feat(credentials): Thrive saved credential, and close the batch-3 audit findings

Thrive gets a credential holding its key, tenant id, and region host (one of
its four API hosts). Audit fixes: the connect form sends URL-shaped domains
as typed so the provider check keeps their scheme and path; credentials
default to a name with their domain or account id (GitLab keeps its token
name) and record it in the audit log; Upstash accepts http and a read-only
token refused PING; Infisical keeps http and a proxy path; Devin, Dynatrace,
and Logfire refuse dot segments, non-http schemes, and mistyped regions.

Author: waleedlatif1

apps/docs/components/ui/icon-mapping.ts

@@ -773,6 +773,7 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   textract_v3: TextractIcon,
   thinking: BrainIcon,
   thrive: ThriveIcon,
+  thrive_v2: ThriveIcon,
   tiktok: TikTokIcon,
   tinybird: TinybirdIcon,
   tinybird_v2: TinybirdIcon,

apps/docs/content/docs/integrations/thrive.mdx

@@ -110,7 +110,7 @@ function TokenServiceAccountModalForm({
   const workspaceField = descriptor.fields.find((field) => field.id === 'providerWorkspaceId')
 
   const trimmedToken = apiToken.trim()
-  const normalizedDomain = normalizeDomainInput(domain)
+  const normalizedDomain = domainField?.url ? domain.trim() : normalizeDomainInput(domain)
   const isPending =
     createCredential.isPending || updateCredential.isPending || submitPending === true
   const isDisabled =

apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/token-service-account-modal.tsx

@@ -2343,8 +2343,6 @@ export const DynatraceV2Block: BlockConfig = {
       },
     },
   },
-  longDescription:
-    'Integrate Dynatrace into workflows. Investigate and close Davis problems, query metrics and monitored entities, search and ingest logs, push deployment events, manage SLOs and their burn rates, triage and mute Application Security vulnerabilities, review runtime attacks, tag entities, manage settings objects such as maintenance windows and alerting profiles, run synthetic monitors on demand, and read the audit log.',
   ...withSavedCredential(DynatraceBlock, {
     id: 'credential',
     type: 'oauth-input',

apps/sim/blocks/blocks/dynatrace.ts

@@ -1,5 +1,6 @@
 import { ThriveIcon } from '@/components/icons'
 import { AuthMode, type BlockConfig, type BlockMeta, IntegrationType } from '@/blocks/types'
+import { withSavedCredential } from '@/blocks/utils'
 
 const PAGINATED_OPS = [
   'search_users',
@@ -71,6 +72,8 @@ const STATUS_FILTER_FIELD = ['userStatus', 'statuses'] as const
 
 export const ThriveBlock: BlockConfig = {
   type: 'thrive',
+  hideFromToolbar: true,
+  sunset: { status: 'legacy', replacedBy: 'thrive_v2' },
   name: 'Thrive',
   description: 'Manage users, audiences, learning and CPD on Thrive',
   longDescription:
@@ -1185,3 +1188,16 @@ export const ThriveBlockMeta = {
     },
   ],
 } as const satisfies BlockMeta
+
+export const ThriveV2Block: BlockConfig = {
+  ...ThriveBlock,
+  type: 'thrive_v2',
+  authMode: AuthMode.OAuth,
+  hideFromToolbar: false,
+  sunset: undefined,
+  ...withSavedCredential(
+    ThriveBlock,
+    { id: 'credential', type: 'oauth-input', serviceId: 'thrive', title: 'Thrive Credential' },
+    { required: true }
+  ),
+}

apps/sim/blocks/blocks/thrive.ts

@@ -666,8 +666,6 @@ export const TinybirdV2Block: BlockConfig = {
   authMode: AuthMode.OAuth,
   hideFromToolbar: false,
   sunset: undefined,
-  longDescription:
-    'Interact with Tinybird: stream JSON or NDJSON events with the Events API, run SQL with the Query API, call published Pipe API Endpoints by name with dynamic parameters, manage Data Sources by appending from a URL, truncating, or deleting rows by condition, and poll the status of asynchronous jobs.',
   ...withSavedCredential(TinybirdBlock, {
     id: 'credential',
     type: 'oauth-input',

