fix: harden Oracle Fusion response handling

Author: Bill Leoutsakos

apps/sim/lib/internal/oracle-fusion-financials/client.ts

@@ -6,6 +6,7 @@ import {
   secureFetchWithPinnedIP,
   validateUrlWithDNS,
 } from '@/lib/core/security/input-validation.server'
+import { redactExactSensitiveValues } from '@/lib/core/security/redaction'
 import { consumeOrCancelBody } from '@/lib/core/utils/stream-limits'
 import { normalizeOracleFusionApplicationOrigin } from '@/lib/credentials/client-credential-accounts/descriptors'
 import type { OracleFusionAuthInput } from '@/lib/internal/oracle-fusion-financials/schema'
@@ -55,7 +56,7 @@ function sanitizeOracleError(body: string, accessToken: string, status: number):
     // Non-JSON proxy pages are intentionally not reflected to tool callers.
   }
   const unique = [...new Set(messages)]
-  const safe = truncate(unique.join(' — ').replaceAll(accessToken, '[REDACTED]'), 1_000)
+  const safe = truncate(redactExactSensitiveValues(unique.join(' — '), [accessToken]), 1_000)
   return safe || `Oracle Fusion Financials request failed with HTTP ${status}`
 }
 

apps/sim/lib/internal/oracle-fusion-financials/oracle-fusion-financials.test.ts

@@ -305,23 +305,33 @@ describe('Oracle Fusion Financials provider', () => {
   })
 
   it('stops after two retries and surfaces a sanitized Oracle error', async () => {
+    const accessToken = 'short/lived+access~token='
+    const encodedAccessToken = encodeURIComponent(accessToken)
+    const formEncodedAccessToken = new URLSearchParams({ value: accessToken })
+      .toString()
+      .slice('value='.length)
     mockSecureFetch
       .mockResolvedValueOnce(response(504, { title: 'gateway timeout' }))
       .mockResolvedValueOnce(response(503, { title: 'unavailable' }))
       .mockResolvedValueOnce(
         response(429, {
-          title: `Token ${AUTH.accessToken}`,
-          detail: 'Request temporarily throttled',
+          title: `Token ${encodedAccessToken}`,
+          detail: `Token ${formEncodedAccessToken}`,
+          message: 'access_token=provider-detail-canary&scope=read',
         })
       )
 
-    const error = await requestOracleFusionJson(AUTH, {
-      path: '/fscmRestApi/resources/11.13.18.05/invoices',
-    }).catch((caught) => caught)
+    const error = await requestOracleFusionJson(
+      { ...AUTH, accessToken },
+      { path: '/fscmRestApi/resources/11.13.18.05/invoices' }
+    ).catch((caught) => caught)
     expect(error).toBeInstanceOf(OracleFusionFinancialsProviderError)
     expect(error).toMatchObject({ status: 429 })
     expect((error as Error).message).toContain('[REDACTED]')
-    expect((error as Error).message).not.toContain(AUTH.accessToken)
+    expect((error as Error).message).not.toContain(accessToken)
+    expect((error as Error).message).not.toContain(encodedAccessToken)
+    expect((error as Error).message).not.toContain(formEncodedAccessToken)
+    expect((error as Error).message).not.toContain('provider-detail-canary')
     expect(mockSecureFetch).toHaveBeenCalledTimes(3)
   })
 
@@ -353,6 +363,7 @@ describe('Oracle Fusion Financials provider', () => {
 
   it('rejects malformed Oracle list envelopes and projected field types', async () => {
     mockSecureFetch
+      .mockResolvedValueOnce(response(200, { count: 0, hasMore: false, limit: 50, offset: 0 }))
       .mockResolvedValueOnce(
         response(200, { items: [], count: '0', hasMore: false, limit: 50, offset: 0 })
       )
@@ -361,6 +372,16 @@ describe('Oracle Fusion Financials provider', () => {
       )
       .mockResolvedValueOnce(response(200, page([{ CheckId: 'not-a-number' }])))
 
+    await expect(
+      executeOracleFusionFinancialsOperation(
+        'oracle_fusion_financials_list_payables_payments',
+        AUTH
+      )
+    ).rejects.toMatchObject({
+      name: 'OracleFusionFinancialsProviderError',
+      status: 502,
+      message: 'Oracle Fusion Financials returned an unexpected response shape',
+    })
     await expect(
       executeOracleFusionFinancialsOperation(
         'oracle_fusion_financials_list_payables_payments',

apps/sim/lib/internal/oracle-fusion-financials/schema.ts

@@ -203,7 +203,7 @@ export const oracleFusionPaymentSchema = z
 
 export const oracleFusionListEnvelopeSchema = z
   .object({
-    items: z.array(z.unknown()).max(100).default([]),
+    items: z.array(z.unknown()).max(100),
     count: z.number().int().nonnegative().max(100),
     hasMore: z.boolean(),
     limit: z.number().int().positive().max(100),

apps/sim/lib/selectors/server/providers/oracle-fusion-financials.test.ts

@@ -211,9 +211,15 @@ describe('Oracle Fusion Financials invoice selector', () => {
     mocks.request.mockRejectedValue(
       new OracleFusionFinancialsProviderError('provider-secret-canary', 401)
     )
-    await expect(attachment.execute(args({ kind: 'list' }), prepared())).rejects.toEqual(
-      expect.objectContaining({ name: 'SelectorConnectionUnavailableError' })
-    )
+    const authenticationError = await attachment
+      .execute(args({ kind: 'list' }), prepared())
+      .catch((error) => error)
+    expect(authenticationError).toMatchObject({
+      name: 'SelectorConnectionUnavailableError',
+      message: 'Connection unavailable',
+      status: 401,
+    })
+    expect((authenticationError as Error).message).not.toContain('provider-secret-canary')
 
     mocks.request.mockRejectedValue(
       new OracleFusionFinancialsProviderError('provider-secret-canary', 404)