feat(oracle-fusion): add shared integration foundation by BillLeoutsakosvl346 · Pull Request #7427 · simstudioai/sim

BillLeoutsakosvl346 · 2026-09-03T02:16:57Z

Summary

Adds the shared Oracle Fusion foundation used by sibling product integrations without registering or advertising any product service.

Registers one reusable integration-user credential with strict Oracle-assigned origin validation, encrypted username/password storage, local Basic derivation, a five-minute rotation-sensitive cache, and no save-time provider probe.
Enforces trusted tool credential provider and kind centrally for service accounts and OAuth, including selector policies, while preserving policies that do not declare credentialKind.
Adds canonical fixed-version HCM, FSCM, and CRM resource addressing plus shared exact decimal-identifier and opaque-key validation.
Adds a DNS-pinned client limited to GET, POST, PATCH, PUT, and DELETE. GET may retry once for 429, 503, or 504 when the execution deadline permits; mutations never retry.
Restricts mutations to bounded plain JSON, three documented media types, and the Effective-Of, If-Match, and Upsert-Mode operation headers. Callers cannot supply arbitrary URLs, roots, versions, methods, or headers.
Provides separate bounded JSON and empty-response APIs, 30-second wall-clock attempt deadlines, fixed provider-message-free errors, safe collection parsing, expected offsets, pre-projection item limits, and nextOffset.
Reuses the existing Oracle oval through shared Sim and docs icon aliases without changing SVG data.

The credential provider/kind enforcement is isolated as a platform-security commit. Oracle addressing/protocol stabilization and bounded mutations are separate commits for independent review.

Product-specific services, blocks, routes below the family root, schemas, selectors, registrations, operations, and documentation remain child-owned. Downloads, binary bodies, streaming, automatic pagination, mutation retries, arbitrary transport inputs, and async-job infrastructure are intentionally excluded.

Fixes: N/A

Type of Change

Testing

Focused credential resolution, selector, OAuth route, Oracle addressing, identifier, protocol, serializer, and client tests
bun run type-check in apps/sim
bun run agent-stream-docs:generate
bun run skills:sync
bun run lint
bun run apps/sim/scripts/check-block-registry.ts origin/staging
bun run check:audits
git diff --check

Reviewers should focus on the central credential boundary, fixed-origin and family-root enforcement, exact identifiers, mutation serialization/header constraints, retry/deadline behavior, and product-neutral protocol invariants.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added or updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement

Screenshots/Videos

Not applicable. This foundation does not add a product UI surface; it only exports the existing Oracle oval under a shared alias.

vercel · 2026-09-03T02:17:03Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 4, 2026 2:02am UTC

greptile-apps · 2026-09-03T02:19:19Z

Greptile Summary

Adds a shared, product-neutral Oracle Fusion integration foundation without registering a user-facing product service.

Adds reusable Oracle Fusion integration-user credentials with canonical Oracle-origin validation and locally derived Basic authentication.
Centralizes credential provider and kind enforcement across tool, OAuth, and selector resolution.
Adds fixed HCM, FSCM, and CRM resource addressing, identifier and payload validation, bounded response parsing, and a DNS-pinned HTTP client with constrained methods, headers, retries, and deadlines.
Reuses the existing Oracle oval through shared icon aliases.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains in the eligible follow-up review scope.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/internal/oracle-fusion/client.ts	Introduces the DNS-pinned, deadline-aware Oracle request boundary with closed methods, media types, headers, retries, and response handling.
apps/sim/lib/internal/oracle-fusion/protocol.ts	Adds bounded collection parsing, pagination validation, opaque-key extraction, and stable next-offset behavior.
apps/sim/lib/internal/oracle-fusion/request-body.ts	Adds bounded serialization for plain JSON mutation bodies while rejecting unsupported object shapes and unsafe numeric values.
apps/sim/lib/credentials/client-credential-accounts/descriptors.ts	Registers the reusable Oracle Fusion credential descriptor and strict canonical Oracle application-origin normalization.
apps/sim/lib/credentials/client-credential-accounts/minters/oracle-fusion.ts	Validates integration-user credentials and locally derives short-lived cached Basic authentication material without a provider probe.
apps/sim/lib/oauth/token-resolution.ts	Enforces declared credential kind and service-account provider binding before tool credential resolution.
apps/sim/lib/selectors/server/credentials.ts	Applies credential-kind constraints to selector authorization while preserving policies that omit the constraint.
apps/sim/lib/credentials/service-account-secret.ts	Limits data-center persistence to credential descriptors that actually declare that field.

