fix(netsuite): address final audit findings

Author: Bill Leoutsakos

apps/sim/app/api/tools/netsuite/objects/route.test.ts

@@ -234,11 +234,11 @@ describe('POST /api/tools/netsuite/objects', () => {
     })
   })
 
-  it('normalizes, deduplicates, sorts, and caps record types', async () => {
-    const items = Array.from({ length: 1_001 }, (_, index) => ({
-      name: `record_${String(1_000 - index).padStart(4, '0')}`,
+  it('normalizes, deduplicates, and sorts up to 1,000 unique record types', async () => {
+    const items = Array.from({ length: 1_000 }, (_, index) => ({
+      name: `record_${String(999 - index).padStart(4, '0')}`,
     }))
-    items.push({ name: 'record_0000' })
+    items.push({ name: 'record_0000' }, { name: 'record_0999' })
     mockListRecordTypes.mockResolvedValueOnce(success({ items }))
 
     const response = await POST(request(RECORD_TYPES_BODY), {})
@@ -250,6 +250,21 @@ describe('POST /api/tools/netsuite/objects', () => {
     expect((body.objects as { id: string }[]).at(-1)?.id).toBe('record_0999')
   })
 
+  it('fails closed instead of returning a partial record-type catalog', async () => {
+    mockListRecordTypes.mockResolvedValueOnce(
+      success({
+        items: Array.from({ length: 1_001 }, (_, index) => ({ name: `record_${index}` })),
+      })
+    )
+
+    const response = await POST(request(RECORD_TYPES_BODY), {})
+
+    expect(response.status).toBe(502)
+    expect(await json(response)).toEqual({
+      error: 'NetSuite returned an invalid object-discovery response.',
+    })
+  })
+
   it('fails closed on a malformed provider envelope', async () => {
     mockListRecordTypes.mockResolvedValueOnce(success({ items: [{ name: 42 }] }))
 

apps/sim/app/api/tools/netsuite/objects/route.ts

@@ -78,11 +78,19 @@ function dedupeAndSort(objects: NetSuiteSelectorObject[]): NetSuiteSelectorObjec
 }
 
 function normalizeRecordTypes(data: unknown): NetSuiteSelectorObject[] {
-  const objects = requireItems(data, 'record-type catalog').map((item) => {
+  const objects: NetSuiteSelectorObject[] = []
+  const names = new Set<string>()
+  for (const item of requireItems(data, 'record-type catalog')) {
     const name = requireString(item.name, 'record type name', MAX_ID_LENGTH)
-    return { id: name, label: name, detail: null }
-  })
-  return dedupeAndSort(objects).slice(0, MAX_RECORD_TYPES)
+    if (!names.has(name)) {
+      if (names.size >= MAX_RECORD_TYPES) {
+        throw new Error('NetSuite returned too many record types')
+      }
+      names.add(name)
+      objects.push({ id: name, label: name, detail: null })
+    }
+  }
+  return dedupeAndSort(objects)
 }
 
 function taskIdFromHref(href: unknown, origin: string, jobId: string): string {

apps/sim/tools/netsuite/netsuite.test.ts

@@ -238,13 +238,15 @@ const SOURCE_MATRIX: SourceMatrixEntry[] = [
   {
     id: 'netsuite_get_record',
     source: GET_RECORD_SOURCE,
+    additionalSources: [FORM_SOURCE],
     method: 'GET',
     path: '/services/rest/record/v1/customer/A%2FB',
-    query: { expandSubResources: 'true' },
+    query: { expand: 'salesRep', expandSubResources: 'true' },
     successStatus: 200,
     execute: invoke(netsuiteGetRecordTool, {
       recordType: 'customer',
       recordId: 'A/B',
+      expand: 'salesRep',
       expandSubResources: true,
     }),
   },
@@ -662,7 +664,7 @@ describe('NetSuite operation contracts', () => {
       if (entry.body !== undefined && !expectedHeaders['Content-Type']) {
         expectedHeaders['Content-Type'] = 'application/json'
       }
-      if (entry.body !== undefined) {
+      if (entry.body !== undefined && entry.path.startsWith('/services/rest/record/')) {
         expectedHeaders['X-NetSuite-PropertyNameValidation'] = 'error'
       }
       expect(

apps/sim/tools/netsuite/utils.ts

@@ -412,7 +412,9 @@ async function sendSuiteTalkRequest(
   const hasBody = serializedBody !== undefined
   if (hasBody) {
     if (!headers['Content-Type']) headers['Content-Type'] = 'application/json'
-    headers['X-NetSuite-PropertyNameValidation'] = 'error'
+    if (request.path.startsWith('/services/rest/record/')) {
+      headers['X-NetSuite-PropertyNameValidation'] = 'error'
+    }
   }
   return fetch(url, {
     method: request.method,