apps/sim/blocks/blocks/tinybird.ts

@@ -415,7 +415,7 @@ import {
   TextractV3Block,
 } from '@/blocks/blocks/textract'
 import { ThinkingBlock } from '@/blocks/blocks/thinking'
-import { ThriveBlock, ThriveBlockMeta } from '@/blocks/blocks/thrive'
+import { ThriveBlock, ThriveBlockMeta, ThriveV2Block } from '@/blocks/blocks/thrive'
 import { TikTokBlock, TikTokBlockMeta } from '@/blocks/blocks/tiktok'
 import { TinybirdBlock, TinybirdBlockMeta, TinybirdV2Block } from '@/blocks/blocks/tinybird'
 import { TinyFishBlock, TinyFishBlockMeta } from '@/blocks/blocks/tinyfish'
@@ -912,6 +912,7 @@ export const BLOCK_REGISTRY: Record<string, BlockConfig> = {
   textract_v3: TextractV3Block,
   thinking: ThinkingBlock,
   thrive: ThriveBlock,
+  thrive_v2: ThriveV2Block,
   tiktok: TikTokBlock,
   tinybird: TinybirdBlock,
   tinybird_v2: TinybirdV2Block,

apps/sim/blocks/registry-maps.ts

@@ -289,7 +289,7 @@ export const BLOCK_NAMES: Readonly<Record<string, string>> = {
   temporal: 'Temporal',
   textract_v3: 'AWS Textract',
   thinking: 'Thinking',
-  thrive: 'Thrive',
+  thrive_v2: 'Thrive',
   tiktok: 'TikTok',
   tinybird_v2: 'Tinybird',
   tinyfish: 'TinyFish',

