fix(atlassian): add shared selector credential safety

Author: Bill Leoutsakos

apps/sim/lib/atlassian/discovery.test.ts

@@ -123,6 +123,19 @@ describe('resolveAtlassianCloudId', () => {
     expect(fetchMock).toHaveBeenCalledTimes(1)
   })
 
+  it('omits provider response bodies from selector discovery errors', async () => {
+    fetchMock.mockResolvedValue(failure(403, { marker: 'provider-body-secret-marker' }))
+
+    const error = await resolveAtlassianCloudId(
+      options({
+        retryOptions: { ...FAST, omitResponseBodyFromErrors: true },
+      })
+    ).catch((caught) => caught as Error)
+
+    expect(error.message).toBe('Failed to fetch Jira accessible resources: 403')
+    expect(error.message).not.toContain('provider-body-secret-marker')
+  })
+
   it('does not pin a failure in the cache', async () => {
     fetchMock.mockResolvedValueOnce(failure(403, { message: 'nope' }))
     await expect(resolveAtlassianCloudId(options({ retryOptions: FAST }))).rejects.toThrow()

apps/sim/lib/atlassian/discovery.ts

@@ -102,12 +102,20 @@ interface AccessibleResource {
   url: string
 }
 
+export interface AtlassianDiscoveryRetryOptions extends RetryOptions {
+  /**
+   * Selector routes set this to avoid putting provider-controlled response
+   * bodies into thrown errors, which the shared retry helper intentionally logs.
+   */
+  omitResponseBodyFromErrors?: boolean
+}
+
 interface ResolveAtlassianCloudIdOptions {
   domain: string
   accessToken: string
   /** Product name woven into the failure messages, e.g. `Jira` or `Confluence`. */
   product: string
-  retryOptions?: RetryOptions
+  retryOptions?: AtlassianDiscoveryRetryOptions
 }
 
 const cloudIdCache = createAtlassianDiscoveryCache()
@@ -141,8 +149,9 @@ export function fetchAtlassianDiscoveryJson<T>(
   url: string,
   headers: Record<string, string>,
   failureLabel: string,
-  retryOptions?: RetryOptions
+  retryOptions?: AtlassianDiscoveryRetryOptions
 ): Promise<T> {
+  const { omitResponseBodyFromErrors = false, ...effectiveRetryOptions } = retryOptions ?? {}
   return retryWithExponentialBackoff(
     async () => {
       const response = await fetch(url, {
@@ -152,10 +161,10 @@ export function fetchAtlassianDiscoveryJson<T>(
       })
 
       if (!response.ok) {
-        const errorText = await response.text()
-        const error: HTTPError = new Error(
-          `${failureLabel}: ${response.status} - ${errorText || response.statusText}`
-        )
+        const errorDetail = omitResponseBodyFromErrors
+          ? ''
+          : ` - ${(await response.text()) || response.statusText}`
+        const error: HTTPError = new Error(`${failureLabel}: ${response.status}${errorDetail}`)
         error.status = response.status
         error.statusText = response.statusText
         const retryAfterMs = parseRetryAfter(response.headers.get('Retry-After'))
@@ -165,14 +174,14 @@ export function fetchAtlassianDiscoveryJson<T>(
 
       return (await response.json()) as T
     },
-    { ...ATLASSIAN_DISCOVERY_RETRY_OPTIONS, ...retryOptions }
+    { ...ATLASSIAN_DISCOVERY_RETRY_OPTIONS, ...effectiveRetryOptions }
   )
 }
 
 function fetchAccessibleResources(
   accessToken: string,
   product: string,
-  retryOptions: RetryOptions | undefined
+  retryOptions: AtlassianDiscoveryRetryOptions | undefined
 ): Promise<AccessibleResource[]> {
   return fetchAtlassianDiscoveryJson<AccessibleResource[]>(
     ACCESSIBLE_RESOURCES_URL,
@@ -232,7 +241,10 @@ export async function resolveAtlassianCloudId(
   options: ResolveAtlassianCloudIdOptions
 ): Promise<string> {
   const { domain, accessToken, product, retryOptions } = options
-  const key = atlassianDiscoveryKey(normalizeAtlassianSiteUrl(domain), accessToken)
+  const errorMode = retryOptions?.omitResponseBodyFromErrors
+    ? 'sanitized-errors'
+    : 'standard-errors'
+  const key = `${atlassianDiscoveryKey(normalizeAtlassianSiteUrl(domain), accessToken)}:${errorMode}`
 
