fix(aws): address final review

Share the optional-boolean parse through @sim/utils/coerce toBooleanFromInput,
the IAM tags schema through iam-shared, and the SES message-tag schema through
ses-shared. Accept SES email tags as a JSON string from agent calls, name the
field on Secrets Manager JSON errors, accept JSON-array IAM tag strings and skip
null tag values, and reject a JSON-object Textract query string.

Author: waleedlatif1

apps/sim/blocks/blocks/iam.ts

@@ -5,19 +5,28 @@ import { AuthMode, IntegrationType } from '@/blocks/types'
 import { withSavedCredential } from '@/blocks/utils'
 
 /**
- * Converts the Tags table, a `[{ key, value }]` list, a plain object, or a JSON object
- * string into the JSON object string the tools accept.
+ * Converts the Tags table, a `[{ key, value }]` list (or its JSON string), a plain
+ * object, or a JSON object string into the JSON object string the tools accept.
  */
 function serializeTags(tags: unknown): string | undefined {
-  if (typeof tags === 'string') return tags.trim() ? tags : undefined
+  if (typeof tags === 'string') {
+    const trimmed = tags.trim()
+    if (!trimmed) return undefined
+    if (!trimmed.startsWith('[')) return trimmed
+    try {
+      return serializeTags(JSON.parse(trimmed))
+    } catch {
+      return trimmed
+    }
+  }
   if (isRecordLike(tags)) return Object.keys(tags).length > 0 ? JSON.stringify(tags) : undefined
   if (!Array.isArray(tags)) return undefined
   const obj: Record<string, string> = {}
   for (const row of tags) {
     const entry = isRecordLike(row) && isRecordLike(row.cells) ? row.cells : row
     const key = isRecordLike(entry) ? entry.key : undefined
     const value = isRecordLike(entry) ? entry.value : undefined
-    if (typeof key === 'string' && key && value !== undefined) obj[key] = String(value)
+    if (typeof key === 'string' && key && value != null) obj[key] = String(value)
   }
   return Object.keys(obj).length > 0 ? JSON.stringify(obj) : undefined
 }

apps/sim/blocks/blocks/secrets_manager.ts

@@ -1,8 +1,19 @@
+import { getErrorMessage } from '@sim/utils/errors'
 import { SecretsManagerIcon } from '@/components/icons'
 import type { BlockConfig, BlockMeta } from '@/blocks/types'
 import { AuthMode, IntegrationType } from '@/blocks/types'
 import { withSavedCredential } from '@/blocks/utils'
 
+/** Parses a JSON field typed into the block, naming the field when it is invalid. */
+function parseJsonField(value: unknown, fieldName: string): unknown {
+  if (typeof value !== 'string') return value
+  try {
+    return JSON.parse(value)
+  } catch (error) {
+    throw new Error(`Invalid JSON in ${fieldName}: ${getErrorMessage(error)}`)
+  }
+}
+
 export const SecretsManagerBlock: BlockConfig = {
   type: 'secrets_manager',
   hideFromToolbar: true,
@@ -433,10 +444,7 @@ Return ONLY the JSON array - no explanations, no markdown code blocks.`,
             }
             if (rest.nextToken) result.nextToken = rest.nextToken
             if (rest.listFilters) {
-              result.filters =
-                typeof rest.listFilters === 'string'
-                  ? JSON.parse(rest.listFilters)
-                  : rest.listFilters
+              result.filters = parseJsonField(rest.listFilters, 'Filters')
             }
             if (rest.sortBy) result.sortBy = rest.sortBy
             if (rest.sortOrder) result.sortOrder = rest.sortOrder
@@ -449,11 +457,7 @@ Return ONLY the JSON array - no explanations, no markdown code blocks.`,
             result.secretValue = rest.secretValue
             if (rest.description) result.description = rest.description
             result.kmsKeyId = rest.kmsKeyId || undefined
-            result.tags = rest.createTags
-              ? typeof rest.createTags === 'string'
-                ? JSON.parse(rest.createTags)
-                : rest.createTags
-              : undefined
+            result.tags = rest.createTags ? parseJsonField(rest.createTags, 'Tags') : undefined
             break
           case 'update_secret':
             result.secretId = rest.secretId

