fix(agiloft): redact credentials on every error path the two routes relay

Review finding. Create redacted both its log line and its response; natural
language search redacted only the refusal branch, leaving the non-refusal
path logging the raw error object and returning an unredacted message. Both
routes now relay the same redacted string to the log and to the caller on
every branch.

The outermost handler could not redact at all, because the parsed body it
would need is scoped to the try it is catching. Both routes now capture the
credentials as they are parsed, so that handler can redact too. It is not
reachable with upstream text today - it catches auth and contract validation,
neither of which talks to Agiloft - but "unreachable today" is the kind of
reasoning that stops being true without anyone noticing.

Author: mzxchandra

apps/sim/app/api/tools/agiloft/create_record/route.ts

@@ -35,6 +35,13 @@ const AGILOFT_EXCEPTION = /EW[A-Za-z]*Exception/
 export const POST = withRouteHandler(async (request: NextRequest) => {
   const requestId = generateRequestId()
 
+  /**
+   * Captured for the outer catch, which sits outside the scope the parsed body
+   * lives in. Anything relayed from there can still carry upstream text, and
+   * these operations put the credentials on the request itself.
+   */
+  let credentials: { login: string; password: string } | undefined
+
   try {
     const authResult = await checkInternalAuth(request, { requireWorkflowId: false })
 
@@ -66,6 +73,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     )
     if (!parsed.success) return parsed.response
     const params = parsed.data.body
+    credentials = params
 
     let fieldValues: Record<string, unknown>
     try {
@@ -109,7 +117,11 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     } catch (error) {
       logger.warn(`[${requestId}] Rejected Agiloft instance URL`, { error })
       return NextResponse.json(
-        { success: false, output: { id: null, fields: {} }, error: toError(error).message },
+        {
+          success: false,
+          output: { id: null, fields: {} },
+          error: redactAgiloftSecrets(toError(error).message, params),
+        },
         { status: 400 }
       )
     }
@@ -239,8 +251,11 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
     return NextResponse.json(result)
   } catch (error) {
-    logger.error(`[${requestId}] Error creating Agiloft record:`, error)
+    const described = credentials
+      ? redactAgiloftSecrets(toError(error).message, credentials)
+      : toError(error).message
+    logger.error(`[${requestId}] Error creating Agiloft record`, { error: described })
 
-    return NextResponse.json({ success: false, error: toError(error).message }, { status: 500 })
+    return NextResponse.json({ success: false, error: described }, { status: 500 })
   }
 })

apps/sim/app/api/tools/agiloft/nlp_search/route.ts

@@ -22,6 +22,13 @@ const logger = createLogger('AgiloftNlpSearchAPI')
 export const POST = withRouteHandler(async (request: NextRequest) => {
   const requestId = generateRequestId()
 
+  /**
+   * Captured for the outer catch, which sits outside the scope the parsed body
+   * lives in. Anything relayed from there can still carry upstream text, and
+   * these operations put the credentials on the request itself.
+   */
+  let credentials: { login: string; password: string } | undefined
+
   try {
     const authResult = await checkInternalAuth(request, { requireWorkflowId: false })
 
@@ -53,6 +60,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     )
     if (!parsed.success) return parsed.response
     const params = parsed.data.body
+    credentials = params
 
     let result: AgiloftNlpSearchResponse
     try {
@@ -117,17 +125,18 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
         })
       }
 
-      logger.error(`[${requestId}] Error running Agiloft NLP search:`, error)
-      return NextResponse.json(
-        { success: false, error: redactAgiloftSecrets(toError(error).message, params) },
-        { status: 500 }
-      )
+      const described = redactAgiloftSecrets(toError(error).message, params)
+      logger.error(`[${requestId}] Error running Agiloft NLP search`, { error: described })
+      return NextResponse.json({ success: false, error: described }, { status: 500 })
     }
 
     return NextResponse.json(result)
   } catch (error) {
-    logger.error(`[${requestId}] Error running Agiloft NLP search:`, error)
+    const described = credentials
+      ? redactAgiloftSecrets(toError(error).message, credentials)
+      : toError(error).message
+    logger.error(`[${requestId}] Error running Agiloft NLP search`, { error: described })
 
-    return NextResponse.json({ success: false, error: toError(error).message }, { status: 500 })
+    return NextResponse.json({ success: false, error: described }, { status: 500 })
   }
 })