fix(sailpoint): adaptive token TTL buffer and honest search-count on missing header

- Cap the token cache expiry buffer at the smaller of 60s and 10% of the lifetime so a short-lived
  token still caches instead of expiring immediately.
- Return an error for search_count when SailPoint provides no X-Total-Count (and no numeric body)
  instead of reporting a misleading total of 0. Tests added for both count paths.

Author: mzxchandra

apps/sim/app/api/tools/sailpoint/client.ts

@@ -185,9 +185,12 @@ export async function getSailPointAccessToken(creds: SailPointServerCredentials)
 
   const parsedExpiry = Number(data.expires_in)
   const expiresInSec = Number.isFinite(parsedExpiry) && parsedExpiry > 0 ? parsedExpiry : 3600
+  // Use the smaller of the 60s buffer and 10% of the lifetime so a short-lived token (expires_in
+  // under ~60s) still gets cached for most of its life instead of expiring immediately.
+  const bufferMs = Math.min(TOKEN_EXPIRY_BUFFER_MS, expiresInSec * 100)
   tokenCache.set(key, {
     token: data.access_token,
-    expiresAt: Date.now() + Math.max(expiresInSec * 1000 - TOKEN_EXPIRY_BUFFER_MS, 0),
+    expiresAt: Date.now() + Math.max(expiresInSec * 1000 - bufferMs, 0),
   })
   return data.access_token
 }

apps/sim/app/api/tools/sailpoint/query/route.test.ts

@@ -124,6 +124,46 @@ describe('SailPoint query route', () => {
     expect(data.output.results).toEqual([{ _type: 'identity', id: 'i1' }])
   })
 
+  it('returns the total from search count', async () => {
+    fetchMock
+      .mockResolvedValueOnce(tokenResponse())
+      .mockResolvedValueOnce(
+        new Response(null, { status: 204, headers: { 'X-Total-Count': '42' } })
+      )
+
+    const request = createMockRequest('POST', {
+      ...baseCreds,
+      tenant: 'acme-count',
+      operation: 'sailpoint_search_count',
+      indices: 'identities',
+    })
+
+    const response = await POST(request)
+    const data = await response.json()
+
+    expect(response.status).toBe(200)
+    expect(data.output).toEqual({ total: 42 })
+  })
+
+  it('errors instead of reporting zero when search count has no total header', async () => {
+    fetchMock
+      .mockResolvedValueOnce(tokenResponse())
+      .mockResolvedValueOnce(new Response(null, { status: 204 }))
+
+    const request = createMockRequest('POST', {
+      ...baseCreds,
+      tenant: 'acme-count-none',
+      operation: 'sailpoint_search_count',
+      indices: 'identities',
+    })
+
+    const response = await POST(request)
+    const data = await response.json()
+
+    expect(response.status).toBe(502)
+    expect(data.success).toBe(false)
+  })
+
   it('preserves the aggregation object returned by /search/aggregate', async () => {
     const aggregationResult = {
       aggregations: { department: { buckets: [{ key: 'Finance', count: 12 }] } },

apps/sim/app/api/tools/sailpoint/query/route.ts

@@ -145,12 +145,22 @@ async function execute(
     case 'item':
       output = { item: result.data ?? null }
       break
-    case 'count':
-      output = {
-        total:
-          readTotalCount(result.headers) ?? (typeof result.data === 'number' ? result.data : 0),
+    case 'count': {
+      const total =
+        readTotalCount(result.headers) ?? (typeof result.data === 'number' ? result.data : null)
+      // Do not report an unknown count as 0 - that reads as "no matches". Surface it as an error.
+      if (total === null) {
+        return NextResponse.json(
+          {
+            success: false,
+            error: 'SailPoint did not return a total count (X-Total-Count missing)',
+          },
+          { status: 502 }
+        )
       }
+      output = { total }
       break
+    }
     case 'write':
       output = { accepted: result.ok, status: result.status }
       break