Merge remote-tracking branch 'origin/staging' into fix/table-error

Author: TheodoreSpeaks

apps/docs/content/docs/en/integrations/agiloft.mdx

@@ -34,7 +34,7 @@ In Sim, the Agiloft integration enables your agents to manage contracts and reco
 
 ## Usage Instructions
 
-Integrate with Agiloft contract lifecycle management to create, read, update, delete, and search records. Supports file attachments, SQL-based selection, saved searches, and record locking across any table in your knowledge base.
+Integrate with Agiloft contract lifecycle management to create, read, update, delete, and search records. Supports file attachments, SQL-based selection, saved searches, record locking, and running action buttons across any table in your knowledge base.
 
 
 
@@ -129,6 +129,7 @@ Delete a record from an Agiloft table.
 | `password` | string | Yes | Agiloft password |
 | `table` | string | Yes | Table name \(e.g., "contracts", "contacts.employees"\) |
 | `recordId` | string | Yes | ID of the record to delete |
+| `deleteRule` | string | No | How to treat records that depend on this one: ERROR_IF_DEPENDANTS \(default — fails rather than cascading\), APPLY_DELETE_WHERE_POSSIBLE, DELETE_WHERE_POSSIBLE_OTHERWISE_UNLINK, APPLY_UNLINK, or UNLINK_WHERE_POSSIBLE_OTHERWISE_DELETE |
 
 #### Output
 
@@ -174,13 +175,14 @@ Lock, unlock, or check the lock status of an Agiloft record.
 | `table` | string | Yes | Table name \(e.g., "contracts"\) |
 | `recordId` | string | Yes | ID of the record to lock, unlock, or check |
 | `lockAction` | string | Yes | Action to perform: "lock", "unlock", or "check" |
+| `force` | boolean | No | Unlock only: release a lock held by another user. Requires membership in the admin group. |
 
 #### Output
 
 | Parameter | Type | Description |
 | --------- | ---- | ----------- |
 | `id` | string | Record ID |
-| `lockStatus` | string | Lock status \(e.g., "LOCKED", "UNLOCKED"\) |
+| `lockStatus` | string | Lock status: "LOCKED" when the record is held, "NO_LOCK" when it is free |
 | `lockedBy` | string | Username of the user who locked the record |
 | `lockExpiresInMinutes` | number | Minutes until the lock expires |
 
@@ -255,9 +257,9 @@ Download an attached file from an Agiloft record field.
 | --------- | ---- | ----------- |
 | `file` | file | Downloaded attachment file |
 
-### Agiloft Saved Search
+### Agiloft Run Action Button
 
-List saved searches defined for an Agiloft table.
+Run an action button on an Agiloft record, such as an approval or send-for-signature step.
 
 #### Input
 
@@ -267,17 +269,40 @@ List saved searches defined for an Agiloft table.
 | `knowledgeBase` | string | Yes | Knowledge base name |
 | `login` | string | Yes | Agiloft username |
 | `password` | string | Yes | Agiloft password |
-| `table` | string | Yes | Table name to list saved searches for \(e.g., "contracts"\) |
+| `table` | string | Yes | Table name \(e.g., "contracts", "case"\) |
+| `recordId` | string | Yes | ID of the record to run the action button on |
+| `actionButtonField` | string | Yes | Logical name of the field holding the action button \(e.g., "ab_field"\) |
 
 #### Output
 
 | Parameter | Type | Description |
 | --------- | ---- | ----------- |
-| `searches` | array | List of saved searches for the table |
-|   ↳ `name` | string | Saved search name |
-|   ↳ `label` | string | Saved search display label |
-|   ↳ `id` | number | Saved search database identifier |
-|   ↳ `description` | string | Saved search description |
+| `recordId` | string | ID of the record the action button was run on |
+| `callbackId` | string | Callback identifier for the asynchronous run, which Agiloft returns as EWCALLBACK_ID |
+
+### saved_search
+
+
+### Agiloft Saved Search (retired)
+
+Retired. Agiloft does not document an endpoint for listing saved searches — use the Search Records operation and set its Saved Search field instead.
+
+#### Input
+
+| Parameter | Type | Required | Description |
+| --------- | ---- | -------- | ----------- |
+| `instanceUrl` | string | No | Agiloft instance URL |
+| `knowledgeBase` | string | No | Knowledge base name |
+| `login` | string | No | Agiloft username |
+| `password` | string | No | Agiloft password |
+| `table` | string | No | Table name |
+| `output` | string | No | No description |
+
+#### Output
+
+| Parameter | Type | Description |
+| --------- | ---- | ----------- |
+| `searches` | array | Always empty; this operation is retired |
 
