Merge branch 'fix/cubic-iam' into feat/aws-integration-batch

Author: waleedlatif1

apps/sim/blocks/blocks/iam.test.ts

@@ -0,0 +1,74 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import { IAMBlock } from '@/blocks/blocks/iam'
+
+const SHAPE_ERROR =
+  'Condition Context Keys must be a JSON array of { contextKeyName, contextKeyValues, contextKeyType }'
+
+const CONTEXT_ENTRY = {
+  contextKeyName: 'aws:SourceIp',
+  contextKeyValues: ['203.0.113.10'],
+  contextKeyType: 'ip',
+}
+
+function simulateParams(extra: Record<string, unknown>) {
+  return IAMBlock.tools.config!.params!({
+    operation: 'simulate_principal_policy',
+    region: 'us-east-1',
+    accessKeyId: 'AKIAIOSFODNN7EXAMPLE',
+    secretAccessKey: 'secret',
+    policySourceArn: 'arn:aws:iam::000000000000:role/example',
+    actionNames: 's3:GetObject',
+    ...extra,
+  })
+}
+
+describe('IAMBlock contextEntries parsing', () => {
+  it('passes a JSON array string through as parsed context entries', () => {
+    const result = simulateParams({ contextEntries: JSON.stringify([CONTEXT_ENTRY]) })
+    expect(result.contextEntries).toEqual([CONTEXT_ENTRY])
+  })
+
+  it('passes an already-parsed array through unchanged', () => {
+    const result = simulateParams({ contextEntries: [CONTEXT_ENTRY] })
+    expect(result.contextEntries).toEqual([CONTEXT_ENTRY])
+  })
+
+  it('rejects a JSON object rather than silently simulating without the context keys', () => {
+    expect(() => simulateParams({ contextEntries: JSON.stringify(CONTEXT_ENTRY) })).toThrow(
+      SHAPE_ERROR
+    )
+  })
+
+  it('rejects a JSON scalar rather than silently dropping it', () => {
+    expect(() => simulateParams({ contextEntries: '"aws:SourceIp"' })).toThrow(SHAPE_ERROR)
+    expect(() => simulateParams({ contextEntries: '42' })).toThrow(SHAPE_ERROR)
+  })
+
+  it('rejects a non-array object supplied directly', () => {
+    expect(() => simulateParams({ contextEntries: CONTEXT_ENTRY })).toThrow(SHAPE_ERROR)
+  })
+
+  it('rejects malformed JSON with the same shape message', () => {
+    expect(() => simulateParams({ contextEntries: '{not json' })).toThrow(SHAPE_ERROR)
+  })
+
+  it('omits contextEntries when the field is blank', () => {
+    const result = simulateParams({ contextEntries: '' })
+    expect(result.contextEntries).toBeUndefined()
+  })
+
+  it('omits contextEntries for an empty JSON array without throwing', () => {
+    const result = simulateParams({ contextEntries: '[]' })
+    expect(result.contextEntries).toBeUndefined()
+  })
+})
+
+describe('IAMBlock contextEntries wand config', () => {
+  it('generates a JSON array, matching the prompt and the tool contract', () => {
+    const subBlock = IAMBlock.subBlocks.find((block) => block.id === 'contextEntries')
+    expect(subBlock?.wandConfig?.generationType).toBe('json-array')
+  })
+})

apps/sim/blocks/blocks/iam.ts

@@ -3,6 +3,16 @@ import type { BlockConfig, BlockMeta } from '@/blocks/types'
 import { AuthMode, IntegrationType } from '@/blocks/types'
 import type { IAMBaseResponse } from '@/tools/iam/types'
 
+/**
+ * Raised when `contextEntries` is not a JSON array of context entries.
+ *
+ * A simulation that quietly drops the caller's condition context keys returns a
+ * *wrong* permission answer — `aws:SourceIp` never applies, so a policy that should
+ * have denied reports `allowed`. Rejecting the input is the only safe outcome.
+ */
+const CONTEXT_ENTRIES_SHAPE_ERROR =
+  'Condition Context Keys must be a JSON array of { contextKeyName, contextKeyValues, contextKeyType }'
+
 export const IAMBlock: BlockConfig<IAMBaseResponse> = {
   type: 'iam',
   name: 'AWS IAM',
@@ -407,7 +417,7 @@ export const IAMBlock: BlockConfig<IAMBaseResponse> = {
         enabled: true,
         prompt:
           'Generate a JSON array of AWS IAM simulation context entries. Each element must have contextKeyName (a full condition context key such as aws:SourceIp), contextKeyValues (an array of strings), and contextKeyType (one of string, stringList, numeric, numericList, boolean, booleanList, ip, ipList, binary, binaryList, date, dateList). Return ONLY the JSON array - no explanations, no extra text.',
-        generationType: 'json-object',
+        generationType: 'json-array',
         placeholder: 'Describe the request conditions to simulate, e.g. "from IP 203.0.113.10"',
       },
     },
@@ -685,12 +695,13 @@ export const IAMBlock: BlockConfig<IAMBaseResponse> = {
                 try {
                   parsed = JSON.parse(contextEntries)
                 } catch {
-                  throw new Error(
-                    'Condition Context Keys must be a JSON array of { contextKeyName, contextKeyValues, contextKeyType }'
-                  )
+                  throw new Error(CONTEXT_ENTRIES_SHAPE_ERROR)
                 }
               }
-              if (Array.isArray(parsed) && parsed.length > 0) result.contextEntries = parsed
+              if (!Array.isArray(parsed)) {
+                throw new Error(CONTEXT_ENTRIES_SHAPE_ERROR)
+              }
+              if (parsed.length > 0) result.contextEntries = parsed
             }
             if (maxItems) {
               const parsed = Number.parseInt(String(maxItems), 10)

