fix(oracle-epm): reject unusable link policies

Author: Bill Leoutsakos

apps/sim/lib/internal/oracle-epm/links.test.ts

@@ -57,4 +57,26 @@ describe('Oracle EPM returned-link declarations', () => {
       'not a valid declaration'
     )
   })
+
+  it('rejects endpoint-bound policies whose required headers cannot be supplied', () => {
+    const endpoint = routes.defineEndpoint({
+      method: 'GET',
+      version: 'v3',
+      path: [oracleEpmLiteral('download')],
+      headers: { range: { name: 'Range', required: true, maxBytes: 64 } },
+      body: 'none',
+      response: 'stream',
+      timeoutMs: 2_000,
+      maxResponseBytes: 1_024,
+    })
+
+    expect(() =>
+      routes.defineReturnedLinkPolicy({
+        relation: 'download',
+        method: 'GET',
+        endpoint,
+        preserveGatewayBasePath: true,
+      })
+    ).toThrow('input contract')
+  })
 })

apps/sim/lib/internal/oracle-epm/links.ts

@@ -57,9 +57,12 @@ export function defineOracleEpmReturnedLinkPolicy(
     if (
       endpoint.routeSpace !== routeSpace ||
       endpoint.method !== declaration.method ||
-      endpoint.body !== 'none'
+      endpoint.body !== 'none' ||
+      Object.values(endpoint.headers ?? {}).some((header) => header.required)
     ) {
-      throw new Error('Oracle EPM returned-link policy endpoint does not match its route or method')
+      throw new Error(
+        'Oracle EPM returned-link policy endpoint does not match its route, method, or input contract'
+      )
     }
     endpointDefinition = endpoint
     version = endpoint.version

apps/sim/lib/oauth/token-resolution.test.ts

@@ -538,6 +538,33 @@ describe('resolveCredentialAccessToken', () => {
     )
   })
 
+  it('fails closed when declared tool service metadata has no registered service', async () => {
+    mockResolveOAuthAccountId.mockResolvedValue({
+      accountId: 'credential-1',
+      credentialId: 'credential-1',
+      credentialType: 'service_account',
+      providerId: 'oracle-epm-service-account',
+      usedCredentialTable: true,
+    })
+    mockGetServiceConfigByProviderId.mockReturnValue(null)
+
+    await expect(
+      resolveCredentialAccessToken({
+        requestId: 'req-1',
+        credentialId: 'credential-1',
+        toolId: 'synthetic_oracle_tool',
+        authenticate,
+      })
+    ).resolves.toEqual({
+      ok: false,
+      status: 403,
+      code: 'CREDENTIAL_PROVIDER_MISMATCH',
+      error: 'Credential does not match the tool service',
+    })
+    expect(authenticate).not.toHaveBeenCalled()
+    expect(mockResolveServiceAccountToken).not.toHaveBeenCalled()
+  })
+
   it('rejects a mismatched OAuth account after loading its authoritative provider', async () => {
     mockResolveOAuthAccountId.mockResolvedValue({
       accountId: 'account-1',

apps/sim/lib/oauth/token-resolution.ts

@@ -379,6 +379,21 @@ export async function resolveCredentialAccessToken(
     ? getServiceConfigByProviderId(toolMetadata.oauth.provider)
     : null
 
+  if (
+    credentialId &&
+    toolId &&
+    resolved?.credentialType !== 'managed_oauth' &&
+    toolMetadata?.oauth?.required &&
+    !expectedService
+  ) {
+    return {
+      ok: false,
+      status: 403,
+      code: 'CREDENTIAL_PROVIDER_MISMATCH',
+      error: 'Credential does not match the tool service',
+    }
+  }
+
   if (
     resolved?.credentialType !== 'managed_oauth' &&
     resolved?.providerId &&