feat(oci): add native Object Storage integration

Author: Bill Leoutsakos

apps/docs/components/ui/icon-mapping.ts

@@ -482,6 +482,7 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   notion: NotionIcon,
   notion_v2: NotionIcon,
   obsidian: ObsidianIcon,
+  oci_object_storage_native: NetSuiteIcon,
   okta: OktaIcon,
   onedrive: MicrosoftOneDriveIcon,
   onepassword: OnePasswordIcon,

apps/docs/content/docs/integrations/meta.json

@@ -185,6 +185,7 @@
     "notion",
     "notion-service-account",
     "obsidian",
+    "oci_object_storage_native",
     "okta",
     "onedrive",
     "onepassword",

apps/docs/content/docs/integrations/oci_object_storage_native.mdx

@@ -239,6 +239,7 @@ import { MSSQLBlock, MSSQLBlockMeta } from '@/blocks/blocks/mssql'
 import { MySQLBlock, MySQLBlockMeta } from '@/blocks/blocks/mysql'
 import { Neo4jBlock, Neo4jBlockMeta } from '@/blocks/blocks/neo4j'
 import { NetSuiteBlock, NetSuiteBlockMeta } from '@/blocks/blocks/netsuite'
+import { OciObjectStorageNativeBlock, OciObjectStorageNativeBlockMeta } from '@/blocks/blocks/oci_object_storage_native'
 import { NeverBounceBlock, NeverBounceBlockMeta } from '@/blocks/blocks/neverbounce'
 import { NewRelicBlock, NewRelicBlockMeta } from '@/blocks/blocks/new_relic'
 import { NoteBlock } from '@/blocks/blocks/note'
@@ -590,6 +591,7 @@ export const BLOCK_REGISTRY: Record<string, BlockConfig> = {
   mysql: MySQLBlock,
   neo4j: Neo4jBlock,
   netsuite: NetSuiteBlock,
+  oci_object_storage_native: OciObjectStorageNativeBlock,
   new_relic: NewRelicBlock,
   note: NoteBlock,
   notion: NotionBlock,
@@ -915,6 +917,7 @@ export const BLOCK_META_REGISTRY: Record<string, BlockMeta> = {
   mysql: MySQLBlockMeta,
   neo4j: Neo4jBlockMeta,
   netsuite: NetSuiteBlockMeta,
+  oci_object_storage_native: OciObjectStorageNativeBlockMeta,
   neverbounce: NeverBounceBlockMeta,
   new_relic: NewRelicBlockMeta,
   notion: NotionBlockMeta,

apps/sim/blocks/blocks/oci_object_storage_native.ts

@@ -243,6 +243,7 @@ export const DOCS_MANIFEST: readonly string[] = [
   'integrations/notion-service-account.mdx',
   'integrations/notion.mdx',
   'integrations/obsidian.mdx',
+  'integrations/oci_object_storage_native.mdx',
   'integrations/okta.mdx',
   'integrations/onedrive.mdx',
   'integrations/onepassword.mdx',

apps/sim/blocks/registry-maps.ts

@@ -465,6 +465,7 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   notion: NotionIcon,
   notion_v2: NotionIcon,
   obsidian: ObsidianIcon,
+  oci_object_storage_native: NetSuiteIcon,
   okta: OktaIcon,
   onedrive: MicrosoftOneDriveIcon,
   onepassword: OnePasswordIcon,

apps/sim/lib/copilot/generated/docs-manifest.ts

@@ -0,0 +1,22 @@
+import { isPayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
+import { OciClientError } from '@/lib/internal/oci/errors'
+
+export class OciNativeOperationError extends Error {
+  constructor(message: string, readonly status = 400) {
+    super(message)
+    this.name = 'OciNativeOperationError'
+  }
+}
+
+/** Keep credential material, provider response bodies, and storage errors out of tool failures. */
+export function normalizeOciNativeError(error: unknown): { status: number; message: string } {
+  if (error instanceof OciNativeOperationError) return { status: error.status, message: error.message }
+  if (isPayloadSizeLimitError(error)) return { status: 413, message: 'File exceeds the 100 MiB transfer limit' }
+  if (error instanceof OciClientError) {
+    return {
+      status: error.status ?? (error.code === 'response_too_large' ? 413 : error.code === 'deadline_exceeded' ? 504 : 502),
+      message: error.message,
+    }
+  }
+  return { status: 500, message: 'OCI Object Storage operation failed' }
+}

