fix(integrations): validate Oracle selector detail IDs

Author: Bill Leoutsakos

apps/sim/lib/selectors/server/providers/oracle-fusion-hcm.test.ts

@@ -4,6 +4,7 @@ import { selectorManifest } from '@/lib/selectors/manifest'
 import {
   SelectorConnectionUnavailableError,
   SelectorContextUnavailableError,
+  SelectorOptionsUnavailableError,
 } from '@/lib/selectors/server/errors'
 import { oracleFusionHcmSelectorAttachments } from '@/lib/selectors/server/providers/oracle-fusion-hcm'
 import type {
@@ -291,6 +292,32 @@ describe('Oracle Fusion HCM selectors', () => {
     )
   })
 
+  it('rejects detail responses whose resource ID differs from the requested ID', async () => {
+    const context = {
+      domain: 'https://acme.fa.ocs.oraclecloud.com',
+      username: 'reader',
+      password: 'secret',
+      personId: '1',
+    }
+    for (const [key, id, mock, output] of [
+      ['workers', '1', mocks.getWorker, { worker: { personId: '9' } }],
+      ['assignments', '2', mocks.getAssignment, { assignment: { assignmentId: '9' } }],
+      ['absences', '3', mocks.getAbsence, { absence: { absenceId: '9', personId: '1' } }],
+    ] as const) {
+      mock.mockResolvedValueOnce({ success: true, output })
+      const attachment = oracleFusionHcmSelectorAttachments[`oracle_fusion_hcm.${key}`]
+      const input = args({
+        selectorKey: `oracle_fusion_hcm.${key}`,
+        context,
+        request: { kind: 'detail', id },
+      })
+
+      await expect(
+        attachment.execute(input, await prepare(attachment, input))
+      ).rejects.toBeInstanceOf(SelectorOptionsUnavailableError)
+    }
+  })
+
   it('rejects an absence detail that does not belong to the selected worker', async () => {
     mocks.getAbsence.mockResolvedValueOnce({
       success: true,

apps/sim/lib/selectors/server/providers/oracle-fusion-hcm.ts

@@ -97,13 +97,17 @@ export const oracleFusionHcmSelectorAttachments = {
     async execute(args, prepared) {
       try {
         if (args.request.kind === 'detail') {
+          const requestedPersonId = parseId(args.request.id)
           const result = await executeOracleFusionHcmGetWorker(
-            { ...prepared, personId: parseId(args.request.id) },
+            { ...prepared, personId: requestedPersonId },
             args.signal
           )
           const worker = result.output.worker
+          if (worker.personId !== requestedPersonId) {
+            throw new SelectorOptionsUnavailableError()
+          }
           return detailSelectorResult({
-            id: worker.personId,
+            id: requestedPersonId,
             label: worker.displayName || worker.personNumber || worker.personId,
             meta: { personNumber: worker.personNumber, workEmail: worker.workEmail },
           })
@@ -137,17 +141,21 @@ export const oracleFusionHcmSelectorAttachments = {
       if (!prepared.personId) throw new SelectorContextUnavailableError()
       try {
         if (args.request.kind === 'detail') {
+          const requestedAssignmentId = parseId(args.request.id)
           const result = await executeOracleFusionHcmGetWorkerAssignment(
             {
               ...prepared,
               personId: prepared.personId,
-              assignmentId: parseId(args.request.id),
+              assignmentId: requestedAssignmentId,
             },
             args.signal
           )
           const assignment = result.output.assignment
+          if (assignment.assignmentId !== requestedAssignmentId) {
+            throw new SelectorOptionsUnavailableError()
+          }
           return detailSelectorResult({
-            id: assignment.assignmentId,
+            id: requestedAssignmentId,
             label:
               assignment.assignmentName || assignment.assignmentNumber || assignment.assignmentId,
             meta: { assignmentNumber: assignment.assignmentNumber },
@@ -183,16 +191,18 @@ export const oracleFusionHcmSelectorAttachments = {
       if (!prepared.personId) throw new SelectorContextUnavailableError()
       try {
         if (args.request.kind === 'detail') {
+          const requestedAbsenceId = parseId(args.request.id)
           const result = await executeOracleFusionHcmGetAbsence(
-            { ...prepared, absenceId: parseId(args.request.id) },
+            { ...prepared, absenceId: requestedAbsenceId },
             args.signal
           )
           const absence = result.output.absence
-          if (absence.personId !== prepared.personId) {
-            throw new SelectorContextUnavailableError()
+          if (absence.absenceId !== requestedAbsenceId) {
+            throw new SelectorOptionsUnavailableError()
           }
+          if (absence.personId !== prepared.personId) throw new SelectorContextUnavailableError()
           return detailSelectorResult({
-            id: absence.absenceId,
+            id: requestedAbsenceId,
             label:
               [absence.absenceType, absence.startDate, absence.endDate]
                 .filter(Boolean)