fix(zoho-desk): OAuth PKCE, DC scope-marker parsing, SSRF, and e2e fixes

OAuth: forward code_verifier in the custom getToken (PKCE is enabled, so the
exchange must echo the verifier or Zoho rejects the request with invalid_request).
Surface Zoho's error/error_description, which it returns in the JSON body with
HTTP 200, instead of collapsing every failure into "no access token".

Data-center base parsing: better-auth persists Zoho's scopes comma-joined with no
spaces, so the greedy \S+ marker regex swallowed the whole scope list into the
host. Stop the capture at a comma or whitespace in both read sites (token route
and webhook handler), so apiDomain resolves to the real Desk host.

Attachment SSRF: replace the permissive host regex (which accepted attacker
domains like zoho.attacker.com) with a strict Zoho-apex suffix allowlist.

Block: guard Number() pagination so a non-numeric typo can't send NaN; add the
ignoreSourceId -> sourceId loop-guard header to update_ticket (matching add_comment).

Organizations route: surface fetch/Zoho failures with a real status instead of a
200 with an empty list, so the org selector no longer fails silently.

Author: mzxchandra

apps/docs/components/icons.tsx

@@ -8930,7 +8930,13 @@ export function LogfireIcon(props: SVGProps<SVGSVGElement>) {
 
 export function ZohoDeskIcon(props: SVGProps<SVGSVGElement>) {
   return (
-    <svg {...props} viewBox='0 0 24 24' fill='none' xmlns='http://www.w3.org/2000/svg' aria-hidden='true'>
+    <svg
+      {...props}
+      viewBox='0 0 24 24'
+      fill='none'
+      xmlns='http://www.w3.org/2000/svg'
+      aria-hidden='true'
+    >
       <path
         d='M12 2.75c-4.28 0-7.75 3.47-7.75 7.75v3.1A2.6 2.6 0 0 0 3 16.35v1.3A2.6 2.6 0 0 0 5.6 20.25h1.15a.9.9 0 0 0 .9-.9v-4.9a.9.9 0 0 0-.9-.9H6.05v-2.15a5.95 5.95 0 0 1 11.9 0v2.15h-.7a.9.9 0 0 0-.9.9v4.9c0 .17.05.33.13.47-.5.6-1.24.98-2.08.98h-1.02a1.4 1.4 0 0 0-1.31-.9h-1a1.4 1.4 0 0 0 0 2.8h1a1.4 1.4 0 0 0 1.31-.9h1.02c2.06 0 3.74-1.63 3.83-3.67a2.6 2.6 0 0 0 1.44-2.33v-1.3a2.6 2.6 0 0 0-1.25-2.22v-3.1c0-4.28-3.47-7.75-7.75-7.75Z'
         fill='currentColor'

apps/sim/app/api/auth/oauth/token/route.ts

@@ -26,7 +26,10 @@ export const dynamic = 'force-dynamic'
 const logger = createLogger('OAuthTokenAPI')
 
 const SALESFORCE_INSTANCE_URL_REGEX = /__sf_instance__:([^\s]+)/
-const ZOHO_DESK_BASE_URL_REGEX = /__zoho_domain__:([^\s]+)/
+// Stop at a comma or whitespace: better-auth persists Zoho's scopes comma-joined
+// (no spaces), so a greedy `\S+` would swallow the whole scope list into the host.
+// The Desk base URL itself never contains a comma or space.
+const ZOHO_DESK_BASE_URL_REGEX = /__zoho_domain__:([^\s,]+)/
 
