feat(oracle-epm): add validated integration foundation

Author: Bill Leoutsakos

apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/client-credential-account-modal.tsx

@@ -189,7 +189,7 @@ function ClientCredentialAccountModalForm({
       // stored on a credential whose grant never reads it.
       const secretFields: FieldValues = {}
       for (const field of visibleFields) {
-        const value = values[field.id]?.trim()
+        const value = field.preserveWhitespace ? values[field.id] : values[field.id]?.trim()
         if (value) secretFields[field.id] = value
       }
       if (credentialId) {

apps/sim/lib/api/contracts/credentials.ts

@@ -156,7 +156,7 @@ export const createCredentialFieldsSchema = z.object({
   signingSecret: z.string().trim().min(1).optional(),
   botToken: z.string().trim().min(1).optional(),
   clientId: z.string().trim().min(1).max(512).optional(),
-  clientSecret: z.string().trim().min(1).max(1024).optional(),
+  clientSecret: z.string().min(1).max(1024).optional(),
   certificateId: z.string().trim().min(1).max(512).optional(),
   orgId: z.string().trim().min(1).max(255).optional(),
   /** Optional provider region selector (Zoho Desk data center). */
@@ -276,7 +276,7 @@ export const updateCredentialByIdBodySchema = z
     atlassianProduct: atlassianProductSchema.optional(),
     /** Client-credential service-account secret rotation (reconnect). */
     clientId: z.string().trim().min(1).max(512).optional(),
-    clientSecret: z.string().trim().min(1).max(1024).optional(),
+    clientSecret: z.string().min(1).max(1024).optional(),
     certificateId: z.string().trim().min(1).max(512).optional(),
     orgId: z.string().trim().min(1).max(255).optional(),
     dataCenter: z.string().trim().min(1).max(32).optional(),

apps/sim/lib/api/contracts/v2/credentials.ts

@@ -444,7 +444,6 @@ const v2ServiceAccountCredentialFieldsSchema = z
     clientId: z.string().trim().min(1).max(512).optional().describe('OAuth client identifier.'),
     clientSecret: z
       .string()
-      .trim()
       .min(1)
       .max(1024)
       .optional()
@@ -693,7 +692,6 @@ const v2ServiceAccountSecretFieldsShape = {
   clientId: z.string().trim().min(1).max(512).optional().describe('OAuth client identifier.'),
   clientSecret: z
     .string()
-    .trim()
     .min(1)
     .max(1024)
     .optional()

apps/sim/lib/credentials/client-credential-accounts/descriptors.ts

@@ -42,6 +42,8 @@ export interface ClientCredentialAccountField {
   placeholder: string
   /** Rendered with SecretInput and never echoed back. */
   secret: boolean
+  /** Preserve exact password bytes instead of normalizing surrounding whitespace. */
+  preserveWhitespace?: boolean
   /**
    * Renders a multi-line control instead of a single-line one. Required for
    * PEM-encoded material (a private key spans ~28 newline-separated lines and
@@ -111,13 +113,15 @@ export const BOX_SERVICE_ACCOUNT_PROVIDER_ID = 'box-service-account' as const
 export const SALESFORCE_SERVICE_ACCOUNT_PROVIDER_ID = 'salesforce-service-account' as const
 export const ZOHO_DESK_SERVICE_ACCOUNT_PROVIDER_ID = 'zoho-desk-service-account' as const
 export const NETSUITE_SERVICE_ACCOUNT_PROVIDER_ID = 'netsuite-service-account' as const
+export const ORACLE_EPM_SERVICE_ACCOUNT_PROVIDER_ID = 'oracle-epm-service-account' as const
 
 export type ClientCredentialAccountProviderId =
   | typeof ZOOM_SERVICE_ACCOUNT_PROVIDER_ID
   | typeof BOX_SERVICE_ACCOUNT_PROVIDER_ID
   | typeof SALESFORCE_SERVICE_ACCOUNT_PROVIDER_ID
   | typeof ZOHO_DESK_SERVICE_ACCOUNT_PROVIDER_ID
   | typeof NETSUITE_SERVICE_ACCOUNT_PROVIDER_ID
+  | typeof ORACLE_EPM_SERVICE_ACCOUNT_PROVIDER_ID
 
