fix(zoho-desk): strip ticket description HTML, classify body-reported refresh failures

Final validation pass findings.

descriptionText never stripped anything. It was gated on a
`descriptionContentType` discriminator that Zoho does not send: the Ticket_Add
webhook sample ships `"description": "<div>Description</div>"` with no such key,
and the ticket GET/PATCH response field lists have no content-type sibling
either. So get_ticket, update_ticket, and every webhook ticket payload emitted
descriptionText as a byte-identical copy of the raw HTML, while the declared
output promised stripped text.

The tests did not catch it because they fabricated the shape - both fixtures
constructed `descriptionContentType: 'html'`, a key Zoho never emits, proving the
branch works without proving it is ever taken. Ticket descriptions are HTML by
convention, so the strip is now unconditional (html-to-text is a near-identity on
genuinely plain text), an explicit descriptionContentType is still honored if
Zoho ever adds one, and the fixtures now use Zoho's real shape with no
content-type key anywhere.

A body-reported refresh failure was unclassified. Zoho answers a revoked refresh
token with HTTP 200 and `{"error":"invalid_client"}`; refreshOAuthToken only
checked `data.ok === false` (a Slack-ism), so the request fell through to the
"no access token" guard and returned no errorCode. isTerminalRefreshError could
therefore never recognize invalid_client as terminal, the credential was never
marked dead, and every later execution retried a refresh that cannot succeed -
with the user shown "No access token in refresh response" instead of a reconnect
prompt. The body is now classified before the status is trusted, matching what
the token exchange and the service-account mint already did. That guard also
stopped logging the whole response body, which carries live tokens on a partial
success.

Also: an unrecognized dataCenter now fails with a named error instead of quietly
resolving to US and surfacing as an opaque invalid_client (blank still means US);
the webhook JWKS cache is bounded, since its key derives from a providerConfig
field that SYSTEM_MANAGED_FIELDS protects from diffing but not from being
written; and the attachment `size` output no longer asserts bytes, a unit Zoho
documents as KB.

Author: waleedlatif1

apps/docs/content/docs/en/integrations/zoho_desk.mdx

@@ -70,7 +70,7 @@ List tickets from a Zoho Desk organization with optional filters. Returns a list
 |   ↳ `ticketNumber` | string | Human-readable ticket number |
 |   ↳ `subject` | string | Ticket subject |
 |   ↳ `description` | string | Ticket description \(raw; may be HTML\) |
-|   ↳ `descriptionText` | string | Plain-text rendering of the description; HTML stripped when Zoho marks it HTML, otherwise mirrors description |
+|   ↳ `descriptionText` | string | Plain-text rendering of the description with HTML stripped \(Zoho sends ticket descriptions as HTML\) |
 |   ↳ `status` | string | Ticket status |
 |   ↳ `statusType` | string | Status category \(Open/Closed/On Hold\) |
 |   ↳ `priority` | string | Ticket priority |
@@ -121,7 +121,7 @@ Retrieve a single Zoho Desk ticket by ID.
 |   ↳ `ticketNumber` | string | Human-readable ticket number |
 |   ↳ `subject` | string | Ticket subject |
 |   ↳ `description` | string | Ticket description \(raw; may be HTML\) |
-|   ↳ `descriptionText` | string | Plain-text rendering of the description; HTML stripped when Zoho marks it HTML, otherwise mirrors description |
+|   ↳ `descriptionText` | string | Plain-text rendering of the description with HTML stripped \(Zoho sends ticket descriptions as HTML\) |
 |   ↳ `status` | string | Ticket status |
 |   ↳ `statusType` | string | Status category \(Open/Closed/On Hold\) |
 |   ↳ `priority` | string | Ticket priority |
@@ -182,7 +182,7 @@ Update fields on an existing Zoho Desk ticket.
 |   ↳ `ticketNumber` | string | Human-readable ticket number |
 |   ↳ `subject` | string | Ticket subject |
 |   ↳ `description` | string | Ticket description \(raw; may be HTML\) |
-|   ↳ `descriptionText` | string | Plain-text rendering of the description; HTML stripped when Zoho marks it HTML, otherwise mirrors description |
+|   ↳ `descriptionText` | string | Plain-text rendering of the description with HTML stripped \(Zoho sends ticket descriptions as HTML\) |
 |   ↳ `status` | string | Ticket status |
 |   ↳ `statusType` | string | Status category \(Open/Closed/On Hold\) |
 |   ↳ `priority` | string | Ticket priority |
@@ -248,7 +248,7 @@ List comments on a Zoho Desk ticket.
 |   ↳ `attachments` | array | Comment attachments |
 |     ↳ `id` | string | Attachment ID |
 |     ↳ `name` | string | File name |
-|     ↳ `size` | string | File size in bytes |
+|     ↳ `size` | string | File size as reported by Zoho |
 |     ↳ `href` | string | Download href |
 | `count` | number | Number of comments returned |
 