 /**
  * Get an access token for a specific credential

apps/sim/app/api/tools/zoho_desk/attachment/route.ts

@@ -13,9 +13,38 @@ const logger = createLogger('ZohoDeskAttachmentAPI')
 
 const MAX_ATTACHMENT_BYTES = 50 * 1024 * 1024
 
-/** Only allow downloads from Zoho hosts to prevent SSRF via a crafted href. */
+/**
+ * Zoho-owned apex domains across data centers. The `href` on an attachment is
+ * user/LLM-influenced, so the download host must be anchored to one of these
+ * with a strict suffix match — a naive `contains "zoho."` check would accept an
+ * attacker domain like `zoho.attacker.com` or `desk.zoho.com.attacker.com` and
+ * leak the OAuth token + orgId to it.
+ */
+const ZOHO_ALLOWED_APEX_DOMAINS = [
+  'zoho.com',
+  'zoho.eu',
+  'zoho.in',
+  'zoho.com.au',
+  'zoho.jp',
+  'zoho.ca',
+  'zoho.sa',
+  'zoho.com.cn',
+  'zoho.uk',
+  'zohoapis.com',
+  'zohoapis.eu',
+  'zohoapis.in',
+  'zohoapis.com.au',
+  'zohoapis.jp',
+  'zohoapis.ca',
+  'zohoapis.sa',
+  'zohoapis.com.cn',
+  'zohoapis.uk',
+]
+
+/** True only when the hostname is exactly a Zoho apex or a subdomain of one. */
 function isZohoHost(hostname: string): boolean {
-  return /(^|\.)zoho\.[a-z.]+$/i.test(hostname) || /(^|\.)zohoapis\.[a-z.]+$/i.test(hostname)
+  const host = hostname.toLowerCase()
+  return ZOHO_ALLOWED_APEX_DOMAINS.some((apex) => host === apex || host.endsWith(`.${apex}`))
 }
 
 export const POST = withRouteHandler(async (request: NextRequest) => {

apps/sim/app/api/tools/zoho_desk/organizations/route.ts

@@ -5,7 +5,7 @@ import { zohoDeskListOrganizationsContract } from '@/lib/api/contracts/tools/zoh
 import { parseRequest } from '@/lib/api/server'
 import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { getZohoDeskApiBase } from '@/tools/zoho_desk/utils'
+import { getZohoDeskApiBase, getZohoDeskErrorMessage } from '@/tools/zoho_desk/utils'
 
 export const dynamic = 'force-dynamic'
 
@@ -45,8 +45,17 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
     const data = await response.json().catch(() => ({}))
     if (!response.ok) {
-      logger.warn('Failed to list Zoho Desk organizations', { status: response.status })
-      return NextResponse.json({ organizations: [] })
+      // Surface the failure instead of returning an empty 200, which would make
+      // the org dropdown silently render empty on an auth/connectivity error.
+      const message = getZohoDeskErrorMessage(
+        data,
+        `Failed to list organizations (HTTP ${response.status})`
+      )
+      logger.warn('Failed to list Zoho Desk organizations', { status: response.status, message })
+      return NextResponse.json(
+        { error: message },
+        { status: response.status >= 400 && response.status < 500 ? response.status : 502 }
+      )
     }
 
     const organizations = (Array.isArray(data.data) ? (data.data as ZohoOrganization[]) : [])
@@ -59,7 +68,8 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
     return NextResponse.json({ organizations })
   } catch (error) {
-    logger.error('Error listing Zoho Desk organizations', { error: getErrorMessage(error) })
-    return NextResponse.json({ organizations: [] })
+    const message = getErrorMessage(error, 'Failed to list organizations')
+    logger.error('Error listing Zoho Desk organizations', { error: message })
+    return NextResponse.json({ error: message }, { status: 502 })
   }
 })

apps/sim/blocks/blocks/zoho-desk.ts

@@ -187,7 +187,7 @@ export const ZohoDeskBlock: BlockConfig<ZohoDeskResponse> = {
       type: 'short-input',
       mode: 'advanced',
       placeholder: 'Loop-guard source ID (from a Zoho Desk trigger)',
-      condition: { field: 'operation', value: 'add_comment' },
+      condition: { field: 'operation', value: ['add_comment', 'update_ticket'] },
     },
     // Update ticket
     {
@@ -343,11 +343,20 @@ export const ZohoDeskBlock: BlockConfig<ZohoDeskResponse> = {
     config: {
       tool: (params) => `zoho_desk_${params.operation}`,
       params: (params) => {
-        const { oauthCredential, ...rest } = params
+        // Pull raw pagination out of the spread so invalid values never reach the
+        // tool; only re-add them when Number() yields a finite value (a non-numeric
+        // typo would otherwise become NaN and produce an invalid Zoho query param).
+        const { oauthCredential, from: rawFrom, limit: rawLimit, ...rest } = params
         const result: Record<string, unknown> = { ...rest, oauthCredential }
 
-        if (rest.from !== undefined && rest.from !== '') result.from = Number(rest.from)
-        if (rest.limit !== undefined && rest.limit !== '') result.limit = Number(rest.limit)
+        if (rawFrom !== undefined && rawFrom !== '') {
+          const from = Number(rawFrom)
+          if (Number.isFinite(from)) result.from = from
+        }
+        if (rawLimit !== undefined && rawLimit !== '') {
+          const limit = Number(rawLimit)
+          if (Number.isFinite(limit)) result.limit = limit
+        }
         if (rest.isPublic !== undefined) {
           result.isPublic = rest.isPublic === true || rest.isPublic === 'true'
         }

apps/sim/lib/auth/auth.ts

@@ -2068,29 +2068,69 @@ export const auth = betterAuth({
             prompt: 'consent',
             scope: getCanonicalScopesForProvider('zoho-desk').join(','),
           },
-          getToken: async ({ code, redirectURI }) => {
+          getToken: async ({ code, redirectURI, codeVerifier }) => {
+            const tokenParams = new URLSearchParams({
+              client_id: env.ZOHO_CLIENT_ID as string,
+              client_secret: env.ZOHO_CLIENT_SECRET as string,
+              code,
+              grant_type: 'authorization_code',
+              redirect_uri: redirectURI,
+            })
+            // PKCE is enabled, so better-auth sent a code_challenge on the authorize
+            // request. The exchange MUST echo the matching code_verifier or Zoho
+            // rejects the request shape (invalid_request). Verified by isolating
+            // pkce:false (which connected) then restoring pkce:true + this verifier.
+            if (codeVerifier) tokenParams.set('code_verifier', codeVerifier)
+
             const response = await fetch('https://accounts.zoho.com/oauth/v2/token', {
               method: 'POST',
               headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-              body: new URLSearchParams({
-                client_id: env.ZOHO_CLIENT_ID as string,
-                client_secret: env.ZOHO_CLIENT_SECRET as string,
-                code,
-                grant_type: 'authorization_code',
-                redirect_uri: redirectURI,
-              }),
+              body: tokenParams,
             })
             const data = await readResponseJsonWithLimit<Record<string, unknown>>(response, {
               maxBytes: 1024 * 1024,
               label: 'Zoho Desk OAuth token response',
             })
 
-            if (!response.ok || !data || typeof data !== 'object' || Array.isArray(data)) {
-              throw new Error(`Zoho Desk OAuth token exchange failed with HTTP ${response.status}`)
+            // Zoho signals OAuth failures in the JSON body, usually with HTTP 200,
+            // e.g. { error: 'invalid_code' } or { error: 'invalid_client',
+            // error_description: '...' }. The status-only guard therefore never
+            // fires, so surface the actual error/description instead of collapsing
+            // every failure into one opaque "no access token" string.
+            const errorObj =
+              data && typeof data === 'object' && !Array.isArray(data)
+                ? (data as { error?: unknown; error_description?: unknown })
+                : {}
+            const zohoError = typeof errorObj.error === 'string' ? errorObj.error : undefined
+            const zohoErrorDescription =
+              typeof errorObj.error_description === 'string'
+                ? errorObj.error_description
+                : undefined
+            if (
+              !response.ok ||
+              !data ||
+              typeof data !== 'object' ||
+              Array.isArray(data) ||
+              zohoError
+            ) {
+              logger.error('Zoho Desk OAuth token exchange failed', {
+                status: response.status,
+                zohoError: zohoError ?? null,
+                zohoErrorDescription: zohoErrorDescription ?? null,
+              })
+              throw new Error(
+                `Zoho Desk OAuth token exchange failed (HTTP ${response.status}${
+                  zohoError ? `, ${zohoError}` : ''
+                }${zohoErrorDescription ? `: ${zohoErrorDescription}` : ''})`
+              )
             }
 
             const tokens = getOAuth2Tokens(data)
             if (!tokens.accessToken) {
+              logger.error('Zoho Desk OAuth token response had no access token', {
+                status: response.status,
+                bodyKeys: Object.keys(data),
+              })
               throw new Error('Zoho Desk OAuth token response did not include an access token')
             }
 

apps/sim/lib/webhooks/providers/zoho-desk.ts

@@ -22,7 +22,9 @@ import { refreshAccessTokenIfNeeded } from '@/app/api/auth/oauth/utils'
 const logger = createLogger('WebhookProvider:ZohoDesk')
 
 const DEFAULT_ZOHO_DESK_BASE = 'https://desk.zoho.com'
-const ZOHO_DESK_BASE_URL_REGEX = /__zoho_domain__:(\S+)/
+// Stop at a comma or whitespace: better-auth persists Zoho's scopes comma-joined
+// (no spaces), so a greedy `\S+` would swallow the whole scope list into the host.
+const ZOHO_DESK_BASE_URL_REGEX = /__zoho_domain__:([^\s,]+)/
 
 /**
  * Remote JWKS sets are cached per Desk data-center host. `createRemoteJWKSet`

apps/sim/tools/zoho_desk/types.ts

@@ -37,6 +37,7 @@ export interface ZohoDeskUpdateTicketParams extends ZohoDeskBaseParams {
   subCategory?: string
   dueDate?: string
   customFields?: Record<string, unknown>
+  ignoreSourceId?: string
 }
 
 export interface ZohoDeskListCommentsParams extends ZohoDeskBaseParams {

apps/sim/tools/zoho_desk/update_ticket.ts

@@ -95,12 +95,25 @@ export const zohoDeskUpdateTicketTool: ToolConfig<ZohoDeskUpdateTicketParams, Zo
       visibility: 'user-or-llm',
       description: 'Custom field values as a JSON object',
     },
+    ignoreSourceId: {
+      type: 'string',
+      required: false,
+      visibility: 'hidden',
+      description:
+        'Source ID echoed back on the resulting webhook event so this write can be filtered out (loop guard)',
+    },
   },
 
   request: {
     url: (params) => `${getZohoDeskApiBase(params)}/tickets/${encodeURIComponent(params.ticketId)}`,
     method: 'PATCH',
-    headers: (params) => buildZohoDeskHeaders(params),
+    headers: (params) => {
+      const headers = buildZohoDeskHeaders(params)
+      // Echo the webhook subscription's ignoreSourceId so Zoho tags the resulting
+      // Ticket_Update event with this sourceId, letting our own trigger drop self-writes.
+      if (params.ignoreSourceId) headers.sourceId = params.ignoreSourceId
+      return headers
+    },
     body: (params) =>
       filterUndefined({
         subject: params.subject,

apps/sim/tools/zoho_desk/utils.test.ts

@@ -50,7 +50,9 @@ describe('zoho desk tool utils', () => {
     })
 
     it('falls back to errorCode then the fallback', () => {
-      expect(getZohoDeskErrorMessage({ errorCode: 'INVALID_DATA' }, 'fallback')).toBe('INVALID_DATA')
+      expect(getZohoDeskErrorMessage({ errorCode: 'INVALID_DATA' }, 'fallback')).toBe(
+        'INVALID_DATA'
+      )
       expect(getZohoDeskErrorMessage(null, 'fallback')).toBe('fallback')
     })
   })