fix(microsoft-word): fail closed when a document reports no version to compare

Author: waleedlatif1

apps/sim/app/api/tools/microsoft_word/append/route.test.ts

@@ -172,6 +172,65 @@ describe('POST /api/tools/microsoft_word/append', () => {
     )
   })
 
+  it('refuses to write when Graph reports no version to compare against', async () => {
+    const untagged = {
+      id: 'doc-abc',
+      name: 'notes.docx',
+      file: {
+        mimeType: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+      },
+    }
+    mockSecureFetchWithPinnedIP.mockResolvedValueOnce({
+      ok: true,
+      status: 200,
+      statusText: '',
+      headers: new Headers(),
+      body: null,
+      text: async () => JSON.stringify(untagged),
+      json: async () => untagged,
+      arrayBuffer: async () => new ArrayBuffer(0),
+    })
+
+    const response = await POST(createMockRequest('POST', baseBody))
+
+    expect(response.status).toBe(409)
+    const data = (await response.json()) as { error: string }
+    expect(data.error).toMatch(/did not report a version/)
+    expect(mockSecureFetchWithPinnedIP.mock.calls.some((call) => call[2]?.method === 'PUT')).toBe(
+      false
+    )
+  })
+
+  it('refuses to write when the re-read reports no version', async () => {
+    const untagged = {
+      id: 'doc-abc',
+      name: 'notes.docx',
+      file: {
+        mimeType: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+      },
+    }
+    mockSecureFetchWithPinnedIP
+      .mockResolvedValueOnce(itemResponse('tag-1'))
+      .mockResolvedValueOnce(await docxResponse())
+      .mockResolvedValueOnce({
+        ok: true,
+        status: 200,
+        statusText: '',
+        headers: new Headers(),
+        body: null,
+        text: async () => JSON.stringify(untagged),
+        json: async () => untagged,
+        arrayBuffer: async () => new ArrayBuffer(0),
+      })
+
+    const response = await POST(createMockRequest('POST', baseBody))
+
+    expect(response.status).toBe(409)
+    expect(mockSecureFetchWithPinnedIP.mock.calls.some((call) => call[2]?.method === 'PUT')).toBe(
+      false
+    )
+  })
+
   it('surfaces a 412 from the upload precondition as the same conflict', async () => {
     mockSecureFetchWithPinnedIP
       .mockResolvedValueOnce(itemResponse('tag-1'))

apps/sim/app/api/tools/microsoft_word/append/route.ts

@@ -10,7 +10,7 @@ import {
   assertContentUnchanged,
   downloadDocumentContent,
   fetchDocumentItem,
-  getContentTag,
+  requireContentTag,
   toDocumentMetadata,
   uploadDocumentContent,
 } from '@/lib/microsoft-word/graph.server'
@@ -45,7 +45,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
   try {
     const basePath = getDocumentBasePath(documentId, driveId ?? undefined)
     const existingItem = await fetchDocumentItem(basePath, accessToken)
-    const contentTag = getContentTag(existingItem)
+    const contentTag = requireContentTag(existingItem)
 
     const existingBuffer = await downloadDocumentContent(basePath, accessToken)
     const { buffer, paragraphsAppended } = await appendParagraphsToDocx(existingBuffer, content)

apps/sim/app/api/tools/microsoft_word/replace-text/route.ts

@@ -10,7 +10,7 @@ import {
   assertContentUnchanged,
   downloadDocumentContent,
   fetchDocumentItem,
-  getContentTag,
+  requireContentTag,
   toDocumentMetadata,
   uploadDocumentContent,
 } from '@/lib/microsoft-word/graph.server'
@@ -46,7 +46,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
   try {
     const basePath = getDocumentBasePath(documentId, driveId ?? undefined)
     const existingItem = await fetchDocumentItem(basePath, accessToken)
-    const contentTag = getContentTag(existingItem)
+    const contentTag = requireContentTag(existingItem)
 
     const existingBuffer = await downloadDocumentContent(basePath, accessToken)
     const { buffer, occurrencesChanged } = await replaceTextInDocx(

apps/sim/lib/microsoft-word/graph.server.ts

@@ -191,24 +191,49 @@ export function documentChangedError(): GraphRequestError {
   return new GraphRequestError(CONFLICT_MESSAGE, 409)
 }
 
+/** Message shown when the document carries no version to compare against. */
+const UNVERIFIABLE_MESSAGE =
+  'Microsoft Graph did not report a version for this document, so Sim cannot confirm the edit would not overwrite someone else’s change and did not apply it. Use Replace Content if you intend to overwrite the document outright.'
+
+/**
+ * Raised when there is no version to compare, rather than writing unguarded.
+ *
+ * Graph returns `cTag` for every file and `eTag` for every drive item, so this
+ * should not be reachable in practice — but a read-modify-write that silently
+ * degrades to no protection is the failure this whole guard exists to prevent,
+ * so the missing-version path fails closed instead of proceeding.
+ */
+function unverifiableDocumentError(): GraphRequestError {
+  return new GraphRequestError(UNVERIFIABLE_MESSAGE, 409)
+}
+
+/**
+ * Returns the content tag an edit must be based on, refusing the edit outright
+ * when the item carries none.
+ */
+export function requireContentTag(item: GraphDriveItem): string {
+  const tag = getContentTag(item)
+  if (!tag) {
+    throw unverifiableDocumentError()
+  }
+  return tag
+}
+
 /**
  * Aborts a read-modify-write when the document's content changed since it was
  * read. Without this, two overlapping edits both succeed and the later upload
  * silently discards the earlier one.
  *
- * `expected` being undefined means Graph returned neither tag for this item, so
- * there is nothing to compare and the caller proceeds unguarded — the
- * `if-match` header on the upload is the remaining line of defense.
+ * Every branch fails closed: a changed tag, and equally a re-read that reports
+ * no tag at all, both refuse the write rather than fall through to it.
  */
 export async function assertContentUnchanged(
   basePath: string,
   accessToken: string,
-  expected: string | undefined
+  expected: string
 ): Promise<void> {
-  if (!expected) return
-
-  const current = getContentTag(await fetchDocumentItem(basePath, accessToken))
-  if (current && current !== expected) {
+  const current = requireContentTag(await fetchDocumentItem(basePath, accessToken))
+  if (current !== expected) {
     throw documentChangedError()
   }
 }