@@ -291,7 +291,7 @@ Add a comment to a Zoho Desk ticket.
 |   ↳ `attachments` | array | Comment attachments |
 |     ↳ `id` | string | Attachment ID |
 |     ↳ `name` | string | File name |
-|     ↳ `size` | string | File size in bytes |
+|     ↳ `size` | string | File size as reported by Zoho |
 |     ↳ `href` | string | Download href |
 
 ### `zoho_desk_list_threads`
@@ -344,7 +344,7 @@ List conversation threads on a Zoho Desk ticket, newest first (Zoho sorts by sen
 |   ↳ `attachments` | array | Thread attachments |
 |     ↳ `id` | string | Attachment ID |
 |     ↳ `name` | string | File name |
-|     ↳ `size` | string | File size in bytes |
+|     ↳ `size` | string | File size as reported by Zoho |
 |     ↳ `href` | string | Download href |
 | `count` | number | Number of threads returned |
 
@@ -397,7 +397,7 @@ Retrieve the full content of a single Zoho Desk ticket thread.
 |   ↳ `attachments` | array | Thread attachments |
 |     ↳ `id` | string | Attachment ID |
 |     ↳ `name` | string | File name |
-|     ↳ `size` | string | File size in bytes |
+|     ↳ `size` | string | File size as reported by Zoho |
 |     ↳ `href` | string | Download href |
 
 ### `zoho_desk_get_contact`

apps/sim/lib/credentials/client-credential-accounts/minters/zoho-desk.test.ts

@@ -235,16 +235,18 @@ describe('mintZohoDeskServiceAccountToken', () => {
     }
   )
 
-  it('falls back to the US data center for an unrecognized value instead of erroring', async () => {
-    mockFetch.mockResolvedValueOnce(jsonResponse(200, { access_token: 'zoho-access' }))
-
-    const result = await mintZohoDeskServiceAccountToken(
-      { ...FIELDS, dataCenter: 'jp' },
-      { skipIdentity: true }
-    )
-
-    mintBody(TOKEN_URL)
-    expect(result.apiDomain).toBe('https://desk.zoho.com')
+  // A typed-but-unrecognized region must NOT quietly resolve to US and then fail
+  // against Zoho as an opaque invalid_client — the operator would have no way to
+  // tell a wrong region from wrong credentials. Blank still means US (see above).
+  it('rejects an unrecognized data center instead of silently using US', async () => {
+    await expect(
+      mintZohoDeskServiceAccountToken({ ...FIELDS, dataCenter: 'jp' })
+    ).rejects.toMatchObject({
+      code: 'invalid_credentials',
+      status: 400,
+      logDetail: expect.objectContaining({ step: 'data_center_validation', dataCenter: 'jp' }),
+    })
+    expect(mockFetch).not.toHaveBeenCalled()
   })
 
   it('records the resolved data center in the stored metadata', async () => {

apps/sim/lib/credentials/client-credential-accounts/minters/zoho-desk.ts

@@ -1,7 +1,10 @@
 import { createLogger } from '@sim/logger'
 import {
+  normalizeZohoDeskDataCenter,
   normalizeZohoDeskSoid,
   resolveZohoDeskDataCenter,
+  ZOHO_DESK_DATA_CENTER_IDS,
+  ZOHO_DESK_DATA_CENTER_REGEX,
   ZOHO_DESK_SOID_REGEX,
 } from '@/lib/credentials/client-credential-accounts/descriptors'
 import type {
@@ -144,7 +147,21 @@ export async function mintZohoDeskServiceAccountToken(
     })
   }
 
-  const dataCenter = resolveZohoDeskDataCenter(fields.dataCenter)
+  // A blank data center legitimately means "US" (the pre-field default), but a
+  // value that was typed and not recognized must not silently resolve to US and
+  // then fail against Zoho as an opaque `invalid_client`. Reject it here, next to
+  // the soid check, so the connect modal names the real problem. This runs on
+  // every execution-time re-mint too, where there is no UI to show a format hint.
+  const rawDataCenter = normalizeZohoDeskDataCenter(fields.dataCenter ?? '')
+  if (rawDataCenter && !ZOHO_DESK_DATA_CENTER_REGEX.test(rawDataCenter)) {
+    throw new TokenServiceAccountValidationError('invalid_credentials', 400, {
+      step: 'data_center_validation',
+      dataCenter: rawDataCenter,
+      reason: `unrecognized data center; expected one of ${ZOHO_DESK_DATA_CENTER_IDS.join(', ')} (or blank for us)`,
+    })
+  }
+
+  const dataCenter = resolveZohoDeskDataCenter(rawDataCenter)
 
