fix(cbinsights): accept only plain decimal organization IDs

Number reads "0x10" as 16 and "1e2" as 100, so either notation resolved to a
real but unintended organization and the request spent credits on it. Both the
path-scoped and the bulk validators now require a plain run of digits, and use
Number.isSafeInteger so an ID past the precision limit cannot round to a
neighbouring one.

Author: waleedlatif1

apps/sim/tools/cbinsights/cbinsights.test.ts

@@ -313,6 +313,40 @@ describe('cbinsights request building', () => {
     })
   })
 
+  /*
+   * `Number` reads "0x10" as 16 and "1e2" as 100, so either notation would
+   * resolve to a real but unintended organization and bill for it. An ID field
+   * should only accept a plain run of digits.
+   */
+  it.each(['0x10', '1e2', '12.5', 'true', '', ' '])(
+    'rejects the alternate numeric notation %j in an ID list',
+    async (entry) => {
+      mockFetch([AUTH_OK])
+      await expect(
+        cbinsightsGetOrgOutlookTool.directExecution!({ ...CREDS, orgId: entry } as never)
+      ).rejects.toThrow(/"orgId" must be a positive integer/)
+    }
+  )
+
+  it('still accepts a plain decimal ID, with or without padding', async () => {
+    mockFetch([AUTH_OK, { body: {} }, { body: {} }])
+    await cbinsightsGetOrgOutlookTool.directExecution!({ ...CREDS, orgId: '  129410  ' } as never)
+    expect(calls[1].url).toContain('/organizations/129410/outlook')
+
+    await cbinsightsGetOrgOutlookTool.directExecution!({ ...CREDS, orgId: 129410 } as never)
+    expect(calls[2].url).toContain('/organizations/129410/outlook')
+  })
+
+  it('rejects an alternate numeric notation inside a bulk ID list', async () => {
+    mockFetch([AUTH_OK])
+    await expect(
+      cbinsightsListFundingsTool.directExecution!({
+        ...CREDS,
+        orgIds: '129410, 0x10',
+      } as never)
+    ).rejects.toThrow(/must contain only positive integers \(invalid: 0x10\)/)
+  })
+
   it('rejects a non-integer organization ID rather than interpolating it into the path', async () => {
     mockFetch([AUTH_OK])
     await expect(

apps/sim/tools/cbinsights/utils.ts

@@ -241,10 +241,33 @@ export async function cbInsightsRequest<T>(
   }
 }
 
+/**
+ * Accepts only a plain run of decimal digits.
+ *
+ * `Number` is far more permissive than an ID field should be: it reads `0x10`
+ * as 16 and `1e2` as 100, so a pasted value in either notation would resolve to
+ * a real but unintended organization and the request would spend credits on it.
+ */
+const DECIMAL_ID = /^\d+$/
+
+/** Coerces one entry to a positive integer ID, or returns null if it is not one. */
+function toOrgId(value: unknown): number | null {
+  if (typeof value === 'number') {
+    return Number.isInteger(value) && value > 0 ? value : null
+  }
+  if (typeof value !== 'string') return null
+
+  const trimmed = value.trim()
+  if (!DECIMAL_ID.test(trimmed)) return null
+
+  const parsed = Number(trimmed)
+  return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : null
+}
+
 /** Validates the organization ID a path-scoped endpoint interpolates. */
 export function requireOrgId(value: unknown): number {
-  const parsed = typeof value === 'number' ? value : Number(String(value ?? '').trim())
-  if (!Number.isInteger(parsed) || parsed <= 0) {
+  const parsed = toOrgId(value)
+  if (parsed === null) {
     throw new Error(
       `CB Insights "orgId" must be a positive integer (received "${String(value ?? '')}")`
     )
@@ -309,10 +332,9 @@ function toPositiveIntegers(entries: readonly unknown[], paramName: string): num
   const ids: number[] = []
 
   for (const entry of entries) {
-    const label = typeof entry === 'number' ? String(entry) : String(entry).trim()
-    const parsed = typeof entry === 'number' ? entry : Number(label)
-    if (!Number.isInteger(parsed) || parsed <= 0) {
-      invalid.push(label)
+    const parsed = toOrgId(entry)
+    if (parsed === null) {
+      invalid.push(typeof entry === 'string' ? entry.trim() : String(entry))
       continue
     }
     ids.push(parsed)