWREST body', async () => {
-    inputValidationMockFns.mockSecureFetchWithPinnedIP
-      .mockResolvedValueOnce(mockSecureFetchResponse({ json: { access_token: 'tok-c' } }))
-      .mockResolvedValueOnce(
-        mockSecureFetchResponse({ text: 'Error executing query, please consult logs' })
-      )
-      .mockResolvedValueOnce(mockSecureFetchResponse({}))
+  it('trims the trailing space Agiloft puts on authentication_scheme', async () => {
+    arrange(res({ json: { success: true, result: { id: 6342 } } }))
 
-    const response = await POST(createMockRequest('POST', baseBody))
-    const data = (await response.json()) as { success: boolean; error?: string }
+    await POST(createMockRequest('POST', { ...baseBody, data: '{"a":"b"}' }))
 
-    expect(data.success).toBe(false)
-    expect(data.error).toContain('did not return a record ID')
+    const [, , init] = inputValidationMockFns.mockSecureFetchWithPinnedIP.mock.calls[1]
+    expect(init.headers.Authorization).toBe('Bearer tok-123')
   })
 
-  it('rejects a data payload that is not a JSON object', async () => {
-    const response = await POST(
-      createMockRequest('POST', { ...baseBody, data: '["not", "an", "object"]' })
+  it('surfaces the live "One has to specify" refusal instead of a generic failure', async () => {
+    inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValueOnce(
+      res({
+        ok: false,
+        status: 400,
+        text: '<html><body>EWWrongDataException has occurred: One has to specify $table, $KB, $lang parameters</body></html>',
+      })
     )
+
+    const response = await POST(createMockRequest('POST', { ...baseBody, data: '{"a":"b"}' }))
     const data = (await response.json()) as { success: boolean; error?: string }
 
     expect(data.success).toBe(false)
-    expect(data.error).toContain('must be a JSON object')
-    expect(inputValidationMockFns.mockSecureFetchWithPinnedIP).not.toHaveBeenCalled()
+    expect(data.error).toContain('One has to specify $table, $KB, $lang')
   })
 })
 
-describe('empty EWREST bodies on search and select', () => {
-  const listBase = {
-    instanceUrl: 'https://example.agiloft.com',
-    knowledgeBase: 'Demo',
-    login: 'admin',
-    password: 'secret',
-    table: 'helpdesk_case',
-  }
+describe('alrest envelope handling', () => {
+  it('targets /ewws/alrest/{KB} for record creation', async () => {
+    arrange(res({ json: { success: true, result: { id: 6342, contract_title1: 'X' } } }))
 
-  function arrange(text: string) {
-    inputValidationMockFns.mockSecureFetchWithPinnedIP
-      .mockResolvedValueOnce(mockSecureFetchResponse({ json: { access_token: 'tok' } }))
-      .mockResolvedValueOnce(mockSecureFetchResponse({ text }))
-      .mockResolvedValueOnce(mockSecureFetchResponse({}))
-  }
+    const response = await POST(
+      createMockRequest('POST', { ...baseBody, data: '{"contract_title1":"X"}' })
+    )
+    const data = (await response.json()) as { success: boolean; output: { id: string | null } }
 
-  it('treats a plain-text refusal from EWSearch as a failure, not an empty result', async () => {
-    arrange('Error executing query, please consult logs')
+    const [url] = inputValidationMockFns.mockSecureFetchWithPinnedIP.mock.calls[1]
+    expect(url).toBe(
+      'https://example.agiloft.com/ewws/alrest/Russell%20Investments/contract?lang=en'
+    )
+    expect(data.output.id).toBe('6342')
+  })
 
-    const response = await SEARCH(
-      createMockRequest('POST', { ...listBase, query: "priority='High'" })
+  it('treats HTTP 200 with success:false as a failure, not a successful create', async () => {
+    arrange(
+      res({
+        json: { success: false, errors: [{ message: 'Field contract_title1 is required' }] },
+      })
     )
+
+    const response = await POST(createMockRequest('POST', { ...baseBody, data: '{"a":"b"}' }))
     const data = (await response.json()) as { success: boolean; error?: string }
 
     expect(data.success).toBe(false)
-    expect(data.error).toContain('did not return search results')
+    expect(data.error).toContain('Field contract_title1 is required')
   })
+})
 