 /**
  * Exact account-specific SuiteTalk origin accepted by NetSuite's OAuth and
@@ -531,6 +535,40 @@ export const CLIENT_CREDENTIAL_ACCOUNT_DESCRIPTORS: Record<
     helpText:
       'Use the account-specific SuiteTalk URL and the client ID, certificate ID, and private key from one OAuth 2.0 client-credentials mapping.',
   },
+  [ORACLE_EPM_SERVICE_ACCOUNT_PROVIDER_ID]: {
+    providerId: ORACLE_EPM_SERVICE_ACCOUNT_PROVIDER_ID,
+    serviceLabel: 'Oracle EPM Cloud',
+    connectNoun: 'integration user',
+    fields: [
+      {
+        id: 'orgId',
+        label: 'REST Base URL',
+        placeholder: 'https://example.oraclecloud.com',
+        secret: false,
+        hintPattern: /^https:\/\//,
+        hintMessage: 'Expected the HTTPS REST base URL for one Oracle EPM environment.',
+        hint: 'Enter the HTTPS base URL for your environment without /epmcloud or an API endpoint path. Include a gateway prefix only if your deployment requires it.',
+      },
+      {
+        id: 'clientId',
+        label: 'Integration username',
+        placeholder: 'integration.user@example.com',
+        secret: false,
+        hint: 'Basic authentication requires a user without MFA. Credentials are checked on the first product request.',
+      },
+      {
+        id: 'clientSecret',
+        label: 'Password',
+        placeholder: 'Paste the integration user password',
+        secret: true,
+        preserveWhitespace: true,
+      },
+    ],
+    docsUrl:
+      'https://docs.oracle.com/en/cloud/saas/enterprise-performance-management-common/prest/authentication.html',
+    helpText:
+      'The credential is bound to one EPM environment. Use a dedicated integration user with only the permissions its workflows require.',
+  },
 }
 
 /**

apps/sim/lib/credentials/client-credential-accounts/minters/oracle-epm.test.ts

@@ -0,0 +1,66 @@
+/** @vitest-environment node */
+import { describe, expect, it, vi } from 'vitest'
+import { mintOracleEpmServiceAccountToken } from '@/lib/credentials/client-credential-accounts/minters/oracle-epm'
+import { TokenServiceAccountValidationError } from '@/lib/credentials/token-service-accounts/errors'
+
+describe('mintOracleEpmServiceAccountToken', () => {
+  it('mints Basic authentication locally and binds the normalized destination', async () => {
+    const fetchSpy = vi.spyOn(globalThis, 'fetch')
+    const result = await mintOracleEpmServiceAccountToken({
+      orgId: ' https://EPM.example.com/gateway/ ',
+      clientId: 'integration.user@example.com',
+      clientSecret: 'password',
+    })
+    expect(Buffer.from(result.accessToken, 'base64').toString()).toBe(
+      'integration.user@example.com:password'
+    )
+    expect(result).toMatchObject({
+      expiresInSeconds: 600,
+      instanceUrl: 'https://epm.example.com/gateway',
+      identity: {
+        principal: null,
+        auditMetadata: { environmentUrl: 'https://epm.example.com/gateway' },
+        storedMetadata: { environmentUrl: 'https://epm.example.com/gateway' },
+      },
+    })
+    expect(JSON.stringify(result.identity)).not.toContain('password')
+    expect(JSON.stringify(result.identity)).not.toContain('integration.user')
+    expect(fetchSpy).not.toHaveBeenCalled()
+    fetchSpy.mockRestore()
+  })
+
+  it.each([
+    { clientId: 'user:name', clientSecret: 'password' },
+    { clientId: 'user\nname', clientSecret: 'password' },
+    { clientId: 'user', clientSecret: 'pass\nword' },
+    { clientId: 'user\uD800', clientSecret: 'password' },
+    { clientId: 'user', clientSecret: 'password\uDC00' },
+    { clientId: '', clientSecret: 'password' },
+  ])('rejects unsafe Basic credential text', async (credentials) => {
+    await expect(
+      mintOracleEpmServiceAccountToken({
+        orgId: 'https://epm.example.com',
+        ...credentials,
+      })
+    ).rejects.toBeInstanceOf(TokenServiceAccountValidationError)
+  })
+
+  it('preserves valid surrogate pairs in Basic credential values', async () => {
+    const result = await mintOracleEpmServiceAccountToken({
+      orgId: 'https://epm.example.com',
+      clientId: 'integration-😀',
+      clientSecret: 'password-🔒',
+    })
+    expect(Buffer.from(result.accessToken, 'base64').toString()).toBe('integration-😀:password-🔒')
+  })
+
+  it('does not reflect secrets in validation errors', async () => {
+    const secret = 'password-with-newline\n'
+    const error = await mintOracleEpmServiceAccountToken({
+      orgId: 'https://epm.example.com',
+      clientId: 'user',
+      clientSecret: secret,
+    }).catch((value: unknown) => value)
+    expect(JSON.stringify(error)).not.toContain(secret)
+  })
+})