apps/sim/lib/block-metadata/names.generated.ts

@@ -24,6 +24,12 @@ export interface TokenServiceAccountField {
   placeholder: string
   /** Rendered with SecretInput and never echoed back. */
   secret: boolean
+  /**
+   * The value is a URL whose scheme and path matter (a self-hosted instance or
+   * deployment URL), so the connect form sends it as typed and the provider's
+   * check normalizes it. Other domains are reduced to a bare host first.
+   */
+  url?: boolean
   /** Soft-format hint shown while the current value doesn't match `hintPattern`. */
   hintPattern?: RegExp
   hintMessage?: string
@@ -85,6 +91,7 @@ export const FLOW_SERVICE_ACCOUNT_PROVIDER_ID = 'flow-service-account' as const
 export const CODA_SERVICE_ACCOUNT_PROVIDER_ID = 'coda-service-account' as const
 export const GAUGE_SERVICE_ACCOUNT_PROVIDER_ID = 'gauge-service-account' as const
 export const HIGGSFIELD_SERVICE_ACCOUNT_PROVIDER_ID = 'higgsfield-service-account' as const
+export const THRIVE_SERVICE_ACCOUNT_PROVIDER_ID = 'thrive-service-account' as const
 export const SUPABASE_SERVICE_ACCOUNT_PROVIDER_ID = 'supabase-service-account' as const
 export const INFISICAL_SERVICE_ACCOUNT_PROVIDER_ID = 'infisical-service-account' as const
 export const OKTA_SERVICE_ACCOUNT_PROVIDER_ID = 'okta-service-account' as const
@@ -211,6 +218,7 @@ export type TokenServiceAccountProviderId =
   | typeof CODA_SERVICE_ACCOUNT_PROVIDER_ID
   | typeof GAUGE_SERVICE_ACCOUNT_PROVIDER_ID
   | typeof HIGGSFIELD_SERVICE_ACCOUNT_PROVIDER_ID
+  | typeof THRIVE_SERVICE_ACCOUNT_PROVIDER_ID
   | typeof SUPABASE_SERVICE_ACCOUNT_PROVIDER_ID
   | typeof INFISICAL_SERVICE_ACCOUNT_PROVIDER_ID
   | typeof OKTA_SERVICE_ACCOUNT_PROVIDER_ID
@@ -1839,6 +1847,7 @@ export const TOKEN_SERVICE_ACCOUNT_DESCRIPTORS: Record<
         label: 'Grafana URL',
         placeholder: 'https://your-stack.grafana.net',
         secret: false,
+        url: true,
       },
     ],
     docsUrl: 'https://docs.sim.ai/integrations/grafana',
@@ -1864,6 +1873,7 @@ export const TOKEN_SERVICE_ACCOUNT_DESCRIPTORS: Record<
         label: 'Server URL',
         placeholder: 'https://jupyter.example.com',
         secret: false,
+        url: true,
       },
     ],
     docsUrl: 'https://docs.sim.ai/integrations/jupyter',
@@ -1889,6 +1899,7 @@ export const TOKEN_SERVICE_ACCOUNT_DESCRIPTORS: Record<
         label: 'Deployment URL',
         placeholder: 'https://your-deployment.convex.cloud',
         secret: false,
+        url: true,
       },
     ],
     docsUrl: 'https://docs.sim.ai/integrations/convex',
@@ -1909,6 +1920,7 @@ export const TOKEN_SERVICE_ACCOUNT_DESCRIPTORS: Record<
         label: 'API base URL',
         placeholder: 'https://api.tinybird.co',
         secret: false,
+        url: true,
       },
     ],
     docsUrl: 'https://docs.sim.ai/integrations/tinybird',
@@ -1929,6 +1941,7 @@ export const TOKEN_SERVICE_ACCOUNT_DESCRIPTORS: Record<
         label: 'Environment URL',
         placeholder: 'https://abc12345.live.dynatrace.com',
         secret: false,
+        url: true,
       },
     ],
     docsUrl: 'https://docs.sim.ai/integrations/dynatrace',
@@ -1964,6 +1977,7 @@ export const TOKEN_SERVICE_ACCOUNT_DESCRIPTORS: Record<
         label: 'Region or host',
         placeholder: 'auto, us, eu, or https://logfire.example.com',
         secret: false,
+        url: true,
       },
     ],
     docsUrl: 'https://docs.sim.ai/integrations/logfire',
@@ -2023,7 +2037,13 @@ export const TOKEN_SERVICE_ACCOUNT_DESCRIPTORS: Record<
     connectNoun: 'API token',
     fields: [
       { id: 'apiToken', label: 'API token', placeholder: 'plane_api_...', secret: true },
-      { id: 'domain', label: 'Instance URL', placeholder: 'https://api.plane.so', secret: false },
+      {
+        id: 'domain',
+        label: 'Instance URL',
+        placeholder: 'https://api.plane.so',
+        secret: false,
+        url: true,
+      },
     ],
     docsUrl: 'https://docs.sim.ai/integrations/plane',
     helpText:
@@ -2103,7 +2123,7 @@ export const TOKEN_SERVICE_ACCOUNT_DESCRIPTORS: Record<
     ],
     docsUrl: 'https://docs.sim.ai/integrations/algolia',
     helpText:
-      'Copy the Application ID and an API key from Settings > API Keys in the Algolia dashboard. Use the Write API key, or a key with the ACLs your workflows need; a Search-only key can only search.',
+      'Copy the Application ID and an API key from Settings > API Keys in the Algolia dashboard. Use the Write API key, or a key with the ACLs your workflows need; a Search-only key can only search, and secured (derived) keys are not supported.',
     invalidCredentialsHelp:
       'Algolia rejected this application ID and API key. Check that the key belongs to this application and has not been deleted.',
   },
@@ -2124,6 +2144,7 @@ export const TOKEN_SERVICE_ACCOUNT_DESCRIPTORS: Record<
         label: 'REST URL',
         placeholder: 'https://your-database.upstash.io',
         secret: false,
+        url: true,
       },
     ],
     docsUrl: 'https://docs.sim.ai/integrations/upstash',
@@ -2149,6 +2170,7 @@ export const TOKEN_SERVICE_ACCOUNT_DESCRIPTORS: Record<
         label: 'Instance URL',
         placeholder: 'https://dedi.emailbison.com',
         secret: false,
+        url: true,
       },
     ],
     docsUrl: 'https://docs.sim.ai/integrations/emailbison',
@@ -2204,7 +2226,7 @@ export const TOKEN_SERVICE_ACCOUNT_DESCRIPTORS: Record<
     helpText:
       'Create an API token in the Okta Admin Console under Security > API > Tokens. The token acts with the admin roles of the user who created it. Enter your Okta domain, such as dev-123456.okta.com; custom domains are not supported.',
     invalidCredentialsHelp:
-      'Okta rejected this token. Check that it is active, was created in this Okta org, and that the domain is your okta.com (or oktapreview.com) domain.',
+      'Okta rejected this token. Check that it is active, was created in this Okta org, and that the domain is your Okta-hosted domain (okta.com, oktapreview.com, okta-emea.com, or okta-gov.com).',
   },
   [INFISICAL_SERVICE_ACCOUNT_PROVIDER_ID]: {
     providerId: INFISICAL_SERVICE_ACCOUNT_PROVIDER_ID,
@@ -2223,6 +2245,7 @@ export const TOKEN_SERVICE_ACCOUNT_DESCRIPTORS: Record<
         label: 'Instance URL',
         placeholder: 'https://us.infisical.com',
         secret: false,
+        url: true,
       },
     ],
     docsUrl: 'https://docs.sim.ai/integrations/infisical',
@@ -2246,6 +2269,27 @@ export const TOKEN_SERVICE_ACCOUNT_DESCRIPTORS: Record<
     invalidCredentialsHelp:
       "Supabase rejected this key. Check that it belongs to the project you entered and hasn't been revoked.",
   },
+  [THRIVE_SERVICE_ACCOUNT_PROVIDER_ID]: {
+    providerId: THRIVE_SERVICE_ACCOUNT_PROVIDER_ID,
+    serviceLabel: 'Thrive',
+    tokenNoun: 'API key',
+    connectNoun: 'API key',
+    fields: [
+      { id: 'apiToken', label: 'API key', placeholder: 'Paste your Thrive API key', secret: true },
+      {
+        id: 'providerWorkspaceId',
+        label: 'Tenant ID',
+        placeholder: 'Your Thrive tenant ID',
+        secret: false,
+      },
+      { id: 'domain', label: 'Region host', placeholder: 'public.api.learn.link', secret: false },
+    ],
+    docsUrl: 'https://docs.sim.ai/integrations/thrive',
+    helpText:
+      'Use the API key and tenant ID from your Thrive admin settings. Region host is public.api.learn.link, or public.api.mea.learn.tech for the Middle East and Africa (staging hosts also work).',
+    invalidCredentialsHelp:
+      'Thrive rejected this API key. Check that the tenant ID matches the key and that the region host is the one your tenant uses.',
+  },
 }
 
