opensource/sim
3
0
Fork 0
mirror of https://github.com/simstudioai/sim.git synced 2026-09-24 15:45:35 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(hubspot): selector fetchOptions default + credentialId validation (#4723)

Browse Source 
* fix(hubspot): fall back to objectType default in selector fetchOptions

useSubBlockStore.getValue returns null for default-valued dropdowns
until the user interacts with them. The properties, pipelines, stages,
and ownerId selectors were treating that as "no selection" and
short-circuiting, so the dropdowns appeared empty even though the
trigger uses 'contact' as the visible default.

Adds resolveSelectedObjectType to mirror the rendered default, so the
selectors fire on first paint with a valid objectType.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* fix(hubspot): validate credentialId in selector routes

Mirrors the Gmail/Webflow/Jira selector route security pattern by
rejecting non-alphanumeric credentialId values before authorization
or token refresh.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* fix(hubspot): use resolveSelectedObjectType in pipelineId/stageId fetchOptions

Both selectors used inline `?? 'contact'` fallbacks while properties and
targetPropertyName already routed through the resolver. Switch to the
shared helper so custom-object handling stays consistent across every
cascading selector.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Waleed
2026-05-22 09:07:48 -07:00
committed by GitHub
co-authored by Claude Opus 4.7
parent b6d08fb0e6
commit 19b5099d19
5 changed files with 55 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/sim/app/api/tools/hubspot/lists/route.ts
+7
View File
@@ -3,6 +3,7 @@ import { type NextRequest, NextResponse } from 'next/server'
import { hubspotListsSelectorContract } from '@/lib/api/contracts/selectors/hubspot'
import { parseRequest } from '@/lib/api/server'
import { authorizeCredentialUse } from '@/lib/auth/credential-access'
import { validateAlphanumericId } from '@/lib/core/security/input-validation'
import { generateRequestId } from '@/lib/core/utils/request'
import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
import { refreshAccessTokenIfNeeded } from '@/app/api/auth/oauth/utils'
@@ -27,6 +28,12 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
if (!parsed.success) return parsed.response
const { credentialId, objectTypeId, query } = parsed.data.query
const credentialIdValidation = validateAlphanumericId(credentialId, 'credentialId', 255)
if (!credentialIdValidation.isValid) {
logger.warn(`[${requestId}] Invalid credential ID: ${credentialIdValidation.error}`)
return NextResponse.json({ error: credentialIdValidation.error }, { status: 400 })
}
const authz = await authorizeCredentialUse(request, {
credentialId,
requireWorkflowIdForInternal: false,
apps/sim/app/api/tools/hubspot/owners/route.ts
+7
View File
@@ -3,6 +3,7 @@ import { type NextRequest, NextResponse } from 'next/server'
import { hubspotOwnersSelectorContract } from '@/lib/api/contracts/selectors/hubspot'
import { parseRequest } from '@/lib/api/server'
import { authorizeCredentialUse } from '@/lib/auth/credential-access'
import { validateAlphanumericId } from '@/lib/core/security/input-validation'
import { generateRequestId } from '@/lib/core/utils/request'
import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
import { refreshAccessTokenIfNeeded } from '@/app/api/auth/oauth/utils'
@@ -27,6 +28,12 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
if (!parsed.success) return parsed.response
const { credentialId, query } = parsed.data.query
const credentialIdValidation = validateAlphanumericId(credentialId, 'credentialId', 255)
if (!credentialIdValidation.isValid) {
logger.warn(`[${requestId}] Invalid credential ID: ${credentialIdValidation.error}`)
return NextResponse.json({ error: credentialIdValidation.error }, { status: 400 })
}
const authz = await authorizeCredentialUse(request, {
credentialId,
requireWorkflowIdForInternal: false,
apps/sim/app/api/tools/hubspot/pipelines/route.ts
+7
View File
@@ -3,6 +3,7 @@ import { type NextRequest, NextResponse } from 'next/server'
import { hubspotPipelinesSelectorContract } from '@/lib/api/contracts/selectors/hubspot'
import { parseRequest } from '@/lib/api/server'
import { authorizeCredentialUse } from '@/lib/auth/credential-access'
import { validateAlphanumericId } from '@/lib/core/security/input-validation'
import { generateRequestId } from '@/lib/core/utils/request'
import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
import { refreshAccessTokenIfNeeded } from '@/app/api/auth/oauth/utils'
@@ -33,6 +34,12 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
if (!parsed.success) return parsed.response
const { credentialId, objectType } = parsed.data.query
const credentialIdValidation = validateAlphanumericId(credentialId, 'credentialId', 255)
if (!credentialIdValidation.isValid) {
logger.warn(`[${requestId}] Invalid credential ID: ${credentialIdValidation.error}`)
return NextResponse.json({ error: credentialIdValidation.error }, { status: 400 })
}
const authz = await authorizeCredentialUse(request, {
credentialId,
requireWorkflowIdForInternal: false,
