fix(rabbitmq): strip auth on redirect, require https, and bound the retrieval response

Author: waleedlatif1

apps/docs/content/docs/en/integrations/rabbitmq.mdx

@@ -34,6 +34,7 @@ Sim talks to RabbitMQ over its **Management HTTP API** — the same interface be
 **Before you start**
 
 - The **management plugin must be enabled and reachable** from Sim. It listens on port `15672` by default and is separate from the AMQP port (`5672`). Self-hosted brokers enable it with `rabbitmq-plugins enable rabbitmq_management`; managed providers expose it as a management or console URL.
+- The management URL **must use `https`** unless the broker is on a loopback host. Credentials travel on every request as HTTP basic auth, so plain `http` to a remote broker would put them on the wire in the clear — Sim rejects it rather than sending them.
 - The user you authenticate as needs the **`management` tag** at minimum, plus read and write permissions on the virtual host you target. Administrative operations require broader permissions.
 - Publishing and reading messages over the HTTP API is **convenient but not a high-throughput transport** — RabbitMQ opens a new connection per request. It is well suited to workflow-rate traffic, inspection, and operational automation; a service consuming thousands of messages per second should use an AMQP client instead.
 - Queue statistics such as message and consumer counts are **collected on an interval**, so a queue declared moments ago may report them as empty until the broker's next sample.
@@ -83,7 +84,7 @@ Retrieve messages from a RabbitMQ queue. Defaults to requeueing the messages so
 | `count` | number | No | Maximum number of messages to retrieve, from 1 to $\{MAX_MESSAGE_COUNT\}. Defaults to 1 |
 | `ackmode` | string | No | How retrieved messages are handled: ack_requeue_true \(default, leaves messages in the queue\), ack_requeue_false \(removes them\), reject_requeue_true, or reject_requeue_false |
 | `encoding` | string | No | auto \(default\) returns readable text where possible, base64 always returns base64 |
-| `truncate` | number | No | Truncate payloads longer than this many bytes. Defaults to $\{DEFAULT_TRUNCATE_BYTES\}; each message reports whether it was truncated |
+| `truncate` | number | No | Truncate payloads longer than this many bytes. Defaults to $\{DEFAULT_TRUNCATE_BYTES\} and is capped at $\{MAX_TRUNCATE_BYTES\}, and lowered further when a large count would push the response past the transport limit. Each message reports whether it was truncated |
 
 #### Output
 

apps/sim/blocks/blocks/rabbitmq.ts

@@ -157,7 +157,8 @@ export const RabbitmqBlock: BlockConfig<RabbitmqResponse> = {
       title: 'Management URL',
       type: 'short-input',
       placeholder: 'https://rabbit.example.com:15672',
-      description: 'Base URL of the RabbitMQ management plugin, including scheme and port',
+      description:
+        'Base URL of the RabbitMQ management plugin, including scheme and port. Must use https unless the broker is on a loopback host',
       required: true,
     },
     {

apps/sim/tools/generated/tool-metadata.ts

@@ -78,20 +78,21 @@ export const rabbitmqCreateBindingTool: ToolConfig<
   },
 
   request: {
-    url: (params) =>
-      buildManagementUrl(params, [
+    url: ({ host, vhost, destinationType, exchange, queue }) =>
+      buildManagementUrl(host, [
         'bindings',
-        resolveVhost(params),
+        resolveVhost(vhost),
         'e',
-        params.exchange,
-        params.destinationType === 'exchange' ? 'e' : 'q',
-        params.queue,
+        exchange,
+        destinationType === 'exchange' ? 'e' : 'q',
+        queue,
       ]),
     method: 'POST',
-    headers: (params) => buildAuthHeaders(params),
-    body: (params) => ({
-      routing_key: params.routingKey ?? '',
-      arguments: parseJsonObjectParam(params.arguments, 'arguments') ?? {},
+    headers: ({ username, password }) => buildAuthHeaders(username, password),
+    stripAuthOnRedirect: true,
+    body: ({ arguments: bindingArguments, routingKey }) => ({
+      routing_key: routingKey ?? '',
+      arguments: parseJsonObjectParam(bindingArguments, 'arguments') ?? {},
     }),
   },
 