   return cloudIdCache.resolve(key, async () =>
     selectAtlassianCloudId(

apps/sim/lib/selectors/application/atlassian-credential.test.ts

@@ -0,0 +1,89 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  getServiceAccountSecret: vi.fn(),
+  providerMatches: vi.fn(),
+  refreshToken: vi.fn(),
+  resolveAccount: vi.fn(),
+}))
+
+vi.mock('@/lib/oauth/credential-service', () => ({
+  getAtlassianServiceAccountSecret: mocks.getServiceAccountSecret,
+  refreshAccessTokenIfNeeded: mocks.refreshToken,
+  resolveOAuthAccountId: mocks.resolveAccount,
+}))
+vi.mock('@/lib/selectors/application/credential-provider', () => ({
+  selectorCredentialMatchesService: mocks.providerMatches,
+}))
+
+import { resolveAtlassianSelectorCredential } from '@/lib/selectors/application/atlassian-credential'
+
+describe('resolveAtlassianSelectorCredential', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.providerMatches.mockResolvedValue(true)
+    mocks.resolveAccount.mockResolvedValue({
+      providerId: 'atlassian',
+      credentialId: 'credential-1',
+    })
+    mocks.refreshToken.mockResolvedValue('oauth-access-token')
+  })
+
+  it('binds a credential to the requested integration before reading or refreshing secrets', async () => {
+    mocks.providerMatches.mockResolvedValue(false)
+
+    const result = await resolveAtlassianSelectorCredential({
+      credentialId: 'credential-1',
+      credentialOwnerUserId: 'owner-1',
+      requestId: 'request-1',
+      serviceId: 'jira',
+    })
+
+    expect(result).toBeNull()
+    expect(mocks.providerMatches).toHaveBeenCalledWith({
+      credentialId: 'credential-1',
+      credentialOwnerUserId: 'owner-1',
+      serviceId: 'jira',
+    })
+    expect(mocks.resolveAccount).not.toHaveBeenCalled()
+    expect(mocks.getServiceAccountSecret).not.toHaveBeenCalled()
+    expect(mocks.refreshToken).not.toHaveBeenCalled()
+  })
+
+  it('refreshes an OAuth token only after provider binding succeeds', async () => {
+    const result = await resolveAtlassianSelectorCredential({
+      credentialId: 'credential-1',
+      credentialOwnerUserId: 'owner-1',
+      requestId: 'request-1',
+      serviceId: 'confluence',
+    })
+
+    expect(result).toEqual({ accessToken: 'oauth-access-token' })
+    expect(mocks.refreshToken).toHaveBeenCalledWith('credential-1', 'owner-1', 'request-1')
+  })
+
+  it('reads an Atlassian service account only after provider binding succeeds', async () => {
+    mocks.resolveAccount.mockResolvedValue({
+      providerId: 'atlassian-service-account',
+      credentialId: 'service-account-1',
+    })
+    mocks.getServiceAccountSecret.mockResolvedValue({
+      apiToken: 'service-account-token',
+      cloudId: 'cloud-1',
+    })
+
+    const result = await resolveAtlassianSelectorCredential({
+      credentialId: 'credential-1',
+      credentialOwnerUserId: 'owner-1',
+      requestId: 'request-1',
+      serviceId: 'jira',
+    })
+
+    expect(result).toEqual({ accessToken: 'service-account-token', cloudId: 'cloud-1' })
+    expect(mocks.getServiceAccountSecret).toHaveBeenCalledWith('service-account-1')
+    expect(mocks.refreshToken).not.toHaveBeenCalled()
+  })
+})

apps/sim/lib/selectors/application/atlassian-credential.ts

@@ -0,0 +1,34 @@
+import {
+  getAtlassianServiceAccountSecret,
+  refreshAccessTokenIfNeeded,
+  resolveOAuthAccountId,
+} from '@/lib/oauth/credential-service'
+import { ATLASSIAN_SERVICE_ACCOUNT_PROVIDER_ID } from '@/lib/oauth/types'
+import { selectorCredentialMatchesService } from '@/lib/selectors/application/credential-provider'
+
+export async function resolveAtlassianSelectorCredential(input: {
+  credentialId: string
+  credentialOwnerUserId: string
+  requestId: string
+  serviceId: 'jira' | 'confluence'
+}): Promise<{ accessToken: string; cloudId?: string } | null> {
+  const providerMatches = await selectorCredentialMatchesService({
+    credentialId: input.credentialId,
+    credentialOwnerUserId: input.credentialOwnerUserId,
+    serviceId: input.serviceId,
+  })
+  if (!providerMatches) return null
+
+  const resolved = await resolveOAuthAccountId(input.credentialId)
+  if (resolved?.providerId === ATLASSIAN_SERVICE_ACCOUNT_PROVIDER_ID && resolved.credentialId) {
+    const secret = await getAtlassianServiceAccountSecret(resolved.credentialId)
+    return { accessToken: secret.apiToken, cloudId: secret.cloudId }
+  }
+
+  const accessToken = await refreshAccessTokenIfNeeded(
+    input.credentialId,
+    input.credentialOwnerUserId,
+    input.requestId
+  )
+  return accessToken ? { accessToken } : null
+}

apps/sim/lib/selectors/server/provider-errors.test.ts

@@ -0,0 +1,51 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import {
+  resolveSelectorProviderValue,
+  selectorProviderFailure,
+} from '@/lib/selectors/server/provider-errors'
+
+describe('selectorProviderFailure', () => {
+  it.each([
+    [
+      401,
+      {
+        error: 'Atlassian rejected this credential. Reconnect it and try again.',
+        status: 401,
+        authRequired: true,
+      },
+    ],
+    [403, { error: 'Atlassian denied selector access.', status: 403 }],
+    [
+      429,
+      {
+        error: 'Atlassian rate-limited selector discovery. Try again shortly.',
+        status: 429,
+      },
+    ],
+    [400, { error: 'Atlassian selector discovery failed.', status: 502 }],
+    [500, { error: 'Atlassian selector discovery failed.', status: 502 }],
+  ])('maps provider status %s to its stable public failure', (input, expected) => {
+    expect(selectorProviderFailure('Atlassian', input)).toEqual(expected)
+  })
+
+  it('sanitizes a provider discovery exception without serializing its body marker', async () => {
+    const providerError = Object.assign(new Error('provider-body-secret-marker'), { status: 429 })
+
+    const result = await resolveSelectorProviderValue('Jira', async () => {
+      throw providerError
+    })
+
+    expect(result).toEqual({
+      ok: false,
+      failure: {
+        error: 'Jira rate-limited selector discovery. Try again shortly.',
+        status: 429,
+      },
+      upstreamStatus: 429,
+    })
+    expect(JSON.stringify(result)).not.toContain('provider-body-secret-marker')
+  })
+})

apps/sim/lib/selectors/server/provider-errors.ts

@@ -0,0 +1,68 @@
+export interface SelectorProviderFailure {
+  error: string
+  status: number
+  authRequired?: true
+}
+
+export type SelectorAtlassianProvider =
+  | 'Atlassian'
+  | 'Jira'
+  | 'Confluence'
+  | 'Jira Service Management'
+
+/** Keeps provider-controlled discovery bodies out of selector errors and retry logs. */
+export const SELECTOR_ATLASSIAN_DISCOVERY_OPTIONS = {
+  omitResponseBodyFromErrors: true,
+} as const
+
+function providerStatusFromError(error: unknown): number | undefined {
+  if (!error || typeof error !== 'object' || !('status' in error)) return undefined
+  const status = error.status
+  return typeof status === 'number' && Number.isInteger(status) ? status : undefined
+}
+
+/** Maps provider failures to stable selector-safe responses without reading response bodies. */
+export function selectorProviderFailure(
+  provider: SelectorAtlassianProvider,
+  status: number
+): SelectorProviderFailure {
+  if (status === 401) {
+    return {
+      error: `${provider} rejected this credential. Reconnect it and try again.`,
+      status: 401,
+      authRequired: true,
+    }
+  }
+  if (status === 403) {
+    return { error: `${provider} denied selector access.`, status: 403 }
+  }
+  if (status === 429) {
+    return { error: `${provider} rate-limited selector discovery. Try again shortly.`, status: 429 }
+  }
+  return { error: `${provider} selector discovery failed.`, status: 502 }
+}
+
+export type SelectorProviderValueResult<T> =
+  | { ok: true; value: T }
+  | {
+      ok: false
+      failure: SelectorProviderFailure
+      upstreamStatus?: number
+    }
+
+/** Converts provider discovery exceptions into a safe value boundary. */
+export async function resolveSelectorProviderValue<T>(
+  provider: SelectorAtlassianProvider,
+  resolve: () => Promise<T>
+): Promise<SelectorProviderValueResult<T>> {
+  try {
+    return { ok: true, value: await resolve() }
+  } catch (error) {
+    const upstreamStatus = providerStatusFromError(error)
+    return {
+      ok: false,
+      failure: selectorProviderFailure(provider, upstreamStatus ?? 502),
+      upstreamStatus,
+    }
+  }
+}

apps/sim/tools/jira/utils.ts

@@ -1,6 +1,8 @@
 import { createLogger } from '@sim/logger'
-import { resolveAtlassianCloudId } from '@/lib/atlassian/discovery'
-import type { RetryOptions } from '@/lib/knowledge/documents/utils'
+import {
+  type AtlassianDiscoveryRetryOptions,
+  resolveAtlassianCloudId,
+} from '@/lib/atlassian/discovery'
 import { fetchWithRetry } from '@/lib/knowledge/documents/utils'
 
 const logger = createLogger('JiraUtils')
@@ -250,7 +252,7 @@ export function normalizeJiraWorklogTimestamp(value: string): string {
 export function getJiraCloudId(
   domain: string,
   accessToken: string,
-  retryOptions?: RetryOptions
+  retryOptions?: AtlassianDiscoveryRetryOptions
 ): Promise<string> {
   return resolveAtlassianCloudId({ domain, accessToken, product: 'Jira', retryOptions })
 }