apps/sim/blocks/blocks/textract.ts

@@ -251,11 +251,12 @@ interface TextractQueryParam {
  * one plain-text question per line.
  */
 function parseTextractQueries(value: unknown): TextractQueryParam[] {
+  if (value === undefined || value === null) return []
   let raw: unknown = value
   if (typeof value === 'string') {
     const trimmed = value.trim()
     if (!trimmed) return []
-    if (trimmed.startsWith('[')) {
+    if (trimmed.startsWith('[') || trimmed.startsWith('{')) {
       try {
         raw = JSON.parse(trimmed)
       } catch {
@@ -265,7 +266,9 @@ function parseTextractQueries(value: unknown): TextractQueryParam[] {
       raw = trimmed.split('\n')
     }
   }
-  if (!Array.isArray(raw)) return []
+  if (!Array.isArray(raw)) {
+    throw new Error('Queries must be a JSON array or one question per line')
+  }
   return raw.flatMap((entry): TextractQueryParam[] => {
     if (typeof entry === 'string') {
       const text = entry.trim()

apps/sim/lib/api/contracts/tools/aws/iam-create-role.ts

@@ -1,4 +1,3 @@
-import { isRecordLike } from '@sim/utils/object'
 import { z } from 'zod'
 import {
   iamAssumeRolePolicyDocumentSchema,
@@ -7,6 +6,7 @@ import {
   iamPolicyArnSchema,
   iamRoleDescriptionSchema,
   iamRoleNameSchema,
+  iamTagsJsonSchema,
 } from '@/lib/api/contracts/tools/aws/iam-shared'
 import type {
   ContractBody,
@@ -29,27 +29,7 @@ const Schema = z.object({
     .optional()
     .nullable(),
   permissionsBoundary: iamPolicyArnSchema.optional().nullable(),
-  tags: z
-    .string()
-    .refine(
-      (value) => {
-        try {
-          const parsed: unknown = JSON.parse(value)
-          return (
-            isRecordLike(parsed) &&
-            Object.keys(parsed).length <= 50 &&
-            Object.values(parsed).every((tagValue) =>
-              ['string', 'number', 'boolean'].includes(typeof tagValue)
-            )
-          )
-        } catch {
-          return false
-        }
-      },
-      { message: 'Tags must be a JSON object of at most 50 key/value pairs with scalar values' }
-    )
-    .optional()
-    .nullable(),
+  tags: iamTagsJsonSchema.optional().nullable(),
 })
 
 const CreateRoleResponseSchema = z.object({

apps/sim/lib/api/contracts/tools/aws/iam-create-user.ts

@@ -1,9 +1,9 @@
-import { isRecordLike } from '@sim/utils/object'
 import { z } from 'zod'
 import {
   iamConnectionShape,
   iamCreatePathSchema,
   iamPolicyArnSchema,
+  iamTagsJsonSchema,
   iamUserName64Schema,
 } from '@/lib/api/contracts/tools/aws/iam-shared'
 import type {
@@ -18,27 +18,7 @@ const Schema = z.object({
   userName: iamUserName64Schema,
   path: iamCreatePathSchema.optional().nullable(),
   permissionsBoundary: iamPolicyArnSchema.optional().nullable(),
-  tags: z
-    .string()
-    .refine(
-      (value) => {
-        try {
-          const parsed: unknown = JSON.parse(value)
-          return (
-            isRecordLike(parsed) &&
-            Object.keys(parsed).length <= 50 &&
-            Object.values(parsed).every((tagValue) =>
-              ['string', 'number', 'boolean'].includes(typeof tagValue)
-            )
-          )
-        } catch {
-          return false
-        }
-      },
-      { message: 'Tags must be a JSON object of at most 50 key/value pairs with scalar values' }
-    )
-    .optional()
-    .nullable(),
+  tags: iamTagsJsonSchema.optional().nullable(),
 })
 
 const CreateUserResponseSchema = z.object({

apps/sim/lib/api/contracts/tools/aws/iam-shared.ts

@@ -1,3 +1,4 @@
+import { isRecordLike } from '@sim/utils/object'
 import { z } from 'zod'
 import { validateAwsRegion } from '@/lib/core/security/input-validation'
 
@@ -266,3 +267,22 @@ export const iamPaginationResponseShape = {
   marker: z.string().nullable(),
   count: z.number(),
 }
+
+/** IAM tags as a JSON object string: at most 50 pairs with string, number, or boolean values. */
+export const iamTagsJsonSchema = z.string().refine(
+  (value) => {
+    try {
+      const parsed: unknown = JSON.parse(value)
+      return (
+        isRecordLike(parsed) &&
+        Object.keys(parsed).length <= 50 &&
+        Object.values(parsed).every((tagValue) =>
+          ['string', 'number', 'boolean'].includes(typeof tagValue)
+        )
+      )
+    } catch {
+      return false
+    }
+  },
+  { message: 'Tags must be a JSON object of at most 50 key/value pairs with scalar values' }
+)

apps/sim/lib/api/contracts/tools/aws/ses-send-bulk-email.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod'
+import { sesEmailTagsSchema } from '@/lib/api/contracts/tools/aws/ses-shared'
 import type {
   ContractBody,
   ContractBodyInput,
@@ -7,11 +8,6 @@ import type {
 import { defineRouteContract } from '@/lib/api/contracts/types'
 import { validateAwsRegion } from '@/lib/core/security/input-validation'
 
-/** SES `MessageTag` name or value: 1-256 letters, digits, underscores, or hyphens. */
-const sesMessageTagPartSchema = z
-  .string()
-  .regex(/^[A-Za-z0-9_-]{1,256}$/, 'Tag names and values may contain only letters, digits, _ and -')
-
 const SendBulkEmailSchema = z.object({
   region: z
     .string()
@@ -28,9 +24,7 @@ const SendBulkEmailSchema = z.object({
   configurationSetName: z.string().nullish(),
   replyToAddresses: z.string().nullish(),
   fromName: z.string().nullish(),
-  emailTags: z
-    .array(z.object({ name: sesMessageTagPartSchema, value: sesMessageTagPartSchema }))
-    .nullish(),
+  emailTags: sesEmailTagsSchema,
 })
 
 const SendBulkEmailResponseSchema = z.object({

apps/sim/lib/api/contracts/tools/aws/ses-send-email.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod'
+import { sesEmailTagsSchema } from '@/lib/api/contracts/tools/aws/ses-shared'
 import type {
   ContractBody,
   ContractBodyInput,
@@ -7,11 +8,6 @@ import type {
 import { defineRouteContract } from '@/lib/api/contracts/types'
 import { validateAwsRegion } from '@/lib/core/security/input-validation'
 
-/** SES `MessageTag` name or value: 1-256 letters, digits, underscores, or hyphens. */
-const sesMessageTagPartSchema = z
-  .string()
-  .regex(/^[A-Za-z0-9_-]{1,256}$/, 'Tag names and values may contain only letters, digits, _ and -')
-
 const SendEmailSchema = z
   .object({
     region: z
@@ -32,9 +28,7 @@ const SendEmailSchema = z
     replyToAddresses: z.string().nullish(),
     configurationSetName: z.string().nullish(),
     fromName: z.string().nullish(),
-    emailTags: z
-      .array(z.object({ name: sesMessageTagPartSchema, value: sesMessageTagPartSchema }))
-      .nullish(),
+    emailTags: sesEmailTagsSchema,
   })
   .refine((data) => data.bodyText || data.bodyHtml, {
     message: 'At least one of bodyText or bodyHtml is required',

apps/sim/lib/api/contracts/tools/aws/ses-send-templated-email.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod'
+import { sesEmailTagsSchema } from '@/lib/api/contracts/tools/aws/ses-shared'
 import type {
   ContractBody,
   ContractBodyInput,
@@ -7,11 +8,6 @@ import type {
 import { defineRouteContract } from '@/lib/api/contracts/types'
 import { validateAwsRegion } from '@/lib/core/security/input-validation'
 
-/** SES `MessageTag` name or value: 1-256 letters, digits, underscores, or hyphens. */
-const sesMessageTagPartSchema = z
-  .string()
-  .regex(/^[A-Za-z0-9_-]{1,256}$/, 'Tag names and values may contain only letters, digits, _ and -')
-
 const SendTemplatedEmailSchema = z.object({
   region: z
     .string()
@@ -30,9 +26,7 @@ const SendTemplatedEmailSchema = z.object({
   configurationSetName: z.string().nullish(),
   replyToAddresses: z.string().nullish(),
   fromName: z.string().nullish(),
-  emailTags: z
-    .array(z.object({ name: sesMessageTagPartSchema, value: sesMessageTagPartSchema }))
-    .nullish(),
+  emailTags: sesEmailTagsSchema,
 })
 
 const SendTemplatedEmailResponseSchema = z.object({

apps/sim/lib/api/contracts/tools/aws/ses-shared.ts

@@ -0,0 +1,11 @@
+import { z } from 'zod'
+
+/** SES `MessageTag` name or value: 1-256 letters, digits, underscores, or hyphens. */
+const sesMessageTagPartSchema = z
+  .string()
+  .regex(/^[A-Za-z0-9_-]{1,256}$/, 'Tag names and values may contain only letters, digits, _ and -')
+
+/** Message tags on an SES send, for filtering its sending events. */
+export const sesEmailTagsSchema = z
+  .array(z.object({ name: sesMessageTagPartSchema, value: sesMessageTagPartSchema }))
+  .nullish()