Sequence Diagram

sequenceDiagram
  participant Caller as Product-owned caller
  participant Cred as Credential resolver
  participant Client as Oracle Fusion client
  participant Guard as DNS validation and pinned transport
  participant Oracle as Oracle Fusion API
  Caller->>Cred: Resolve Oracle integration-user credential
  Cred-->>Caller: Canonical origin and Basic material
  Caller->>Client: Fixed family, relative path, method, and bounded body
  Client->>Client: Validate address, headers, identifiers, and payload
  Client->>Guard: Validate origin and pin public IP
  Guard->>Oracle: Bounded request with redirects disabled
  Oracle-->>Guard: Response
  Guard-->>Client: Size-limited response
  alt Eligible transient GET response
    Client->>Guard: Retry once within execution deadline
    Guard->>Oracle: Repeat GET
    Oracle-->>Client: Final response
  end
  Client-->>Caller: Bounded JSON, empty result, or fixed error

_{Reviews (11): Last reviewed commit: "fix(oracle-fusion): preserve self-link k..." | Re-trigger Greptile}

cubic-dev-ai

All reported issues were addressed across 18 files

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

BillLeoutsakosvl346 · 2026-09-03T02:25:07Z

@greptile

BillLeoutsakosvl346 · 2026-09-03T02:25:13Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-03T02:25:19Z

@cubic-dev-ai review this PR

@BillLeoutsakosvl346 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 18 files

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

BillLeoutsakosvl346 · 2026-09-03T02:34:04Z

@greptile

BillLeoutsakosvl346 · 2026-09-03T02:34:05Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-03T02:34:11Z

@cubic-dev-ai review this PR

@BillLeoutsakosvl346 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 18 files

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

BillLeoutsakosvl346 · 2026-09-03T02:46:49Z

@greptile

BillLeoutsakosvl346 · 2026-09-03T02:46:50Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-03T02:46:55Z

@cubic-dev-ai review this PR

@BillLeoutsakosvl346 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 18 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

BillLeoutsakosvl346 · 2026-09-04T01:06:49Z

@greptile

BillLeoutsakosvl346 · 2026-09-04T01:23:12Z

@greptile

BillLeoutsakosvl346 · 2026-09-04T01:23:17Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-04T01:23:24Z

@cubic-dev-ai review this PR

@BillLeoutsakosvl346 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

3 issues found across 29 files

Confidence score: 3/5

apps/sim/lib/internal/oracle-fusion/protocol.ts: extractOracleFusionOpaqueKey can return an altered opaque key when a self-link contains raw tab, newline, or carriage-return characters, because new URL(href) strips them before validation; preserve the raw value or validate before URL normalization.
apps/sim/lib/internal/oracle-fusion/request-body.ts: Proxy-backed containers can pass the plain-object checks while JSON.stringify triggers traps or custom serialization, allowing the serialized request to differ from the validated values; reject proxy-backed values or serialize the validated descriptor values directly.
apps/sim/lib/internal/oracle-fusion/protocol.ts: Valid empty terminal pages for offsets beyond the result set can be rejected because totalResults is compared with offset + count even when count is zero; adjust the boundary check for zero-count pages.