 ### Agiloft Search Records
 
@@ -292,19 +317,20 @@ Search for records in an Agiloft table using a query.
 | `login` | string | Yes | Agiloft username |
 | `password` | string | Yes | Agiloft password |
 | `table` | string | Yes | Table name to search in \(e.g., "contracts", "contacts.employees"\) |
-| `query` | string | Yes | Search query using Agiloft query syntax \(e.g., "status=\'Active\'" or "company_name~=\'Acme\'"\) |
+| `query` | string | No | Ad hoc EWSearch query. Combine conditions with && \(and\) or \|\| \(or\) and quote every value — e.g. \"summary~='test'&&priority='High'\". Required unless a saved search is given. |
+| `search` | string | No | Label of a saved search defined on the table \(e.g., "C: Status is Closed"\). Can be combined with a query to narrow it further. |
 | `fields` | string | No | Comma-separated list of field names to include in the results |
 | `page` | string | No | Page number for paginated results \(starting from 0\) |
-| `limit` | string | No | Maximum number of records to return per page |
+| `limit` | string | No | Maximum number of records to return per page. Agiloft treats 0 as "all records", so leave it unset or use a positive value to keep result sizes bounded. |
 
 #### Output
 
 | Parameter | Type | Description |
 | --------- | ---- | ----------- |
 | `records` | json | Array of matching records with their field values |
-| `totalCount` | number | Total number of matching records |
-| `page` | number | Current page number |
-| `limit` | number | Records per page |
+| `totalCount` | number | Number of records reported by EWSearch. When paginating this is the count for the current page, not the whole result set. |
+| `page` | number | Page number that was requested \(0-based\) |
+| `limit` | number | Page size that was requested; 0 when no limit was sent and Agiloft chose one |
 
 ### Agiloft Select Records
 
@@ -319,7 +345,7 @@ Select record IDs matching a SQL WHERE clause from an Agiloft table.
 | `login` | string | Yes | Agiloft username |
 | `password` | string | Yes | Agiloft password |
 | `table` | string | Yes | Table name \(e.g., "contracts", "contacts.employees"\) |
-| `where` | string | Yes | SQL WHERE clause using database column names \(e.g., "summary like \'%new%\'" or "assigned_person=\'John Doe\'"\) |
+| `where` | string | Yes | SQL WHERE clause using database column names \(e.g., "summary like \'%new%\'" or "assigned_person=\'John Doe\'"\). EWSelect has no page size and returns every matching ID, so append a database limit such as "limit 0,200" to bound the result. |
 
 #### Output
 

apps/sim/app/api/auth/forget-password/route.test.ts

@@ -6,6 +6,34 @@
 import { createMockRequest, resetEnvMock, setEnv } from '@sim/testing'
 import { afterAll, afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
+const { mockCheckRateLimitDirect } = vi.hoisted(() => ({
+  mockCheckRateLimitDirect: vi.fn(),
+}))
+
+/**
+ * Mocked at the storage boundary rather than at `route-helpers`, so the real
+ * key derivation (normalize + hash) is exercised through the route.
+ */
+vi.mock('@/lib/core/rate-limiter/rate-limiter', () => ({
+  RateLimiter: class {
+    checkRateLimitDirect = mockCheckRateLimitDirect
+  },
+}))
+
+const allowAll = () => ({ allowed: true, resetAt: new Date(Date.now() + 60_000) })
+
+function exhaust(dimension: string, resetAt: Date) {
+  mockCheckRateLimitDirect.mockImplementation(async (key: string) =>
+    key.includes(dimension) ? { allowed: false, resetAt } : allowAll()
+  )
+}
+
+function recipientKeys(): string[] {
+  return mockCheckRateLimitDirect.mock.calls
+    .map(([key]) => key as string)
+    .filter((key) => key.includes(':recipient:'))
+}
+
 const { mockRequestPasswordReset, mockLogger } = vi.hoisted(() => {
   const logger = {
     info: vi.fn(),
@@ -42,6 +70,7 @@ describe('Forget Password API Route', () => {
     vi.clearAllMocks()
     setEnv({ NEXT_PUBLIC_APP_URL: 'https://app.example.com' })
     mockRequestPasswordReset.mockResolvedValue(undefined)
+    mockCheckRateLimitDirect.mockImplementation(async () => allowAll())
   })
 
   afterAll(() => {
@@ -73,6 +102,42 @@ describe('Forget Password API Route', () => {
     })
   })
 