apps/sim/lib/integrations/icon-mapping.ts

@@ -0,0 +1,103 @@
+/** @vitest-environment node */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({ executeOciNativeOperation: vi.fn() }))
+vi.mock('@/lib/internal/oci-object-storage-native/operations', () => mocks)
+
+import { OciClientError } from '@/lib/internal/oci/errors'
+import { executeOciObjectStorageNativeTool } from '@/lib/internal/oci-object-storage-native/execute-tool'
+import type { InternalToolOperationCall } from '@/lib/internal/tool-operations/types'
+import { createOciNativeOperationInput } from '@/tools/oci_object_storage_native/shared'
+
+const AUTH = { credentialId: 'authorized', namespace: 'namespace' }
+const BUCKET = { ...AUTH, bucketName: 'reports' }
+const OBJECT = { ...BUCKET, objectName: 'report.txt' }
+const MULTIPART = { ...OBJECT, uploadId: 'upload' }
+const CASES: [string, Record<string, unknown>][] = [
+  ['get_namespace', AUTH], ['list_buckets', { ...AUTH, compartmentId: 'compartment' }],
+  ['get_bucket', BUCKET], ['create_bucket', { ...BUCKET, compartmentId: 'compartment' }],
+  ['update_bucket', { ...BUCKET, versioning: 'Enabled' }], ['delete_bucket', BUCKET],
+  ['list_objects', BUCKET], ['head_object', OBJECT], ['upload_object', { ...OBJECT, content: '' }],
+  ['download_object', OBJECT], ['copy_object', { ...OBJECT, destinationRegion: 'us-phoenix-1', destinationNamespace: 'namespace', destinationBucket: 'copies', destinationObjectName: 'copy' }],
+  ['rename_object', { ...OBJECT, newName: 'new' }], ['delete_object', OBJECT],
+  ['batch_delete_objects', { ...BUCKET, objects: [{ objectName: 'report.txt' }] }],
+  ['list_object_versions', BUCKET], ['restore_object', OBJECT],
+  ['update_object_storage_tier', { ...OBJECT, storageTier: 'Archive' }],
+  ['get_lifecycle_policy', BUCKET], ['put_lifecycle_policy', { ...BUCKET, rules: [] }], ['delete_lifecycle_policy', BUCKET],
+  ['create_multipart_upload', OBJECT], ['upload_part', { ...MULTIPART, partNumber: 1, content: '' }],
+  ['list_multipart_uploads', BUCKET], ['list_multipart_parts', MULTIPART],
+  ['commit_multipart_upload', { ...MULTIPART, partsToCommit: [{ partNum: 1, etag: 'etag' }] }],
+  ['abort_multipart_upload', MULTIPART],
+  ['create_preauthenticated_request', { ...OBJECT, name: 'Report', scope: 'object', accessType: 'ObjectRead', timeExpires: '2099-01-01T00:00:00Z' }],
+  ['list_preauthenticated_requests', BUCKET], ['get_preauthenticated_request', { ...BUCKET, parId: 'par' }],
+  ['delete_preauthenticated_request', { ...BUCKET, parId: 'par' }], ['get_work_request', { ...AUTH, workRequestId: 'work' }],
+]
+
+function request(operation: string, input: unknown): InternalToolOperationCall {
+  return { toolId: `oci_object_storage_native_${operation}`, input, headers: new Headers(),
+    context: { workflowId: 'workflow', workspaceId: 'trusted-workspace', userId: 'actor' }, requestId: 'request' }
+}
+
+describe('native OCI tool operation handler', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.executeOciNativeOperation.mockResolvedValue({ success: true, output: {} })
+  })
+
+  it.each(CASES)('validates and dispatches %s with trusted workspace context', async (operation, input) => {
+    const result = await executeOciObjectStorageNativeTool(request(operation, input))
+    expect(result.status).toBe(200)
+    expect(mocks.executeOciNativeOperation).toHaveBeenCalledWith(expect.objectContaining({ ...input, operation }), {
+      workspaceId: 'trusted-workspace', workflowId: 'workflow', executionId: undefined, userId: 'actor', requestId: 'request', signal: undefined,
+    })
+  })
+
+  it('maps the authorized hidden reference and strips the caller execution context', async () => {
+    const input = createOciNativeOperationInput({ oauthCredential: 'visible-selection', accessToken: 'authorized', _context: { workspaceId: 'attacker' }, _credentialId: 'bookkeeping', _workflowId: 'workflow', credential: undefined, impersonateUserEmail: undefined, namespace: 'namespace' })
+    expect(input).toEqual(AUTH)
+    await executeOciObjectStorageNativeTool(request('get_namespace', input))
+    expect(mocks.executeOciNativeOperation).toHaveBeenCalledWith(expect.objectContaining({ credentialId: 'authorized' }), expect.objectContaining({ workspaceId: 'trusted-workspace' }))
+    const missing = createOciNativeOperationInput({ oauthCredential: 'visible-selection' })
+    expect((await executeOciObjectStorageNativeTool(request('get_namespace', missing))).status).toBe(400)
+  })
+
+  it.each([{ ...AUTH, workspaceId: 'injected' }, { ...AUTH, operation: 'delete_bucket' }, { ...AUTH, authorization: 'injected' }])('rejects unexpected authority or operation fields', async (input) => {
+    expect((await executeOciObjectStorageNativeTool(request('get_namespace', input))).status).toBe(400)
+    expect(mocks.executeOciNativeOperation).not.toHaveBeenCalled()
+  })
+
+  it('requires trusted workspace scope', async () => {
+    const call = request('get_namespace', AUTH)
+    delete call.context.workspaceId
+    expect((await executeOciObjectStorageNativeTool(call)).status).toBe(403)
+    expect(mocks.executeOciNativeOperation).not.toHaveBeenCalled()
+  })
+
+  it('uses the delegated subject for file authorization', async () => {
+    const call = request('upload_object', { ...OBJECT, file: { key: 'file', name: 'file.txt', size: 0 } })
+    call.context.executorDelegationOrigin = { subjectUserId: 'delegated-actor', workflowId: 'origin-workflow', executionId: 'origin-execution' }
+    await executeOciObjectStorageNativeTool(call)
+    expect(mocks.executeOciNativeOperation).toHaveBeenCalledWith(expect.anything(), expect.objectContaining({ userId: 'delegated-actor', workspaceId: 'trusted-workspace' }))
+  })
+
+  it('projects safe foundation failures without exposing arbitrary error details', async () => {
+    mocks.executeOciNativeOperation.mockRejectedValueOnce(new OciClientError('request_failed', { status: 412 }))
+    const known = await executeOciObjectStorageNativeTool(request('get_namespace', AUTH))
+    expect(known.status).toBe(412)
+    await expect(known.json()).resolves.toEqual({ success: false, error: 'OCI request failed' })
+    mocks.executeOciNativeOperation.mockRejectedValueOnce(new Error('private-key-or-storage-secret'))
+    const unknown = await executeOciObjectStorageNativeTool(request('get_namespace', AUTH))
+    await expect(unknown.json()).resolves.toEqual({ success: false, error: 'OCI Object Storage operation failed' })
+  })
+
+  it('preserves cancellation before and after provider work', async () => {
+    const controller = new AbortController()
+    const reason = new DOMException('Canceled', 'AbortError')
+    const call = { ...request('get_namespace', AUTH), signal: controller.signal }
+    mocks.executeOciNativeOperation.mockImplementationOnce(async () => { controller.abort(reason); throw reason })
+    await expect(executeOciObjectStorageNativeTool(call)).rejects.toBe(reason)
+    mocks.executeOciNativeOperation.mockClear()
+    await expect(executeOciObjectStorageNativeTool(call)).rejects.toBe(reason)
+    expect(mocks.executeOciNativeOperation).not.toHaveBeenCalled()
+  })
+})