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/sim/lib/internal/oracle-fusion/request-body.ts">

<violation number="1" location="apps/sim/lib/internal/oracle-fusion/request-body.ts:26">
P2: A proxy-backed container can pass the plain-object checks, then `JSON.stringify` invokes its traps and custom serialization. Reject proxy-backed values or serialize the validated descriptor values directly so custom code cannot alter the body or allocate an over-limit payload after validation.</violation>
</file>

<file name="apps/sim/lib/internal/oracle-fusion/protocol.ts">

<violation number="1" location="apps/sim/lib/internal/oracle-fusion/protocol.ts:85">
P2: When a caller requests an offset beyond the result set, an empty terminal page can have `totalResults < offset`; this check rejects that valid page because it compares against `offset + count` even when `count` is zero. Enforce the lower bound only for non-empty pages.</violation>

<violation number="2" location="apps/sim/lib/internal/oracle-fusion/protocol.ts:132">
P2: When a self-link contains a raw tab, newline, or carriage return in its opaque key, `new URL(href)` strips it before `validateOpaqueKey` runs. `extractOracleFusionOpaqueKey` can therefore return a different key and lead callers to a different resource; reject ASCII controls in `href` before URL parsing.

(Based on your team's feedback about rejecting malformed Oracle path input.)</violation>
</file>

_{You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Fix all with cubic | Re-trigger cubic}

BillLeoutsakosvl346 · 2026-09-04T01:37:02Z

@greptile

BillLeoutsakosvl346 · 2026-09-04T01:37:07Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-04T01:37:13Z

@cubic-dev-ai review this PR

@BillLeoutsakosvl346 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

2 issues found across 29 files

Confidence score: 3/5

In apps/sim/lib/internal/oracle-fusion/protocol.ts, contradictory pagination metadata can set hasMore: false even when results remain, causing valid-looking pages to truncate pagination; reject this metadata, including on empty pages, before returning the page.
In apps/sim/lib/internal/oracle-fusion/protocol.ts, self-link validation can accept traversal and encoded-dot variants because new URL(href) normalizes them first, weakening path validation; reject raw dot segments, backslashes, and encoded-dot components before canonicalization.

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/sim/lib/internal/oracle-fusion/protocol.ts">

<violation number="1" location="apps/sim/lib/internal/oracle-fusion/protocol.ts:86">
P2: When `totalResults` exceeds `offset + count`, `hasMore: false` makes a valid-looking page truncate pagination. Reject this contradictory metadata, including empty pages, before returning the page.</violation>

<violation number="2" location="apps/sim/lib/internal/oracle-fusion/protocol.ts:133">
P2: Self-link validation accepts traversal and encoded-dot variants because `new URL(href)` normalizes them before path validation. Reject raw dot segments, backslashes, and encoded dot path components before URL canonicalization so only the provider’s canonical resource link can be accepted.

(Based on your team's feedback about rejecting malformed Oracle path variants.)</violation>
</file>

_{You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Fix all with cubic | Re-trigger cubic}

BillLeoutsakosvl346 · 2026-09-04T01:45:36Z

@greptile

BillLeoutsakosvl346 · 2026-09-04T01:45:40Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-04T01:45:49Z

@cubic-dev-ai review this PR

@BillLeoutsakosvl346 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 29 files

_{You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Fix all with cubic | Re-trigger cubic}

BillLeoutsakosvl346 · 2026-09-04T01:53:33Z

@greptile

BillLeoutsakosvl346 · 2026-09-04T01:53:37Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-04T01:53:44Z

@cubic-dev-ai review this PR

@BillLeoutsakosvl346 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 29 files

_{You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Fix all with cubic | Re-trigger cubic}

BillLeoutsakosvl346 · 2026-09-04T02:02:37Z

@greptile

BillLeoutsakosvl346 · 2026-09-04T02:02:41Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-09-04T02:02:46Z

@cubic-dev-ai review this PR

@BillLeoutsakosvl346 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 29 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Re-trigger cubic}

feat(oracle-fusion): add shared integration foundation

abb64b8

vercel Bot deployed to Preview September 3, 2026 02:18 View deployment

cubic-dev-ai Bot reviewed Sep 3, 2026

View reviewed changes

Comment thread apps/sim/lib/internal/oracle-fusion/client.ts Outdated

Comment thread apps/sim/lib/credentials/client-credential-accounts/descriptors.ts

