fix(selectors): restore migration parity and egress guarantees

Author: Bill Leoutsakos

apps/sim/app/api/selectors/execute/route.test.ts

@@ -110,7 +110,9 @@ describe('POST /api/selectors/execute', () => {
   it.each([
     [new SelectorContextUnavailableError(), 400, 'Context unavailable'],
     [new SelectorConnectionUnavailableError(), 403, 'Connection unavailable'],
+    [new SelectorConnectionUnavailableError(401), 401, 'Connection unavailable'],
     [new SelectorOptionsUnavailableError(), 502, 'Options unavailable'],
+    [new SelectorOptionsUnavailableError(429), 429, 'Options temporarily unavailable'],
   ])('preserves selector error projection for %s', (error, status, message) => {
     expect(project(error)).toEqual({
       status,

apps/sim/app/api/selectors/execute/route.ts

@@ -28,10 +28,18 @@ const selectorOperationErrorPolicy = extendInternalErrorPolicy(
       return internalErrorResponse(400, { error: 'Context unavailable' }, PRIVATE_NO_STORE)
     }
     if (error instanceof SelectorConnectionUnavailableError) {
-      return internalErrorResponse(403, { error: 'Connection unavailable' }, PRIVATE_NO_STORE)
+      return internalErrorResponse(
+        error.status,
+        { error: 'Connection unavailable' },
+        PRIVATE_NO_STORE
+      )
     }
     if (error instanceof SelectorOptionsUnavailableError) {
-      return internalErrorResponse(502, { error: 'Options unavailable' }, PRIVATE_NO_STORE)
+      return internalErrorResponse(
+        error.status,
+        { error: error.status === 429 ? 'Options temporarily unavailable' : 'Options unavailable' },
+        PRIVATE_NO_STORE
+      )
     }
     return null
   }
@@ -67,7 +75,7 @@ export const POST = defineInternalJsonRoute({
   }),
   errorPolicy: selectorErrorPolicy,
   parseOptions: { maxBodyBytes: 256 * 1024 },
-  mapInput: ({ body }, { request }) => ({ ...body, signal: request.signal }),
+  mapInput: ({ body }, { request }) => ({ ...body, signal: request.signal, auditRequest: request }),
   useCase: executeSelector,
   staticResponseHeaders: PRIVATE_NO_STORE,
 })

apps/sim/app/api/tools/managed-agent/list/route.ts

@@ -22,7 +22,6 @@ export * from './execution-payloads'
 export * from './folders'
 export * from './hotspots'
 export * from './inbox'
-export * from './managed-agents'
 export * from './media'
 export * from './permission-groups'
 export * from './pinned-items'

apps/sim/lib/api/contracts/index.ts

@@ -163,6 +163,25 @@ describe('authorizeCredentialUse', () => {
       expect(result.resolvedCredentialId).toBe(ACCOUNT_ID)
     })
 
+    it('pins a legacy account id to the explicitly authorized workspace', async () => {
+      const targetWorkspace = 'ws-2'
+      const targetRow = { id: 'cred-2', workspaceId: targetWorkspace, type: 'oauth' }
+      queueTableRows(credential, [])
+      queueTableRows(credential, [targetRow])
+      queueActorContext(targetRow)
+      queueTokenIdentity(null, OWNER)
+      mockResolveWorkspaceAccess.mockResolvedValue(workspaceAdmin)
+
+      const result = await authorizeCredentialUseForAuth(
+        { success: true, userId: 'acting-user', authType: 'session' },
+        { credentialId: ACCOUNT_ID, workspaceId: targetWorkspace }
+      )
+
+      expect(result.ok).toBe(true)
+      expect(result.workspaceId).toBe(targetWorkspace)
+      expect(result.resolvedCredentialId).toBe(ACCOUNT_ID)
+    })
+
     it('rejects when no workspace credential is reachable by the caller', async () => {
       queueTableRows(credential, [])
       queueTableRows(credential, [sharedRow])

apps/sim/lib/api/contracts/managed-agents.ts

@@ -55,6 +55,7 @@ export async function authorizeCredentialUse(
   params: {
     credentialId: string
     workflowId?: string
+    workspaceId?: string
     requireWorkflowIdForInternal?: boolean
     callerUserId?: string
   }
@@ -75,10 +76,11 @@ export async function authorizeCredentialUseForAuth(
   params: {
     credentialId: string
     workflowId?: string
+    workspaceId?: string
     callerUserId?: string
   }
 ): Promise<CredentialAccessResult> {
-  const { credentialId, workflowId, callerUserId } = params
+  const { credentialId, workflowId, workspaceId, callerUserId } = params
 
   if (!auth.success || !auth.userId) {
     return { ok: false, error: auth.error || 'Authentication required' }
@@ -112,7 +114,11 @@ export async function authorizeCredentialUseForAuth(
     return { ok: false, error: 'Workflow not found' }
   }
 
-  const scopeWorkspaceId = workflowContext?.workspaceId ?? null
+  if (workflowContext?.workspaceId && workspaceId && workflowContext.workspaceId !== workspaceId) {
+    return { ok: false, error: 'Credential is not accessible from this workspace' }
+  }
+
+  const scopeWorkspaceId = workflowContext?.workspaceId ?? workspaceId ?? null
   const platformCredential = platformAccess.credential
 
   if (platformCredential) {

apps/sim/lib/auth/credential-access.test.ts

@@ -3,7 +3,14 @@
  */
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockResolve } = vi.hoisted(() => ({ mockResolve: vi.fn() }))
+const { mockResolve, mockWarn } = vi.hoisted(() => ({
+  mockResolve: vi.fn(),
+  mockWarn: vi.fn(),
+}))
+
+vi.mock('@sim/logger', () => ({
+  createLogger: () => ({ warn: mockWarn }),
+}))
 
 vi.mock('@sim/security/dns', () => ({
   resolveHostAddresses: mockResolve,
@@ -96,4 +103,15 @@ describe('validateUrlWithDNS address classification', () => {
 
     expect((await validateUrlWithDNS('https://missing.example/api')).isValid).toBe(false)
   })
+
+  it('can conceal credential-derived host details in validation logs', async () => {
+    mockResolve.mockRejectedValue(new Error('DNS failure with credential-host-canary'))
+
+    await validateUrlWithDNS('https://credential-host-canary.example/api', 'url', {
+      logDetails: false,
+    })
+
+    expect(mockWarn).toHaveBeenCalledWith('DNS lookup failed for URL', { paramName: 'url' })
+    expect(JSON.stringify(mockWarn.mock.calls)).not.toContain('credential-host-canary')
+  })
 })

apps/sim/lib/auth/credential-access.ts

@@ -49,9 +49,9 @@ export interface AsyncValidationResult extends ValidationResult {
 export async function validateUrlWithDNS(
   url: string | null | undefined,
   paramName = 'url',
-  options: { allowHttp?: boolean } = {}
+  options: { allowHttp?: boolean; logDetails?: boolean } = {}
 ): Promise<AsyncValidationResult> {
-  const basicValidation = validateExternalUrl(url, paramName, options)
+  const basicValidation = validateExternalUrl(url, paramName, { allowHttp: options.allowHttp })
   if (!basicValidation.isValid) {
     return basicValidation
   }
@@ -77,11 +77,16 @@ export async function validateUrlWithDNS(
     )
 
     if (usable.length === 0) {
-      logger.warn('URL resolves to blocked IP address', {
-        paramName,
-        hostname,
-        resolvedIP: addresses.find((address) => isPrivateIp(address)),
-      })
+      logger.warn(
+        'URL resolves to blocked IP address',
+        options.logDetails === false
+          ? { paramName }
+          : {
+              paramName,
+              hostname,
+              resolvedIP: addresses.find((address) => isPrivateIp(address)),
+            }
+      )
       return {
         isValid: false,
         error: `${paramName} resolves to a blocked IP address`,
@@ -96,11 +101,12 @@ export async function validateUrlWithDNS(
       originalHostname: hostname,
     }
   } catch (error) {
-    logger.warn('DNS lookup failed for URL', {
-      paramName,
-      hostname,
-      error: toError(error).message,
-    })
+    logger.warn(
+      'DNS lookup failed for URL',
+      options.logDetails === false
+        ? { paramName }
+        : { paramName, hostname, error: toError(error).message }
+    )
     return {
       isValid: false,
       error: `${paramName} hostname could not be resolved`,
@@ -383,6 +389,8 @@ export interface SecureFetchOptions {
    * bypassed (the proxy resolves the target).
    */
   proxyUrl?: string
+  /** Hide credential-derived URL details from validation logs. */
+  logUrlValidationDetails?: boolean
 }
 
 export class SecureFetchHeaders {
@@ -1317,6 +1325,7 @@ export async function secureFetchWithValidation(
 ): Promise<SecureFetchResponse> {
   const validation = await validateUrlWithDNS(url, paramName, {
     allowHttp: options.allowHttp,
+    logDetails: options.logUrlValidationDetails,
   })
   if (!validation.isValid) {
     throw new Error(validation.error)