fix(instagram): harden OAuth and insight inputs

Author: Bill Leoutsakos

apps/sim/lib/oauth/instagram.test.ts

@@ -61,17 +61,16 @@ describe('instagram oauth helpers', () => {
     expect(
       parseInstagramShortLivedToken({
         access_token: 'short-token',
-        user_id: 123,
+        user_id: 17_841_467_109_118_740,
         permissions: ['instagram_business_basic'],
       })
     ).toEqual({
       access_token: 'short-token',
-      user_id: 123,
       permissions: ['instagram_business_basic'],
     })
     expect(
       parseInstagramShortLivedToken({ data: [{ access_token: 'wrapped-token', user_id: '456' }] })
-    ).toEqual({ access_token: 'wrapped-token', user_id: '456' })
+    ).toEqual({ access_token: 'wrapped-token' })
   })
 
   it('rejects malformed or oversized token responses', () => {

apps/sim/lib/oauth/instagram.ts

@@ -24,7 +24,6 @@ const instagramGraphIdSchema = z.union([
 
 const instagramShortLivedTokenSchema = z.object({
   access_token: z.string().min(1).max(INSTAGRAM_ACCESS_TOKEN_MAX_LENGTH),
-  user_id: instagramGraphIdSchema.optional(),
   permissions: z
     .union([
       z.string().min(1).max(INSTAGRAM_ACCESS_TOKEN_MAX_LENGTH),
@@ -57,7 +56,12 @@ export type InstagramShortLivedToken = z.output<typeof instagramShortLivedTokenS
 export type InstagramLongLivedToken = z.output<typeof instagramLongLivedTokenResponseSchema>
 export type InstagramProfile = z.output<typeof instagramProfileResponseSchema>
 
-/** Parses the direct or legacy data-array shape returned by Instagram's code exchange. */
+/**
+ * Parses the direct or legacy data-array shape returned by Instagram's code exchange.
+ * The exchange's user_id is intentionally ignored: Meta may serialize it as a number too
+ * large for JavaScript to represent safely, and the callback resolves the authoritative
+ * professional-account ID from /me instead.
+ */
 export function parseInstagramShortLivedToken(value: unknown): InstagramShortLivedToken | null {
   const parsed = instagramShortLivedTokenResponseSchema.safeParse(value)
   if (!parsed.success) return null

apps/sim/tools/instagram/utils.test.ts

@@ -2,7 +2,11 @@
  * @vitest-environment node
  */
 import { describe, expect, it } from 'vitest'
-import { createPublishTransform, INSTAGRAM_RESPONSE_MAX_BYTES } from '@/tools/instagram/utils'
+import {
+  createPublishTransform,
+  INSTAGRAM_RESPONSE_MAX_BYTES,
+  parseCommaSeparated,
+} from '@/tools/instagram/utils'
 
 const FALLBACK_OUTPUT = {
   containerId: null,
@@ -84,3 +88,18 @@ describe('createPublishTransform', () => {
     )
   })
 })
+
+describe('parseCommaSeparated', () => {
+  it('parses nonempty comma-separated insight metrics', () => {
+    expect(parseCommaSeparated(' reach, views,likes ')).toEqual(['reach', 'views', 'likes'])
+  })
+
+  it.each([{ value: undefined }, { value: '' }, { value: ' , ' }, { value: [] }])(
+    'rejects invalid insight metrics: $value',
+    ({ value }) => {
+      expect(() => parseCommaSeparated(value)).toThrow(
+        'Instagram insight metrics must be a non-empty comma-separated string'
+      )
+    }
+  )
+})

apps/sim/tools/instagram/utils.ts

@@ -180,12 +180,21 @@ function isCompleteInstagramPublishOutput(
   )
 }
 
-export function parseCommaSeparated(value?: string): string[] {
-  if (!value) return []
-  return value
+export function parseCommaSeparated(value: unknown): string[] {
+  if (typeof value !== 'string') {
+    throw new Error('Instagram insight metrics must be a non-empty comma-separated string')
+  }
+
+  const items = value
     .split(',')
     .map((part) => part.trim())
     .filter(Boolean)
+
+  if (items.length === 0) {
+    throw new Error('Instagram insight metrics must be a non-empty comma-separated string')
+  }
+
+  return items
 }
 
 /** Clamp Graph pagination `limit` to a safe range (default 25, max 100). */