fix(agiloft): stop sending a bearer token to EWAttach

EWAttach lives on the legacy surface, which authenticates from inline
$login/$password and rejects a bearer token — the same pairing that made the
record operations fail. The attach route was still logging in and sending
Authorization, while its URL builder was the one EW* builder that never
included credentials, so the call had no usable auth at all.

It now builds the URL through the shared EW* query prefix and issues a single
request with no login/logout pair, matching every other legacy operation.

Author: waleedlatif1

apps/sim/app/api/tools/agiloft/attach/route.test.ts

@@ -109,11 +109,10 @@ describe('POST /api/tools/agiloft/attach', () => {
     expect(inputValidationMockFns.mockSecureFetchWithPinnedIP).not.toHaveBeenCalled()
   })
 
-  it('pins the resolved IP for login, attach, and logout (TOCTOU fix)', async () => {
-    inputValidationMockFns.mockSecureFetchWithPinnedIP
-      .mockResolvedValueOnce(mockSecureFetchResponse({ json: { access_token: 'tok-att' } }))
-      .mockResolvedValueOnce(mockSecureFetchResponse({ text: '1' }))
-      .mockResolvedValueOnce(mockSecureFetchResponse({}))
+  it('attaches with inline credentials on the pinned IP, with no login round trip', async () => {
+    inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValueOnce(
+      mockSecureFetchResponse({ text: '1' })
+    )
 
     const response = await POST(createMockRequest('POST', baseBody))
     expect(response.status).toBe(200)
@@ -125,21 +124,17 @@ describe('POST /api/tools/agiloft/attach', () => {
     expect(data.output.fileName).toBe('file.txt')
 
     const calls = inputValidationMockFns.mockSecureFetchWithPinnedIP.mock.calls
-    expect(calls).toHaveLength(3)
-    for (const call of calls) {
-      expect(call[1]).toBe(PINNED_IP)
-    }
+    expect(calls).toHaveLength(1)
+    expect(calls[0][1]).toBe(PINNED_IP)
 
-    expect(calls[0][0]).toContain('https://example.agiloft.com/ewws/EWLogin')
-    expect(calls[1][0]).toContain('https://example.agiloft.com/ewws/EWAttach')
-    expect(calls[1][2]).toMatchObject({
+    expect(calls[0][0]).toContain('https://example.agiloft.com/ewws/EWAttach')
+    expect(calls[0][0]).toContain('&$login=admin')
+    expect(calls[0][2]).toMatchObject({
       method: 'PUT',
-      headers: {
-        Authorization: 'Bearer tok-att',
-        'Content-Type': 'application/octet-stream',
-      },
+      headers: { 'Content-Type': 'application/octet-stream' },
     })
-    expect(calls[2][0]).toContain('https://example.agiloft.com/ewws/EWLogout')
+    // A bearer token on this surface is rejected; it must not be sent.
+    expect(calls[0][2].headers.Authorization).toBeUndefined()
 
     // DNS only resolved once.
     expect(inputValidationMockFns.mockValidateUrlWithDNS).toHaveBeenCalledTimes(1)

apps/sim/app/api/tools/agiloft/attach/route.ts

@@ -13,11 +13,7 @@ import { downloadServableFileFromStorage } from '@/lib/uploads/utils/file-utils.
 import { docNotReadyResponse } from '@/lib/uploads/utils/servable-file-response'
 import { assertToolFileAccess } from '@/app/api/files/authorization'
 import { buildAttachFileUrl } from '@/tools/agiloft/utils'
-import {
-  agiloftLoginPinned,
-  agiloftLogoutPinned,
-  resolveAgiloftInstance,
-} from '@/tools/agiloft/utils.server'
+import { resolveAgiloftInstance } from '@/tools/agiloft/utils.server'
 
 export const dynamic = 'force-dynamic'
 
@@ -99,10 +95,14 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       return NextResponse.json({ success: false, error: toError(error).message }, { status: 400 })
     }
 
-    const session = await agiloftLoginPinned(data, resolvedIP)
     const base = data.instanceUrl.replace(/\/$/, '')
 
-    try {
+    {
+      /**
+       * EWAttach lives on the legacy surface, which authenticates from the
+       * inline credentials in the URL and rejects a bearer token — so there is
+       * no login/logout pair here.
+       */
       const url = buildAttachFileUrl(base, data, resolvedFileName)
 
       logger.info(`[${requestId}] Uploading file to Agiloft: ${resolvedFileName}`)
@@ -111,7 +111,6 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
         method: 'PUT',
         headers: {
           'Content-Type': 'application/octet-stream',
-          Authorization: session.authorization,
         },
         body: new Uint8Array(fileBuffer),
       })
@@ -150,13 +149,6 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
           totalAttachments,
         },
       })
-    } finally {
-      await agiloftLogoutPinned(
-        data.instanceUrl,
-        data.knowledgeBase,
-        session.authorization,
-        resolvedIP
-      )
     }
   } catch (error) {
     logger.error(`[${requestId}] Error attaching file to Agiloft:`, error)

apps/sim/tools/agiloft/utils.ts

@@ -138,16 +138,20 @@ export function buildLockRecordUrl(base: string, params: AgiloftLockRecordParams
   return url
 }
 
+/**
+ * EWAttach carries the file as the raw request body, so its credentials have to
+ * travel in the query string like the rest of the EW* surface — there is no
+ * room for a form-encoded credential body here.
+ */
 export function buildAttachFileUrl(
   base: string,
   params: AgiloftBaseParams & { recordId: string; fieldName: string },
   fileName: string
 ): string {
-  const { kb, table } = encodeTable(params)
   const recordId = encodeURIComponent(params.recordId.trim())
   const fieldName = encodeURIComponent(params.fieldName.trim())
   const encodedFileName = encodeURIComponent(fileName)
-  return `${base}/ewws/EWAttach?$KB=${kb}&$table=${table}&$lang=${AGILOFT_LANG}&id=${recordId}&field=${fieldName}&fileName=${encodedFileName}`
+  return `${base}/ewws/EWAttach?${buildEwBaseQuery(params)}&id=${recordId}&field=${fieldName}&fileName=${encodedFileName}`
 }
 
 export function buildGetChoiceLineIdUrl(