   // Zoho requires a comma-separated scope list on this endpoint; a
   // space-separated list is rejected as an invalid scope.

apps/sim/lib/oauth/oauth.ts

@@ -1874,6 +1874,31 @@ export async function refreshOAuthToken(
 
     const data = await response.json()
 
+    // Some providers - Zoho notably - report OAuth failures in the JSON body with
+    // HTTP 200 rather than a 4xx (e.g. `{"error":"invalid_client"}` for a revoked
+    // refresh token). Without this the `!accessToken` guard below returns a
+    // failure with no `errorCode`, so `isTerminalRefreshError` cannot recognize a
+    // terminal condition, the credential is never marked dead, and every later
+    // execution retries a refresh that can never succeed. Classify on the body
+    // before trusting the status, matching the token-exchange and service-account
+    // mint paths, which already do this.
+    if (data && typeof data === 'object' && typeof data.error === 'string' && data.error) {
+      logger.error('Token refresh failed with an error body:', {
+        status: response.status,
+        error: data.error,
+        errorDescription:
+          typeof data.error_description === 'string' ? data.error_description : null,
+        providerId,
+      })
+      return {
+        ok: false,
+        errorCode: data.error,
+        message: `Failed to refresh token: ${data.error}${
+          typeof data.error_description === 'string' ? ` - ${data.error_description}` : ''
+        }`,
+      }
+    }
+
     if (data && typeof data === 'object' && data.ok === false) {
       logger.error('Token refresh failed:', {
         status: response.status,
@@ -1904,7 +1929,12 @@ export async function refreshOAuthToken(
     const expiresIn = data.expires_in || data.expiresIn || 3600
 
     if (!accessToken) {
-      logger.warn('No access token found in refresh response', { providerId, response: data })
+      // Never log `data` itself here - on a partial success it carries live
+      // tokens. The error-body branch above already surfaces the diagnosable case.
+      logger.warn('No access token found in refresh response', {
+        providerId,
+        responseKeys: Object.keys(data ?? {}),
+      })
       return { ok: false, message: 'No access token in refresh response' }
     }
 

apps/sim/lib/webhooks/providers/zoho-desk.ts

@@ -33,13 +33,30 @@ const ZOHO_DESK_BASE_URL_REGEX = /__zoho_domain__:([^\s,]+)/
  * verification within Zoho's 5-second delivery deadline.
  */
 const jwksCache = new Map<string, ReturnType<typeof jose.createRemoteJWKSet>>()
+
+/**
+ * Bound on distinct Desk hosts held in {@link jwksCache}. The host is derived
+ * from `providerConfig.apiDomain`, which `SYSTEM_MANAGED_FIELDS` protects from
+ * *diffing* but not from being written by a workspace member. `safeZohoDeskBase`
+ * already clamps it to a Zoho apex so no key material is ever fetched off-Zoho,
+ * but any `*.zoho.com` label still passes - so without a cap, repeated writes
+ * plus webhook hits could grow one JWKS instance (and its key cache) per label.
+ * Zoho has a handful of data centers; anything beyond this is not legitimate
+ * traffic, so evicting oldest-first is safe.
+ */
+const JWKS_CACHE_MAX_ENTRIES = 16
+
 function getJwks(deskHost: string): ReturnType<typeof jose.createRemoteJWKSet> {
-  let set = jwksCache.get(deskHost)
-  if (!set) {
-    set = jose.createRemoteJWKSet(new URL(`https://${deskHost}/.well-known/jwks.json`))
-    jwksCache.set(deskHost, set)
+  const set = jwksCache.get(deskHost)
+  if (set) return set
+
+  if (jwksCache.size >= JWKS_CACHE_MAX_ENTRIES) {
+    const oldest = jwksCache.keys().next()
+    if (!oldest.done) jwksCache.delete(oldest.value)
   }
-  return set
+  const created = jose.createRemoteJWKSet(new URL(`https://${deskHost}/.well-known/jwks.json`))
+  jwksCache.set(deskHost, created)
+  return created
 }
 
 /**

apps/sim/tools/generated/tool-outputs.ts

@@ -86,7 +86,10 @@ export interface ZohoDeskResponse extends ToolResponse {
 export const ZOHO_DESK_ATTACHMENT_PROPERTIES: Record<string, ToolOutputProperty> = {
   id: { type: 'string', description: 'Attachment ID' },
   name: { type: 'string', description: 'File name', optional: true },
-  size: { type: 'string', description: 'File size in bytes', optional: true },
+  // Zoho documents this as KB, but serializes it as a string and its samples are
+  // not self-consistent about the unit — report it as Zoho gives it rather than
+  // asserting a unit we would be guessing at.
+  size: { type: 'string', description: 'File size as reported by Zoho', optional: true },
   href: { type: 'string', description: 'Download href', optional: true },
 }
 
