feat(oracle-fusion): add shared integration foundation

apps/sim/lib/credentials/client-credential-accounts/descriptors.test.ts

@@ -3,6 +3,7 @@ import {
   BOX_SERVICE_ACCOUNT_PROVIDER_ID,
   getClientCredentialAccountDescriptor,
   normalizeNetSuiteSuiteTalkOrigin,
+  normalizeOracleFusionApplicationOrigin,
   partitionClientCredentialFields,
   resolveClientCredentialAuthMethod,
   resolveSalesforceAuthMethod,
@@ -70,6 +71,41 @@ describe('normalizeNetSuiteSuiteTalkOrigin', () => {
   })
 })
 
+describe('normalizeOracleFusionApplicationOrigin', () => {
+  it.each([
+    [' https://VISION.fa.us2.oraclecloud.com/ ', 'https://vision.fa.us2.oraclecloud.com'],
+    ['https://acme-prod.fa.ocs.oraclecloud.com', 'https://acme-prod.fa.ocs.oraclecloud.com'],
+    [
+      'https://pod.fa.eu-frankfurt-1.oraclecloud.com',
+      'https://pod.fa.eu-frankfurt-1.oraclecloud.com',
+    ],
+  ])('normalizes the supported application origin %j', (value, expected) => {
+    expect(normalizeOracleFusionApplicationOrigin(value)).toBe(expected)
+  })
+
+  it.each([
+    'http://vision.fa.us2.oraclecloud.com',
+    'https://vision.fa.us2.oraclecloud.com/path',
+    'https://vision.fa.us2.oraclecloud.com/path/..',
+    'https://vision.fa.us2.oraclecloud.com/./',
+    'https://vision.fa.us2.oraclecloud.com/%2e%2e/',
+    'https://vision.fa.us2.oraclecloud.com:443',
+    'https://vision.fa.us2.oraclecloud.com:8443',
+    'https://user@vision.fa.us2.oraclecloud.com',
+    'https://user:password@vision.fa.us2.oraclecloud.com',
+    'https://vision.fa.us2.oraclecloud.com?tenant=other',
+    'https://vision.fa.us2.oraclecloud.com#fragment',
+    'https://vision.fa.us2.oraclecloud.com.evil.example',
+    'https://vision.fa.us2.oraclecloud.co',
+    'https://fusion.example.com',
+    'https://fa.us2.oraclecloud.com',
+    'https://-vision.fa.us2.oraclecloud.com',
+    'https://vision.fa.-us2.oraclecloud.com',
+  ])('rejects the noncanonical Fusion Applications URL %j', (value) => {
+    expect(normalizeOracleFusionApplicationOrigin(value)).toBeUndefined()
+  })
+})
+
 describe('resolveClientCredentialAuthMethod', () => {
   it('returns undefined for a provider that declares no method selector', () => {
     expect(resolveClientCredentialAuthMethod(box, 'jwt_bearer')).toBeUndefined()

apps/sim/lib/credentials/client-credential-accounts/descriptors.ts

@@ -111,13 +111,15 @@ export const BOX_SERVICE_ACCOUNT_PROVIDER_ID = 'box-service-account' as const
 export const SALESFORCE_SERVICE_ACCOUNT_PROVIDER_ID = 'salesforce-service-account' as const
 export const ZOHO_DESK_SERVICE_ACCOUNT_PROVIDER_ID = 'zoho-desk-service-account' as const
 export const NETSUITE_SERVICE_ACCOUNT_PROVIDER_ID = 'netsuite-service-account' as const
+export const ORACLE_FUSION_SERVICE_ACCOUNT_PROVIDER_ID = 'oracle-fusion-service-account' as const
 
 export type ClientCredentialAccountProviderId =
   | typeof ZOOM_SERVICE_ACCOUNT_PROVIDER_ID
   | typeof BOX_SERVICE_ACCOUNT_PROVIDER_ID
   | typeof SALESFORCE_SERVICE_ACCOUNT_PROVIDER_ID
   | typeof ZOHO_DESK_SERVICE_ACCOUNT_PROVIDER_ID
   | typeof NETSUITE_SERVICE_ACCOUNT_PROVIDER_ID
+  | typeof ORACLE_FUSION_SERVICE_ACCOUNT_PROVIDER_ID
 
 /**
  * Exact account-specific SuiteTalk origin accepted by NetSuite's OAuth and
@@ -154,6 +156,40 @@ export function normalizeNetSuiteSuiteTalkOrigin(rawUrl: string): string | undef
   }
 }
 
+/** Canonical Oracle-assigned Fusion Applications origin used by product REST APIs. */
+const ORACLE_FUSION_APPLICATION_ORIGIN_REGEX =
+  /^https:\/\/[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.fa\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.oraclecloud\.com$/
+const ORACLE_FUSION_APPLICATION_INPUT_REGEX =
+  /^https:\/\/[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.fa\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.oraclecloud\.com\/?$/i
+
+/**
+ * Normalizes a Fusion Applications URL to its authoritative HTTPS origin.
+ * Explicit ports are rejected even when they match HTTPS's default port so a
+ * saved credential can never silently broaden the accepted endpoint shape.
+ */
+export function normalizeOracleFusionApplicationOrigin(rawUrl: string): string | undefined {
+  try {
+    const trimmed = rawUrl.trim()
+    if (!ORACLE_FUSION_APPLICATION_INPUT_REGEX.test(trimmed)) return undefined
+    const parsed = new URL(trimmed)
+    if (
+      parsed.protocol !== 'https:' ||
+      parsed.port ||
+      parsed.username ||
+      parsed.password ||
+      parsed.search ||
+      parsed.hash ||
+      (parsed.pathname !== '' && parsed.pathname !== '/') ||
+      !ORACLE_FUSION_APPLICATION_ORIGIN_REGEX.test(parsed.origin)
+    ) {
+      return undefined
+    }
+    return parsed.origin
+  } catch {
+    return undefined
+  }
+}
+
 /**
  * Allowed My Domain host shapes: one org label (optionally with a
  * `--sandboxName` suffix), an optional partition label (sandbox, develop,
@@ -531,6 +567,39 @@ export const CLIENT_CREDENTIAL_ACCOUNT_DESCRIPTORS: Record<
     helpText:
       'Use the account-specific SuiteTalk URL and the client ID, certificate ID, and private key from one OAuth 2.0 client-credentials mapping.',
   },
+  [ORACLE_FUSION_SERVICE_ACCOUNT_PROVIDER_ID]: {
+    providerId: ORACLE_FUSION_SERVICE_ACCOUNT_PROVIDER_ID,
+    serviceLabel: 'Oracle Fusion',
+    connectNoun: 'integration user',
+    fields: [
+      {
+        id: 'orgId',
+        label: 'Fusion Applications URL',
+        placeholder: 'https://your-environment.fa.ocs.oraclecloud.com',
+        secret: false,
+        hintPattern: ORACLE_FUSION_APPLICATION_ORIGIN_REGEX,
+        hintNormalize: (value) =>
+          normalizeOracleFusionApplicationOrigin(value) ?? value.trim().toLowerCase(),
+        hintMessage:
+          'Expected the Oracle-assigned HTTPS application URL with no path, port, credentials, query, or fragment.',
+      },
+      {
+        id: 'clientId',
+        label: 'Integration username',
+        placeholder: 'Paste the integration username',
+        secret: false,
+      },
+      {
+        id: 'clientSecret',
+        label: 'Password',
+        placeholder: 'Paste the password',
+        secret: true,
+      },
+    ],
+    docsUrl: 'https://docs.oracle.com/en/cloud/saas/applications-common/26b/farca/Quick_Start.html',
+    helpText:
+      'The application URL is validated when saved. Oracle authenticates the integration user on the first product request.',
+  },
 }
 
 /**

apps/sim/lib/credentials/client-credential-accounts/minters/oracle-fusion.test.ts