apps/sim/lib/internal/oci-object-storage-native/errors.ts

@@ -0,0 +1,36 @@
+import { createLogger } from '@sim/logger'
+import { isPlainRecord } from '@sim/utils/object'
+import { getValidationErrorMessage } from '@/lib/api/server'
+import { normalizeOciNativeError } from '@/lib/internal/oci-object-storage-native/errors'
+import { executeOciNativeOperation } from '@/lib/internal/oci-object-storage-native/operations'
+import { ociNativeInputSchema } from '@/lib/internal/oci-object-storage-native/schema'
+import type { InternalToolOperationHandler } from '@/lib/internal/tool-operations/types'
+
+const logger = createLogger('OciObjectStorageNativeToolExecution')
+const PREFIX = 'oci_object_storage_native_'
+
+export const executeOciObjectStorageNativeTool: InternalToolOperationHandler = async (request) => {
+  request.signal?.throwIfAborted()
+  if (!request.toolId.startsWith(PREFIX) || !isPlainRecord(request.input) || 'operation' in request.input) {
+    return Response.json({ success: false, error: 'Invalid native OCI tool input' }, { status: 400 })
+  }
+  const parsed = ociNativeInputSchema.safeParse({ ...request.input, operation: request.toolId.slice(PREFIX.length) })
+  if (!parsed.success) return Response.json({ success: false, error: getValidationErrorMessage(parsed.error, 'Invalid native OCI request') }, { status: 400 })
+  if (!request.context.workspaceId) return Response.json({ success: false, error: 'Workspace context is required' }, { status: 403 })
+  try {
+    const result = await executeOciNativeOperation(parsed.data, {
+      workspaceId: request.context.workspaceId,
+      workflowId: request.context.workflowId,
+      executionId: request.context.executionId,
+      userId: request.context.executorDelegationOrigin?.subjectUserId ?? request.context.userId,
+      requestId: request.requestId, signal: request.signal,
+    })
+    request.signal?.throwIfAborted()
+    return Response.json(result)
+  } catch (error) {
+    request.signal?.throwIfAborted()
+    const normalized = normalizeOciNativeError(error)
+    logger.warn('Native OCI operation failed', { requestId: request.requestId, toolId: request.toolId, status: normalized.status })
+    return Response.json({ success: false, error: normalized.message }, { status: normalized.status })
+  }
+}