fix(oracle-fusion): harden numeric and origin parsing

a7ae174

vercel Bot temporarily deployed to Preview September 3, 2026 02:25 Inactive

cubic-dev-ai Bot reviewed Sep 3, 2026

View reviewed changes

Comment thread apps/sim/lib/internal/oracle-fusion/client.ts Outdated

fix(oracle-fusion): handle large integral exponents

7b669e7

vercel Bot temporarily deployed to Preview September 3, 2026 02:33 Inactive

cubic-dev-ai Bot reviewed Sep 3, 2026

View reviewed changes

Comment thread apps/sim/lib/internal/oracle-fusion/client.ts Outdated

fix(oracle-fusion): classify rejected redirects

b0d41e7

vercel Bot temporarily deployed to Preview September 3, 2026 02:46 Inactive

cubic-dev-ai Bot reviewed Sep 3, 2026

View reviewed changes

This was referenced Sep 3, 2026

feat(oracle-fusion): add SCM integration #7439

Open

feat(integrations): add Oracle Fusion Cloud HCM #7415

Open

Bill Leoutsakos added 3 commits September 3, 2026 17:48

fix(credentials): enforce service-account provider and kind centrally

623fc6e

refactor(oracle-fusion): stabilize addressing and protocol primitives

a63a436

feat(oracle-fusion): add bounded JSON mutations

c8c83c8

vercel Bot temporarily deployed to Preview September 4, 2026 01:06 Inactive

fix(oracle-fusion): close validation edge cases

4600846

vercel Bot temporarily deployed to Preview September 4, 2026 01:22 Inactive

cubic-dev-ai Bot reviewed Sep 4, 2026

View reviewed changes

Comment thread apps/sim/lib/internal/oracle-fusion/request-body.ts Outdated

Comment thread apps/sim/lib/internal/oracle-fusion/protocol.ts Outdated

Comment thread apps/sim/lib/internal/oracle-fusion/protocol.ts

fix(oracle-fusion): preserve validated protocol values

0431a39

vercel Bot temporarily deployed to Preview September 4, 2026 01:36 Inactive

cubic-dev-ai Bot reviewed Sep 4, 2026

View reviewed changes

Comment thread apps/sim/lib/internal/oracle-fusion/protocol.ts

Comment thread apps/sim/lib/internal/oracle-fusion/protocol.ts

fix(oracle-fusion): harden response invariants

fc2d2ea

vercel Bot temporarily deployed to Preview September 4, 2026 01:45 Inactive

cubic-dev-ai Bot reviewed Sep 4, 2026

View reviewed changes

Comment thread apps/sim/lib/internal/oracle-fusion/protocol.ts

fix(oracle-fusion): validate continuing page totals

4d644af

vercel Bot temporarily deployed to Preview September 4, 2026 01:53 Inactive

cubic-dev-ai Bot reviewed Sep 4, 2026

View reviewed changes

Comment thread apps/sim/lib/internal/oracle-fusion/protocol.ts

fix(oracle-fusion): preserve self-link key whitespace

a9659a7

vercel Bot temporarily deployed to Preview September 4, 2026 02:02 Inactive

cubic-dev-ai Bot reviewed Sep 4, 2026

View reviewed changes

Uh oh!

Conversation

BillLeoutsakosvl346 commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Checklist

Screenshots/Videos

Uh oh!

vercel Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

BillLeoutsakosvl346 commented Sep 3, 2026

Uh oh!

BillLeoutsakosvl346 commented Sep 3, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 3, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

BillLeoutsakosvl346 commented Sep 3, 2026

Uh oh!

BillLeoutsakosvl346 commented Sep 3, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 3, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

BillLeoutsakosvl346 commented Sep 3, 2026

Uh oh!

BillLeoutsakosvl346 commented Sep 3, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 3, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

BillLeoutsakosvl346 commented Sep 4, 2026

Uh oh!

BillLeoutsakosvl346 commented Sep 4, 2026

Uh oh!

BillLeoutsakosvl346 commented Sep 4, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 4, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

BillLeoutsakosvl346 commented Sep 4, 2026

Uh oh!

BillLeoutsakosvl346 commented Sep 4, 2026

Uh oh!

cubic-dev-ai Bot commented Sep 4, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

BillLeoutsakosvl346 commented Sep 3, 2026 •

edited

Loading

vercel Bot commented Sep 3, 2026 •

edited

Loading

greptile-apps Bot commented Sep 3, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading