fix(agiloft): redact encoded credentials and separate declines from unconfirmed writes

Review round 2.

Redaction only replaced the raw credential strings, but the values are sent
form-encoded, so an error page quoting the submitted parameters quotes the
encoded spelling. A password with a space leaves as a%20b or a+b and sailed
past a replace that only knew a b. All three spellings are now replaced,
longest first.

Redaction also ran after truncation on the create path, so clipping the text
could cut through a credential and leave a prefix that no longer matched
anything being replaced. The order is reversed and the reason recorded, since
the two read as interchangeable and are not.

The non-OK create branch always warned that the record might exist, including
on a 4xx validation decline where Agiloft had refused the request and written
nothing. That is the opposite of the rule this branch introduces: it told the
caller not to retry a create that never happened. A 4xx carrying a typed
exception is now reported as a definite refusal; a 5xx keeps the warning,
because a server fault may have committed first.

Redirects were refused on the calls carrying credentials in a body but not on
executeAgiloftRequest's operation fetch or on logout, both of which send a
Bearer token that secureFetchWithPinnedIP would replay to a redirect host.
Those are the calls behind list tables and saved search.

Author: mzxchandra

apps/sim/app/api/tools/agiloft/create_record/route.test.ts

@@ -311,6 +311,43 @@ describe('EWCreate', () => {
     expect(data.error).toContain('[redacted]')
   })
 
+  /**
+   * A 4xx carrying a typed exception is Agiloft declining the request, so
+   * nothing was written and warning about a phantom record is wrong.
+   */
+  it('reports a 4xx validation decline as a definite failure, not an unconfirmed write', async () => {
+    arrangeCreate(
+      res({
+        ok: false,
+        status: 400,
+        text: '<html><body>EWWrongDataException has occurred: Wrong format/value pointed to start_date</body></html>',
+      })
+    )
+
+    const response = await POST(createMockRequest('POST', { ...baseBody, data: '{"a":"b"}' }))
+    const data = (await response.json()) as { success: boolean; error?: string }
+
+    expect(response.status).toBe(200)
+    expect(data.success).toBe(false)
+    expect(data.error).toContain('no record was written')
+    expect(data.error).not.toContain('may exist')
+  })
+
+  it('keeps the unconfirmed warning on a 5xx, which may have committed first', async () => {
+    arrangeCreate(
+      res({
+        ok: false,
+        status: 502,
+        text: '<html><body>EWUnexpectedException has occurred: upstream failure</body></html>',
+      })
+    )
+
+    const response = await POST(createMockRequest('POST', { ...baseBody, data: '{"a":"b"}' }))
+    const data = (await response.json()) as { error?: string }
+
+    expect(data.error).toContain('may exist')
+  })
+
   it('keeps the instance password out of a relayed transport error', async () => {
     inputValidationMockFns.mockSecureFetchWithPinnedIP.mockRejectedValueOnce(
       new Error(`upstream echoed $password=${PLACEHOLDER_PASSWORD}`)

apps/sim/app/api/tools/agiloft/create_record/route.ts

@@ -130,7 +130,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
            * and the credentials are in the submitted form body, so an error page
            * that echoes request parameters would carry them back.
            */
-          const described = redactAgiloftSecrets(truncate(describeAgiloftError(text), 300), params)
+          const described = truncate(redactAgiloftSecrets(describeAgiloftError(text), params), 300)
 
           /**
            * Every failure below is one Agiloft already decided on, so each is
@@ -139,10 +139,19 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
            * record rather than converging on the first.
            */
           if (!response.ok) {
+            /**
+             * A 4xx carrying a typed exception is Agiloft validating the request
+             * and declining it, so nothing was written and a corrected retry is
+             * safe. A 5xx is a server fault that may have committed first, so it
+             * keeps the unconfirmed warning whatever the body says.
+             */
+            const declined = response.status < 500 && AGILOFT_EXCEPTION.test(described)
             return {
               success: false,
               output: { id: null, fields: {} },
-              error: `${UNCONFIRMED_PREFIX} Agiloft answered ${response.status}: ${described}`,
+              error: declined
+                ? `Agiloft refused the create, so no record was written: ${described}`
+                : `${UNCONFIRMED_PREFIX} Agiloft answered ${response.status}: ${described}`,
             }
           }
 
