feat(oci): add native Object Storage integration

Author: Bill Leoutsakos

apps/docs/components/ui/icon-mapping.ts

@@ -482,6 +482,7 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   notion: NotionIcon,
   notion_v2: NotionIcon,
   obsidian: ObsidianIcon,
+  oci_object_storage_native: NetSuiteIcon,
   okta: OktaIcon,
   onedrive: MicrosoftOneDriveIcon,
   onepassword: OnePasswordIcon,

apps/docs/content/docs/integrations/meta.json

@@ -185,6 +185,7 @@
     "notion",
     "notion-service-account",
     "obsidian",
+    "oci_object_storage_native",
     "okta",
     "onedrive",
     "onepassword",

apps/docs/content/docs/integrations/oci_object_storage_native.mdx

@@ -249,6 +249,10 @@ import {
   NotionV2BlockMeta,
 } from '@/blocks/blocks/notion'
 import { ObsidianBlock, ObsidianBlockMeta } from '@/blocks/blocks/obsidian'
+import {
+  OciObjectStorageNativeBlock,
+  OciObjectStorageNativeBlockMeta,
+} from '@/blocks/blocks/oci_object_storage_native'
 import { OktaBlock, OktaBlockMeta } from '@/blocks/blocks/okta'
 import { OneDriveBlock, OneDriveBlockMeta } from '@/blocks/blocks/onedrive'
 import { OnePasswordBlock, OnePasswordBlockMeta } from '@/blocks/blocks/onepassword'
@@ -590,6 +594,7 @@ export const BLOCK_REGISTRY: Record<string, BlockConfig> = {
   mysql: MySQLBlock,
   neo4j: Neo4jBlock,
   netsuite: NetSuiteBlock,
+  oci_object_storage_native: OciObjectStorageNativeBlock,
   new_relic: NewRelicBlock,
   note: NoteBlock,
   notion: NotionBlock,
@@ -915,6 +920,7 @@ export const BLOCK_META_REGISTRY: Record<string, BlockMeta> = {
   mysql: MySQLBlockMeta,
   neo4j: Neo4jBlockMeta,
   netsuite: NetSuiteBlockMeta,
+  oci_object_storage_native: OciObjectStorageNativeBlockMeta,
   neverbounce: NeverBounceBlockMeta,
   new_relic: NewRelicBlockMeta,
   notion: NotionBlockMeta,

apps/sim/blocks/blocks/oci_object_storage_native.ts

@@ -243,6 +243,7 @@ export const DOCS_MANIFEST: readonly string[] = [
   'integrations/notion-service-account.mdx',
   'integrations/notion.mdx',
   'integrations/obsidian.mdx',
+  'integrations/oci_object_storage_native.mdx',
   'integrations/okta.mdx',
   'integrations/onedrive.mdx',
   'integrations/onepassword.mdx',

apps/sim/blocks/registry-maps.ts

@@ -465,6 +465,7 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   notion: NotionIcon,
   notion_v2: NotionIcon,
   obsidian: ObsidianIcon,
+  oci_object_storage_native: NetSuiteIcon,
   okta: OktaIcon,
   onedrive: MicrosoftOneDriveIcon,
   onepassword: OnePasswordIcon,

apps/sim/lib/copilot/generated/docs-manifest.ts

@@ -0,0 +1,33 @@
+import { isPayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
+import { OciClientError } from '@/lib/internal/oci/errors'
+
+export class OciNativeOperationError extends Error {
+  constructor(
+    message: string,
+    readonly status = 400
+  ) {
+    super(message)
+    this.name = 'OciNativeOperationError'
+  }
+}
+
+/** Keep credential material, provider response bodies, and storage errors out of tool failures. */
+export function normalizeOciNativeError(error: unknown): { status: number; message: string } {
+  if (error instanceof OciNativeOperationError)
+    return { status: error.status, message: error.message }
+  if (isPayloadSizeLimitError(error))
+    return { status: 413, message: 'File exceeds the 100 MiB transfer limit' }
+  if (error instanceof OciClientError) {
+    return {
+      status:
+        error.status ??
+        (error.code === 'response_too_large'
+          ? 413
+          : error.code === 'deadline_exceeded'
+            ? 504
+            : 502),
+      message: error.message,
+    }
+  }
+  return { status: 500, message: 'OCI Object Storage operation failed' }
+}