-  it('still reports a genuinely empty EWSearch result as a success', async () => {
-    arrange("EWREST_id_length = '0';")
+describe('field projection', () => {
+  it('reads through search when fields are named, so a 184KB record is not pulled whole', async () => {
+    arrange(res({ json: { success: true, result: [{ id: 6342, contract_title1: 'X' }] } }))
 
-    const response = await SEARCH(
-      createMockRequest('POST', { ...listBase, query: "priority='High'" })
+    await READ(
+      createMockRequest('POST', {
+        ...baseBody,
+        recordId: '6342',
+        fields: 'contract_title1, company_name',
+      })
     )
-    const data = (await response.json()) as {
-      success: boolean
-      output: { records: unknown[]; totalCount: number }
-    }
 
-    expect(data.success).toBe(true)
-    expect(data.output.records).toEqual([])
-    expect(data.output.totalCount).toBe(0)
+    const [url, , init] = inputValidationMockFns.mockSecureFetchWithPinnedIP.mock.calls[1]
+    expect(url).toContain('/contract/search?lang=en')
+    expect(JSON.parse(init.body as string)).toEqual({
+      field: ['id', 'contract_title1', 'company_name'],
+      query: 'id=6342',
+    })
   })
 
-  it('treats a plain-text refusal from EWSelect as a failure, not an empty result', async () => {
-    arrange('Error executing query, please consult logs')
+  it('fetches the record directly when no projection was asked for', async () => {
+    arrange(res({ json: { success: true, result: { id: 6342 } } }))
 
-    const response = await SELECT(
-      createMockRequest('POST', { ...listBase, where: "summary like '%new%'" })
-    )
-    const data = (await response.json()) as { success: boolean; error?: string }
+    await READ(createMockRequest('POST', { ...baseBody, recordId: '6342' }))
 
-    expect(data.success).toBe(false)
-    expect(data.error).toContain('did not return a result set')
+    const [url, , init] = inputValidationMockFns.mockSecureFetchWithPinnedIP.mock.calls[1]
+    expect(url).toContain('/contract/6342?lang=en')
+    expect(init.method).toBe('GET')
   })
+})
 
-  it('still reports a genuinely empty EWSelect result as a success', async () => {
-    arrange("EWREST_id_length = '0';")
+describe('optional inputs arriving as null', () => {
+  it('accepts a null page instead of rejecting the call before it is made', async () => {
+    arrange(res({ json: { success: true, result: [] } }))
 
-    const response = await SELECT(
-      createMockRequest('POST', { ...listBase, where: "summary like '%new%'" })
+    const response = await SEARCH(
+      createMockRequest('POST', {
+        ...baseBody,
+        query: "status='Active'",
+        page: null,
+        limit: null,
+        fields: null,
+        search: null,
+      })
     )
-    const data = (await response.json()) as {
-      success: boolean
-      output: { recordIds: string[]; totalCount: number }
-    }
+    const data = (await response.json()) as { success: boolean; error?: string }
 
     expect(data.success).toBe(true)
-    expect(data.output.recordIds).toEqual([])
-    expect(data.output.totalCount).toBe(0)
+    expect(data.error).toBeUndefined()
+  })
+
+  it('omits unset optional fields from the search body rather than sending null', async () => {
+    arrange(res({ json: { success: true, result: [] } }))
+
+    await SEARCH(createMockRequest('POST', { ...baseBody, query: "status='Active'", page: null }))
+
+    const [, , init] = inputValidationMockFns.mockSecureFetchWithPinnedIP.mock.calls[1]
+    expect(JSON.parse(init.body as string)).toEqual({ query: "status='Active'" })
   })
 })