fix(jsm): add input validation and extract shared error parser

- Add validateJiraIssueKey for projectIdOrKey in templates and structure routes
- Add validateJiraCloudId for formId (UUID) in structure route
- Extract parseJsmErrorMessage to shared utils.ts (was duplicated across 3 routes)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: waleedlatif1

apps/sim/app/api/tools/jsm/forms/issue/route.ts

@@ -2,26 +2,17 @@ import { createLogger } from '@sim/logger'
 import { type NextRequest, NextResponse } from 'next/server'
 import { checkInternalAuth } from '@/lib/auth/hybrid'
 import { validateJiraCloudId, validateJiraIssueKey } from '@/lib/core/security/input-validation'
-import { getJiraCloudId, getJsmFormsApiBaseUrl, getJsmHeaders } from '@/tools/jsm/utils'
+import {
+  getJiraCloudId,
+  getJsmFormsApiBaseUrl,
+  getJsmHeaders,
+  parseJsmErrorMessage,
+} from '@/tools/jsm/utils'
 
 export const dynamic = 'force-dynamic'
 
 const logger = createLogger('JsmIssueFormsAPI')
 
-function parseJsmErrorMessage(status: number, statusText: string, errorText: string): string {
-  try {
-    const errorData = JSON.parse(errorText)
-    if (errorData.errorMessage) {
-      return `JSM Forms API error: ${errorData.errorMessage}`
-    }
-  } catch {
-    if (errorText) {
-      return `JSM Forms API error: ${errorText}`
-    }
-  }
-  return `JSM Forms API error: ${status} ${statusText}`
-}
-
 export async function POST(request: NextRequest) {
   const auth = await checkInternalAuth(request)
   if (!auth.success || !auth.userId) {

apps/sim/app/api/tools/jsm/forms/structure/route.ts

@@ -1,27 +1,18 @@
 import { createLogger } from '@sim/logger'
 import { type NextRequest, NextResponse } from 'next/server'
 import { checkInternalAuth } from '@/lib/auth/hybrid'
-import { validateJiraCloudId } from '@/lib/core/security/input-validation'
-import { getJiraCloudId, getJsmFormsApiBaseUrl, getJsmHeaders } from '@/tools/jsm/utils'
+import { validateJiraCloudId, validateJiraIssueKey } from '@/lib/core/security/input-validation'
+import {
+  getJiraCloudId,
+  getJsmFormsApiBaseUrl,
+  getJsmHeaders,
+  parseJsmErrorMessage,
+} from '@/tools/jsm/utils'
 
 export const dynamic = 'force-dynamic'
 
 const logger = createLogger('JsmFormStructureAPI')
 
-function parseJsmErrorMessage(status: number, statusText: string, errorText: string): string {
-  try {
-    const errorData = JSON.parse(errorText)
-    if (errorData.errorMessage) {
-      return `JSM Forms API error: ${errorData.errorMessage}`
-    }
-  } catch {
-    if (errorText) {
-      return `JSM Forms API error: ${errorText}`
-    }
-  }
-  return `JSM Forms API error: ${status} ${statusText}`
-}
-
 export async function POST(request: NextRequest) {
   const auth = await checkInternalAuth(request)
   if (!auth.success || !auth.userId) {
@@ -59,6 +50,16 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ error: cloudIdValidation.error }, { status: 400 })
     }
 
+    const projectIdOrKeyValidation = validateJiraIssueKey(projectIdOrKey, 'projectIdOrKey')
+    if (!projectIdOrKeyValidation.isValid) {
+      return NextResponse.json({ error: projectIdOrKeyValidation.error }, { status: 400 })
+    }
+
+    const formIdValidation = validateJiraCloudId(formId, 'formId')
+    if (!formIdValidation.isValid) {
+      return NextResponse.json({ error: formIdValidation.error }, { status: 400 })
+    }
+
     const baseUrl = getJsmFormsApiBaseUrl(cloudId)
     const url = `${baseUrl}/project/${encodeURIComponent(projectIdOrKey)}/form/${encodeURIComponent(formId)}`
 

apps/sim/app/api/tools/jsm/forms/templates/route.ts

@@ -1,27 +1,18 @@
 import { createLogger } from '@sim/logger'
 import { type NextRequest, NextResponse } from 'next/server'
 import { checkInternalAuth } from '@/lib/auth/hybrid'
-import { validateJiraCloudId } from '@/lib/core/security/input-validation'
-import { getJiraCloudId, getJsmFormsApiBaseUrl, getJsmHeaders } from '@/tools/jsm/utils'
+import { validateJiraCloudId, validateJiraIssueKey } from '@/lib/core/security/input-validation'
+import {
+  getJiraCloudId,
+  getJsmFormsApiBaseUrl,
+  getJsmHeaders,
+  parseJsmErrorMessage,
+} from '@/tools/jsm/utils'
 
 export const dynamic = 'force-dynamic'
 
 const logger = createLogger('JsmFormTemplatesAPI')
 
-function parseJsmErrorMessage(status: number, statusText: string, errorText: string): string {
-  try {
-    const errorData = JSON.parse(errorText)
-    if (errorData.errorMessage) {
-      return `JSM Forms API error: ${errorData.errorMessage}`
-    }
-  } catch {
-    if (errorText) {
-      return `JSM Forms API error: ${errorText}`
-    }
-  }
-  return `JSM Forms API error: ${status} ${statusText}`
-}
-
 export async function POST(request: NextRequest) {
   const auth = await checkInternalAuth(request)
   if (!auth.success || !auth.userId) {
@@ -54,6 +45,11 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ error: cloudIdValidation.error }, { status: 400 })
     }
 
+    const projectIdOrKeyValidation = validateJiraIssueKey(projectIdOrKey, 'projectIdOrKey')
+    if (!projectIdOrKeyValidation.isValid) {
+      return NextResponse.json({ error: projectIdOrKeyValidation.error }, { status: 400 })
+    }
+
     const baseUrl = getJsmFormsApiBaseUrl(cloudId)
     const url = `${baseUrl}/project/${encodeURIComponent(projectIdOrKey)}/form`
 

apps/sim/tools/jsm/utils.ts

@@ -35,3 +35,28 @@ export function getJsmHeaders(accessToken: string): Record<string, string> {
     'X-ExperimentalApi': 'opt-in',
   }
 }
+
+/**
+ * Parse error messages from JSM/Forms API responses
+ * @param status - HTTP status code
+ * @param statusText - HTTP status text
+ * @param errorText - Raw error response body
+ * @returns Formatted error message string
+ */
+export function parseJsmErrorMessage(
+  status: number,
+  statusText: string,
+  errorText: string
+): string {
+  try {
+    const errorData = JSON.parse(errorText)
+    if (errorData.errorMessage) {
+      return `JSM Forms API error: ${errorData.errorMessage}`
+    }
+  } catch {
+    if (errorText) {
+      return `JSM Forms API error: ${errorText}`
+    }
+  }
+  return `JSM Forms API error: ${status} ${statusText}`
+}