apps/sim/tools/rabbitmq/create_binding.ts

@@ -68,22 +68,23 @@ export const rabbitmqCreateExchangeTool: ToolConfig<
   },
 
   request: {
-    url: (params) =>
-      buildManagementUrl(params, ['exchanges', resolveVhost(params), params.exchange]),
+    url: ({ host, vhost, exchange }) =>
+      buildManagementUrl(host, ['exchanges', resolveVhost(vhost), exchange]),
     method: 'PUT',
-    headers: (params) => buildAuthHeaders(params),
-    body: (params) => ({
-      type: EXCHANGE_TYPES.has(params.exchangeType ?? '') ? params.exchangeType : 'direct',
-      durable: params.durable !== false,
-      auto_delete: params.autoDelete === true,
-      internal: params.internal === true,
-      arguments: parseJsonObjectParam(params.arguments, 'arguments') ?? {},
+    headers: ({ username, password }) => buildAuthHeaders(username, password),
+    stripAuthOnRedirect: true,
+    body: ({ arguments: exchangeArguments, autoDelete, durable, exchangeType, internal }) => ({
+      type: EXCHANGE_TYPES.has(exchangeType ?? '') ? exchangeType : 'direct',
+      durable: durable !== false,
+      auto_delete: autoDelete === true,
+      internal: internal === true,
+      arguments: parseJsonObjectParam(exchangeArguments, 'arguments') ?? {},
     }),
   },
 
   transformResponse: async (response, params) => {
     const exchangeName = params?.exchange ?? ''
-    const vhost = params ? resolveVhost(params) : ''
+    const vhost = params ? resolveVhost(params.vhost) : ''
 
     if (!response.ok) {
       const error = await extractErrorMessage(response)

apps/sim/tools/rabbitmq/create_exchange.ts

@@ -70,21 +70,22 @@ export const rabbitmqCreatePolicyTool: ToolConfig<
   },
 
   request: {
-    url: (params) =>
-      buildManagementUrl(params, ['policies', resolveVhost(params), params.policyName]),
+    url: ({ host, vhost, policyName }) =>
+      buildManagementUrl(host, ['policies', resolveVhost(vhost), policyName]),
     method: 'PUT',
-    headers: (params) => buildAuthHeaders(params),
-    body: (params) => ({
-      pattern: params.pattern,
-      definition: parseJsonObjectParam(params.definition, 'definition') ?? {},
-      priority: params.priority ?? 0,
-      'apply-to': APPLY_TO.has(params.applyTo ?? '') ? params.applyTo : 'queues',
+    headers: ({ username, password }) => buildAuthHeaders(username, password),
+    stripAuthOnRedirect: true,
+    body: ({ applyTo, definition, pattern, priority }) => ({
+      pattern: pattern,
+      definition: parseJsonObjectParam(definition, 'definition') ?? {},
+      priority: priority ?? 0,
+      'apply-to': APPLY_TO.has(applyTo ?? '') ? applyTo : 'queues',
     }),
   },
 
   transformResponse: async (response, params) => {
     const policyName = params?.policyName ?? ''
-    const vhost = params ? resolveVhost(params) : ''
+    const vhost = params ? resolveVhost(params.vhost) : ''
 
     if (!response.ok) {
       const error = await extractErrorMessage(response)