apps/sim/lib/integrations/icon-mapping.ts

@@ -0,0 +1,191 @@
+/** @vitest-environment node */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({ executeOciNativeOperation: vi.fn() }))
+vi.mock('@/lib/internal/oci-object-storage-native/operations', () => mocks)
+
+import { OciClientError } from '@/lib/internal/oci/errors'
+import { executeOciObjectStorageNativeTool } from '@/lib/internal/oci-object-storage-native/execute-tool'
+import type { InternalToolOperationCall } from '@/lib/internal/tool-operations/types'
+import { createOciNativeOperationInput } from '@/tools/oci_object_storage_native/shared'
+
+const AUTH = { credentialId: 'authorized', namespace: 'namespace' }
+const BUCKET = { ...AUTH, bucketName: 'reports' }
+const OBJECT = { ...BUCKET, objectName: 'report.txt' }
+const MULTIPART = { ...OBJECT, uploadId: 'upload' }
+const CASES: [string, Record<string, unknown>][] = [
+  ['get_namespace', AUTH],
+  ['list_buckets', { ...AUTH, compartmentId: 'compartment' }],
+  ['get_bucket', BUCKET],
+  ['create_bucket', { ...BUCKET, compartmentId: 'compartment' }],
+  ['update_bucket', { ...BUCKET, versioning: 'Enabled' }],
+  ['delete_bucket', BUCKET],
+  ['list_objects', BUCKET],
+  ['head_object', OBJECT],
+  ['upload_object', { ...OBJECT, content: '' }],
+  ['download_object', OBJECT],
+  [
+    'copy_object',
+    {
+      ...OBJECT,
+      destinationRegion: 'us-phoenix-1',
+      destinationNamespace: 'namespace',
+      destinationBucket: 'copies',
+      destinationObjectName: 'copy',
+    },
+  ],
+  ['rename_object', { ...OBJECT, newName: 'new' }],
+  ['delete_object', OBJECT],
+  ['batch_delete_objects', { ...BUCKET, objects: [{ objectName: 'report.txt' }] }],
+  ['list_object_versions', BUCKET],
+  ['restore_object', OBJECT],
+  ['update_object_storage_tier', { ...OBJECT, storageTier: 'Archive' }],
+  ['get_lifecycle_policy', BUCKET],
+  ['put_lifecycle_policy', { ...BUCKET, rules: [] }],
+  ['delete_lifecycle_policy', BUCKET],
+  ['create_multipart_upload', OBJECT],
+  ['upload_part', { ...MULTIPART, partNumber: 1, content: '' }],
+  ['list_multipart_uploads', BUCKET],
+  ['list_multipart_parts', MULTIPART],
+  ['commit_multipart_upload', { ...MULTIPART, partsToCommit: [{ partNum: 1, etag: 'etag' }] }],
+  ['abort_multipart_upload', MULTIPART],
+  [
+    'create_preauthenticated_request',
+    {
+      ...OBJECT,
+      name: 'Report',
+      scope: 'object',
+      accessType: 'ObjectRead',
+      timeExpires: '2099-01-01T00:00:00Z',
+    },
+  ],
+  ['list_preauthenticated_requests', BUCKET],
+  ['get_preauthenticated_request', { ...BUCKET, parId: 'par' }],
+  ['delete_preauthenticated_request', { ...BUCKET, parId: 'par' }],
+  ['get_work_request', { ...AUTH, workRequestId: 'work' }],
+]
+
+function request(operation: string, input: unknown): InternalToolOperationCall {
+  return {
+    toolId: `oci_object_storage_native_${operation}`,
+    input,
+    headers: new Headers(),
+    context: { workflowId: 'workflow', workspaceId: 'trusted-workspace', userId: 'actor' },
+    requestId: 'request',
+  }
+}
+
+describe('native OCI tool operation handler', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.executeOciNativeOperation.mockResolvedValue({ success: true, output: {} })
+  })
+
+  it.each(CASES)(
+    'validates and dispatches %s with trusted workspace context',
+    async (operation, input) => {
+      const result = await executeOciObjectStorageNativeTool(request(operation, input))
+      expect(result.status).toBe(200)
+      expect(mocks.executeOciNativeOperation).toHaveBeenCalledWith(
+        expect.objectContaining({ ...input, operation }),
+        {
+          workspaceId: 'trusted-workspace',
+          workflowId: 'workflow',
+          executionId: undefined,
+          userId: 'actor',
+          requestId: 'request',
+          signal: undefined,
+        }
+      )
+    }
+  )
+
+  it('maps the authorized hidden reference and strips the caller execution context', async () => {
+    const input = createOciNativeOperationInput({
+      oauthCredential: 'visible-selection',
+      accessToken: 'authorized',
+      _context: { workspaceId: 'attacker' },
+      _credentialId: 'bookkeeping',
+      _workflowId: 'workflow',
+      credential: undefined,
+      impersonateUserEmail: undefined,
+      namespace: 'namespace',
+    })
+    expect(input).toEqual(AUTH)
+    await executeOciObjectStorageNativeTool(request('get_namespace', input))
+    expect(mocks.executeOciNativeOperation).toHaveBeenCalledWith(
+      expect.objectContaining({ credentialId: 'authorized' }),
+      expect.objectContaining({ workspaceId: 'trusted-workspace' })
+    )
+    const missing = createOciNativeOperationInput({ oauthCredential: 'visible-selection' })
+    expect(
+      (await executeOciObjectStorageNativeTool(request('get_namespace', missing))).status
+    ).toBe(400)
+  })
+
+  it.each([
+    { ...AUTH, workspaceId: 'injected' },
+    { ...AUTH, operation: 'delete_bucket' },
+    { ...AUTH, authorization: 'injected' },
+  ])('rejects unexpected authority or operation fields', async (input) => {
+    expect((await executeOciObjectStorageNativeTool(request('get_namespace', input))).status).toBe(
+      400
+    )
+    expect(mocks.executeOciNativeOperation).not.toHaveBeenCalled()
+  })
+
+  it('requires trusted workspace scope', async () => {
+    const call = request('get_namespace', AUTH)
+    call.context.workspaceId = undefined
+    expect((await executeOciObjectStorageNativeTool(call)).status).toBe(403)
+    expect(mocks.executeOciNativeOperation).not.toHaveBeenCalled()
+  })
+
+  it('uses the delegated subject for file authorization', async () => {
+    const call = request('upload_object', {
+      ...OBJECT,
+      file: { key: 'file', name: 'file.txt', size: 0 },
+    })
+    call.context.executorDelegationOrigin = {
+      subjectUserId: 'delegated-actor',
+      workflowId: 'origin-workflow',
+      executionId: 'origin-execution',
+    }
+    await executeOciObjectStorageNativeTool(call)
+    expect(mocks.executeOciNativeOperation).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ userId: 'delegated-actor', workspaceId: 'trusted-workspace' })
+    )
+  })
+
+  it('projects safe foundation failures without exposing arbitrary error details', async () => {
+    mocks.executeOciNativeOperation.mockRejectedValueOnce(
+      new OciClientError('request_failed', { status: 412 })
+    )
+    const known = await executeOciObjectStorageNativeTool(request('get_namespace', AUTH))
+    expect(known.status).toBe(412)
+    await expect(known.json()).resolves.toEqual({ success: false, error: 'OCI request failed' })
+    mocks.executeOciNativeOperation.mockRejectedValueOnce(
+      new Error('private-key-or-storage-secret')
+    )
+    const unknown = await executeOciObjectStorageNativeTool(request('get_namespace', AUTH))
+    await expect(unknown.json()).resolves.toEqual({
+      success: false,
+      error: 'OCI Object Storage operation failed',
+    })
+  })
+
+  it('preserves cancellation before and after provider work', async () => {
+    const controller = new AbortController()
+    const reason = new DOMException('Canceled', 'AbortError')
+    const call = { ...request('get_namespace', AUTH), signal: controller.signal }
+    mocks.executeOciNativeOperation.mockImplementationOnce(async () => {
+      controller.abort(reason)
+      throw reason
+    })
+    await expect(executeOciObjectStorageNativeTool(call)).rejects.toBe(reason)
+    mocks.executeOciNativeOperation.mockClear()
+    await expect(executeOciObjectStorageNativeTool(call)).rejects.toBe(reason)
+    expect(mocks.executeOciNativeOperation).not.toHaveBeenCalled()
+  })
+})

