fix(netsuite): isolate cached credentials

Author: Bill Leoutsakos

apps/sim/blocks/blocks/netsuite.test.ts

@@ -2,7 +2,7 @@
  * @vitest-environment node
  */
 import { describe, expect, it } from 'vitest'
-import { NETSUITE_TOOL_IDS, NetSuiteBlock, NetSuiteBlockMeta } from './netsuite'
+import { NETSUITE_TOOL_IDS, NetSuiteBlock, NetSuiteBlockMeta } from '@/blocks/blocks/netsuite'
 
 function getSubBlock(id: string) {
   const subBlock = NetSuiteBlock.subBlocks.find((candidate) => candidate.id === id)

apps/sim/tools/netsuite/utils.test.ts

@@ -16,6 +16,10 @@ import {
 
 const { privateKey, publicKey } = generateKeyPairSync('rsa', { modulusLength: 2048 })
 const PRIVATE_KEY = privateKey.export({ type: 'pkcs8', format: 'pem' }).toString()
+const { privateKey: alternatePrivateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 })
+const ALTERNATE_PRIVATE_KEY = alternatePrivateKey
+  .export({ type: 'pkcs8', format: 'pem' })
+  .toString()
 const AUTH: NetSuiteAuthParams = {
   accountId: '1234567_SB1',
   clientId: 'client-id',
@@ -129,6 +133,15 @@ describe('NetSuite shared executor', () => {
     expect(expiring.calls.filter((call) => call.url === TOKEN_URL)).toHaveLength(2)
   })
 
+  it('isolates cached tokens by private-key identity', async () => {
+    const { calls } = installFetch([jsonResponse({}), jsonResponse({})], 3600)
+
+    await executeServerTime()
+    await executeServerTime({ ...AUTH, privateKey: ALTERNATE_PRIVATE_KEY })
+
+    expect(calls.filter((call) => call.url === TOKEN_URL)).toHaveLength(2)
+  })
+
   it('bounds the cache and evicts the least-recently-inserted identity', async () => {
     const { calls } = installFetch([], 3600)
     for (let index = 0; index <= 100; index += 1) {

apps/sim/tools/netsuite/utils.ts

@@ -1,4 +1,4 @@
-import { createPrivateKey } from 'node:crypto'
+import { createHash, createPrivateKey } from 'node:crypto'
 import { getErrorMessage } from '@sim/utils/errors'
 import { SignJWT } from 'jose'
 import {
@@ -469,7 +469,15 @@ function setCachedToken(cacheKey: string, accessToken: string, expiresAt: number
 }
 
 function getCacheKey(accountHost: string, auth: NetSuiteAuthParams): string {
-  return JSON.stringify([accountHost, auth.clientId.trim(), auth.certificateId.trim()])
+  const privateKeyFingerprint = createHash('sha256')
+    .update(auth.privateKey.trim())
+    .digest('base64url')
+  return JSON.stringify([
+    accountHost,
+    auth.clientId.trim(),
+    auth.certificateId.trim(),
+    privateKeyFingerprint,
+  ])
 }
 
 function parseJobId(location: string): string | undefined {