+  it('rejects with 429 once the recipient budget is spent, without sending mail', async () => {
+    const resetAt = new Date(Date.now() + 900_000)
+    exhaust(':recipient:', resetAt)
+
+    const response = await POST(createMockRequest('POST', { email: 'test@example.com' }))
+
+    expect(response.status).toBe(429)
+    expect(response.headers.get('Retry-After')).toBe('900')
+    expect(mockRequestPasswordReset).not.toHaveBeenCalled()
+  })
+
+  it('buckets addresses that normalize to the same recipient together', async () => {
+    await POST(createMockRequest('POST', { email: 'Test@Example.com' }))
+    await POST(createMockRequest('POST', { email: 'test@example.com' }))
+
+    const [first, second] = recipientKeys()
+    expect(first).toBe(second)
+  })
+
+  it('keys the recipient bucket by hash, never the raw address', async () => {
+    await POST(createMockRequest('POST', { email: 'test@example.com' }))
+
+    const [key] = recipientKeys()
+    expect(key).toMatch(/^route:forget-password:recipient:[0-9a-f]{64}$/)
+  })
+
+  it('short-circuits on the per-IP budget before spending the recipient budget', async () => {
+    exhaust(':ip:', new Date(Date.now() + 60_000))
+
+    const response = await POST(createMockRequest('POST', { email: 'test@example.com' }))
+
+    expect(response.status).toBe(429)
+    expect(recipientKeys()).toHaveLength(0)
+    expect(mockRequestPasswordReset).not.toHaveBeenCalled()
+  })
+
   it('should reject external redirectTo URL', async () => {
     const req = createMockRequest('POST', {
       email: 'test@example.com',

apps/sim/app/api/auth/forget-password/route.ts

@@ -7,14 +7,29 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { forgetPasswordContract } from '@/lib/api/contracts'
 import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
 import { auth } from '@/lib/auth'
+import {
+  enforceIpRateLimit,
+  enforceRecipientRateLimit,
+  type TokenBucketConfig,
+} from '@/lib/core/rate-limiter'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 
 export const dynamic = 'force-dynamic'
 
 const logger = createLogger('ForgetPasswordAPI')
 
+/** Sized to absorb a frustrated user retrying, not to be tight. */
+const RESET_EMAIL_RATE_LIMIT: TokenBucketConfig = {
+  maxTokens: 5,
+  refillRate: 5,
+  refillIntervalMs: 15 * 60_000,
+}
+
 export const POST = withRouteHandler(async (request: NextRequest) => {
   try {
+    const ipRateLimited = await enforceIpRateLimit('forget-password', request)
+    if (ipRateLimited) return ipRateLimited
+
     const parsed = await parseRequest(
       forgetPasswordContract,
       request,
@@ -33,6 +48,17 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
     const { email, redirectTo } = parsed.data.body
 
+    /**
+     * Enforced before any lookup, and identically whether or not the account
+     * exists, so a 429 discloses nothing the success response doesn't already.
+     */
+    const recipientRateLimited = await enforceRecipientRateLimit(
+      'forget-password',
+      email,
+      RESET_EMAIL_RATE_LIMIT
+    )
+    if (recipientRateLimited) return recipientRateLimited
+
     await auth.api.requestPasswordReset({
       body: {
         email,

apps/sim/app/api/auth/reset-password/route.test.ts

@@ -6,6 +6,16 @@
 import { createMockRequest } from '@sim/testing'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
+const { mockCheckRateLimitDirect } = vi.hoisted(() => ({
+  mockCheckRateLimitDirect: vi.fn(),
+}))
+
+vi.mock('@/lib/core/rate-limiter/rate-limiter', () => ({
+  RateLimiter: class {
+    checkRateLimitDirect = mockCheckRateLimitDirect
+  },
+}))
+
 const { mockResetPassword, mockLogger } = vi.hoisted(() => {
   const logger = {
     info: vi.fn(),
@@ -41,12 +51,31 @@ describe('Reset Password API Route', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockResetPassword.mockResolvedValue(undefined)
+    mockCheckRateLimitDirect.mockResolvedValue({
+      allowed: true,
+      resetAt: new Date(Date.now() + 60_000),
+    })
   })
 
   afterEach(() => {
     vi.clearAllMocks()
   })
 