apps/sim/lib/internal/oci-object-storage-native/errors.ts

@@ -0,0 +1,65 @@
+import { createLogger } from '@sim/logger'
+import { isPlainRecord } from '@sim/utils/object'
+import { getValidationErrorMessage } from '@/lib/api/server'
+import { normalizeOciNativeError } from '@/lib/internal/oci-object-storage-native/errors'
+import { executeOciNativeOperation } from '@/lib/internal/oci-object-storage-native/operations'
+import { ociNativeInputSchema } from '@/lib/internal/oci-object-storage-native/schema'
+import type { InternalToolOperationHandler } from '@/lib/internal/tool-operations/types'
+
+const logger = createLogger('OciObjectStorageNativeToolExecution')
+const PREFIX = 'oci_object_storage_native_'
+
+export const executeOciObjectStorageNativeTool: InternalToolOperationHandler = async (request) => {
+  request.signal?.throwIfAborted()
+  if (
+    !request.toolId.startsWith(PREFIX) ||
+    !isPlainRecord(request.input) ||
+    'operation' in request.input
+  ) {
+    return Response.json(
+      { success: false, error: 'Invalid native OCI tool input' },
+      { status: 400 }
+    )
+  }
+  const parsed = ociNativeInputSchema.safeParse({
+    ...request.input,
+    operation: request.toolId.slice(PREFIX.length),
+  })
+  if (!parsed.success)
+    return Response.json(
+      {
+        success: false,
+        error: getValidationErrorMessage(parsed.error, 'Invalid native OCI request'),
+      },
+      { status: 400 }
+    )
+  if (!request.context.workspaceId)
+    return Response.json(
+      { success: false, error: 'Workspace context is required' },
+      { status: 403 }
+    )
+  try {
+    const result = await executeOciNativeOperation(parsed.data, {
+      workspaceId: request.context.workspaceId,
+      workflowId: request.context.workflowId,
+      executionId: request.context.executionId,
+      userId: request.context.executorDelegationOrigin?.subjectUserId ?? request.context.userId,
+      requestId: request.requestId,
+      signal: request.signal,
+    })
+    request.signal?.throwIfAborted()
+    return Response.json(result)
+  } catch (error) {
+    request.signal?.throwIfAborted()
+    const normalized = normalizeOciNativeError(error)
+    logger.warn('Native OCI operation failed', {
+      requestId: request.requestId,
+      toolId: request.toolId,
+      status: normalized.status,
+    })
+    return Response.json(
+      { success: false, error: normalized.message },
+      { status: normalized.status }
+    )
+  }
+}