apps/sim/lib/credentials/client-credential-accounts/minters/oracle-epm.ts

@@ -0,0 +1,79 @@
+import type {
+  ClientCredentialAccountFields,
+  ClientCredentialAccountMintOptions,
+  ClientCredentialAccountMintResult,
+} from '@/lib/credentials/client-credential-accounts/server'
+import {
+  requireClientSecret,
+  TokenServiceAccountValidationError,
+} from '@/lib/credentials/token-service-accounts/errors'
+import { normalizeOracleEpmDestination } from '@/lib/internal/oracle-epm/destination'
+
+const SYNTHETIC_TOKEN_TTL_SECONDS = 600
+const MAX_USERNAME_BYTES = 255
+const MAX_AUTH_VALUE_BYTES = 1_024
+const FORBIDDEN_CREDENTIAL_TEXT = /[\u0000-\u001f\u007f]/
+const MALFORMED_UTF16 = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/
+
+function invalidCredentials(reason: string): TokenServiceAccountValidationError {
+  return new TokenServiceAccountValidationError('invalid_credentials', 400, {
+    step: 'oracle_epm_basic_auth',
+    reason,
+  })
+}
+
+/**
+ * Builds credential-bound Basic authentication locally. Oracle EPM does not
+ * expose a token mint for this v1 flow, so connect performs no network probe.
+ */
+export async function mintOracleEpmServiceAccountToken(
+  fields: ClientCredentialAccountFields,
+  _options?: ClientCredentialAccountMintOptions
+): Promise<ClientCredentialAccountMintResult> {
+  let instanceUrl: string
+  try {
+    instanceUrl = normalizeOracleEpmDestination(fields.orgId)
+  } catch {
+    throw new TokenServiceAccountValidationError('site_not_found', 400, {
+      step: 'oracle_epm_destination_validation',
+      reason: 'environment URL must be a valid HTTPS Oracle EPM destination',
+    })
+  }
+
+  const username = fields.clientId.trim()
+  const password = requireClientSecret(
+    fields.clientSecret,
+    'oracle_epm_basic_auth',
+    'Oracle EPM Cloud'
+  )
+  if (
+    !username ||
+    username.includes(':') ||
+    FORBIDDEN_CREDENTIAL_TEXT.test(username) ||
+    MALFORMED_UTF16.test(username) ||
+    Buffer.byteLength(username, 'utf8') > MAX_USERNAME_BYTES
+  ) {
+    throw invalidCredentials('integration username is invalid')
+  }
+  if (
+    !password ||
+    FORBIDDEN_CREDENTIAL_TEXT.test(password) ||
+    MALFORMED_UTF16.test(password) ||
+    Buffer.byteLength(password, 'utf8') > MAX_AUTH_VALUE_BYTES
+  ) {
+    throw invalidCredentials('password is invalid')
+  }
+
+  const hostname = new URL(instanceUrl).hostname
+  return {
+    accessToken: Buffer.from(`${username}:${password}`, 'utf8').toString('base64'),
+    expiresInSeconds: SYNTHETIC_TOKEN_TTL_SECONDS,
+    instanceUrl,
+    identity: {
+      displayName: `Oracle EPM ${hostname}`,
+      principal: null,
+      auditMetadata: { environmentUrl: instanceUrl },
+      storedMetadata: { environmentUrl: instanceUrl },
+    },
+  }
+}

apps/sim/lib/credentials/client-credential-accounts/oracle-epm-password.test.ts

@@ -0,0 +1,69 @@
+import { encryptionMock, encryptionMockFns } from '@sim/testing/mocks/encryption.mock'
+import { beforeEach, expect, it, vi } from 'vitest'
+import {
+  createCredentialBodySchema,
+  updateCredentialByIdBodySchema,
+} from '@/lib/api/contracts/credentials'
+import {
+  v2CreateServiceAccountCredentialBodySchema,
+  v2UpdateCredentialBodySchema,
+} from '@/lib/api/contracts/v2/credentials'
+import { mintOracleEpmServiceAccountToken } from '@/lib/credentials/client-credential-accounts/minters/oracle-epm'
+import { parseClientCredentialAccountSecretBlob } from '@/lib/credentials/client-credential-accounts/server'
+import { verifyAndBuildServiceAccountSecret } from '@/lib/credentials/service-account-secret'
+
+vi.mock('@/lib/core/security/encryption', () => encryptionMock)
+
+const input = {
+  workspaceId: '11111111-1111-4111-8111-111111111111',
+  type: 'service_account' as const,
+  providerId: 'oracle-epm-service-account',
+  displayName: 'Oracle test',
+  orgId: 'https://epm.example.com/gateway',
+  clientId: 'integration-user',
+  clientSecret: ' password with spaces ',
+}
+
+beforeEach(() => {
+  encryptionMockFns.mockEncryptSecret.mockImplementation(async (value: string) => ({
+    encrypted: value,
+  }))
+})
+
+it.each([
+  ['internal create', () => createCredentialBodySchema.parse(input)],
+  [
+    'internal reconnect',
+    () => updateCredentialByIdBodySchema.parse({ clientSecret: input.clientSecret }),
+  ],
+  [
+    'v2 create',
+    () =>
+      v2CreateServiceAccountCredentialBodySchema.parse({
+        workspaceId: input.workspaceId,
+        type: input.type,
+        providerId: input.providerId,
+        credentials: JSON.stringify({
+          orgId: input.orgId,
+          clientId: input.clientId,
+          clientSecret: input.clientSecret,
+        }),
+      }).credentials,
+  ],
+  ['v2 reconnect', () => v2UpdateCredentialBodySchema.parse({ clientSecret: input.clientSecret })],
+  ['secret builder', () => input],
+] as const)(
+  'preserves the password through %s, storage, and Basic authentication',
+  async (_surface, parse) => {
+    const fields = { ...input, ...parse() }
+    const result = await verifyAndBuildServiceAccountSecret(input.providerId, fields)
+    const stored = parseClientCredentialAccountSecretBlob(
+      result.encryptedServiceAccountKey,
+      input.providerId
+    )
+    const credential = await mintOracleEpmServiceAccountToken(stored)
+    expect(Buffer.from(credential.accessToken, 'base64').toString('utf8')).toBe(
+      `integration-user:${input.clientSecret}`
+    )
+  }
+)

apps/sim/lib/credentials/client-credential-accounts/server.ts

@@ -5,19 +5,21 @@ import {
   getClientCredentialAccountDescriptor,
   isClientCredentialAccountProviderId,
   NETSUITE_SERVICE_ACCOUNT_PROVIDER_ID,
+  ORACLE_EPM_SERVICE_ACCOUNT_PROVIDER_ID,
   partitionClientCredentialFields,
   SALESFORCE_SERVICE_ACCOUNT_PROVIDER_ID,
   ZOHO_DESK_SERVICE_ACCOUNT_PROVIDER_ID,
   ZOOM_SERVICE_ACCOUNT_PROVIDER_ID,
 } from '@/lib/credentials/client-credential-accounts/descriptors'
 import { mintBoxServiceAccountToken } from '@/lib/credentials/client-credential-accounts/minters/box'
 import { mintNetSuiteServiceAccountToken } from '@/lib/credentials/client-credential-accounts/minters/netsuite'
+import { mintOracleEpmServiceAccountToken } from '@/lib/credentials/client-credential-accounts/minters/oracle-epm'
 import { mintSalesforceServiceAccountToken } from '@/lib/credentials/client-credential-accounts/minters/salesforce'
 import { mintZohoDeskServiceAccountToken } from '@/lib/credentials/client-credential-accounts/minters/zoho-desk'
 import { mintZoomServiceAccountToken } from '@/lib/credentials/client-credential-accounts/minters/zoom'
 import type { ServiceAccountPrincipal } from '@/lib/credentials/principal'
 
-/** Raw fields a client-credential minter receives (already trimmed). */
+/** Credential fields normalized according to the provider descriptor; passwords retain exact bytes. */
 export interface ClientCredentialAccountFields {
   clientId: string
   /** Certificate mapping identifier used as the JWT `kid` by NetSuite. */
@@ -29,8 +31,8 @@ export interface ClientCredentialAccountFields {
   clientSecret?: string
   /**
    * Provider-specific org identifier (Zoom Account ID, Box Enterprise ID,
-   * Salesforce My Domain host, Zoho Desk organization ID, or NetSuite
-   * SuiteTalk origin).
+   * Salesforce My Domain host, Zoho Desk organization ID, NetSuite SuiteTalk
+   * origin, or an Oracle EPM environment URL).
    */
   orgId: string
   /**
@@ -84,8 +86,8 @@ export interface ClientCredentialAccountMintResult {
   accessToken: string
   expiresInSeconds: number
   /**
-   * Provider API origin the minted token must be used against (Salesforce or
-   * NetSuite), forwarded to tools alongside the token.
+   * Provider API destination the minted token must be used against (Salesforce,
+   * NetSuite, or Oracle EPM), forwarded to tools alongside the token.
    */
   instanceUrl?: string
   /**
@@ -130,6 +132,7 @@ const CLIENT_CREDENTIAL_ACCOUNT_MINTERS: Record<
   [SALESFORCE_SERVICE_ACCOUNT_PROVIDER_ID]: mintSalesforceServiceAccountToken,
   [ZOHO_DESK_SERVICE_ACCOUNT_PROVIDER_ID]: mintZohoDeskServiceAccountToken,
   [NETSUITE_SERVICE_ACCOUNT_PROVIDER_ID]: mintNetSuiteServiceAccountToken,
+  [ORACLE_EPM_SERVICE_ACCOUNT_PROVIDER_ID]: mintOracleEpmServiceAccountToken,
 }
 
 export function getClientCredentialAccountMinter(