apps/sim/tools/rabbitmq/create_policy.ts

@@ -49,19 +49,21 @@ export const rabbitmqCreateQueueTool: ToolConfig<
   },
 
   request: {
-    url: (params) => buildManagementUrl(params, ['queues', resolveVhost(params), params.queue]),
+    url: ({ host, vhost, queue }) =>
+      buildManagementUrl(host, ['queues', resolveVhost(vhost), queue]),
     method: 'PUT',
-    headers: (params) => buildAuthHeaders(params),
-    body: (params) => ({
-      durable: params.durable !== false,
-      auto_delete: params.autoDelete === true,
-      arguments: parseJsonObjectParam(params.arguments, 'arguments') ?? {},
+    headers: ({ username, password }) => buildAuthHeaders(username, password),
+    stripAuthOnRedirect: true,
+    body: ({ arguments: queueArguments, autoDelete, durable }) => ({
+      durable: durable !== false,
+      auto_delete: autoDelete === true,
+      arguments: parseJsonObjectParam(queueArguments, 'arguments') ?? {},
     }),
   },
 
   transformResponse: async (response, params) => {
     const queueName = params?.queue ?? ''
-    const vhost = params ? resolveVhost(params) : ''
+    const vhost = params ? resolveVhost(params.vhost) : ''
 
     if (!response.ok) {
       const error = await extractErrorMessage(response)

apps/sim/tools/rabbitmq/create_queue.ts

@@ -51,18 +51,19 @@ export const rabbitmqDeleteBindingTool: ToolConfig<
   },
 
   request: {
-    url: (params) =>
-      buildManagementUrl(params, [
+    url: ({ host, vhost, destination, destinationType, exchange, propertiesKey }) =>
+      buildManagementUrl(host, [
         'bindings',
-        resolveVhost(params),
+        resolveVhost(vhost),
         'e',
-        params.exchange,
-        params.destinationType === 'exchange' ? 'e' : 'q',
-        params.destination,
-        params.propertiesKey,
+        exchange,
+        destinationType === 'exchange' ? 'e' : 'q',
+        destination,
+        propertiesKey,
       ]),
     method: 'DELETE',
-    headers: (params) => buildAuthHeaders(params),
+    headers: ({ username, password }) => buildAuthHeaders(username, password),
+    stripAuthOnRedirect: true,
   },
 
   transformResponse: async (response, params) => {

apps/sim/tools/rabbitmq/delete_binding.ts

@@ -38,17 +38,18 @@ export const rabbitmqDeleteExchangeTool: ToolConfig<
   },
 
   request: {
-    url: (params) =>
-      buildManagementUrl(params, ['exchanges', resolveVhost(params), params.exchange], {
-        'if-unused': params.ifUnused ? 'true' : undefined,
+    url: ({ host, vhost, exchange, ifUnused }) =>
+      buildManagementUrl(host, ['exchanges', resolveVhost(vhost), exchange], {
+        'if-unused': ifUnused ? 'true' : undefined,
       }),
     method: 'DELETE',
-    headers: (params) => buildAuthHeaders(params),
+    headers: ({ username, password }) => buildAuthHeaders(username, password),
+    stripAuthOnRedirect: true,
   },
 
   transformResponse: async (response, params) => {
     const exchangeName = params?.exchange ?? ''
-    const vhost = params ? resolveVhost(params) : ''
+    const vhost = params ? resolveVhost(params.vhost) : ''
 
     if (!response.ok) {
       const error = await extractErrorMessage(response)

apps/sim/tools/rabbitmq/delete_exchange.ts

@@ -32,15 +32,16 @@ export const rabbitmqDeletePolicyTool: ToolConfig<
   },
 
   request: {
-    url: (params) =>
-      buildManagementUrl(params, ['policies', resolveVhost(params), params.policyName]),
+    url: ({ host, vhost, policyName }) =>
+      buildManagementUrl(host, ['policies', resolveVhost(vhost), policyName]),
     method: 'DELETE',
-    headers: (params) => buildAuthHeaders(params),
+    headers: ({ username, password }) => buildAuthHeaders(username, password),
+    stripAuthOnRedirect: true,
   },
 
   transformResponse: async (response, params) => {
     const policyName = params?.policyName ?? ''
-    const vhost = params ? resolveVhost(params) : ''
+    const vhost = params ? resolveVhost(params.vhost) : ''
 
     if (!response.ok) {
       const error = await extractErrorMessage(response)