fix(agiloft): cap search results against unverified alrest pagination

Whether alrest honours page/limit in the request body is unverified — those
names carry over from the legacy EWSearch query string, and neither the
customer's working tool nor any known client sends them. If the server ignores
them a broad query returns the whole table at roughly 184KB per contract
record, so the result is bounded here instead of trusting the server.

Author: waleedlatif1

apps/sim/app/api/tools/agiloft/create_record/route.test.ts

@@ -204,3 +204,26 @@ describe('optional inputs arriving as null', () => {
     expect(JSON.parse(init.body as string)).toEqual({ query: "status='Active'" })
   })
 })
+
+describe('search result ceiling', () => {
+  it('caps the returned records, since alrest honouring limit is unverified', async () => {
+    arrange(
+      res({
+        json: {
+          success: true,
+          result: Array.from({ length: 250 }, (_, i) => ({ id: i })),
+        },
+      })
+    )
+
+    const response = await SEARCH(
+      createMockRequest('POST', { ...baseBody, query: "status='Active'" })
+    )
+    const data = (await response.json()) as {
+      output: { records: unknown[]; totalCount: number }
+    }
+
+    expect(data.output.records).toHaveLength(200)
+    expect(data.output.totalCount).toBe(200)
+  })
+})

apps/sim/app/api/tools/agiloft/search_records/route.ts

@@ -8,7 +8,7 @@ import { checkInternalAuth } from '@/lib/auth/hybrid'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import type { AgiloftSearchResponse } from '@/tools/agiloft/types'
-import { alrestSearchUrl, parseFieldList } from '@/tools/agiloft/utils'
+import { AGILOFT_MAX_SEARCH_RECORDS, alrestSearchUrl, parseFieldList } from '@/tools/agiloft/utils'
 import { executeAlrestRequest, readAlrestJson } from '@/tools/agiloft/utils.server'
 
 export const dynamic = 'force-dynamic'
@@ -70,7 +70,15 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
         ),
       }),
       async (response) => {
-        const records = (await readAlrestJson<Record<string, unknown>[]>(response)) ?? []
+        const returned = (await readAlrestJson<Record<string, unknown>[]>(response)) ?? []
+        const records = returned.slice(0, AGILOFT_MAX_SEARCH_RECORDS)
+
+        if (returned.length > records.length) {
+          logger.warn(
+            `[${requestId}] Agiloft search returned ${returned.length} records; truncated to ${AGILOFT_MAX_SEARCH_RECORDS}`,
+            { table: params.table }
+          )
+        }
 
         return {
           success: true,

apps/sim/blocks/blocks/agiloft.ts

@@ -497,7 +497,7 @@ export const AgiloftBlock: BlockConfig = {
     totalCount: {
       type: 'number',
       description:
-        'Number of matching results. For a paginated search this counts the current page only',
+        'Number of records returned by this call, capped at 200 — not a total match count',
       condition: {
         field: 'operation',
         value: ['search_records', 'select_records', 'attachment_info'],

apps/sim/tools/agiloft/utils.ts

@@ -56,6 +56,17 @@ export function alrestRetrieveAttachUrl(base: string, table: string): string {
   return `${base}/${tableSegment(table)}/retrieveAttach?lang=${AGILOFT_LANG}`
 }
 
+/**
+ * Hard ceiling on records returned from a search.
+ *
+ * Whether alrest honours `page`/`limit` in the request body is unverified — the
+ * names carry over from the legacy EWSearch query string. If it ignores them a
+ * broad query returns the whole table, and an unfiltered contract record runs
+ * to roughly 184 KB, so the result is capped here rather than trusting the
+ * server to bound it.
+ */
+export const AGILOFT_MAX_SEARCH_RECORDS = 200
+
 /**
  * Splits a comma-separated field list into the `field` array alrest search
  * accepts. Field selection is the only way to keep a response small — a single