@@ -0,0 +1,94 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it, vi } from 'vitest'
+import { mintOracleFusionServiceAccountToken } from '@/lib/credentials/client-credential-accounts/minters/oracle-fusion'
+
+const FIELDS = {
+  orgId: 'https://vision.fa.us2.oraclecloud.com',
+  clientId: 'integration-user',
+  clientSecret: 'password-with-symbols-!@#',
+}
+
+describe('mintOracleFusionServiceAccountToken', () => {
+  it('derives an opaque Basic credential locally with a five-minute lifetime', async () => {
+    const fetchSpy = vi.spyOn(globalThis, 'fetch')
+
+    await expect(mintOracleFusionServiceAccountToken(FIELDS)).resolves.toEqual({
+      instanceUrl: FIELDS.orgId,
+      accessToken: Buffer.from(`${FIELDS.clientId}:${FIELDS.clientSecret}`, 'utf8').toString(
+        'base64'
+      ),
+      expiresInSeconds: 300,
+      identity: {
+        displayName: 'Oracle Fusion vision',
+        principal: null,
+        auditMetadata: { oracleFusionApplicationOrigin: FIELDS.orgId },
+        storedMetadata: { applicationOrigin: FIELDS.orgId },
+      },
+    })
+    expect(fetchSpy).not.toHaveBeenCalled()
+    fetchSpy.mockRestore()
+  })
+
+  it('normalizes the origin and omits connect-time identity during resolution', async () => {
+    await expect(
+      mintOracleFusionServiceAccountToken(
+        { ...FIELDS, orgId: ' HTTPS://VISION.FA.OCS.ORACLECLOUD.COM/ ' },
+        { skipIdentity: true }
+      )
+    ).resolves.toEqual({
+      instanceUrl: 'https://vision.fa.ocs.oraclecloud.com',
+      accessToken: Buffer.from(`${FIELDS.clientId}:${FIELDS.clientSecret}`, 'utf8').toString(
+        'base64'
+      ),
+      expiresInSeconds: 300,
+    })
+  })
+
+  it.each([
+    'http://vision.fa.us2.oraclecloud.com',
+    'https://vision.fa.us2.oraclecloud.com/path',
+    'https://vision.fa.us2.oraclecloud.com/path/..',
+    'https://vision.fa.us2.oraclecloud.com/%2e%2e/',
+    'https://vision.fa.us2.oraclecloud.com:443',
+    'https://user:password@vision.fa.us2.oraclecloud.com',
+    'https://vision.fa.us2.oraclecloud.com?tenant=other',
+    'https://vision.fa.us2.oraclecloud.com#fragment',
+    'https://vision.fa.us2.oraclecloud.com.evil.example',
+    'https://vanity.example.com',
+  ])('rejects the unsafe application URL %j without a network probe', async (orgId) => {
+    const fetchSpy = vi.spyOn(globalThis, 'fetch')
+    await expect(mintOracleFusionServiceAccountToken({ ...FIELDS, orgId })).rejects.toMatchObject({
+      code: 'site_not_found',
+      status: 400,
+    })
+    expect(fetchSpy).not.toHaveBeenCalled()
+    fetchSpy.mockRestore()
+  })
+
+  it.each([
+    ['', FIELDS.clientSecret],
+    ['user:name', FIELDS.clientSecret],
+    ['user\nname', FIELDS.clientSecret],
+    ['u'.repeat(256), FIELDS.clientSecret],
+    [FIELDS.clientId, ''],
+    [FIELDS.clientId, 'password\n'],
+    [FIELDS.clientId, 'p'.repeat(1025)],
+  ])(
+    'rejects malformed local credentials without exposing them',
+    async (clientId, clientSecret) => {
+      const error = await mintOracleFusionServiceAccountToken({
+        ...FIELDS,
+        clientId,
+        clientSecret,
+      }).catch((caught: unknown) => caught)
+      expect(error).toMatchObject({ code: 'invalid_credentials', status: 400 })
+      const serialized = JSON.stringify(error)
+      if (clientId) expect(serialized).not.toContain(clientId)
+      if (clientSecret) expect(serialized).not.toContain(clientSecret)
+      const encoded = Buffer.from(`${clientId}:${clientSecret}`, 'utf8').toString('base64')
+      if (encoded) expect(serialized).not.toContain(encoded)
+    }
+  )
+})

apps/sim/lib/credentials/client-credential-accounts/minters/oracle-fusion.ts

@@ -0,0 +1,68 @@
+import { normalizeOracleFusionApplicationOrigin } from '@/lib/credentials/client-credential-accounts/descriptors'
+import type {
+  ClientCredentialAccountFields,
+  ClientCredentialAccountMintOptions,
+  ClientCredentialAccountMintResult,
+} from '@/lib/credentials/client-credential-accounts/server'
+import { TokenServiceAccountValidationError } from '@/lib/credentials/token-service-accounts/errors'
+
+const BASIC_CREDENTIAL_CACHE_TTL_SECONDS = 5 * 60
+const ORACLE_FUSION_CREDENTIAL_STEP = 'oracle_fusion_credential_validation'
+const USERNAME_MAX_LENGTH = 255
+const PASSWORD_MAX_LENGTH = 1024
+const CONTROL_CHARACTER = /[\u0000-\u001f\u007f]/
+
+function invalidCredential(reason: string): TokenServiceAccountValidationError {
+  return new TokenServiceAccountValidationError('invalid_credentials', 400, {
+    step: ORACLE_FUSION_CREDENTIAL_STEP,
+    reason,
+  })
+}
+
+/**
+ * Resolves locally validated Oracle Basic credentials through the shared
+ * client-credential minter contract. Oracle does not expose a documented,
+ * privilege-neutral identity probe, so authentication occurs on first use.
+ */
+export async function mintOracleFusionServiceAccountToken(
+  fields: ClientCredentialAccountFields,
+  options?: ClientCredentialAccountMintOptions
+): Promise<ClientCredentialAccountMintResult> {
+  const instanceUrl = normalizeOracleFusionApplicationOrigin(fields.orgId)
+  if (!instanceUrl) {
+    throw new TokenServiceAccountValidationError('site_not_found', 400, {
+      step: ORACLE_FUSION_CREDENTIAL_STEP,
+      reason: 'Fusion Applications URL must be a canonical Oracle-assigned HTTPS origin',
+    })
+  }
+
+  const username = fields.clientId.trim()
+  const password = fields.clientSecret
+  if (!username || username.length > USERNAME_MAX_LENGTH || CONTROL_CHARACTER.test(username)) {
+    throw invalidCredential('integration username is invalid')
+  }
+  if (username.includes(':')) {
+    throw invalidCredential('integration username must not contain a colon')
+  }
+  if (!password || password.length > PASSWORD_MAX_LENGTH || CONTROL_CHARACTER.test(password)) {
+    throw invalidCredential('password is invalid')
+  }
+
+  const accessToken = Buffer.from(`${username}:${password}`, 'utf8').toString('base64')
+  const tenant = new URL(instanceUrl).hostname.split('.')[0]
+  return {
+    instanceUrl,
+    accessToken,
+    expiresInSeconds: BASIC_CREDENTIAL_CACHE_TTL_SECONDS,
+    ...(!options?.skipIdentity
+      ? {
+          identity: {
+            displayName: `Oracle Fusion ${tenant}`,
+            principal: null,
+            auditMetadata: { oracleFusionApplicationOrigin: instanceUrl },
+            storedMetadata: { applicationOrigin: instanceUrl },
+          },
+        }
+      : {}),
+  }
+}