 /**

apps/sim/lib/credentials/token-service-accounts/descriptors.ts

@@ -103,6 +103,7 @@ import {
   TAILSCALE_SERVICE_ACCOUNT_PROVIDER_ID,
   TAVILY_SERVICE_ACCOUNT_PROVIDER_ID,
   TELEGRAM_SERVICE_ACCOUNT_PROVIDER_ID,
+  THRIVE_SERVICE_ACCOUNT_PROVIDER_ID,
   TINYBIRD_SERVICE_ACCOUNT_PROVIDER_ID,
   TOKEN_SERVICE_ACCOUNT_SECRET_TYPE,
   type TokenServiceAccountProviderId,
@@ -223,6 +224,7 @@ import {
   validateTailscaleServiceAccount,
   validateTavilyServiceAccount,
   validateTelegramServiceAccount,
+  validateThriveServiceAccount,
   validateTinybirdServiceAccount,
   validateTriggerDevServiceAccount,
   validateTwilioServiceAccount,
@@ -394,6 +396,7 @@ const TOKEN_SERVICE_ACCOUNT_VALIDATORS: Record<
   [STRIPE_SERVICE_ACCOUNT_PROVIDER_ID]: validateStripeServiceAccount,
   [SUPABASE_SERVICE_ACCOUNT_PROVIDER_ID]: validateSupabaseServiceAccount,
   [TELEGRAM_SERVICE_ACCOUNT_PROVIDER_ID]: validateTelegramServiceAccount,
+  [THRIVE_SERVICE_ACCOUNT_PROVIDER_ID]: validateThriveServiceAccount,
   [TINYBIRD_SERVICE_ACCOUNT_PROVIDER_ID]: validateTinybirdServiceAccount,
   [TWILIO_SERVICE_ACCOUNT_PROVIDER_ID]: validateTwilioServiceAccount,
   [TYPEFORM_SERVICE_ACCOUNT_PROVIDER_ID]: validateTypeformServiceAccount,