apps/sim/lib/api/contracts/tools/aws/iam-shared.test.ts

@@ -0,0 +1,65 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import { iamRegionSchema } from '@/lib/api/contracts/tools/aws/iam-shared'
+
+describe('iamRegionSchema', () => {
+  it.each([
+    'us-east-1',
+    'eu-west-2',
+    'ap-southeast-4',
+    'sa-east-1',
+    'il-central-1',
+    'mx-central-1',
+    'ca-west-1',
+  ])('accepts the commercial region %s', (region) => {
+    expect(iamRegionSchema.safeParse(region).success).toBe(true)
+  })
+
+  it.each(['us-gov-east-1', 'us-gov-west-1', 'cn-north-1', 'cn-northwest-1'])(
+    'accepts the partitioned region %s',
+    (region) => {
+      expect(iamRegionSchema.safeParse(region).success).toBe(true)
+    }
+  )
+
+  it.each(['us-iso-east-1', 'us-isob-east-1', 'eu-isoe-west-1', 'eusc-de-east-1'])(
+    'accepts the isolated region %s',
+    (region) => {
+      expect(iamRegionSchema.safeParse(region).success).toBe(true)
+    }
+  )
+
+  /**
+   * The pinned `@aws-sdk/client-iam` endpoint ruleset maps the ISO-F partition to
+   * `https://iam.us-isof-south-1.csp.hci.ic.gov`, so IAM demonstrably exists there.
+   */
+  it.each(['us-isof-south-1', 'us-isof-east-1'])('accepts the ISO-F region %s', (region) => {
+    expect(iamRegionSchema.safeParse(region).success).toBe(true)
+  })
+
+  it('rejects an empty region', () => {
+    expect(iamRegionSchema.safeParse('').success).toBe(false)
+  })
+
+  it.each([
+    'us_east_1',
+    'US-EAST-1',
+    'us east 1',
+    'useast1',
+    'us-east-1.evil.example.com',
+    'us-east-1/../admin',
+    'us-east-1:443',
+    'user@us-east-1',
+    'us-east-1\nx-injected: 1',
+    '-us-east-1',
+    'us-east-1-',
+  ])('rejects the host-unsafe or malformed value %j', (region) => {
+    expect(iamRegionSchema.safeParse(region).success).toBe(false)
+  })
+
+  it('rejects a region longer than 64 characters', () => {
+    expect(iamRegionSchema.safeParse(`us-${'a'.repeat(70)}-1`).success).toBe(false)
+  })
+})

apps/sim/lib/core/security/aws-region-partitions.test.ts

@@ -0,0 +1,32 @@
+import { describe, expect, it } from 'vitest'
+import { validateAwsRegion } from '@/lib/core/security/input-validation'
+
+const ok = [
+  'us-east-1',
+  'eu-west-2',
+  'us-gov-west-1',
+  'cn-northwest-1',
+  'us-iso-east-1',
+  'us-isob-east-1',
+  'eu-isoe-west-1',
+  'eusc-de-east-1',
+  'us-isof-south-1',
+  'us-isof-east-1',
+  'ap-southeast-4',
+  'me-central-1',
+]
+const bad = [
+  '',
+  'us-east',
+  'US-EAST-1',
+  'us-east-1.evil.com',
+  'us-east-1/x',
+  'us-isog-east-1',
+  '../us-east-1',
+  'us-east-1:80',
+]
+describe('validateAwsRegion partitions', () => {
+  for (const r of ok) it(`accepts ${r}`, () => expect(validateAwsRegion(r).isValid).toBe(true))
+  for (const r of bad)
+    it(`rejects ${JSON.stringify(r)}`, () => expect(validateAwsRegion(r).isValid).toBe(false))
+})

apps/sim/lib/core/security/input-validation.ts

@@ -630,8 +630,13 @@ export function validateAwsRegion(
     }
   }
 
+  /**
+   * Partition prefixes are matched longest-first: `us-isob` and `us-isof` must precede
+   * `us-iso`, or the shorter alternative wins and the trailing partition letter fails to
+   * match the following `-`.
+   */
   const awsRegionPattern =
-    /^(eu-isoe|eusc-[a-z]{2}|us-isob|us-iso|us-gov|af|ap|ca|cn|eu|il|me|mx|sa|us)-(central|north|northeast|northwest|south|southeast|southwest|east|west)-\d{1,2}$/
+    /^(eu-isoe|eusc-[a-z]{2}|us-isob|us-isof|us-iso|us-gov|af|ap|ca|cn|eu|il|me|mx|sa|us)-(central|north|northeast|northwest|south|southeast|southwest|east|west)-\d{1,2}$/
 
   if (!awsRegionPattern.test(value)) {
     logger.warn('Invalid AWS region format', {