improvement(network): consolidate outbound HTTP helpers

Author: waleedlatif1

apps/sim/connectors/fireflies/fireflies.ts

@@ -1,7 +1,7 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
 import { z } from 'zod'
-import { outboundFetch } from '@/lib/core/network/fetch.server'
+import { outboundFetch } from '@/lib/core/security/input-validation.server'
 import { isPayloadSizeLimitError, readResponseTextWithLimit } from '@/lib/core/utils/stream-limits'
 import {
   isRetryableError,

apps/sim/connectors/github/request.ts

@@ -1,12 +1,12 @@
 import { createHash } from 'node:crypto'
 import { createLogger } from '@sim/logger'
-import { outboundFetch } from '@/lib/core/network/fetch.server'
 import { acquireProviderCapacity } from '@/lib/core/rate-limiter/provider-capacity'
 import {
   type ProviderCapacityDeferralReason,
   ProviderCapacityDeferredError,
 } from '@/lib/core/rate-limiter/provider-capacity-error'
 import type { ProviderCapacityQuota } from '@/lib/core/rate-limiter/provider-capacity-state'
+import { outboundFetch } from '@/lib/core/security/input-validation.server'
 import { readResponseTextWithLimit } from '@/lib/core/utils/stream-limits'
 import {
   fetchWithRetry,

apps/sim/connectors/google-drive/google-drive-errors.ts

@@ -1,4 +1,4 @@
-import { outboundFetch } from '@/lib/core/network/fetch.server'
+import { outboundFetch } from '@/lib/core/security/input-validation.server'
 import {
   attachRetryHeaders,
   isRetryableError,

apps/sim/lib/atlassian/discovery.ts

@@ -1,7 +1,7 @@
 import { sha256Hex } from '@sim/security/hash'
 import { parseRetryAfter } from '@sim/utils/retry'
 import { LRUCache } from 'lru-cache'
-import { outboundFetch } from '@/lib/core/network/fetch.server'
+import { outboundFetch } from '@/lib/core/security/input-validation.server'
 import {
   type HTTPError,
   isRetryableError,

apps/sim/lib/core/network/fetch.server.ts

@@ -12,7 +12,11 @@ import { toError } from '@sim/utils/errors'
 import { HttpProxyAgent } from 'http-proxy-agent'
 import { HttpsProxyAgent } from 'https-proxy-agent'
 import { Agent, type Dispatcher, type RequestInit as UndiciRequestInit } from 'undici/index.js'
-import { requireDirectOutboundTransport } from '@/lib/core/network/context.server'
+import { isOutboundRoutingEnabled } from '@/lib/core/network/config.server'
+import {
+  requireDirectOutboundTransport,
+  resolveCurrentOutboundRoute,
+} from '@/lib/core/network/context.server'
 import { OutboundRoutingError } from '@/lib/core/network/routing'
 import {
   createOutboundTransport,
@@ -976,6 +980,24 @@ export function createSsrfGuardedFetchWithDispatcher(options: {
   }
 }
 
+let providerFetch: ReturnType<typeof createSsrfGuardedFetchWithDispatcher> | undefined
+
+/**
+ * Fetch for external provider calls. Unconfigured deployments preserve native behavior.
+ * Required gateways use the shared guarded transport and its organization-separated pools.
+ * User-controlled configured endpoints retain their explicit provenance-aware fetch factory.
+ */
+export async function outboundFetch(
+  input: RequestInfo | URL,
+  init?: RequestInit
+): Promise<Response> {
+  if (!isOutboundRoutingEnabled()) return fetch(input, init)
+  const route = await resolveCurrentOutboundRoute()
+  if (route.kind === 'direct') return fetch(input, init)
+  providerFetch ??= createSsrfGuardedFetchWithDispatcher({ profile: 'contentFetch' })
+  return providerFetch.fetch(input, init)
+}
+
 /**
  * Builds a standard `fetch`-compatible function that pins every outbound
  * connection to `resolvedIP`, preventing DNS-rebinding (TOCTOU) between URL

apps/sim/lib/core/security/input-validation.server.ts

@@ -13,10 +13,10 @@ import { getErrorMessage } from '@sim/utils/errors'
 import { generateId } from '@sim/utils/id'
 import { and, eq, inArray, isNull, or, sql } from 'drizzle-orm'
 import { getRedisClient } from '@/lib/core/config/redis'
-import { outboundFetch } from '@/lib/core/network/fetch.server'
 import { resourceScopeFields, resourceScopeFromOwner } from '@/lib/core/resource-scope'
 import { resourceScopeCondition } from '@/lib/core/resource-scope.server'
 import { decryptSecret, encryptSecret } from '@/lib/core/security/encryption'
+import { outboundFetch } from '@/lib/core/security/input-validation.server'
 import { getBaseUrl } from '@/lib/core/utils/urls'
 import { credentialGroupScopePolicyVersion } from '@/lib/credential-groups/provider-adapter'
 import {

apps/sim/lib/credential-groups/slack-managed-users.ts

@@ -12,7 +12,7 @@ import {
   getManagedOAuthConnectorProviderConfig,
   type ManagedOAuthConnectorConfig,
 } from '@/lib/auth/connectors/managed-oauth'
-import { outboundFetch } from '@/lib/core/network/fetch.server'
+import { outboundFetch } from '@/lib/core/security/input-validation.server'
 import { readResponseJsonWithLimit } from '@/lib/core/utils/stream-limits'
 import { credentialGroupOAuthNonceMatches } from '@/lib/credential-groups/oauth-state'
 import type {

apps/sim/lib/credential-groups/standard-oauth-provider.ts

@@ -1,4 +1,4 @@
-import { outboundFetch } from '@/lib/core/network/fetch.server'
+import { outboundFetch } from '@/lib/core/security/input-validation.server'
 import type { AtlassianProduct } from '@/lib/credentials/service-account-fields'
 import { parseAtlassianErrorMessage } from '@/tools/jira/utils'
 

apps/sim/lib/credentials/atlassian-service-account.ts

@@ -2,7 +2,7 @@ import { createPrivateKey, type KeyObject } from 'node:crypto'
 import { generateId } from '@sim/utils/id'
 import { truncate } from '@sim/utils/string'
 import { SignJWT } from 'jose'
-import { outboundFetch } from '@/lib/core/network/fetch.server'
+import { outboundFetch } from '@/lib/core/security/input-validation.server'
 import {
   DEFAULT_MAX_ERROR_BODY_BYTES,
   readResponseJsonWithLimit,