@@ -103,7 +106,7 @@ export const ZOHO_DESK_TICKET_PROPERTIES: Record<string, ToolOutputProperty> = {
   descriptionText: {
     type: 'string',
     description:
-      'Plain-text rendering of the description; HTML stripped when Zoho marks it HTML, otherwise mirrors description',
+      'Plain-text rendering of the description with HTML stripped (Zoho sends ticket descriptions as HTML)',
     optional: true,
     nullable: true,
   },

apps/sim/tools/zoho_desk/types.ts

@@ -251,28 +251,40 @@ describe('zoho desk tool utils', () => {
       expect(withDerivedContentText('str')).toBe('str')
     })
 
-    // Ticket resources carry their body on `description`, not `content`, so a
-    // webhook ticket payload would otherwise reach the workflow as raw HTML with
-    // no plain-text sibling — unlike get_ticket, which derives one.
-    it('derives descriptionText for ticket-shaped resources', () => {
-      const ticket = {
-        id: '5',
-        subject: 'Delay',
-        description: '<div>order is late</div>',
-        descriptionContentType: 'html',
-      }
+    // Zoho ships ticket descriptions as HTML with NO content-type key — this is
+    // the exact shape from Zoho's own Ticket_Add webhook sample. Gating the strip
+    // on a `descriptionContentType` that never arrives made descriptionText a
+    // byte-identical copy of the markup, so this case must stay unfabricated: no
+    // descriptionContentType key anywhere in the fixture.
+    it('strips HTML from a ticket description that carries no content-type key', () => {
+      const ticket = { id: '5', subject: 'Delay', description: '<div>order is late</div>' }
       const result = withDerivedContentText(ticket) as Record<string, unknown>
       expect(result.description).toBe('<div>order is late</div>')
       expect(result.descriptionText).toBe('order is late')
       expect('contentText' in result).toBe(false)
     })
 
+    it('leaves a plain-text ticket description readable', () => {
+      const result = withDerivedContentText({
+        id: '7',
+        description: 'order is late',
+      }) as Record<string, unknown>
+      expect(result.descriptionText).toBe('order is late')
+    })
+
+    it('still honors an explicit descriptionContentType if Zoho ever sends one', () => {
+      const result = withDerivedContentText({
+        description: '<b>literal</b>',
+        descriptionContentType: 'plainText',
+      }) as Record<string, unknown>
+      expect(result.descriptionText).toBe('<b>literal</b>')
+    })
+
     it('derives both fields when a resource carries content and description', () => {
       const result = withDerivedContentText({
         content: '<b>c</b>',
         contentType: 'text/html',
         description: '<b>d</b>',
-        descriptionContentType: 'html',
       }) as Record<string, unknown>
       expect(result.contentText).toBe('c')
       expect(result.descriptionText).toBe('d')

apps/sim/tools/zoho_desk/utils.test.ts

@@ -56,11 +56,25 @@ export function withDerivedContentText(resource: unknown): unknown {
   const record = resource as Record<string, unknown>
 
   const contentText = deriveZohoContentText(record.content, record.contentType)
-  // Ticket resources carry their body on `description` rather than `content`, so
-  // a webhook's ticket payload would otherwise reach the workflow as raw HTML
-  // with no plain-text sibling - unlike get_ticket, which derives one. Mirror
-  // that here so trigger and tool outputs agree.
-  const descriptionText = deriveZohoContentText(record.description, record.descriptionContentType)
+  // Ticket resources carry their body on `description`, not `content`, so without
+  // this a webhook ticket payload reaches the workflow as raw HTML with no
+  // plain-text sibling.
+  //
+  // Unlike comments and threads, a ticket's description has NO content-type
+  // discriminator: Zoho's own Ticket_Add webhook sample ships
+  // `"description": "<div>Description</div>"` with no `descriptionContentType`
+  // key, and the ticket GET/PATCH response field lists have no content-type
+  // sibling either. Gating on one meant the strip never ran and `descriptionText`
+  // was a byte-identical copy of the HTML. Ticket descriptions are HTML by
+  // convention, so convert unconditionally - html-to-text is a near-identity on
+  // genuinely plain text. A `descriptionContentType` is still honored if Zoho
+  // ever starts sending one.
+  const descriptionText =
+    typeof record.description === 'string'
+      ? typeof record.descriptionContentType === 'string'
+        ? deriveZohoContentText(record.description, record.descriptionContentType)
+        : convertZohoHtmlToText(record.description)
+      : undefined
 
   if (contentText === undefined && descriptionText === undefined) return record
   return {