@@ -155,17 +164,17 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
            * unexplained missing ID leaves the write in doubt.
            */
           if (!id) {
-            const refused = AGILOFT_EXCEPTION.test(described)
+            const declined = AGILOFT_EXCEPTION.test(described)
             logger.error(`[${requestId}] Agiloft create returned no record ID`, {
               table: params.table,
               login: params.login,
               fields: Object.keys(fieldValues),
-              refused,
+              declined,
             })
             return {
               success: false,
               output: { id: null, fields: {} },
-              error: refused
+              error: declined
                 ? `Agiloft refused the create, so no record was written: ${described}`
                 : `${UNCONFIRMED_PREFIX} Agiloft accepted the create but returned no record ID: ${described}`,
             }

apps/sim/tools/agiloft/utils.server.ts

@@ -144,6 +144,7 @@ export async function agiloftLogoutPinned(
       {
         method: 'POST',
         headers: { Authorization: authorization },
+        ...AGILOFT_NO_REDIRECT,
       }
     )
   } catch (error) {
@@ -189,6 +190,7 @@ export async function executeAgiloftRequest<R extends ToolResponse>(
         Authorization: session.authorization,
       },
       body: req.body,
+      ...AGILOFT_NO_REDIRECT,
     })
     return await transformResponse(response)
   } finally {

apps/sim/tools/agiloft/utils.test.ts

@@ -20,6 +20,7 @@ import {
   describeAgiloftError,
   ewCredentialBody,
   parseFieldList,
+  redactAgiloftSecrets,
 } from '@/tools/agiloft/utils'
 
 /** Obvious non-secret so credential scanners do not flag these fixtures. */
@@ -386,3 +387,36 @@ describe('pagination input', () => {
     expect(sent.get('limit')).toBe('10')
   })
 })
+
+describe('credential redaction', () => {
+  const creds = { login: 'svc.user', password: 'p@ss word&1' }
+
+  /**
+   * The value goes out form-encoded, so an error page quoting the submitted
+   * parameters quotes the encoded spelling, not the raw one.
+   */
+  it('redacts the encoded spellings the request actually sent', () => {
+    const echoed = [
+      `raw=${creds.password}`,
+      `enc=${encodeURIComponent(creds.password)}`,
+      `form=${encodeURIComponent(creds.password).replace(/%20/g, '+')}`,
+    ].join(' ')
+
+    const safe = redactAgiloftSecrets(echoed, creds)
+
+    expect(safe).not.toContain(creds.password)
+    expect(safe).not.toContain(encodeURIComponent(creds.password))
+    expect(safe).not.toContain('p%40ss+word%261')
+    expect(safe.match(/\[redacted\]/g)).toHaveLength(3)
+  })
+
+  it('redacts the login as well as the password', () => {
+    expect(redactAgiloftSecrets('user=svc.user', creds)).not.toContain('svc.user')
+  })
+
+  it('leaves text carrying no credential untouched', () => {
+    expect(redactAgiloftSecrets('EWWrongDataException: no column bogus', creds)).toBe(
+      'EWWrongDataException: no column bogus'
+    )
+  })
+})

apps/sim/tools/agiloft/utils.ts

@@ -43,6 +43,21 @@ export function describeAgiloftError(body: string): string {
   return detail ? `${typed[1]}: ${detail}` : typed[1]
 }
 
+/**
+ * Every spelling of a credential that could come back in an echoed response.
+ *
+ * The value is sent form-encoded, so an error page that quotes the submitted
+ * parameters quotes the encoded form, not the raw one. A password with a space
+ * leaves as `a%20b` or `a+b` and would sail past a replace that only knows
+ * `a b`. Longest first so a variant that contains another is replaced whole.
+ */
+function secretSpellings(secret: string): string[] {
+  const encoded = encodeURIComponent(secret)
+  return [...new Set([secret, encoded, encoded.replace(/%20/g, '+')])].sort(
+    (a, b) => b.length - a.length
+  )
+}
+
 /**
  * Strips the instance credentials out of any text relayed to the caller.
  *
@@ -51,14 +66,21 @@ export function describeAgiloftError(body: string): string {
  * parameters would carry them straight back. Anything derived from an upstream
  * response or a transport error goes through here before it reaches a workflow
  * result or a log.
+ *
+ * Redact before truncating, never after: clipping the text first can cut
+ * through a credential and leave a prefix that no longer matches anything this
+ * replaces.
  */
 export function redactAgiloftSecrets(
   message: string,
   credentials: { login: string; password: string }
 ): string {
   let safe = message
   for (const secret of [credentials.password, credentials.login]) {
-    if (secret) safe = safe.split(secret).join('[redacted]')
+    if (!secret) continue
+    for (const spelling of secretSpellings(secret)) {
+      safe = safe.split(spelling).join('[redacted]')
+    }
   }
   return safe
 }