apps/sim/lib/credentials/client-credential-accounts/server.test.ts

@@ -102,4 +102,31 @@ describe('parseClientCredentialAccountSecretBlob', () => {
       )
     ).toThrow(MALFORMED)
   })
+
+  it('requires the three reused fields for an Oracle Fusion credential blob', () => {
+    const oracleBlob = blob({
+      providerId: 'oracle-fusion-service-account',
+      orgId: 'https://vision.fa.us2.oraclecloud.com',
+      clientId: 'integration-user',
+      clientSecret: 'password',
+    })
+    expect(
+      parseClientCredentialAccountSecretBlob(oracleBlob, 'oracle-fusion-service-account')
+    ).toMatchObject({
+      orgId: 'https://vision.fa.us2.oraclecloud.com',
+      clientId: 'integration-user',
+      clientSecret: 'password',
+    })
+
+    expect(() =>
+      parseClientCredentialAccountSecretBlob(
+        blob({
+          providerId: 'oracle-fusion-service-account',
+          orgId: 'https://vision.fa.us2.oraclecloud.com',
+          clientSecret: undefined,
+        }),
+        'oracle-fusion-service-account'
+      )
+    ).toThrow(MALFORMED)
+  })
 })

apps/sim/lib/credentials/client-credential-accounts/server.ts

@@ -5,13 +5,15 @@ import {
   getClientCredentialAccountDescriptor,
   isClientCredentialAccountProviderId,
   NETSUITE_SERVICE_ACCOUNT_PROVIDER_ID,
+  ORACLE_FUSION_SERVICE_ACCOUNT_PROVIDER_ID,
   partitionClientCredentialFields,
   SALESFORCE_SERVICE_ACCOUNT_PROVIDER_ID,
   ZOHO_DESK_SERVICE_ACCOUNT_PROVIDER_ID,
   ZOOM_SERVICE_ACCOUNT_PROVIDER_ID,
 } from '@/lib/credentials/client-credential-accounts/descriptors'
 import { mintBoxServiceAccountToken } from '@/lib/credentials/client-credential-accounts/minters/box'
 import { mintNetSuiteServiceAccountToken } from '@/lib/credentials/client-credential-accounts/minters/netsuite'
+import { mintOracleFusionServiceAccountToken } from '@/lib/credentials/client-credential-accounts/minters/oracle-fusion'
 import { mintSalesforceServiceAccountToken } from '@/lib/credentials/client-credential-accounts/minters/salesforce'
 import { mintZohoDeskServiceAccountToken } from '@/lib/credentials/client-credential-accounts/minters/zoho-desk'
 import { mintZoomServiceAccountToken } from '@/lib/credentials/client-credential-accounts/minters/zoom'
@@ -130,6 +132,7 @@ const CLIENT_CREDENTIAL_ACCOUNT_MINTERS: Record<
   [SALESFORCE_SERVICE_ACCOUNT_PROVIDER_ID]: mintSalesforceServiceAccountToken,
   [ZOHO_DESK_SERVICE_ACCOUNT_PROVIDER_ID]: mintZohoDeskServiceAccountToken,
   [NETSUITE_SERVICE_ACCOUNT_PROVIDER_ID]: mintNetSuiteServiceAccountToken,
+  [ORACLE_FUSION_SERVICE_ACCOUNT_PROVIDER_ID]: mintOracleFusionServiceAccountToken,
 }
 
 export function getClientCredentialAccountMinter(