refactor(okta): move validateOktaDomain to centralized input-validation

- Moved validateOktaDomain from tools/okta/types.ts to
  lib/core/security/input-validation.ts alongside other validation utils
- Added .trim() to handle copy-paste whitespace in domain input
- Updated all 18 tool files to import from the new location

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: waleedlatif1

apps/sim/lib/core/security/input-validation.ts

@@ -1192,3 +1192,33 @@ export function validateCallbackUrl(url: string): boolean {
     return false
   }
 }
+
+const OKTA_DOMAIN_PATTERN =
+  /^[a-zA-Z0-9][a-zA-Z0-9-]*\.(okta|okta-gov|okta-emea|oktapreview|trexcloud)\.com$/
+
+/**
+ * Validates and sanitizes an Okta domain to prevent SSRF.
+ * Ensures the domain matches a known Okta domain suffix.
+ *
+ * @param rawDomain - The raw domain string (may include protocol, trailing slash, or whitespace)
+ * @returns The cleaned, validated domain string
+ * @throws Error if the domain does not match a known Okta domain suffix
+ *
+ * @example
+ * ```typescript
+ * const domain = validateOktaDomain(params.domain)
+ * // Returns: "dev-123456.okta.com"
+ * ```
+ */
+export function validateOktaDomain(rawDomain: string): string {
+  const domain = rawDomain
+    .trim()
+    .replace(/^https?:\/\//, '')
+    .replace(/\/$/, '')
+  if (!OKTA_DOMAIN_PATTERN.test(domain)) {
+    throw new Error(
+      `Invalid Okta domain: "${domain}". Must be a valid Okta domain (e.g., dev-123456.okta.com)`
+    )
+  }
+  return domain
+}

apps/sim/tools/okta/activate_user.ts

@@ -1,9 +1,9 @@
 import { createLogger } from '@sim/logger'
-import {
-  type OktaActivateUserParams,
-  type OktaActivateUserResponse,
-  type OktaApiError,
-  validateOktaDomain,
+import { validateOktaDomain } from '@/lib/core/security/input-validation'
+import type {
+  OktaActivateUserParams,
+  OktaActivateUserResponse,
+  OktaApiError,
 } from '@/tools/okta/types'
 import type { ToolConfig } from '@/tools/types'
 

apps/sim/tools/okta/add_user_to_group.ts

@@ -1,9 +1,9 @@
 import { createLogger } from '@sim/logger'
-import {
-  type OktaAddUserToGroupParams,
-  type OktaAddUserToGroupResponse,
-  type OktaApiError,
-  validateOktaDomain,
+import { validateOktaDomain } from '@/lib/core/security/input-validation'
+import type {
+  OktaAddUserToGroupParams,
+  OktaAddUserToGroupResponse,
+  OktaApiError,
 } from '@/tools/okta/types'
 import type { ToolConfig } from '@/tools/types'
 

apps/sim/tools/okta/create_group.ts

@@ -1,10 +1,10 @@
 import { createLogger } from '@sim/logger'
-import {
-  type OktaApiError,
-  type OktaCreateGroupParams,
-  type OktaCreateGroupResponse,
-  type OktaGroup,
-  validateOktaDomain,
+import { validateOktaDomain } from '@/lib/core/security/input-validation'
+import type {
+  OktaApiError,
+  OktaCreateGroupParams,
+  OktaCreateGroupResponse,
+  OktaGroup,
 } from '@/tools/okta/types'
 import type { ToolConfig } from '@/tools/types'
 

apps/sim/tools/okta/create_user.ts

@@ -1,10 +1,10 @@
 import { createLogger } from '@sim/logger'
-import {
-  type OktaApiError,
-  type OktaCreateUserParams,
-  type OktaCreateUserResponse,
-  type OktaUser,
-  validateOktaDomain,
+import { validateOktaDomain } from '@/lib/core/security/input-validation'
+import type {
+  OktaApiError,
+  OktaCreateUserParams,
+  OktaCreateUserResponse,
+  OktaUser,
 } from '@/tools/okta/types'
 import type { ToolConfig } from '@/tools/types'
 

apps/sim/tools/okta/deactivate_user.ts

@@ -1,9 +1,9 @@
 import { createLogger } from '@sim/logger'
-import {
-  type OktaApiError,
-  type OktaDeactivateUserParams,
-  type OktaDeactivateUserResponse,
-  validateOktaDomain,
+import { validateOktaDomain } from '@/lib/core/security/input-validation'
+import type {
+  OktaApiError,
+  OktaDeactivateUserParams,
+  OktaDeactivateUserResponse,
 } from '@/tools/okta/types'
 import type { ToolConfig } from '@/tools/types'
 

apps/sim/tools/okta/delete_group.ts

@@ -1,9 +1,9 @@
 import { createLogger } from '@sim/logger'
-import {
-  type OktaApiError,
-  type OktaDeleteGroupParams,
-  type OktaDeleteGroupResponse,
-  validateOktaDomain,
+import { validateOktaDomain } from '@/lib/core/security/input-validation'
+import type {
+  OktaApiError,
+  OktaDeleteGroupParams,
+  OktaDeleteGroupResponse,
 } from '@/tools/okta/types'
 import type { ToolConfig } from '@/tools/types'
 

apps/sim/tools/okta/delete_user.ts

@@ -1,10 +1,6 @@
 import { createLogger } from '@sim/logger'
-import {
-  type OktaApiError,
-  type OktaDeleteUserParams,
-  type OktaDeleteUserResponse,
-  validateOktaDomain,
-} from '@/tools/okta/types'
+import { validateOktaDomain } from '@/lib/core/security/input-validation'
+import type { OktaApiError, OktaDeleteUserParams, OktaDeleteUserResponse } from '@/tools/okta/types'
 import type { ToolConfig } from '@/tools/types'
 
 const logger = createLogger('OktaDeleteUser')

apps/sim/tools/okta/get_group.ts

@@ -1,10 +1,10 @@
 import { createLogger } from '@sim/logger'
-import {
-  type OktaApiError,
-  type OktaGetGroupParams,
-  type OktaGetGroupResponse,
-  type OktaGroup,
-  validateOktaDomain,
+import { validateOktaDomain } from '@/lib/core/security/input-validation'
+import type {
+  OktaApiError,
+  OktaGetGroupParams,
+  OktaGetGroupResponse,
+  OktaGroup,
 } from '@/tools/okta/types'
 import type { ToolConfig } from '@/tools/types'
 

apps/sim/tools/okta/get_user.ts

@@ -1,10 +1,10 @@
 import { createLogger } from '@sim/logger'
-import {
-  type OktaApiError,
-  type OktaGetUserParams,
-  type OktaGetUserResponse,
-  type OktaUser,
-  validateOktaDomain,
+import { validateOktaDomain } from '@/lib/core/security/input-validation'
+import type {
+  OktaApiError,
+  OktaGetUserParams,
+  OktaGetUserResponse,
+  OktaUser,
 } from '@/tools/okta/types'
 import type { ToolConfig } from '@/tools/types'