apps/sim/app/api/tools/hubspot/properties/route.ts
+7
View File
@@ -3,6 +3,7 @@ import { type NextRequest, NextResponse } from 'next/server'
import { hubspotPropertiesSelectorContract } from '@/lib/api/contracts/selectors/hubspot'
import { parseRequest } from '@/lib/api/server'
import { authorizeCredentialUse } from '@/lib/auth/credential-access'
import { validateAlphanumericId } from '@/lib/core/security/input-validation'
import { generateRequestId } from '@/lib/core/utils/request'
import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
import { refreshAccessTokenIfNeeded } from '@/app/api/auth/oauth/utils'
@@ -36,6 +37,12 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
if (!parsed.success) return parsed.response
const { credentialId, objectType, query } = parsed.data.query
const credentialIdValidation = validateAlphanumericId(credentialId, 'credentialId', 255)
if (!credentialIdValidation.isValid) {
logger.warn(`[${requestId}] Invalid credential ID: ${credentialIdValidation.error}`)
return NextResponse.json({ error: credentialIdValidation.error }, { status: 400 })
}
const authz = await authorizeCredentialUse(request, {
credentialId,
requireWorkflowIdForInternal: false,
apps/sim/triggers/hubspot/poller.ts
+27 -23
View File
@@ -14,6 +14,25 @@ import type { TriggerConfig } from '@/triggers/types'
const logger = createLogger('HubSpotPollingTrigger')
/**
* Resolves the effective object type from the subblock store. `getValue` returns `null`
* for fields the user hasn't interacted with yet, so we fall back to the dropdown's
* default ('contact') — otherwise the cascading property selectors render empty on
* first render even when the dropdown visibly shows "contact".
*/
function resolveSelectedObjectType(blockId: string): string | null {
const objectType = useSubBlockStore.getState().getValue(blockId, 'objectType') as string | null
const customId = useSubBlockStore.getState().getValue(blockId, 'customObjectTypeId') as
| string
| null
const selected = objectType ?? 'contact'
if (selected === 'custom') {
const trimmed = customId?.trim()
return trimmed ? trimmed : null
}
return selected
}
async function fetchHubSpotProperties(blockId: string, objectType: string) {
const credentialId = useSubBlockStore.getState().getValue(blockId, 'triggerCredentials') as
| string
@@ -128,13 +147,7 @@ export const hubspotPollingTrigger: TriggerConfig = {
placeholder: 'Select a property',
options: [],
fetchOptions: async (blockId: string) => {
const objectType = useSubBlockStore.getState().getValue(blockId, 'objectType') as
| string
| null
const customId = useSubBlockStore.getState().getValue(blockId, 'customObjectTypeId') as
| string
| null
const resolved = objectType === 'custom' ? customId : objectType
const resolved = resolveSelectedObjectType(blockId)
if (!resolved) throw new Error('Select an object type first')
try {
return await fetchHubSpotProperties(blockId, resolved)
@@ -162,13 +175,7 @@ export const hubspotPollingTrigger: TriggerConfig = {
placeholder: 'Select properties (optional)',
options: [],
fetchOptions: async (blockId: string) => {
const objectType = useSubBlockStore.getState().getValue(blockId, 'objectType') as
| string
| null
const customId = useSubBlockStore.getState().getValue(blockId, 'customObjectTypeId') as
| string
| null
const resolved = objectType === 'custom' ? customId : objectType
const resolved = resolveSelectedObjectType(blockId)
if (!resolved) return []
try {
return await fetchHubSpotProperties(blockId, resolved)
@@ -193,10 +200,8 @@ export const hubspotPollingTrigger: TriggerConfig = {
const credentialId = useSubBlockStore.getState().getValue(blockId, 'triggerCredentials') as
| string
| null
const objectType = useSubBlockStore.getState().getValue(blockId, 'objectType') as
| string
| null
if (!credentialId || !objectType) return []
const objectType = resolveSelectedObjectType(blockId) ?? 'contact'
if (!credentialId) throw new Error('No HubSpot credential selected')
if (isCredentialSetValue(credentialId)) return []
try {
const data = await requestJson(hubspotPipelinesSelectorContract, {
@@ -224,14 +229,13 @@ export const hubspotPollingTrigger: TriggerConfig = {
const credentialId = useSubBlockStore.getState().getValue(blockId, 'triggerCredentials') as
| string
| null
const objectType = useSubBlockStore.getState().getValue(blockId, 'objectType') as
| string
| null
const objectType = resolveSelectedObjectType(blockId) ?? 'contact'
const pipelineId = useSubBlockStore.getState().getValue(blockId, 'pipelineId') as
| string
| null
if (!credentialId || !objectType || !pipelineId) return []
if (!credentialId) throw new Error('No HubSpot credential selected')
if (isCredentialSetValue(credentialId)) return []
if (!pipelineId) return []
try {
const data = await requestJson(hubspotPipelinesSelectorContract, {
query: { credentialId, objectType },
@@ -259,7 +263,7 @@ export const hubspotPollingTrigger: TriggerConfig = {
const credentialId = useSubBlockStore.getState().getValue(blockId, 'triggerCredentials') as
| string
| null
if (!credentialId) return []
if (!credentialId) throw new Error('No HubSpot credential selected')
if (isCredentialSetValue(credentialId)) return []
try {
const data = await requestJson(hubspotOwnersSelectorContract, {