fix(security): SSRF fixes

[waleedlatif1]

Summary

• Azure TTS: validate `region` param against an allowlist regex in both the contract and at runtime — prevents user-supplied region from redirecting requests (and the Azure subscription key) to an attacker-controlled host
• Shopify OAuth: apply `shopifyShopDomainSchema` validation to the `shopDomain` cookie before building the server-side fetch URL — was only checked as non-empty, allowing SSRF
• HubSpot: remove `fullResponse` from the OAuth introspection `logger.info` call — the raw response includes the access token; now only logs non-sensitive metadata
• Wealthbox OAuth `getUserInfo`: fix wrong endpoint (`/v1/users/me` → `/v1/me`), fix auth header (`ACCESS_TOKEN` → `Authorization: Bearer`), and fix non-deterministic fallback identity that created a new account on every token refresh (`generateId()` removed; fallback now hashes the stable refresh token)

Type of Change

• Bug fix

Testing

Tested manually. Azure region regex validated against all 33 live Azure Speech Service regions — all pass. Shopify schema validated against Shopify's documented domain format. Wealthbox endpoint and auth header confirmed against dev.wealthbox.com API docs.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		May 11, 2026 2:51am

[cursor]

PR Summary

Medium Risk
Tightens validation and identity handling in OAuth and Azure TTS request construction, which is security-relevant and could break edge-case integrations if callers relied on previously-accepted inputs. Also changes Wealthbox user identity derivation, which may affect account linking behavior for existing connections.

Overview
Closes multiple SSRF/token-leak vectors by validating user-controlled host components before server-side fetch calls and by reducing sensitive OAuth logging.

Specifically, the Shopify OAuth store route now enforces shopifyShopDomainSchema on the shopDomain cookie before building the Shopify API URL, and the unified Azure TTS proxy validates region via a strict Azure-region regex in both the API contract and runtime.

OAuth provider hardening includes updating Wealthbox getUserInfo to call the correct /v1/me endpoint with Authorization: Bearer, and making the fallback identity stable by hashing a long-lived token instead of using generateId(). HubSpot token introspection logging is trimmed to metadata-only to avoid logging sensitive response content.

^{Reviewed by Cursor Bugbot for commit c90c3f2. Configure here.}

[greptile-apps]

Greptile Summary

This PR applies targeted SSRF and credential-exposure fixes across four areas: Azure TTS region validation, Shopify OAuth shop domain enforcement, HubSpot introspection log sanitization, and a full Wealthbox OAuth rewrite with the correct endpoint, auth header, and SHA-256-derived stable identity.

• Azure TTS: region is now validated by /^[a-z][a-z0-9-]{1,30}[a-z0-9]$/ at both the Zod contract layer and inside synthesizeWithAzure, preventing an attacker-controlled hostname from redirecting the Azure subscription key.
• Shopify OAuth: shopifyShopDomainSchema (enforces *.myshopify.com) is checked before the shop-domain value is interpolated into the fetch URL, closing the SSRF vector.
• HubSpot / Wealthbox: fullResponse (which contained the raw access token) is stripped from the HubSpot logger; the Wealthbox getUserInfo now hits the real /v1/me endpoint with a proper Authorization: Bearer header and falls back to a SHA-256 hash of the refresh token rather than generateId() to prevent duplicate account creation on token rotation.

Confidence Score: 4/5

The four targeted security fixes are sound and well-structured; an SSML injection issue in the Azure TTS route (flagged in a prior review) remains open.

All four fixes close real attack vectors cleanly — the Shopify domain allowlist, the Azure region allowlist with defense-in-depth, the HubSpot log sanitization, and the Wealthbox identity rewrite are each correct and self-consistent. The remaining concern is that voiceId, style, rate, pitch, and text are still interpolated verbatim into the SSML template without XML escaping in the TTS route, a finding carried forward from a prior review that this PR does not address.

apps/sim/app/api/tools/tts/unified/route.ts — SSML string construction still embeds user-supplied fields without XML escaping.

Important Files Changed

Filename	Overview
apps/sim/app/api/auth/oauth2/shopify/store/route.ts	Adds shopifyShopDomainSchema validation for shopDomain cookie before constructing the fetch URL, preventing SSRF via forged *.myshopify.com enforcement.
apps/sim/app/api/tools/tts/unified/route.ts	Adds runtime AZURE_REGION_RE check in synthesizeWithAzure after the Zod-layer validation, providing defense-in-depth against SSRF via the region parameter; SSML injection via voiceId/style/text (flagged in prior review) remains unaddressed.
apps/sim/lib/api/contracts/tools/media/tts.ts	Adds .regex() validation to the region field in the unified TTS Zod schema, rejecting invalid Azure region strings at the contract layer.
apps/sim/lib/auth/auth.ts	Fixes Wealthbox OAuth (correct endpoint, Bearer auth, SHA-256 stable fallback identity) and strips fullResponse from the HubSpot introspection log to prevent access token leakage.

Sequence Diagram

sequenceDiagram
    participant Client
    participant ShopifyRoute as Shopify Store Route
    participant AzureTTS as Azure TTS Route
    participant WealthboxOAuth as Wealthbox OAuth
    participant ExternalAPI as External API

    Note over ShopifyRoute: SSRF Fix
    Client->>ShopifyRoute: GET shopify/store
    ShopifyRoute->>ShopifyRoute: validate cookie schema
    ShopifyRoute->>ShopifyRoute: shopifyShopDomainSchema check
    alt Domain invalid
        ShopifyRoute-->>Client: "redirect error=shopify_invalid_domain"
    else Domain valid
        ShopifyRoute->>ExternalAPI: fetch shopDomain admin API
        ExternalAPI-->>ShopifyRoute: shop data
        ShopifyRoute-->>Client: redirect shopify_connected
    end

    Note over AzureTTS: SSRF Fix with defense-in-depth
    Client->>AzureTTS: POST tts/unified
    AzureTTS->>AzureTTS: Zod region regex check
    AzureTTS->>AzureTTS: Runtime AZURE_REGION_RE check
    alt Region invalid
        AzureTTS-->>Client: 400 Invalid Azure region
    else Region valid
        AzureTTS->>ExternalAPI: fetch region.tts.speech.microsoft.com
        ExternalAPI-->>AzureTTS: audio buffer
        AzureTTS-->>Client: audio response
    end

    Note over WealthboxOAuth: Auth + Identity Fix
    Client->>WealthboxOAuth: OAuth callback
    WealthboxOAuth->>ExternalAPI: GET api.crmworkspace.com/v1/me
    alt API returns user id
        ExternalAPI-->>WealthboxOAuth: user data
        WealthboxOAuth-->>Client: identity from API
    else API fails
        WealthboxOAuth->>WealthboxOAuth: SHA256 refresh token slice
        WealthboxOAuth-->>Client: stable fallback identity
    end

Loading

_{Reviews (3): Last reviewed commit: "fix(auth): replace stale wealthbox userI..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit b2e9f57. Configure here.}

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit c90c3f2. Configure here.}