+  it('rejects with 429 once the per-IP budget is spent, without consuming the token', async () => {
+    mockCheckRateLimitDirect.mockResolvedValue({
+      allowed: false,
+      resetAt: new Date(Date.now() + 900_000),
+    })
+
+    const response = await POST(
+      createMockRequest('POST', { token: 'guess', newPassword: 'newSecurePassword123!' })
+    )
+
+    expect(response.status).toBe(429)
+    expect(response.headers.get('Retry-After')).toBe('900')
+    expect(mockResetPassword).not.toHaveBeenCalled()
+  })
+
   it('should reset password successfully', async () => {
     const req = createMockRequest('POST', {
       token: 'valid-reset-token',

apps/sim/app/api/auth/reset-password/route.ts

@@ -3,14 +3,32 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { resetPasswordContract } from '@/lib/api/contracts'
 import { parseRequest } from '@/lib/api/server'
 import { auth } from '@/lib/auth'
+import { enforceIpRateLimit, type TokenBucketConfig } from '@/lib/core/rate-limiter'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 
 export const dynamic = 'force-dynamic'
 
 const logger = createLogger('PasswordResetAPI')
 
+/**
+ * Submitting reset tokens without a session is guessing; a legitimate user
+ * submits once. Tighter than the public default for that reason.
+ */
+const RESET_PASSWORD_RATE_LIMIT: TokenBucketConfig = {
+  maxTokens: 10,
+  refillRate: 10,
+  refillIntervalMs: 15 * 60_000,
+}
+
 export const POST = withRouteHandler(async (request: NextRequest) => {
   try {
+    const rateLimited = await enforceIpRateLimit(
+      'reset-password',
+      request,
+      RESET_PASSWORD_RATE_LIMIT
+    )
+    if (rateLimited) return rateLimited
+
     const parsed = await parseRequest(
       resetPasswordContract,
       request,

apps/sim/app/api/table/[tableId]/groups/route.test.ts

@@ -8,6 +8,15 @@ interface CapturedDefinition {
   auth: unknown
   operation: { id: string }
   useCase: unknown
+  mapInput(input: {
+    params: { tableId: string }
+    body: {
+      workspaceId: string
+      group: Record<string, unknown>
+      outputColumns: Record<string, unknown>[]
+      autoRun?: boolean
+    }
+  }): Record<string, unknown>
 }
 
 const mocks = vi.hoisted(() => ({
@@ -70,4 +79,27 @@ describe('/api/table/[tableId]/groups', () => {
       expect(route.operation.id).toBe(useCase.operation.id)
     }
   })
+
+  it('preserves the legacy create default while honoring an explicit opt-out', () => {
+    const route = definition('POST')
+    const input = {
+      params: { tableId: 'table-1' },
+      body: {
+        workspaceId: 'workspace-1',
+        group: { id: 'group-1' },
+        outputColumns: [{ name: 'Result' }],
+      },
+    }
+
+    expect(route.mapInput(input)).toEqual({
+      tableId: 'table-1',
+      ...input.body,
+      autoRun: true,
+    })
+    expect(route.mapInput({ ...input, body: { ...input.body, autoRun: false } })).toEqual({
+      tableId: 'table-1',
+      ...input.body,
+      autoRun: false,
+    })
+  })
 })

apps/sim/app/api/table/[tableId]/groups/route.ts

@@ -48,7 +48,11 @@ export const POST = defineInternalJsonRoute({
   auth: internalTableSessionOrExecutorAuth,
   rateLimit,
   errorPolicy,
-  mapInput: ({ params, body }) => ({ tableId: params.tableId, ...body }),
+  mapInput: ({ params, body }) => ({
+    tableId: params.tableId,
+    ...body,
+    autoRun: body.autoRun ?? true,
+  }),
   present: ({ table }) => presentTable(table),
 })